Oil industry insiders are awash in theories about what caused the massive explosion and spill that continued to spoil the Gulf of Mexico Wednesday, but increasingly they are harboring fresh doubts about a once-trusted fail-safe of offshore drilling.
Known as a blowout preventer, or BOP, the five-story-tall, 900,000-pound concrete contraption has always served as a critical backstop for oil rigs. Rig operators believed that if something went wrong, and oil started gushing from an open well, the blowout preventer's giant hydraulic pistons and shears would clamp shut a gushing well.
"I think that's what's bothering everybody," said Randall Luthi, the former director of the U.S. Minerals Management Service, who now serves as president of the National Ocean Industries Association. "Why didn't the blowout preventer work the way it was supposed to work?"
The failure of the blowout preventer after last week's explosion on the BP-leased Transocean Horizon deepwater rig could turn a tragic, but manageable incident into one of the worst spills in U.S. history, Luthi said.
While the oil industry has always touted the blowout preventer as a key to its ability to drill offshore without great risk to the environment, Senator Maria Cantwell, D.-Wash., says that BP's portrayal of this kind of failure as unprecedented does not stand up to examination.
"There is clear evidence that the oil industry has been well aware for years of the risk that blowout preventers on offshore rigs could fail," said Cantwell in a statement to ABC News on Wednesday.
Cantwell, the chairwoman of two key Senate Commerce and Energy Committee subcommittees with oversight over the offshore drilling, said her staff has found extensive documentary evidence demonstrating the problems with blowout preventers.
"Despite frequent failures, industry assumed the preventers were fail-safe and, as a result, had no back-up plan for responding to a catastrophe like the one now unfolding in the Gulf."
ABC News has learned of several incidents suggesting that the devices could not always be trusted to perform.
After a 2000 spill, federal regulators became alarmed when a blowout preventer failed to work as intended. They issued a safety alert in March 2000, advising oil rigs "to have reliable back-up systems" to trigger the equipment if for some reason it failed to shut down a well on the first attempt. BP appeared to recognize this was a problem. In June of 2000, BP issued a notice of default to Transocean saying the preventer on another rig - the Discover Enterprise - "did not work exactly right" and was unable to operate for an extended period of time, according to a recent report in The Sunday Times.
In 2003, a Transocean official helped present a research paper that looked at reliability issues with blowout preventers - and identified as a reasonable goal for the industry one BOP failure for every 10 years a rig is operating. Minimizing BOP problems was an important goal, the paper said, because shutting a rig down to address the failure of one of the devices could cost the operator $1 million per event.
"Floating drilling rig downtime due to poor BOP reliability is a common and very costly issue confronting all offshore drilling contractors," the paper said.
The paper also stated that "root-cause analysis of the failures" was often not performed because of pressures to get the rig back into production.
In 2004, another study was commissioned by the Minerals Management Service. It found that the company making the blowout preventers had used a faulty formula to determine how much force would be needed for the device to slam down on a pipe and clamp it shut. "It provided shear forces lower than required or desired in many cases; in other words, there was little safety factor built in," the study said. The research also noted that the failure of a blowout preventer helped lead to the second largest oil spill on record - a 1979 disaster off the Yucatan Peninsula that emptied an estimated 140 million gallons into the ocean.
If the devices were not strengthened, the report warned, the dangers of another large spill would escalate, the report said.
"As smaller operators with limited appreciation of the risks venture into ever deeper water, the industry's risk increases. It appears that at least some of the rigs currently in operation have not considered critical issues necessary to ensure that their shear rams will shear the drill pipe and seal the wellbore."
BP did not respond to emailed questions about blowout preventers, and could not be reached by phone. Transocean spokesman Guy Cantwell (no relation to the senator) declined to speculate about why the blowout preventer did not work last week. But he told ABC News Wednesday that the company had had no reason to believe it would not.
"Everyone wants to know about the cause," Cantwell said. "We're going to wait for the facts before we reach any conclusions. But I can tell you, this rig had a very good safety and environmental record."
Elmer Danenberger, a former chief of Offshore Regulatory Programs for the Minerals Management Service, told ABC News that regulators require the rigs to test the blowout preventers every two weeks, and there had been a test on the Deepwater Horizon within hours of the explosion.
Danenberger said it was possible that "some kind of violent flow after the BOP test might have done some damage," and rendered it inoperable. But that "is just speculation," he said.
"To be honest, I can't remember an offshore blowout where the BOP totally mis-functioned like this," he said. "There are going to be a lot of people waiting to hear what happened here -- wanting to know why didn't this safeguard work?"