1,500 meters below the surface. Another 5,500 meters down through rock. A hole 25 centimeters wide.
Through it, 4.9 million barrels of crude oil flowed for 87 days without stopping.
At 9:47 p.m. on April 20, 2010, a blowout struck the semi-submersible drilling rig Deepwater Horizon in the Gulf of Mexico. The rig burned for 36 hours and sank on the morning of April 22. Eleven workers died, seventeen were injured. The rig itself, built at a cost of $560 million, went to the bottom of the sea, and BP — the company responsible — ultimately recorded $61.6 billion in accident-related costs.
Four independent safety systems failed on the same night, in the same direction.
Mission: The Frontier of Deepwater Drilling
The late 1990s. The North Sea and Alaskan oil fields were maturing, and the proven reserves of the major U.S. oil companies were declining year by year. The industry consensus was clear: the next oil fields lay deep beneath the sea.
Fixed platforms can reach down to around 300 meters. Beyond that, floating rigs are needed — vessels that drill without anchoring to the seafloor, holding position above a wellhead with millimeter precision against waves and currents. In the late 1990s, a fifth generation of semi-submersible rigs emerged that could do exactly this.
Deepwater Horizon was one of them. Ordered by R&B Falcon (later absorbed by Transocean), built by Hyundai Heavy Industries in Ulsan, South Korea. Construction began in December 1998, the keel was laid in March 2000, and delivery took place on February 23, 2001. Building cost: $560 million. Maximum operating depth: 2,438 meters. Maximum drilling depth: 10,668 meters — deep enough to lower from the summit of Everest to sea level and drill another two kilometers below that.
BP leased the rig on a three-year contract at delivery, with three subsequent extensions securing operations through 2013. The daily lease rate was approximately $1 million.
In September 2009, the rig set a world record at the Tiber field in the Gulf of Mexico: a water depth of 1,259 meters and a drilling depth of 10,683 meters. It was a rig that had earned its reputation in deep-sea drilling.
Seven months later, it exploded while completing a different well.
Design: Choosing a Single-Barrier Casing
The well in question was the Macondo Prospect (MC252), approximately 66 kilometers off the Louisiana coast in 1,522 meters of water. The drilling plan called for roughly 51 days of work from February to March 2010, with a budget of approximately $96 million.
The first thing that didn’t go according to plan was the geology. The Macondo formation was weak — gas influxes, stuck drill pipe, and lost circulation mud occurred one after another. After multiple interruptions and redesigns, the well reached its target depth of 18,360 feet (5,596 meters) on April 9. At that point, it was 45 days behind schedule and $58 million over budget.
During the completion phase, BP faced a design choice: whether to use a long string casing or a two-stage liner and tieback configuration.
A long string runs a single pipe from the wellhead at the surface down to the bottom — simple and fast, with two barriers: cement and a seal assembly.
A liner and tieback installs a short pipe at the bottom and adds a second pipe above it. The overlap creates four barriers. It’s more complex and adds 7–10 days to the schedule.
BP chose the long string. One reason was the time savings. The U.S. Presidential Commission’s report quoted the following line from internal BP emails at the time:
What could possibly go wrong?
The cement design was handled by the specialty contractor Halliburton — a lightweight foam cement with nitrogen bubbles, in minimal volume. Twenty-one centralizers (spacers that keep the pipe centered in the wellbore) were recommended, but only six were available on site.
Later investigations would reveal that internal testing at Halliburton had identified instability in this cement formulation before placement. Those results were not fully communicated to BP.
Completion operations began on April 20.
Execution: The Chain Reaction at 9:47 p.m.
Two BP “company men” (well site leaders) were on the drill floor that day. The day shift was Robert Kaluza, the night shift was Don Vidrine — a man in his late fifties with over 30 years of field experience, someone expected to make the calls.
In the morning, Halliburton pumped the cement, and the initial assessment declared it a success. Next came the final negative pressure test: a procedure to intentionally reduce pressure inside the well and confirm that no fluid was leaking in from outside. If nothing leaked, the cement and seals were holding. If something leaked, another cement job would be needed.
Around 5 p.m., the first test. With 1,400 psi of pressure still showing on the drill pipe side, 23 barrels of mud returned. A clear anomaly.
Around 7 p.m., Vidrine ordered a second test through a separate line called the kill line. That one read zero pressure. The drill pipe side was still reading high; the kill line read zero — a physical contradiction.
One of the Transocean crew members put forward an explanation called the “bladder effect”: a hypothesis that the weight of the mud in the well was acting like a rubber membrane, blocking the pressure. It was not a formally validated theory within the industry. But no one there had a better explanation.
Vidrine declared the test passed.
Around 8 p.m., the well had already quietly begun to take in fluid. A small increase was showing on the mud pit volume indicators on the drill floor, but it went unnoticed amid the routine operations underway during the night shift handover.
At 9:45 p.m., gas reached the pressure sensors on the mud pumps and alarms started sounding.
At 9:47 p.m., mud and gas erupted onto the drill floor.
The operating manual called for activating a diverter at this stage to expel the blowout material overboard, while simultaneously triggering the blowout preventer’s shear rams — blades designed to cut through the drill pipe. But gas had already reached the top of the riser (the conduit running from the seafloor to the surface) and been drawn into the engine room’s air intakes.
The diesel generators overrevved on the gas and ran away. A spark. The first explosion.
Eleven workers died. Most were on the drill floor and in the mud pump room. The 115 survivors evacuated in lifeboats and life rafts and were rescued by the nearby supply vessel Bankston.
The rig burned for 36 hours. On the morning of April 22, the $560 million rig sank to the bottom of the sea.
At that point, the BOP on the seafloor had not activated.
People: Don Vidrine’s Decision, and the Decisions That Followed
After the accident, Vidrine was indicted on charges of manslaughter and pollution of navigable waters. The manslaughter charges were dropped by prosecutors in 2015, and Vidrine pleaded guilty to a misdemeanor violation of the Clean Water Act. The case was resolved with 10 months of probation, 100 hours of community service, and a $50,000 fine. In 2017, following a three-year battle with cancer, he died at the age of 69.
Judging individuals is difficult. Forty-five days behind schedule, $1 million a day in lease costs. Every day the well wasn’t finished and the rig wasn’t moved to the next job, the accumulated costs at Macondo kept climbing. The negative pressure test results had been ambiguous. Faced with ambiguous results, ordering a retest means losing another day. Calling it a pass means moving forward.
Vidrine chose to move forward.
Tony Hayward, BP’s CEO at the time, spoke to British media in the weeks after the accident:
I’d like my life back.
It was not the thing to say in front of the families of eleven dead workers. Hayward resigned that summer. In an internal document the following year, Transocean described 2010 as “the best year in safety performance in our company’s history,” drawing widespread criticism. Before the accident, the company’s injury rate metrics had indeed been at the top of the industry. That the metrics were excellent and that the rig sank were not contradictory.
Halliburton later acknowledged that after the accident, it had destroyed two simulation results related to the cement design that were held internally. A lawsuit in which BP and Halliburton traded blame back and forth ran from 2013 to 2014, with the court ultimately apportioning responsibility as BP 67%, Transocean 30%, and Halliburton 3%.
The names of the eleven who died are recorded.
Jason Anderson (35), Dale “Bubba” Burkeen (37), Donald Clark (49), Stephen Curtis (40), Gordon Jones (28), Roy Wyatt Kemp (27), Karl Kleppinger (38), Blair Manuel, Dewey Revette (48), Shane Roshto (22), Adam Weise (24). Ages from the mid-twenties to the late forties. Family photos were left behind in lockers on the drill floor.
Legacy: 87 Days, $61.6 Billion, and the Breakup of a Regulator
During the 87 days after the blowout, BP attempted multiple interventions: a containment dome, top kill, junk shot. Robots operating under 1,500 meters of pressure, connecting pipes and injecting cement in the dark. All of them failed.
On July 12, a newly designed capping stack was installed atop the BOP on the seafloor. The device weighed over 160 tons. Before the accident, no standard equipment existed to physically seal a deepwater blowout. Over 87 days, the industry had to build one.
On July 15, the flow stopped. Day 87.
Two relief wells drilled in parallel reached the Macondo well in September and injected cement from the bottom, permanently sealing it.
The damage is captured in numbers. Estimated flow: 4.9 million barrels, approximately 780 million liters. At peak, the contaminated area covered roughly 180,000 square kilometers — more than 80 times the area of Tokyo. Some 230,000 square kilometers, representing 36% of federal fishing grounds, were closed. Wetlands, fisheries, tourism, the health of local residents.
BP’s final cost tally was $61.6 billion (as reported in 2016). Of that, the settlement with the federal government and five Gulf states totaled $20.8 billion. According to the Department of Justice, this comprised $5.5 billion in fines under the Clean Water Act, $8.1 billion in natural resource damages, $5.9 billion in payments to state and local governments, and various previously paid expenses. The remainder covered cleanup costs and economic damages from civil litigation.
Three weeks after the accident, the U.S. Department of the Interior announced the dismantling of the Minerals Management Service (MMS). The MMS had been responsible for both collecting revenue from offshore resources and regulating safety — within a single organization. This structural conflict of interest had been flagged before the accident, but there was no political force capable of moving it. The accident provided that force.
The MMS was split into three: the Office of Natural Resources Revenue (ONRR) for revenue collection, the Bureau of Ocean Energy Management (BOEM) for resource management, and the Bureau of Safety and Environmental Enforcement (BSEE) for safety regulation.
In 2016, BSEE issued the Well Control Rule. Deepwater BOPs were now required to carry two shear rams — pipe-cutting devices. Deepwater Horizon’s BOP had only one.
The industry jointly established the Marine Well Containment Company (MWCC) and HWCG. A system in which multiple companies pool capping stacks and intervention vessels for deepwater blowouts — costs that no single company could justify alone became justifiable as an industry collective.
The wreckage of the Deepwater Horizon remains on the floor of the Gulf of Mexico. There are no plans to raise it.
What Was Learned
The safety design for this operation had four independent layers.
- Cement sealing the wellbore from the formation
- Verification through the negative pressure test
- Monitoring to detect fluid influx into the well
- The blowout preventer as the last line of defense
“Independent” is the key word. That is the textbook assumption: if one layer fails, the next one catches it. The probability of all four failing simultaneously is the product of their individual failure rates — small enough to be acceptable.
On the night of April 20, all four failed, in the same direction.
The cement was placed with less volume than recommended, with fewer centralizers than recommended, using a formulation whose instability had been visible in internal testing. The anomalous test results were declared normal using an unverified hypothesis. The signs of influx were missed during the shift handover. The BOP’s shear rams couldn’t cut through a buckled drill pipe, and the battery was undercharged.
Each failure was the result of an independent decision. But the decisions were not independent.
The long string was chosen to shorten the schedule. The cement volume was minimized to reduce time and cost. The ambiguous test was called a pass to avoid losing another day to a retest. A single driver — 45 days behind schedule and $1 million a day in lease costs — pushed all of the supposedly independent decisions in the same direction.
This is called the Swiss Cheese Model: a diagram proposed by risk researcher James Reason to explain the failure of layered defenses. Each slice of cheese has holes. If the holes are in different positions, nothing passes through. If they align, something does.
The theory assumes the holes are independently distributed. Reality is different. It is not the blueprint that determines where the holes sit — it is organizational decision-making. When an organization is under cost pressure, the holes in every layer migrate toward the same position.
The Deepwater Horizon accident is often described as a cascade of technical failures. But the structure that made the cascade of technical failures possible was organizational. Inspectors were accepting gifts from the industry they regulated. The safety regulator and the revenue collector were housed in the same organization. The boundaries of responsibility among the rig owner, operator, and specialty contractors were clear in normal operations — and designed to become blurry in an emergency.
The accident made that structure visible.
Is there a way to make visible what the accident revealed — before the accident? Is there a way to ask: what is the single driver that is pushing all the holes in the same direction?
The question remains. The MMS was split in three. BOPs now carry two shear rams. Capping stacks are stockpiled collectively by the industry. At the same time, BSEE relaxed certain safety rules in 2019, then reversed course and reinstated them. Safety regulation lives in the cycle of accident and forgetting.
Put another way: it is waiting for the next one.
Sources
- U.S. Chemical Safety Board, “Investigation Report Volume 1” — four-stage failure chain (cement / negative test / influx detection / BOP), technical analysis of drill pipe buckling and battery deficiency in the BOP
- BP, “Deepwater Horizon Accident Investigation Report,” 2010 — BP’s acknowledged misinterpretation of the negative pressure test, background on the long string selection
- National Commission on the BP Deepwater Horizon Oil Spill and Offshore Drilling, “Final Report,” 2011 — Presidential Commission report (citing the “What could possibly go wrong?” internal email, analysis of the design decision)
- U.S. Department of Justice, “U.S. and Five Gulf States Reach Historic Settlement with BP,” 2015 — breakdown of the $20.8 billion settlement, $5.5 billion Clean Water Act penalty
- NOAA, “Deepwater Horizon oil spill settlements: Where the money went” — allocation of the $8.1 billion natural resource damages
- BSEE, “Interior Department Finalizes Well Control Rule,” 2016 — 2016 Well Control Rule, dual shear ram requirement, background on MMS breakup
- Oceana, “A Look Back to 2010: 87 Days Too Late” — timeline to flow stoppage, capping stack installation
- The Conversation, “BP paid a steep price for the Gulf oil spill,” 2020 — BP’s final $61.6 billion cost, long-term impact assessment
- Maritime Executive, “BP, Transocean Officials Botched Safety Tests,” 2013 — Vidrine’s decision-making, criminal prosecution proceedings
- Wikipedia, “Deepwater Horizon” — rig specifications, construction history, BP three-year lease structure
