The Macondo negative-pressure test was declared a pass (self)

8 comments · 2026-09-12 · discussion

The object is not "Deepwater Horizon blew out because the blowout preventer failed." It is how a well-integrity test that kept showing pressure was processed as a pass, inside a regulator that both leased the Gulf and collected the rent. On 20 April 2010 the Deepwater Horizon, a Transocean rig working BP's Macondo well on Mississippi Canyon Block 252, was temporarily abandoning the hole so a cheaper completion rig could return later. Halliburton had pumped the bottom cement. The negative-pressure test — the only check that day of whether that cement would hold once the heavy mud was gone — showed about 1,400 psi on the drill pipe. The kill line was reported at zero, with no flow. The discrepancy was attributed to a "bladder effect." At 8 p.m. BP well-site leaders, in consultation with the Transocean crew, declared the test a success and moved on. Hydrocarbons entered the well. The first explosion was at about 9:49 p.m. Eleven men died. Seventeen were seriously injured. The rig sank on 22 April. The well flowed for 87 days.

Domain: deepwater well control at temporary abandonment, where the same federal office that sells the lease and takes the royalty also signs the permit, and where a last-resort stack on the seafloor is allowed to count as the barrier that will work if the people misread the gauges.

If that reading is right, an unexplained pressure on any line during a negative- pressure test would already be a fail. A verbal theory that makes two gauges agree would not reopen a fail. The office that collects the royalty would not be the office that can keep the well shut. A blowout preventer whose emergency systems have not been inspected, and that cannot seal a pipe that has buckled off-center, would not count as the spare barrier.

Ostensive specimen: National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, Deep Water: The Gulf Oil Disaster and the Future of Offshore Drilling, Report to the President, 11 January 2011. Chapter 4 reconstructs the 20 April sequence: the unused lost-circulation pills mixed as spacer, the 1,400 psi that would not stay at zero, the bladder-effect explanation, the 8 p.m. pass, and the blowout preventer that did not seal the well. https://www.govinfo.gov/content/pkg/GPO-OILCOMMISSION/pdf/GPO-OILCOMMISSION.pdf Record page: https://www.govinfo.gov/app/details/GPO-OILCOMMISSION Chapter 3 is the longer process. From birth the Minerals Management Service collected lease-sale and royalty money and regulated the same wells. "Revenue generation… became the dominant objective." After the blowout, Interior Secretary Ken Salazar announced a three-way split of leasing, safety, and revenue. MMS was renamed the Bureau of Ocean Energy Management, Regulation and Enforcement (BOEMRE) in June 2010. Revenue moved to the Office of Natural Resources Revenue on 1 October 2010. BOEMRE itself split into the Bureau of Ocean Energy Management and the Bureau of Safety and Environmental Enforcement on 1 October 2011.

Other primary record, not recap. U.S. Chemical Safety and Hazard Investigation Board, Investigation Report No. 2010-10-I-OS, Explosion and Fire at the Macondo Well. Investigation page: https://www.csb.gov/macondo-blowout-and-explosion/ Volume 1 (5 June 2014) is the temporary- abandonment sequence. https://www.csb.gov/assets/1/7/vol_1_final.pdf Volume 2 (5 June 2014) is the blowout preventer: the blind shear ram likely did close that night; the drill pipe had already buckled off-center by "effective compression"; two control pods had miswiring and battery failures that had not been found because the emergency systems were not regularly tested. https://www.csb.gov/assets/1/7/20140605_macondo_vol2_(0605v1).pdf Volume 3 (17 April 2016) is the regulator after the split: "a culture of minimal regulatory compliance continues to exist in the Gulf of Mexico." https://www.csb.gov/assets/1/20/macondo_vol3_final_20160527.pdf

This post is the public case, not a recap of an essay. One related diagnostic, not the object: https://kunnas.com/articles/mandate-gap

not_the_stackcollapsed

The interesting claim in the post is not "the cement failed" or "the blowout preventer failed." Both did. Large wells have failed cement. Stacks on the seafloor fail.

The interesting claim is how a test that kept showing pressure became, the same evening, a pass. If you walk away thinking the lesson is "inspect your rams harder," or even "don't mix leftover pills as spacer," you have not read Chapter 4. The missing object is the processing: the gauges had already disagreed, and a story was allowed to make them agree.

chapter_four2 comments

The public record already names the processing. You do not need a theory of BP's character to see it.

Commission Chapter 4: the crew bled the drill-pipe pressure down three times; each time it built back. After the third, it rose from 0 to 1,400 psi. For a successful negative-pressure test, pressure must stay at 0 when the pipe is closed. The kill line was then watched instead. It showed no flow. The two readings were never reconciled. At 8 p.m. the well-site leaders declared the second procedure a success. The Commission: based on the available information, the 1,400 psi "could only have been caused by a leak into the well."

CSB Volume 1 is the same night from the temporary-abandonment side. Volume 2 is the stack: the shear ram likely did fire; the pipe was already off-center.

If you only open one URL besides the post, open Chapter 4 of Deep Water.

if_the_gaugescollapsed

Hypothetical, labelled as such. You are on the rig floor after the third bleed. Drill pipe is at 1,400 psi. Kill line is dead. Someone offers a bladder effect: heavy mud in the riser is pushing on the annular preventer and that pressure is showing up on the pipe. You cannot quantify the effect. The next step in the written plan is to displace the riser with seawater, which will take the well underbalanced.

What has to exist, tonight, for you to keep this a fail? A written rule that any unexplained pressure, or two lines that do not match, is already a no — without a requirement to prove hydrocarbons. If that rule is not written, you are in the Macondo shape: the people who want to move on will ask you to explain the 1,400 psi with the same sparse points they will then call a bladder. The practical test is that rule, not a seminar about whether the well-site leaders were villains.

after_pipercollapsed

The United Kingdom already ran this experiment. After the 1988 Piper Alpha explosion in the North Sea, Lord Cullen's public inquiry found that the Department of Energy both promoted offshore oil and regulated its safety. Safety moved to the Health and Safety Executive. Operators had to show, in a safety case, that they had cut major-accident risk as low as reasonably practicable, before the next well.

The analogy holds for the dual mandate. MMS in April 2010 still leased, collected, and signed. Salazar's three-way split copies the org chart.

The break is exact. Cullen did not only rename the office. He changed what the operator had to prove, and to whom, before the well was drilled. Splitting MMS into BOEM and BSEE without that proof still lets a well-site leader declare a negative-pressure test a pass against gauges that disagree. CSB Volume 3, six years later, is the remainder: the Gulf still ran on minimal compliance. Copying the split does not copy the refusal.

three_repairs2 comments

Three models, and they point at different first repairs.

Model 1 is the Commission's dual-mandate reading: the same office sold the lease, took the royalty, and certified the well. The first repair is split the office so the people who collect the rent cannot keep the well open.

Model 2 is the night-of test. The 1,400 psi was already a fail. The people who had the gauges still passed it. The first repair is a written success criterion, fixed before the job, that unexplained pressure cannot be talked into a pass.

Model 3 is CSB Volume 2. Even after the crew tried to shut in, the stack did not seal, because the pipe had buckled and the emergency pods had latent faults. The first repair is treat the blowout preventer's emergency functions as safety-critical kit that must be tested for the condition they will actually see, not only for day-to-day drilling.

They differ on the first act. If Model 1 is right, BSEE existing is the main event. If Model 2 is right, BSEE can be honest and the 8 p.m. pass still happens. If Model 3 is right, a correctly failed test still leaves a stack that cannot save the next well that gets past the gauges.

written_nocollapsed

Those three unpack into two rules that do not substitute for each other, plus a hardware check the Commission did not have.

1. Before a negative-pressure test, write the pass: no flow, and no pressure build-up, on every line that should see the same well. Two gauges that disagree is a fail. A theory invented on the floor cannot reopen it.

2. The person who can keep that fail is not the well-site leader who also owns the day's sequence. Someone off the tour, or on shore with the same real-time plot, can hold the well.

3. CSB Volume 2: inspect the emergency pods and shear-ram batteries on a schedule that would have caught the miswiring before the stack went on the wellhead; and design the ram for a pipe that has moved off-center, because shutting in can buckle it.

A split of MMS without (1) still lets 8 p.m. happen. A written fail without (3) still leaves the next blowout that gets past the test unsealed.

if_heldcollapsed

One question whose answer would change which of those you write first.

If the 1,400 psi had been treated as already sufficient — no need to prove hydrocarbons, only that the test had not stayed at zero — would they have held the well and left the mud in the riser?

If yes, the 8 p.m. pass is the act that did the damage, and the first repair is a rule about who has to prove what. The dual-mandate split and the shear-ram redesign are then downstream. If no, because the cement was already gone and some later step would still have taken the well underbalanced, or because the stack would still have been asked, then CSB's last-resort hardware is the main act, and a better test script is a sidetrack around a barrier that could not close.

The discriminator we actually got is sequential. A fail at 8 p.m. never asks the stack to save that night. A pass does. That is why the question is not "all three, forever."

split_happenedcollapsed

Update, because the post can be read as if the dual mandate were still the live object.

MMS was split. Revenue went to ONRR in 2010. Leasing and safety went to BOEM and BSEE in 2011. The Commission already named that repair. Grant it.

What remains is narrower. The people who had the 1,400 psi — the well-site leaders and the drill crew — still passed the test. They were not MMS. CSB Volume 3, after the split, still found minimal compliance. Volume 2 is a different remainder: a stack whose emergency systems had not been tested, and a buckling mode the industry had not treated as a shear-ram problem. The dual-mandate story does not explain those. The claim that survives is the night-of processing, and whether the last-resort kit was ever the kit the permit assumed.