Disaster Autopsy (2024) s01e08 Episode Script

1
[Narrator] In a high
rise building.
- There was no warning.
[Narrator] At sea.
- Innocent people died.
[Narrator] In a train.
- Everything was on fire.
Everything was burning.
[Narrator] Disasters can
begin with the smallest
things.
- Changing the opening
hours of a restaurant.
- The bad glue job.
- A paperwork error.
[Narrator] Now,
combining the latest
research with
every available
source of evidence,
experts will forensically
analyze three disasters,
down to each tiny detail.
- You've really got to
think outside the box.
- You have to work
your way back
and understand each
link in the chain.
[Narrator] State of the
art graphics reveal
every critical detail at
every critical moment.
- This whole disaster
could have been averted.
[Narrator] We can
dissect them,
get inside, or
underneath,
freeze time, and
even reverse it.
To conduct a complete
Disaster Autopsy.
♪
[Narrator] Paris, July
25th, 2000.
Charles de Gaulle,
France's busiest airport.
- It's a nice day
with light winds.
Perfect day for flying.
[plane engine roaring]
[Narrator] Concorde
flight 4590 to New York
prepares for takeoff.
- There's a hundred
passengers on board,
six cabin crew, flight
crew, which consists
of the captain, the
first officer, and
the flight engineer.
[Narrator] Less than two
minutes after takeoff,
all of them are dead.
[TV Reporter] The
world's safest and most
stylish plane plunged
to earth after seconds.
[Narrator] Flight 4590
crashes into a hotel
just four miles
from the airport.
Four more people are
killed on the ground.
-Police have sealed
off the entire area.
- The crash site is a
scar on the landscape.
There is debris
everywhere.
There's very little
left of Concorde.
[Narrator] What went
wrong on flight 4590?
Now using physical
evidence,
amateur footage,
and black box data,
we will digitally
reconstruct the disaster
in minute detail.
Why did the
Concorde crash?
Concorde is an icon,
the world's only
successful commercial
supersonic aircraft.
It could fly from
New York to London
in less than three hours.
[Dr. Peter
Hollingsworth] It was
developed by a British
and French consortium.
First flew in the '70s.
By the time of
the accident,
it had been flying
for about 20 years
carrying passengers.
[Narrator] In two
decades, the Concorde
fleet has not suffered a
single fatal accident.
So why does this Concorde
fall out of the sky?
The key piece of evidence
in any air accident
are the aircraft's
flight recorders,
or black boxes.
- There are two recorders
on the aircraft.
One is the cockpit
voice recorder.
The other one's the
flight data recorder.
And that takes in things
like engine throttle,
engine speed, landing
gear position.
[Narrator] During the
takeoff run, it records
an alarming
sensor anomaly.
[Dr. Peter
Hollingsworth] Engine
number one, the leftmost
engine on the wing,
loses 25% of its thrust.
And engine number
two, the one just
inboard of that, loses
97% of its thrust.
[Dr. Shini Somara] A
lack of thrust in the
engine is a real problem
because it gives
the plane speed.
And when you've got
speed, you have lift.
[Narrator] Without
sufficient lift,
Concorde can't fly.
Flight 4590 is just 10
seconds from takeoff
and already traveling
at 210 miles per hour.
But now, the black box
records a terrifying
radio message.
[Dr. Peter
Hollingsworth] The air
traffic control tower
makes a call to Air
France Flight 4590,
indicating that they
can see flames.
[Narrator] Despite this,
the aircraft is now
traveling at 215
miles per hour.
They must
attempt takeoff.
But the scale of the
disaster is clear.
In this amateur footage
taken seconds later,
it shows a huge jet
of flame around
130 feet long, trailing
from the aircraft.
The black box shows that
sensors alert the crew
to the fire within
seconds of takeoff.
[Dr. Peter
Hollingsworth] There's
an alarm that says that
there's a fire in
engine number two.
The flight engineer
pulls the fire handle.
It cuts off fuel
flow to the engine
and discharges
the fire bottles.
And that's designed to
prevent an engine fire
from spreading to the
rest of the aircraft.
But what it does do
is it completely
cuts off thrust
from that engine.
[Narrator] The situation
is now desperate.
They are one
engine down with a
second compromised.
They must maintain
airspeed.
- For all aircraft,
there's something
called a stall speed.
And this is when
your aircraft is not
going fast enough
and then it will
start to pitch up and
drop back down to earth.
[Narrator] In an
emergency, staying above
the stall speed
means reducing drag
through the air.
But the black box
reveals that everything
is stacked against them.
-The co-pilot noticed
that the landing gear
wasn't retracting and
that keeps the drag up.
It makes it even
harder to climb.
[Narrator] Maintaining
power is now critical.
- 35 seconds after
the shutdown of
engine number two,
engine number one
starts to fail again.
A few seconds later,
it fails completely.
So now the aircraft
is operating only
on two engines.
[Narrator] Concorde is
approaching stall speed.
[Sophie Harker] The
black box data shows us
that not only
was Concorde not
reaching that minimum
speed it needed,
but actually the aircraft
was slowing down
at a dangerous rate.
[Narrator] One minute
and five seconds after
takeoff,
the speed has dropped
to 157 miles per hour.
- As the Concorde
slows down,
the wings stop
generating enough lift.
And when that happens,
the Concorde is
going to crash.
- Ultimately, they
were just simply
moving too slowly
to stay airborne.
At 2:44 and 31
seconds, the black box
ends recording at
the point of impact.
Flight 4590
was in the air
for just one minute
and nine seconds.
[Narrator] The black box
reports an engine fire,
and it is loss
of engine thrust
that ultimately brings
down flight 4590.
Is this whole disaster
caused by an engine fire?
The sensor alarm reports
a fire in engine two.
The obvious conclusion is
that this is the source
of the blaze the
control tower sees.
But that theory
is not a good fit
with the evidence.
- After they shut
down the engine,
discharged the
fire bottles,
that flame was still
coming from the wing.
So that would indicate
that it wasn't the
number two engine
that was the primary
source of the fire.
[Narrator] This critical
image is taken just
after takeoff.
- You see the
Concorde taking off,
landing gear extended,
but flames emitting
from the wing.
[Narrator] Magnifying
this image clearly shows
that the source of the
fire is not the engine.
It is right next to it.
- The sensors that
are in the engine
that would trigger a fire
warning in the cockpit,
they are heat sensors,
which means if they
have hot air coming
in, they will trigger
that warning.
[Narrator] It is not
Concorde's engines that
are on fire.
So what is?
- One of the biggest
clues we have
about what actually
happened during
that takeoff run
is an aerial photo
of the runway.
[Narrator] This
photographic evidence
is taken just hours
after the crash.
[Sophie Harker] We can
see black soot from that
trail from the Concorde
for about 4,000
feet or so, as
well as a massive
amount of fuel right
at the very beginning.
So that very clearly
indicates to us
that there was
a fuel leak.
[Narrator] The start of
the trail of soot
marks the point where the
leaking fuel ignites.
Where does the
leak come from?
The jet fuel
on the runway
marks the point where
the leak begins.
It is right here
that vital evidence
is discovered.
- They found a thin piece
of metal on the runway.
Looking at the part,
it's a part that's
unique to Concorde.
It's not from
another aircraft.
[Narrator] The piece of
metal only fits in one
place on the Concorde.
[Sophie Harker]
It came from fuel
tank number five.
So that's where the
leak is coming from.
[Narrator] But how could
part of something
as vital as a fuel
tank simply fall off?
Near the broken
piece of fuel tank,
two large strips of black
rubber are recovered.
Their size and shape
are a good match
for a Concorde tire.
This fits with evidence
from the crash site.
- One of the things
that were found
at the crash site
was one of the
landing gears.
And on that landing
gear, the tire had been
completely ripped off.
This was wheel number
two of the set,
and that is possessioned
directly underneath
tank number five.
[Narrator] So high-speed
rubber fragments from
the tire might
have punctured
Flight 4590's wing
and caused the leak.
♪
But that doesn't
line up completely
with the evidence.
[Dr. Shini Somara]
If you look at the
piece of fuel tank
from fuel tank number
five that they found,
it's strange because
its formation is
curved outwards
rather than inwards.
[Dr. Peter
Hollingsworth] That
looks like the force
came from
within the aircraft
instead of outside,
which would be countered
what you would expect
from a tire burst or a
tire impacting the wing.
[Narrator] But careful
examination of the crash
site uncovers another
damaged piece of the
number five fuel tank.
- This one has a hole
that's pushed inwards
like a tire impact would
normally indicate.
So you have a small input
hole going into the wing
and a much larger hole
coming out of the wing.
[Narrator] How could two
separate holes
end up in the same
fuel tank at the
same critical moment?
[Dr. Peter
Hollingsworth] Fuel is a
liquid, and it's almost
incompressible.
That means if I
put a significant
shock at one end,
you get a pressure
wave that goes
through the tank.
- The shock wave would
have had most impact
at the most
vulnerable point.
[Narrator] A shock wave
from a tire blowout
fractures tank five and
starts a fuel leak,
which leaves just one
question unanswered.
Why did the tire fail?
[explosion]
[Narrator] A burst
tire brings down
Concorde Flight 4590.
-Now we need to know why
the tire failed.
So we're looking at
the edges of the tire.
And while most of
the edges are frayed
like a blowout, there
are two edges that
look like they're
cut and they fit
together perfectly.
[Narrator] Tire
blowouts don't produce
straight edges,
but among the debris
found on the runway
is something that can.
A strip of metal.
- When we marry
up the pieces of
the tire fragment
where the cut was,
that metal strip
matches perfectly.
You know that that
tire was cut by
that metal strip.
[Narrator] A tiny
strip of metal
causes 113 deaths.
[explosion]
How does it end
up on the runway?
It matches a piece
of metal called
a wear strip.
From a CF-650
turbofan engine.
- One of the aircraft
that had taken
off before Concorde
was a DC-10, which
uses that engine.
[Dr. Peter
Hollingsworth] There's
an image of this
specific DC-10 that
had taken off
five minutes before
Concorde. And you can see
that it's missing that
chunk of wear strip.
- Maintenance records
show that the DC-10
had had this strip
of metal replaced.
[Narrator] This repair
happens just two weeks
before the
Concorde disaster.
- And it was that
piece of metal
that was found
on the runway.
[Narrator] We can now
piece together the
evidence and explain what
brought down
Concorde flight 4590.
[Dr. Peter
Hollingsworth] The tire
on Air France flight
4590 runs over a strip
of metal debris
on the runway,
which cuts the tire
and the tire bursts.
[Dr. Shini Somara]
Fragments of the tire
puncture fuel
tank number five.
That creates a
massive shock wave,
blowing out a
section of the tank.
[Narrator] The tank leaks
vast amounts of fuel,
which ignite into
a sheet of flame.
The fire damages two
of Concorde's engines.
[Sophie Harker] With two
engines out and the
landing gear sucked down,
the aircraft can't
reach its required speed
and ultimately can't
generate enough
lift so it stalls.
[Narrator] And there is
nothing anyone can do to
save flight 4590.
All 109 on board die.
Four more on the ground
are also killed.
The entire Concorde
fleet is grounded
for a massive
safety overhaul.
It is more than a
year before this
icon of the skies
is finally cleared
to return to service.
[Newsreader] Noisy,
old-fashioned, but still
the most spectacular
aircraft around.
Concorde roared
back into regular
operation this morning,
lifting off from
Heathrow bound
for New York.
[Narrator] But the world
is moving on
from the dream of
supersonic flight.
Concorde is in
the air for just
three more years.
[Newsreader] BA002 leaves
John F. Kennedy Airport
for the very last time.
[Narrator] On November
26th, 2003, Concorde
takes its final flight.
[plane engine roaring]
Fires can cause
some of the most
terrifying disasters,
whether it's high
in the sky or
beneath a mountain.
Kaprun in the
Austrian Alps.
The town's funicular
railway carries skiers
and day trippers on
a spectacular trip
to the slope of the
Kitzsteinhorn Glacier
through a two mile
long tunnel cut
into solid rock.
- A funicular railway
is a delightfully
elegant way to
get people up
and down a mountain.
You basically have two
trains connected together
by a heavy wire cable
that goes around a
big pulley in the top.
[Narrator] For over 25
years, the funicular has
safely carried
as many as 180
people at a time up the
inside of the mountain.
But on November
11th, 2000,
162 people become trapped
in a burning train.
Deep inside the
claustrophobic tunnel,
just 12 make
it out alive.
It is Austria's deadliest
peacetime disaster.
- Among the victims
are ski teams,
young families,
children, teenagers.
[Narrator] Now, using
all available evidence,
including eyewitness
statements, photographs,
and the surviving
remains of the wreckage,
we will digitally
recreate the disaster
to understand what went
so tragically wrong.
The first question is,
where did the fire start?
- Photographs from
inside the tunnel
show that the
lower carriage was
completely burnt out,
all the fabrics and
plastics completely gone.
The steel rails on which
the train was running
are completely buckled,
suggesting the
temperatures would
have probably gone
in excess of 1,000
degrees Fahrenheit.
[Narrator[It is clear
that the intense fire
begins in the
ascending train.
The bodies of 150
victims are found either
inside the train or
further up the tunnel.
But others die who are
nowhere near the inferno.
[Dr. Andrew Steele] When
firefighters arrive at
the Alpine Center at
the top of the mountain,
they find thick smoke
pouring out of the doors.
And when they go
inside, they find one
unconscious person and
three dead bodies.
[Narrator] In the
tunnel above the
ascending train,
firefighters find
its blackened
but otherwise
undamaged twin.
There are two more
bodies inside.
Yet despite the
lethal fire,
a handful of
passengers survive.
[Dr. Rory Hadden] 10
o'clock in the morning,
around 45 minutes
after the emergency
call is made, the
fire service arrive
and they discover
12 survivors at the
bottom of the tunnel.
[Narrator] Why do these
people survive
when everyone
else is killed?
[Narrator] The 12 people
who survived the Kaprun
Furnicular Disaster have
one thing in common.
[Dr. Rory Hadden] From
their testimony,
it was clear that
these 12 survivors
all came from the
rear compartment
of the ascending train.
[Narrator] They actually
see the fire begin
in the empty attendance
cabin next to them.
Seconds later, the
train stops suddenly,
trapping them all
in the tunnel.
- Once these passengers
are outside the train,
they're faced with
a real dilemma.
Do they go up the tunnel,
which seems intuitive,
or do they go
down the tunnel?
But in order to do
that, they'll have to
literally squeeze past
the cab that's on fire.
[Narrator] Everyone
else on the train
flees uphill.
None of them survive.
Only the survivors
make the counterintuitive
decision to go down
towards the fire.
Is that what saves them?
[Dr. Rory Hadden]
Because the tunnel
here is angled
at this steep slope
of 30 degrees,
the smoke preferentially
spreads uphill.
Smoke rises,
all gases rise.
Fresh air is drawn
in from the bottom
of the tunnel,
creating what we call
the chimney effect.
[Narrator] By going
downhill,
the survivors are walking
into this fresh air.
[Dr. Rory Hadden] This
fresh air feeds the fire
and really accelerates
the fire growth.
The smoke then
spreads really
rapidly up the slope to
the top of the tunnel.
[Narrator] Anyone above
the fire is quickly
overwhelmed by the
lethally toxic smoke.
[Dr. Rory Hadden] They
were basically
overcome almost
immediately.
And many of their
bodies were found very
close to the train.
[Narrator] Why do the
survivors run in the
opposite direction
to everyone else?
[Dr. Luke Bisby] One
of those passengers is
a volunteer fireman,
someone who might know
a little something about
the chimney effect.
The decision made
to send everybody
down the tunnel
rather than up is
likely to have
saved their lives.
[Narrator] The chimney
effect explains
why so few survive.
But why does the
train suddenly
stop in the tunnel
in the first place?
According to
eyewitness statements,
there is a power cut
in the summit station
while the train
is in the tunnel.
- The funicular trains
are actually operated
by an electric motor,
which is located in
the summit station.
There's a 16,000-volt
cable that runs
through the tunnel.
Evidence from the
debris suggests
that the cable was
burnt by the fire.
[Narrator] That
cable supplies the
summit station.
[Dr. Andrew Steele]
Losing that power would
clearly stop
the train moving in the
tunnel.
[Narrator] It sounds
plausible, but the
timing doesn't fit with
the eyewitness evidence.
[Dr. Andrew Steele]
Workers in the
Alpine Center report
the power cutting out
during a call with the
attendant on the train,
trying to work out why
it was that the train
hadn't yet arrived
in the Alpine Center.
[Narrator] The train
stops before the
electricity fails.
- So that power cut
doesn't make sense
as the reason the
train stopped.
[Narrator] And
none of the staff
stopped the train.
- The train seems to
have stopped itself.
[Narrator] How is that
possible?
Analysis of the technical
history of the funicular
may hold vital clues.
[Professor Andrea Sella]
In 1994, the two trains
underwent
a complete refit to
make that spectacular
journey up the
glacier that much
more comfortable.
[Dr. Shini Somara]
When the Caprin
funicular went through
its modernization,
it had a brand new
hydraulic system
fitted for its brakes.
[Narrator] Part of the
new system is a built-in
emergency stop that
activates the brakes
if there's a drop in
hydraulic fluid pressure.
- So if there was a leak
in the hydraulic system,
that would explain
why the train came
to a sudden stop.
[Narrator] But is a
hydraulic leak credible?
We know the train stopped
soon after the survivors
first spot the fire
in the empty cab.
Is there a connection?
To understand
what happened,
we need to know how
the fire started.
- In the train that
caught on fire,
all of that evidence
is completely burned
and unavailable to us.
So we have to look at
the descending car
and the configuration
in that cab
to understand what
might've happened.
[Narrator] The surviving
twin of the destroyed
car has an identical
configuration.
[Dr. Andrea Sella] If we
look at photographs,
we can see below
the control panel,
an electric heater.
This is the place
where wisps of
smoke were spotted.
[Dr. Shini Somara] The
heaters were installed
during the 1994 retrofit.
What's absolutely
incredible is
that the heaters
specifically say
that they are for
domestic use only.
- A report by the
Austrian authorities
looked in detail
at the heater on
the other train.
They found evidence that
the casing for the heater
had become damaged,
and it seems likely
that this damaged casing
coming in contact
with the red hot
heating element
could be a possible
source of ignition.
[Narrator] A burning
plastic case might
provide a source
of ignition,
but on its own, it
is far too small to
explain the lethal
fire that develops.
So how does this turn
into this massive inferno
that's later experienced?
[Dr. Shini Somara] If
you look at the domestic
heater within the
surviving train,
you'll see that it's been
pushed really up close
to some plastic pipes.
[Narrator] A failure
here would also explain
why the train stops
unexpectedly.
- Those plastic pipes
contain hydraulic oil,
which operate the
braking system.
[Narrator] According to
the technical data,
this oil is highly
specialized
because most hydraulic
fluid thickens
in the extreme
cold of the Alps.
[Professor Andrea Sella]
As a result, they chose
to use an unusual fluid,
Mobile Arrow HFA,
which remains effective
at temperatures
down to minus 65
degrees Fahrenheit.
And this made it an
excellent choice
for the Kaprun funicular.
[Narrator] There is just
one problem with this
particular fluid.
[Professor Andrea
Sella]The safety
data sheet for this
oil states that the
flash point is
197 degrees Fahrenheit.
[Narrator] That is 92
degrees Celsius.
-That's the temperature
at which it will
ignite in air.
[Narrator] Could this
oil start the blaze
by coming in contact
with the heater?
[Narrator] Combustible
hydraulic fluid is
definitely present in
pipework in the area
where the Kaprun
funicular fire starts.
- If you look at the
photographs from
the surviving train,
you'll see stains
on the floor
underneath the heater,
which suggests that
fluid has leaked
through the heater.
- In another image,
which actually
shows the pipework
behind the heater,
one can actually see
a drop of liquid,
and it's red in color.
[Narrator] The only red
fluid on the train is
the hydraulic oil.
- The evidence
strongly suggests
there's been a leak
of hydraulic fluid.
- It's likely that
actually you don't
need the fluid itself
to come in contact
with the heater, but
simply the vapors
that are produced from
the hydraulic fluid
passing over the
heater as they're
blown by the fan
could cause ignition
of those vapors.
[Narrator] Once a fire
has started,
the plastic pipes
will melt,
releasing a jet of
burning hydraulic fluid.
The results would
be devastating.
[Dr. Shini Somara] The
oil inside these pipes
are pressurized
to 3,000 PSI,
which is about 100
times the pressure
in a car tire.
So when you've
got a leak,
you've got highly
pressurized
hydraulic fuel
shooting out
from the pipe.
And if it ignites,
essentially, it's
a flamethrower.
[Narrator] This explains
both why the train
stops in the tunnel and
the ferocity of the fire.
We now have all the
evidence we need to piece
together the Kaprun
funicular disaster.
[Professor Andrea Sella]
On the 11th of November,
2000,
161 passengers board one
of the funicular trains
in the Kaprun Valley.
A fire breaks out in the
attendance compartment,
either due to melted
plastic or leaking
hydraulic fluid.
[Narrator] This small
fire melts a plastic
pipe, causing a loss of
hydraulic pressure
that stops the train
in the tunnel.
Combustible oil sprays
out of the leak,
feeding the fire.
[Professor Luke Bisby]
Smoke begins to seep
into the nearest
passenger compartment,
but there's no fire
alarms and no intercom,
and so the passengers
have no way of telling
the attendant.
[Dr. Andrew Steele] 12
passengers break out of
the rear compartment
of the train and
escape down past
the fire to safety.
[Narrator] Toxic fumes
driven by the
chimney effect claim
everyone else.
- 44 other passengers die
from smoke inhalation
before they even get
out of the train.
The others try to make
their way up the tunnel,
but can't keep ahead of
the toxic cloud of smoke.
[Narrator] 155
people die.
[Dr. Shini Somara] After
the disaster,
the funicular
was closed down
and the rail and
the stations were
completely dismantled.
[Narrator] Separate
investigations by
Austrian and German
authorities fail to agree
on the exact cause
behind the fire.
What is clear is that
the mountain railway
had glaring flaws.
[Dr. Andrew Steele]
This funicular was
ill-equipped for
a fire like this.
It had no intercoms,
no fire alarms,
inaccessible fire
extinguishers,
and a tunnel that
actively accelerated
the spread of toxic
smoke contributing
to the death toll.
[Narrator] The evidence
suggests that both
trains were ticking time
bombs for six years.
One went off in the
worst place possible.
The entire disaster
was over in a
matter of hours.
Others have consequences
that are felt for years.
The Gulf of Mexico,
Deepwater Horizon,
this half a billion
dollar oil rig
is one of the biggest
and most advanced
ever constructed.
On April 20th, 2010,
just before 10 p.m.,
it explodes.
- The rig erupts
and the crew
really have to run
for their lives.
- It catches fire.
The entire platform
is just in flames.
[Narrator] 115 people
escape. 11 die.
- The Deepwater Horizon
burns for 36 long hours
before eventually
it collapses
and sinks deep a mile
down into the ocean.
[Narrator] Oil spews
from the ruptured well
on the seabed
for 87 days.
It is the largest marine
oil spill in history.
- The level of damage
is almost unthinkable.
The ecological damage,
the damage to wildlife,
to the fisheries and
to the coastal people,
it's unimaginable.
[Narrator] Now using
recorded data,
witness testimony,
photographic evidence
and recovered wreckage,
we will digitally
reconstruct the disaster.
What destroys
this massive rig?
[Narrator] Before
it explodes,
in April, 2010, the
Deepwater Horizon
rig is involved in some
of the most extreme oil
exploration on Earth.
- Before we can
begin to analyze
what happened in
this disaster,
we've actually got
to understand what
this rig is doing.
And the fact that
really it was drilling
at the edge of
the possible.
[Dr. Josh Macabuag] So
this is really cutting
edge engineering.
This is a floating rig
held in place
by a number of
huge propellers,
all controlled by
GPS positioning
to keep the rig
in position.
[Professor Andrea Sella]
The thing which is kind
of staggering
is the fact that you've
got the rig at the top
floating on the ocean.
It's got a mile
of pipe that goes
down to the seabed.
And then there's
about three more
going down into
the rock below.
These things are
just extreme.
[Narrator] But this is
exactly what the half
billion dollar rig is
built to pull off.
- Deepwater Horizon's
job is to drill
through the rock,
hit the oil, drill
out the well,
and then seal it
and then move on
so that another
rig can come along
and actually
extract the oil.
[Narrator] According to
company records,
on the day of
the disaster,
the crew have
successfully
drilled a well to
more than 18,300
feet below sea level.
Now, after 73 days
of intense work,
they are nearly done.
[Dr. Josh Macabuag] This
has been a tough job.
It's gone over
schedule, over budget.
All they have to do
now, seal the well
and move on.
[Narrator] The well must
be sealed at its base,
more than three
miles below the rig.
And there are no
cameras at the bottom
of the drill pipe
to guide them.
- All they can do
is try and infer
what's happening from
pressure readings
and other senses.
[Narrator] Getting a
perfect seal is
absolutely essential.
- Because you've got
gas, everything's under
tremendous pressure,
and it's extremely
important to
seal things
really carefully.
[Narrator] Something
clearly goes wrong.
[Professor Luke Bisby]
The fact that this
disaster initiates
because oil is pouring
out onto the rig
is a clear indication
that they failed
to seal the well.
[Narrator] What happens
to the well seal?
[Dr. Josh Macabuag] To
seal the well, they pump
cement down the pipe,
which then comes
up around the
outside of the pipe.
Essentially, a
concrete plug
to stop any leakage
of oil from the well.
[Narrator] Because the
rock at the bottom of
the well is weak,
they choose a
specialist cement.
[Professor Andrea Sella]
They use a kind of
aerated cement,
which is injected with
tiny bubbles of nitrogen,
which mean that the
whole thing is lighter.
[Narrator] Light cement
won't damage the fragile
rock,
but it is very difficult
to use as a well seal.
[Professor Luke Bisby]
The environment at the
bottom of
one of these wells
is a hugely alien
environment. You're
under immense
pressure, very
high temperature,
and there's all sorts
of slimy, dirty
sludge involved.
And this makes it
very difficult
to keep the nitrogen
bubbles suspended
within the cement.
[Narrator] Losing the
nitrogen bubbles would
be a critical failure.
[Dr. Josh Macabuag] If
the nitrogen bubbles do
not remain in the cement,
that will reduce
the volume,
and there's a
risk that it just
wouldn't be enough
to fully plug the well.
[Narrator] And
that's not the only
way it can fail.
[Professor Andrea Sella]
The other possibility is
that the bubbles start
to coalesce in some way.
You can essentially
get a channel
through the material,
which of course is gonna
be the source of leaks.
[Ada McVean] We can't
say for certain how
the cement failed,
but if we look
at the disaster, we
can be absolutely
certain that it did fail.
[Narrator] There is no
way for the crew to tell
that the seal has failed,
because at this stage
of the operation, it
is impossible for
oil and gas to leak
out of the cement.
- The oil and gas at
the bottom of the well
are under huge pressure,
and they want to move
up to the surface.
And in order to
prevent this,
they fill the drill
pipe with drilling mud,
which is a very
heavy fluid.
[Narrator] The
pressurized oil and
gas has the weight
of four miles of heavy
mud in the drill pipe,
pushing down with more
force than the oil
and gas pushes up.
In this state, the
well cannot leak.
- This puts the
well in a condition
that people in the
drilling industry
call overbalanced.
[Narrator] But the
disaster suggests
that the pipe becomes
underbalanced,
letting oil and
gas leak past the
failed cement seal
and up to the rig.
How could this happen?
On the afternoon
of April 20th,
the final job is to
confirm that the
cement seal is okay.
- So to make sure
that the cement
has properly set and
sealed the well,
they remove the
heavy drilling mud,
such that the weight
of remaining mud
is less than the
upward pressure from
the oil and gas.
[Narrator] This is the
critical test.
It will tell them if the
cement plug is sealed.
All they have to do is
monitor the pressure
at the top of
the drill pipe.
If the seal has
failed, oil and gas
will push upwards,
making the pressure
in the pipe rise.
- Around 3 p.m., they
begin to start their
pressure testing.
They remove some of
the heavy mud to
see what happens.
- If the pressure
remains at zero,
then the well is sealed.
[Narrator] But that is
not what the rig data
shows.
- And this is when
they start to see
their first anomalies.
The pressure really
begins to shoot up.
[Narrator] Where is this
pressure coming from?
- It can only be
from the oil and gas
down at the bottom.
And yet the entire
assembly is supposed
to be sealed.
[Narrator] The cement
seal is leaking.
They can stop it by
simply pumping the
heavy drilling mud
back into the pipe.
But records show
that never happens.
[Narrator] According to
survivors of the
Deepwater Horizon
disaster, the crew's test
instructions change
while they're still
checking that the
well is sealed.
- They're told that
they've been given
a new protocol
and they need to
measure the pressure
at a new pipe called
the kill line.
[Narrator] This connects
into the drill pipe
a mile down on
the sea floor.
So pressure readings
from the kill line
and the top of the drill
pipe should be the same.
- When they measure
the pressure in
the kill line,
it reads zero,
which indicates a
successful test.
[Narrator] But
this doesn't match
other rig data.
Although the sea
floor kill line
pressure reads zero,
the drill pipe
pressure at the rig
is a huge 1400 PSI.
They should be identical.
Something is very wrong.
Why don't the deck
crew realize it?
[Ada McVean] According
to eyewitness
statements,
a crewman explains
the anomalous reading
on the main pipe
as a flexing of
the rubber seal
near the seabed.
And he calls this
the bladder effect.
[Narrator] That would
explain the
high pressure reading as
a measurement anomaly.
But investigation of oil
engineering journals
turns up no mention of
the bladder effect.
- Because it
doesn't exist.
It's some kind
of oil rig myth,
which has just echoed
around for a long time,
which isn't really true.
[Narrator] Trusting in
the non-existent
bladder effect is
a lethal decision.
[Ada McVean] Ultimately,
the crew decide to
accept the zero
PSI reading from
the kill line
and ignore the
1400 PSI reading
from the main line.
Their assumption
cannot be correct.
Both the pressures
should be the same.
And ultimately
somebody should have
noticed at that point
that something had
gone terribly wrong.
[Narrator] At 8 p.m.,
confident that
the well is sealed, the
crew starts to pump out
the remaining heavy
drilling mud.
The pressure
restraining the oil
and gas in the pipe
disappears rapidly.
According to the
rig's records,
they finished
removing the mud
at about 9:10 p.m.
And if everything's
gone according to plan,
the pressure should
now read zero.
But if you look at
the pressure on the
pipe, it's rising.
[Narrator] There is only
one possible reason
why the pressure
is rising.
Oil and gas are
rushing up the pipe
towards the surface.
30 minutes later,
catastrophe strikes.
[Professor Andrea Sella]
It was at about 9:40
p.m.
That suddenly there
was an eruption of
water, mud, and oil
onto the top of the rig.
Eyewitnesses described
it like a mud waterfall.
[Narrator] As soon as
the oil and gas start
pouring over the rig,
the crew finally realize
they're in big trouble.
They activate the
last line of defense,
the blowout preventer, or
BOP, on the sea floor.
- The Blow-out
preventer is a system
that sits on top
of the borehole
that can shut down
the pipe completely
and prevent oil and gas
spewing uncontrollably
up the pipe.
[Narrator] If we look at
the rig data, at
9:47 p.m., it shows the
pressure in the main pipe
shooting up to
over 5,000 psi.
- That fits with the idea
that they've actually
shut down the well
and that things are
going to be okay.
[Narrator] But if they
closed the well,
why does the rig
still explode?
[fire burning]
[Professor Luke Bisby]
The pipe that connects
the blowout preventer
to the rig is
called the riser.
[Narrator] The riser is
a mile long.
- Anything that's
already in the riser
can't be controlled
by the BOP.
[Narrator] By the time
the BOP is closed,
the riser already
contains highly
flammable gas and oil.
It continues to race
up towards the rig.
- And so by the time
the control room
shut down the well,
it's already too late.
- At 9:49 p.m., all
of the oil and gas
that's been spewing
onto the rig finds
a spark and ignites.
[explosion]
For everybody on the
rig at that point,
their only option is to
try to get out alive.
[Narrator] The rig is
crippled.
- The explosion causes
total power failure,
and without power, the
propellers and GPS
that keep the rig in
place can't work anymore,
and the rig
starts to drift.
[Narrator] As the rig
drifts, it breaks its
control connections
to the BOP,
opening the sealed well.
Oil spews uncontrollably
out of the well
for a further 87 days.
We can now reconstruct
the events that lead up
to the Deepwater
Horizon disaster.
[Ada McVean] April 20th,
2010, a little bit
after midnight,
the crew finished
pumping the foam cement
to seal the Macondo well.
[Professor Luke Bisby]
That afternoon, between
about 5 and 8 p.m.,
the crew conduct
a test to check
that the cement
seal has worked.
[Narrator] The crew
misinterpret the
pressure readings
from the test.
They don't realize
that the cement
seal has failed.
[Professor Luke Bisby]
By about 9 p.m., oil and
gas are flowing up
the drill pipe
towards the rig,
but the people on the
Deepwater Horizon
have no idea that
this is happening.
[Ada McVean] 40 minutes
later, a mixture of
seawater and drilling mud
begins erupting out the
top of the drill pipe.
[Narrator] They shut the
blowout preventer,
but it is already
too late.
At 9.49 p.m., the whole
rig erupts in flame.
11 people die.
Oil leaks from the
broken well for 87 days.
[Ada McVean] Nearly
three months later,
July 15th, 2010,
the Macondo well
is finally sealed, and
this horrible flow of oil
is stopped into the
Gulf of Mexico.
By this point, it
has already become
the biggest man-made
disaster in history.
[Narrator] Over 210
million gallons of oil
spill into the
Gulf of Mexico,
spreading over 57,500
square miles of sea.
In total, the
disaster cost BP
over $65 billion in
fines, settlements,
and private
claim payments.