report title: subsea bop reliability, testing, and well kicks · bop days are defined as the number...

Title: Subsea BOP Reliability, Testing, and Well Kicks

CLIENT: Authors: Multiclient Per Holand

Report no. Version Date ES20150201/1 Final 15-Oct-19

REPORT

Subsea BOP Reliability, Testing, and Well Kicks

Final report Page 4

PREFACE

The evaluation, analysis and calculations performed are based on several assumptions,

limitations, and definitions of system and environmental boundaries, all of which are stated

further in the report or in its references. Exprosoft will accept no liability for conclusions

being deduced by readers of the report. Caution should always be taken when using the results

from this report further, such that decisions are not made on an erroneous basis.


Final report Page 5

TABLE OF CONTENTS

PREFACE ............................................................................................................................ 4

SUMMARY AND CONCLUSIONS ....................................................................................... 8

LIST OF ABBREVIATIONS ................................................................................................ 17

1. INTRODUCTION .......................................................................................... 19

1.1 BACKGROUND ....................................................................................................... 19 1.2 PROJECT PARTICIPANTS ........................................................................................ 19 1.3 STUDY OBJECTIVE ................................................................................................. 20

2. DATA COLLECTION AND ANALYSES ................................................... 21

2.1 DATA SOURCES ..................................................................................................... 21 2.2 STATISTICAL ESTIMATION PROCEDURE AND ASSUMPTIONS .................................. 21

3. SUBSEA BOPS ............................................................................................... 23

3.1 SYSTEM DESCRIPTION AND BOUNDARY CONDITIONS ........................................... 23 3.2 RELEVANT DEFINITIONS ........................................................................................ 25 3.3 OPERATORS AND WELLS ....................................................................................... 26

3.4 RIGS AND WATER DEPTHS EVALUATED ................................................................ 26 3.5 MAIN OPERATION AND WELL TYPE ...................................................................... 27

4. OVERVIEW OF BOP FAILURES ............................................................... 28

4.1 COMPARISON WITH THE PREVIOUS SUBSEA BOP RELIABILITY STUDIES............... 30 4.2 ANNUAL TRENDS IN FAILURE RATES AND DOWNTIME .......................................... 32

4.3 INFLUENCES BY SEASON AND FIELD CONDITIONS ................................................. 34

Water Depth ......................................................................................................... 34 Seasonal Variation ............................................................................................... 35 Area Variation ...................................................................................................... 35

4.4 RIG SPECIFIC PERFORMANCE ................................................................................ 35

5. BOP SYSTEM SPECIFIC RELIABILITY ................................................. 37

5.1 FLEXIBLE JOINT ..................................................................................................... 37

Historic Overview, Flex Joint Failures ................................................................ 37 5.2 ANNULAR PREVENTER RELIABILITY ..................................................................... 38

Failed to Fully Open ............................................................................................ 39 Internal leakage .................................................................................................... 40 Internal Hydraulic Leakage ................................................................................. 40

Historic Overview, Annular Preventer Failures .................................................. 40 5.3 HYDRAULIC CONNECTOR RELIABILITY ................................................................. 41

External Leakage .................................................................................................. 42 Spurious opening .................................................................................................. 43

Failed to lock ........................................................................................................ 43 Historic Overview, Hydraulic Connector Failures .............................................. 43

5.4 RAM PREVENTER RELIABILITY.............................................................................. 44 Failed to Close ..................................................................................................... 45 Internal Leakage (leakage through a closed ram) ............................................... 46


Final report Page 6

Failed to Fully Open ............................................................................................ 46

Other ..................................................................................................................... 46 Historic Overview, Ram Preventer Failures ........................................................ 46

5.5 CHOKE AND KILL VALVE RELIABILITY ................................................................. 47 Internal leakage (leakage through a closed valve) .............................................. 48 Historic Overview, Choke and Kill Valve Failures .............................................. 49

5.6 CHOKE AND KILL LINE RELIABILITY ..................................................................... 49 External Leaks, BOP Attached Line ..................................................................... 50

External Leaks, Jumper Hose Line ...................................................................... 51 External Leaks, Riser Attached Line .................................................................... 51 Plugged Line, Riser Attached Line ....................................................................... 52 Historic Overview, Choke and Kill Line Failures ................................................ 53

5.7 MAIN CONTROL SYSTEM RELIABILITY .................................................................. 54

Loss of all Functions Both Pods ........................................................................... 57 Loss of all Functions One Pod ............................................................................. 57

Loss of One Function Both Pods .......................................................................... 58 Loss of One Function One Pod ............................................................................ 58 Loss of One Function One Topside Panel/Unit ................................................... 59 Emergency Automated BOP Function Failed ...................................................... 59

Other ..................................................................................................................... 60 Unknown ............................................................................................................... 61 Rig Specific Failure Rates .................................................................................... 62

Historic Overview, Main Control System Failures .......................................... 62 5.8 BACK-UP CONTROL SYSTEM RELIABILITY ............................................................ 63

Acoustic Control System Reliability ..................................................................... 64 Failed to Operate one BOP Function by the Acoustic System ............................. 65 One of two Acoustic Units on the BOP Failed ..................................................... 65

Other ..................................................................................................................... 65

Unknown ............................................................................................................... 66 Historic Overview, Acoustic Back-Up Control System Failures ......................... 66 Failure Modes ...................................................................................................... 67

6. FAILURE CRITICALITY IN TERMS WELL CONTROL ..................... 68

6.1 WHEN ARE BOP FAILURES OBSERVED? ................................................................ 68

Failure Observation, Pressure Testing vs. Function Testing ............................... 68 6.2 SAFETY-CRITICAL PERIOD FAILURES .................................................................... 69

BOP Item, Safety-critical Period Failures ........................................................... 69

Choke and Kill Valves and Lines, Safety-critical Failures .................................. 70 Main Control System, Safety-critical Failures ..................................................... 72

Back-up Control System, Safety-critical Failures ................................................ 75 6.3 RANKING OF FAILURES WITH RESPECT TO SAFETY CRITICALITY .......................... 76

7. BOP TESTING EXPERIENCE .................................................................... 78

7.1 BOP TESTING REGULATIONS ................................................................................ 78 7.2 BOP TEST TIME CONSUMPTION ............................................................................ 78 7.3 TESTING OF ACOUSTIC FUNCTION AND BLIND SHEAR RAM .................................. 81 7.4 OTHER TESTS ........................................................................................................ 82

7.5 COMPARISON WITH PREVIOUS STUDIES................................................................. 82

8. WELL KICKS ................................................................................................ 84


Final report Page 7

8.1 KICKS OBSERVED .................................................................................................. 84

8.2 KICK FREQUENCIES ............................................................................................... 86 8.3 COMPARISON OF THE KICK FREQUENCY VS. OTHER STATISTICS ........................... 86

8.4 LEAK OFF PRESSURE VS. MAXIMUM MUD WEIGHT ............................................... 89

9. ABILITY TO CLOSE IN A KICK WITH THE BOP ................................ 92

9.1 INTRODUCTION ...................................................................................................... 92 9.2 PARAMETERS AFFECTING THE BOP’S ABILITY TO CLOSE IN A WELL ................... 92 9.3 OPERATIONAL ASSUMPTIONS ................................................................................ 93

The BOP Stack Design ......................................................................................... 93 BOP Unavailability Calculation .......................................................................... 93 BOP Testing Assumption ...................................................................................... 94 Failure Input Data ............................................................................................... 95 Initial Situation ..................................................................................................... 97

Repair Strategies .................................................................................................. 97

Failure Observation ............................................................................................. 97

Other Assumptions ............................................................................................... 97 9.4 BLOWOUT PROBABILITY, BASE CASE ................................................................... 98

Probability of not Being Able to Close in a Well Kick ......................................... 98 Probability of a Blowout per Time Unit ............................................................... 99

Discussion ............................................................................................................ 99 9.5 BOP TEST STRATEGIES AND BLOWOUT PROBABILITIES...................................... 100 9.6 BOP TEST STRATEGIES AND BOP TEST TIME SAVINGS ...................................... 102

9.7 GUIDANCE FOR ACCEPTING SUBSEA BOP FAILURES OR NOT .............................. 103 9.8 DISCUSSION ......................................................................................................... 105

REFERENCES ..................................................................................................................... 106

ANNEX A BOP TESTING REQUIREMENTS IN NORWAY (/11/) ............................. 107

ANNEX B SUBSEA BOP FAULT TREE .......................................................................... 108


Final report Page 8

SUMMARY AND CONCLUSIONS

Data from subsea BOP failures, subsea BOP testing, and well kicks have been systematically

collected for wells spudded in the period 2016-2017 in Norwegian waters. The main source of

information for the study has been the Petroleum Safety Authority Norway’s Daily Drilling

Reporting System.

Only the periods of the well when the BOPs are located on the wellhead/X-mas tree are

included in the study, so shallow gas incidents or shallow water flows are not considered.

Table 1.1 shows an overview of wells and days in service for the various water depths.

Table 1.1 Overview of no of wells and days in service

Development wells Exploration wells Total

No. of well paths

No. of mother wells

No. of BOP days

No. of well paths

No. of mother wells

No. of BOP days

No. of well paths

No. of mother wells

No. of BOP days

137 95 3 930 45 35 1 282 182 130 5 212

BOP days are defined as the number of days the BOP is located on the wellhead/X-mas tree

until it is pulled.

Nine different drilling contractors and 15 different semisubmersible rigs are included in the

study.

Most of the drilling is carried out in water depths less than 500 meters. The deepest water depth

in the data set is 1273 meters (Aasta Hansten field).

Overview of BOP failures

During the study, 94 subsea BOP-related failures were observed. The total time in service was

5 212 BOP days. The total downtime caused by BOP failures was 1305 hours, or 54 days. This

corresponds to approximately 1,05% of the total time in service for the BOP.

A BOP failure does not mean that the complete BOP safety barrier function failed, but a

component in the BOP or the BOP control system failed. For most of the BOP failures, there

are redundant or alternative components to ensure the overall safety and performance of the

BOP.

An overview of BOP subsystem specific contribution to reliability is shown in Figure 1.1.


Final report Page 9

Figure 1.1 Distribution of BOP failures and downtime

Forty percent of the failures may be attributed to components in the main BOP control system.

The choke and kill lines also experience many failures and approximately 40% of the

downtime. Most of the annular preventer failures are failures where the annular failed to fully

open. These failures normally cause little downtime.

Comparison with previous BOP studies

SINTEF and Exprosoft have carried out subsea BOP reliability studies from the early 80-ties

until today. Until the beginning of the 90s these were studies in Norwegian waters. After that,

studies have been carried out in Brazilian waters and the US GoM OCS. The Norwegian studies

were mainly in shallow waters, whereas the Brazilian and US GoM OCS studies were mainly

in deepwater (DW).

Figure 1.2 compares some key results from the previous subsea BOP reliability studies with

key results from the present study.


Final report Page 10

Figure 1.2 Comparison of key figures, subsea BOP reliability 1979 – 2018

Figure 1.2 is based on in total of 43 683 BOP days, or 120 BOP years of activity with the BOP

on the wellhead (or X-mas tree). A total of 1 285 failures were observed, causing 36 998 hours,

or 1 540 days of downtime.

The mean time to failure (MTTF) in the present study has improved compared with the previous

studies, except for the DW and kick (/1/) study. The average downtime per BOP day is now

much lower than in all the previous studies. It is important to observe that the main source of

information for the DW and kick study was the BSEE well activity reports (WARs) that is a

weekly reporting system, whereas for the all other studies it was the daily drilling reports. It

can be assumed that many less critical failures are not described in the WARs. These less

critical failures typically produce little downtime.

By combining the data from the present study and the data from the previous BOP studies, an

annual BOP failure rate since 1979 has been established. Figure 4.5 shows the annual failure

rates, alongside 90% confidence intervals, and linear and log linear trend lines for subsea BOP

stacks. Figure 4.5 shows from which studies and from where the data stem. Observe that no

data is available from the years 1990, 1991, 1999-2006, and 2011-2015.



Figure 1.3 Annual failure rates, 90% confidence intervals, linear and log linear trend

lines for subsea BOP stacks for the period 1979 – 2018

The confidence band for the years 2007-2009 is very narrow because the BOP service time was

substantially higher than the other studies. It is important to notice that the graph is based on

the average failure rate for each year. The total amount of experience within each year is thereby

not considered. Figure 4.5 indicates that the failure rate has been significantly reduced over the

years.

Safety-critical failures

All failures that occur in the BOP after the installation test are regarded as safety-critical

failures. This is the period the BOP acts as a well barrier. The criticality of each failure will of

course depend on what part of the BOP system that fails and the failure mode.

Fifty-two or 55% of the 94 failures occurred in the safety-critical period. When looking at these

failures, 26 of 52 were observed during normal operation. Twenty-three failures were observed

during a Test after running casing or liner or a Test scheduled by time of the BOP. For three

failures, it was unknown how the failures were observed.

Two of the normal operation failures were observed because the choke- or kill line were

pressure tested, but this was related to the operation and not a BOP test.

When looking at the failures that were observed during a Test after running casing or liner or

a Test scheduled by time, six failures were observed because pressure was applied. Four of

these failures were in choke and kill lines, one was in a choke valve, and one in an annular

preventer.



Eleven failures were observed in association with BOP testing because the BOP was

functioned. This is typically failures related to the control system. The failures are observed

because hydraulic fluid is leaking, or they fail to operate a function.

Six of the failures had failure mode Failed to fully open annular preventer in association with

a BOP test.

The frequency of failures that occurred in the safety-critical period is higher than in the DW

and kick (/1/) study. It is important to notice that the main source of information for the DW

and kick study was the BSEE well activity reports (WARs) – a weekly reporting system,

whereas for all the other studies, it was the daily drilling reports.

When comparing the overall frequency of failures that occurred in the safety-critical period in

the present study with the frequencies in the previous studies, Phase II DW and Phase I DW,

the frequencies are in the same order of magnitude. The frequencies in the present study are a

bit higher compared with the most recent DW and kick study.

It is noteworthy that, in the present study the most serious BOP failure modes were not

observed. Failures, such as leakage in the wellhead connector, external leakage in rams, and

total loss of BOP control through the main control system were not observed. Leaking

preventers or valves were rare in the present study. The most negative observation was a high

number of leaks in choke and kill lines.

Table 1.2 lists a coarse ranking of the most severe failures that occurred in the safety-critical

period in the present study. The same ranking from the previous studies, DW and kick, Phase

II DW, and Phase I DW, is presented alongside.



Table 1.2 Coarse ranking of failures occurring in the safety-critical period according to

severity

Present study Norway (2016 – 2018) DW and kick (/1/) (2007-2009, US GoM OCS)

1. Nine external leaks in choke and kill lines 2. Two failures that caused loss of all functions

one pod 3. Internal leakage (leakage through a closed

annular) 4. Internal leakage (leakage through a closed

choke/kill valve) 5. One loss of one function both pods 6. Two losses of one function one pod

1. One failure causing wellhead connector external leakage

2. One spurious opening of the LMRP connector (Unknown cause, no autoshear in BOP)

3. One control system failure that caused total loss of the BOP control

4. One shear ram leakage in closed position 5. Upper and lower variable bore ram leaked at

the same time 6. Two incidents, pipe ram failed to close 7. Nine incidents, loss of all functions one pod 8. Two incidents, pipe rams leaked in closed

position 9. One flexible joint external leak 10. One failed to close annular incident 11. Four incidents, annular preventer leak 12. Six choke and kill line leaks 13. Five incidents with loss of one function both

pods

Phase II DW BOP study (/2/) (1997-1999, US GoM OCS)

Phase I DW BOP study (/4/) (1992-1996, Brazil and Norway)


2. One spurious opening of the LMRP connector (control system failure)

3. One shear ram failed to close 4. One shear ram leak in closed position 5. Two failures to open pipe ram 6. Two failures where the pipe ram leaked in

closed position 7. External leak in flexible joint 8. One failure to disconnect the LMRP 9. Four failures that caused loss of all functions

one pod 10. Loss of one function both pods (annular close) 11. Four annular preventer leaks in closed position

12. One choke and kill line leak (jumper hose)


2. One failure where they failed to shear the pipe during a disconnect situation

3. One external leakage in the connection between lower inner kill valve and the BOP stack

4. Five failures that caused total loss of the BOP control by the main control system

5. Two shear ram leakages in closed position 6. Two failures to disconnect the LMRP 7. Seven failures that caused loss of all functions

one pod 8. One UPR leakage 9. One spurious closure of the shear ram 10. Three annular preventers that leaked in closed

position 11. Six choke and kill line leakages



BOP testing experience

The total time used for testing was 2884 hours, this represents in average 0,553 hours per BOP

day, which represents 2,3% of the time. When comparing with test experience from earlier

studies, the present study has in average the shortest subsea BOP test times. Most of the wells

drilled have been in shallow waters, reducing the tool handling time. The main reason is,

however, believed to be that a large proportion of the tests after running casing or liner are

partly tests, and not full tests.

It is a large variation in average BOP test times among the various rigs and operators. Rig D

experienced the highest average test time per day in service. The main reason was an event

where a test tool seal ring was lost in hole and they used more than four days to retrieve it. Rig

F experienced a high average BOP test time because they had severe test equipment problems

and prolonged test time in two of the tests.

Rig I performed a full pressure test for nearly all the installation tests and tests after they had

been running casing or liner. Many of the rigs do not perform a full BOP pressure test after

running casing or liner. The full pressure tests were typically replaced by a well pressure test

and a BOP function test. This reduce the total test time consumption.

In addition, some perform a full BOP test after landing the BOP, when only a connector test is

required if the BOP has been fully pressure tested on the rig prior to running.



Well kicks

Only five well kicks were observed, three in exploration wells and two in development wells.

For two of the exploration well kicks they observed a sudden increase in the rate of penetration

during drilling prior to the kick. For the third kick in an exploration well, the well kicked during

plugging and abandoning the well. They were pulling the seal assembly when trapped gas

below the seal assembly caused the well to kick.

One of the two kicks in a development well occurred when plugging and abandoning the well.

When pulling the tubing hanger plug, gas below the plug caused the well to kick. It was believed

that the gas stemmed from the natural gas lift zone in the well through a leaking gas lift valve.

The second development drilling kick occurred after they had just set a balanced cement plug

from 1943 to 1727 m. They then got losses after having pumped 28,3 m3 of 1,45 sg OBM.

When diluting mud from 1,45 sg to 1,40 sg they observed a gain.

Compared to other kick frequency data the kick frequency found in the present study is very

low. Figure 8.1 shows a graphical overview of the overall kick data from various data sources

alongside the frequencies from the present study.

Figure 1.4 Overview of kick frequencies

BOP testing strategy recommendations

An alternative subsea BOP test strategy has been compared with the test strategy reflected in

Norsok D-010, rev 4.

The analysis is performed with “normal” operational situations in mind. If specific operations

shall be carried out that reduces the BOP barrier availability, specific testing or repair should

be evaluated before starting such operations.

The proposed alternative test strategy will not have any effect on the BOP emergency features,

as emergency disconnect system (EDS), automated mode function (AMF/Deadman), auto



shear, and ROV functions. The requirements for verification of these systems remain

unchanged.

The main difference between the two test strategies is that the alternative test strategy does not

include a detailed test of all preventer elements for the Test after running casing or liner and

the Pressure test scheduled by time (14 days).

The analyses show that the two alternatives are nearly identical, which means that the detailed

testing of the preventers has no effect on the safety availability for the above two test strategies.

The reason for this is the redundancy in the BOP stack with respect to flow through the BOP

when there is a drill-pipe in the BOP. It is assumed that all three pipe rams have VBR packers

that can close around normal drill-pipes. A sensitivity evaluation shows the same result if only

two out of three rams can close around normal drill-pipes. The same will also apply for BOPs

with a test ram as long as two pipe rams and one annular can seal around the normal drillpipe.

The analysis assumes that kicks are observed in due time. It is important that all kicks are

observed early, such that the BOP can be closed before the well flow becomes too high. BOPs

are not designed to close against flow. Many blowouts have occurred because the kick was not

detected early enough, and the BOP failed to close (/16/). The simplified BOP testing will not

have any effect on this.

The most important test of the BOP is the pressurizing of the BOP to reveal leaks to the

surroundings, especially in the lower part of the BOP.

A test strategy that prolongs the time between the pressure tests to reveal external leaks in the

lower part of the BOP, including the wellhead connector, will reduce the probability of being

able to close in the BOP when a well kick.

A coarse evaluation indicates that this alternative test strategy will reduce the test time for each

of the tests with approximately 3 hours per test compared to the Norsok D010, rev 4

requirement. The average savings in BOP test time will be 0,2 hours per BOP day (or 3 days

per year).

Guidance for accepting subsea BOP failures or not

When a failure in a BOP occurs, the BOP’s ability to act as a safety barrier will be influenced.

Some failures have a large influence on safety availability, while others have a limited or

insignificant influence on the safety availability.

Eighteen different failure scenarios are analysed with fault tree analyses. The analyses show

that many failures in BOP components have an insignificant effect on the BOP safety

availability. When these failures occur, the best choice is in many cases to continue the

operations until the BOP is pulled for other reason, rather than plugging the well and pulling

the BOP. The results should, however, be combined with a risk evaluation and engineering

judgment related to the specific situation and operations to be carried out.

External leakages in the BOP stack or the choke and kill line should always be repaired if

occurring.



LIST OF ABBREVIATIONS

AMF - Automatic Mode Function (deadman)

BOP - Blowout Preventer

BS - Blind-Shear

BSR - Blind-Shear Ram

BSEE - Bureau of Safety and Environmental Enforcement (US)

CARA - Computer Aided Reliability Analysis

CML - Controlled Mud Level

C/K - Choke and Kill

CR - Casing Ram

CSR - Casing Shear Ram

DDRS Daily Drilling Reporting System

DMAS - Deadman Autoshear

EDPHOT - Emergency Drill Pipe Hang-off Tool

EDS - Emergency Disconnect System

FIT - Formation Integrity Test

FTA - Fault Tree Analysis

HP - High-pressure

HIPAP - HIgh Precision Acoustic Positioning

HPHT - High-pressure High Temperature (A well with an expected

maximum shut-in pressure above 690 bar and/or formation

temperatures above 150oC is regarded as a HPHT well)

ID - Inner Diameter

IK - Inner Kill

ITT - Isolation Test Tool

JIP - Joint Industry Project

LAP - Lower Annular Preventer

Lbs - Pounds

LCL - Lower Confidence Limit

LIC - Lower Inner Choke

LMRP - Lower Marine Riser Package

LOC - Lower Outer Choke

LOT Leak Off Test

LPR - Lower Pipe Ram

MFDT - Mean Fractional Deadtime

MPR - Middle Pipe Ram

MPT - Multi Purpose Tool

MTBK - Mean Time Between Kicks

MTTF - Mean Time To Failure

MUX - Multiplex Control System

MW - Mud Weight

NCS - Norwegian Continental Shelf

NPD - Norwegian Petroleum Directorate

NTNU - Norwegian University of Science and Technology

OBM - Oil Based Mud

OCS - Outer Continental Shelf

OD - Outer Diameter

OK - Outer Kill



POOH - Pull out of hole

Ppg - Pounds per gallon

PSA - Petroleum Safety Authority Norway

RIH - Run in Hole

ROPS - Remotely Operated Pull-in System

ROV - Remotely Operated Vehicle

SEM - Subsea Electronic Module

sg - Specific gravity

SICP - Shut-in Casing Pressure

SIDPP Shut-in Drill Pipe Pressure

UAP - Upper Annular Preventer

UCL - Upper Confidence Limit

UIC - Upper Inner Choke

UOC - Upper Outer Choke

UPR - Upper Pipe Ram

VBR - Variable Bore Ram

Vs. - Versus

WAR - Well Activity Report

WOW - Wait On Weather

WOSP - Wait On Spare Parts

WOO - Wait On Other



1. INTRODUCTION

1.1 BACKGROUND

From 1983 to 2012, SINTEF and Exprosoft have documented results from several detailed

reliability studies of subsea blowout preventer (BOP) systems. The main subsea BOP reliability

publications are listed as references (/1/-/9/). In these studies, the reliability of subsea BOPs is

documented. A total of approximately 800 wells were reviewed with respect to BOP reliability.

All SINTEF’s property rights related to BOP studies were transferred to Exprosoft in April

2000. Continuity in this work is maintained through Exprosoft’s Per Holand, who was

responsible for this work at SINTEF through some 15 years.

The latest study that involved substantial collection of subsea BOP reliability and kick data was

performed on behalf of BSEE in the US and Eni in 2012, Reliability of Deepwater Subsea BOP

Systems and Well Kicks (/1/). Two studies (/2/ and /3/), concerning BOP reliability and well

kicks were performed on behalf of MMS (now BSEE) a bit earlier. The first one, Reliability of

Subsea Blowout Preventer Systems for Deepwater Applications--Phase II was completed in

1999. The second one Performance of Deepwater BOP Equipment During Well Control Events

was completed in 2001.

The three latest studies are public and have been widely used as references for nearly all other

studies involving subsea BOP reliability world-wide.

No detailed BOP reliability study has been carried out based on Norwegian wells since the

early 90’s, in spite of the fact that the subsea BOP is the most important safety barrier in floating

drilling.

Important parameters are;

• Rig downtime during drilling caused by BOP failures

• Time consumption during BOP testing

• The BOP must function always to be prepared to kill the well

1.2 PROJECT PARTICIPANTS

Exprosoft submitted a proposal for a new subsea BOP reliability project that should be based

on Norwegian activity to verify the reliability of current subsea BOPs. The proposal was

distributed in late winter 2018. The project was kicked off by the end of June 2018 with the

following participants:

• Equinor ASA

• Faroe Petroleum Norge as (now DNO North Sea)

• Aker BP ASA

• Lundin Norway AS

• Wellesley Petroleum AS

• VNG Norge AS (now Neptune Energy Norge AS)

https://www.bsee.gov/sites/bsee.gov/files/tap-technical-assessment-program/674aa.pdf







1.3 STUDY OBJECTIVE

The main objectives of this study are to:

• Document the subsea BOP reliability in the Norwegian sector as input for a continuous

improvement in the reliability of subsea BOPs

• Compare performance of current BOPs in terms of downtime caused by BOP failures

and BOP test time consumption for the various rigs, with previous reliability study

results

• Establish a quantified overview of the kick frequencies and the important parameters

contributing to the kick frequency in the various areas

• Verify the BOP’s ability to act as a barrier

• Document and analyse the BOP testing in terms of test time consumption and BOP

safety availability for various BOP layouts

• Identify more efficient ways of testing the BOP without reducing the BOP safety

availability

• Establish a guidance for deciding to pull and repair the BOP or continue operation

with a failed BOP component



2. DATA COLLECTION AND ANALYSES

2.1 DATA SOURCES

The main information source for the study has been the Petroleum Safety Authority Norway

(PSA) Daily Drilling Reporting System (DDRS). All operating companies drilling wells on the

Norwegian Continental Shelf shall submit a daily report to the authorities. This reporting

scheme has been in operation since 1984.

The following DDRS tables were requested.

1. Element drillReport

2. Element wellAlias and wellboreAlias

3. Element WellboreInfo

4. Element StatusInfo

5. Element fluid

6. Element PorePressure

7. Element SurveyStation

8. Element activity

9. Element EquipFailureInfo

10. Element ControlIncidentInfo

11. Element GasReadingInf

The key information is found in file 8. Element activity. This file includes a verbal description

of the activities performed and the starting and stopping times for the activity. The file

comprises approximately 127 000 lines of activity descriptions.

The data for the study is collected from wells drilled with a semisubmersible, spudded in the

period 2016-2017. Approximately 89% of the wells are included.

Information about BOP equipment and the rigs stems from the operators and public sources.

Information related to the wells, BOP failures, BOP test, and well kicks is extracted from the

DDRS files.

2.2 STATISTICAL ESTIMATION PROCEDURE AND ASSUMPTIONS

For data sets where no trend is observed, the number of failures during a specific time period

may be modelled by a homogeneous Poisson process, with failure rate (/3/). The failure rate

is estimated by

�̂� = 𝑁𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑓𝑎𝑖𝑙𝑢𝑟𝑒𝑠

𝐴𝑐𝑐𝑢𝑚𝑢𝑙𝑎𝑡𝑒𝑑 𝑜𝑝𝑒𝑟𝑎𝑡𝑖𝑛𝑔 𝑡𝑖𝑚𝑒=

𝑛

𝑠

The number of BOP days multiplied with the number of items is used as the accumulated

operating time or days in service for the BOP failures.



The uncertainty in the estimate, ̂, may be measured by a 90% confidence interval:

• If the number of failures n > 0, a 90% confidence interval is calculated by:

Lower limit: 𝜆𝐿 =1

2𝑠𝜒2

0.95,2𝑛

Upper limit: 𝜆𝐻 =1

2𝑠𝜒2

0.05,2(𝑛+1)

• If the number of failures n = 0, a 90% (single sided) confidence interval is calculated by:

Lower limit: 𝜆𝐿 = 0

Upper limit: 𝜆𝐻 = 1

2𝑠𝜒2

0.1,2

where ,𝑧 denotes the upper 100% percentile of the Chi-square distribution with z degrees of

freedom (/3/).

The meaning of the 90% confidence intervals is that the frequency is a member of the interval

with probability 90%, i.e., the probability that the frequency is lying outside the interval is 10%.

MTTF (Mean time to failure) is the inverse value of the failure rate, , i.e.:

𝑀𝑇𝑇𝐹 = 1

𝜆

The uncertainty in the MTTF may also be measured by a 90% confidence interval, and can be

expressed by H and L:

Lower limit: 𝑀𝑇𝑇𝐹𝐿 = 1

𝜆𝐻

Upper limit: 𝑀𝑇𝑇𝐹𝐻 = 1

𝜆𝐿

Example:

Assume that we want to find the failure rate and the MTTF of the annular preventers in a

specific BOP stack.

The BOP stack has been in service for 1000 BOP days, and the stack has two annular preventers.

A total of four failures have been observed during the time in operation. The accumulated

operating time then becomes 1000 BOP days x 2 annular preventers = 2000 days in service. The

estimated failure rate is

�̂� = 𝑁𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑓𝑎𝑖𝑙𝑢𝑟𝑒𝑠

𝐴𝑐𝑐𝑢𝑚𝑢𝑙𝑎𝑡𝑒𝑑 𝑜𝑝𝑒𝑟𝑎𝑡𝑖𝑛𝑔 𝑡𝑖𝑚𝑒=

𝑛

𝑠=

4

1000 × 2

= 0.002 𝑓𝑎𝑖𝑙𝑢𝑟𝑒𝑠 𝑝𝑒𝑟 𝑑𝑎𝑦 𝑖𝑛 𝑠𝑒𝑟𝑣𝑖𝑐𝑒

The corresponding estimated MTTF is

𝑀𝑇𝑇𝐹 = 1

𝜆 =

1

0.002 = 500 𝑑𝑎𝑦𝑠 𝑖𝑛 𝑠𝑒𝑟𝑣𝑖𝑐𝑒



3. SUBSEA BOPS

The wells forming the basis for the present study were drilled with floating rigs and spudded

in the Norwegian Continental Shelf (NCS) during the period January 1st, 2016 to January 1st,

2018.

3.1 SYSTEM DESCRIPTION AND BOUNDARY CONDITIONS

Figure 3.1 shows typical BOP configurations for drilling in Norwegian waters. Notice that these

are illustrative sketches of BOPs, because the actual configuration may vary from rig to rig.

The BOP equipment considered in the present study are:

1. Wellhead and LMRP connectors

2. Ram preventers

3. Annular preventers

4. Flexible joint

5. Choke and kill lines and valves

6. Main control system

7. Acoustic back-up control system

The drilling riser, except the choke and kill lines, is not a part of the present study.



Figure 3.1 Typical BOP configurations

Table 3.1 shows an overview of the BOP configuration of rigs that are included in the study.

The BOP stacks were all 18 ¾” and rated for a pressure of either 15 000 or 10 000 psi. All the

drilling vessels were semisubmersible rigs.

Example one

Wellhead connector

Blind Shear ram

Jumper hose line

Riser

Flexible joint

Upper annular preventer

Lower annular preventer

BOP attached line

Lower pipe ram

Middle pipe ram

LMRP connector

Upper pipe ram

Casing shear ram

Riser attached line

Lower kill valves

Upper kill valves

Lower choke valves

Upper choke valves

Bleed off valves

Lower choke valves

Upper choke valves

Lower kill valves

Upper kill valves

Annular preventer

Example two



Table 3.1 BOP configuration of various rigs

Rig name BOP days in service

BOP make Pressure

rating (psi)

Control system principle

No of choke kill

valves

No. of annulars

No. of ram preventers

BSR CSR Pipe ram

Total

Rig A 211 Hydril 10 000 Pilot hydraulic 6 2 1 3 4

Rig B 272 Cameron 10 000 Pilot hydraulic 10 1 1 1 3 5

Rig C 362 NL Shaffer 15 000 Pilot hydraulic 6 2 1 3 4

Rig D 255 Cameron 10 000 Pilot hydraulic 6 2 1 3 4

Rig E 277 NL Shaffer 15 000 Multiplex 10 2 1 1 4 6

Rig F 267 Cameron 15 000 Multiplex 8 2 1 1 3 5

Rig G 496 NL Shaffer 15 000 Pilot hydraulic 10 1 1 1 3 5

Rig H 331 Cameron 10 000 Pilot hydraulic 10 1 1 1 3 5

Rig I 425 Cameron 15 000 Multiplex 10 2 1 1 3 5

Rig J 495 Cameron 15 000 Pilot hydraulic 8 1 1 3 4

Rig K 409 Cameron 15 000 Pilot hydraulic 6 2 1 3 4

Rig L 470 Cameron 10 000 Pilot hydraulic 10 1 1 1 3 5

Rig M 164 NL Shaffer 15 000 Pilot hydraulic 6 2 1 3 4

Rig N 270 Cameron 15 000 Multiplex 8 2 1 1 3 5

Rig O 508 Cameron 10 000 Pilot hydraulic 10 1 1 1 3 5

Total 5 212

Average 8,27 1,60 1 0,60 3,07 4,67

For the BOPs in the present study, the ram and annular preventers come from the same

manufacturer. A BOP stack can, however, have components from different manufacturers. As

seen from Table 3.1 the three major BOP manufacturers are represented in the study. Four

percent of BOP days in service stems from Hydril BOPs, 71% from Cameron, and 25% from

NL Shaffer.

There are two main principles of BOP control systems, pilot hydraulic or multiplex systems.

76% of the BOP days in service stems from pilot hydraulic systems, and the remaining 24%

from multiplex system. The main difference between these two systems is that in pilot systems

the BOP functions are activated by a hydraulic signal from the rig (pilot signal), whereas the

multiplex systems are activated by electronic/electronic signals that are sent to the BOP and

transformed to a pilot signal there. The multiplex system reduces the BOP closing time. To be

able to meet the closing time requirements, multiplex systems are normally needed in

deepwater drilling. For shallow water drilling, both the systems may be used. Most of the

drilling in Norwegian waters are shallow water drilling.

Six of the 15 rigs had only one annular preventer. All rigs had one blind shear ram (BSR)

preventer, and nine had a casing shear ram (CSR) in addition. All rigs, except one, had three

pipe rams, the last one had four.

The number of choke & kill valves varies between six and 10 for the various BOPs.

3.2 RELEVANT DEFINITIONS

• BOP days is defined as the number of days the BOP is located on the wellhead/X-mas

tree until it is pulled.

• Item days for a specific BOP item is the number of BOP days multiplied with the

number of items in the BOP stack.



• BOP failure is an event when any component of the BOP system mentioned in Section

3.1 is not able to perform its intended function. The criticality of a BOP failure depends

on the activity when the failure occurred and the severity of the failure.

• BOP downtime is the lost time in hours due to BOP failure

3.3 OPERATORS AND WELLS

Table 3.2 shows the operators represented with drilling in the present study. A total of 130

mother wells or 182 well paths (when sidetracks and multilaterals are counted as separate wells)

are included. A total of 5 212 BOP days is included.

It is also observed that far more development drilling is carried out than exploration drilling.

Table 3.2 Operators vs. well types and BOP days

Operator

Development wells Exploration wells Total

No. of well paths

No. of mother

wells

No. of BOP days

No. of well paths

No. of mother

wells

No. of BOP days

No. of well paths

No. of mother

wells

No. of BOP days

Operator A 4 2 99 4 2 99

Operator B 1 1 18 1 1 18

Operator C 7 7 157 3 3 113 10 10 270

Operator D 7 7 277 1 1 41 8 8 318

Operator E 18 7 451 2 2 40 20 9 491

Operator F 11 8 425 11 8 425

Operator G 105 74 3 045 21 16 449 126 90 3 494

Operator H 1 1 84 1 1 84

Operator I 1 1 13 1 1 13

Total 137 95 3 930 45 35 1 282 182 130 5 212

3.4 RIGS AND WATER DEPTHS EVALUATED

Table 3.3 shows rigs and their time in service (BOP days) for various water depths.



Table 3.3 Rigs and Water Depths

Rig name Water depth grouped (m)

< 200 200 - 300 300 - 400 400 - 500 1200 - 1300 Total

Rig A 154

57

211

Rig B

19 225 28

272

Rig C 58 56 248

362

Rig D

195 60

255

Rig E

277

277

Rig F

84 183 267

Rig G

496

496

Rig H

75 256

331

Rig I

310 115

425

Rig J 495

495

Rig K 368

41

409

Rig L

470

470

Rig M 164

164

Rig N

179 91

270

Rig O

508

508

Total 1239 345 3 086 359 183 5 212

Most of the drilling is carried out in water depths less than 500 m. The well drilled in the deepest

water depth is at 1273 m (Aasta Hansten field).

3.5 MAIN OPERATION AND WELL TYPE

Table 3.4 shows the time in service (BOP days) for the various main activities vs. well types.

Table 3.4 Time in service for the various main activities

Main operation BOP days in service

Development Exploration Total

Completion 759,4 61,7 821,0

Drilling 2 232,7 716,2 2 948,8

Formation evaluation 32,3 216,9 249,2

Interruption 813,7 122,1 935,8

Moving 10,3 1,5 11,8

Plug abandon 45,1 171,5 216,6

Workover 28,7 0,0 28,7

Total 3 922,1 1 289,9 5 212,0



4. OVERVIEW OF BOP FAILURES

A total of 94 BOP failures are identified during the present study during a total time in service

of 5 212 BOP days. An overview of key reliability parameters is provided in Table 4.1.

Table 4.1 Overview of failures

BOP Subsystem BOP days in service

Item days in service

No of failures

Total lost time (hrs)

MTTF (Item

days in service)

MTTF (BOP days)

Avg. downtime per failure

(hrs)

Avg. downtime

per BOP day (hrs)

Flexible joint 5 212 5 212 0 Annular preventer 5 212 7 852 15 25 523 347 1,7 0,005

Ram preventers 5 212 24 441 6 128 4 074 869 21,3 0,024

Connectors 5 212 10 424 3 26 3 475 1 737 8,6 0,005

Choke kill valves 5 212 44 452 3 31 14 817 1 737 10,4 0,006

Choke and kill lines 5 212 5 212 19 538 274 274 28,3 0,103

Main Control systems 5 212 5 212 38 407 137 137 10,7 0,078

Acoustic control system 5 212 5 212 10 150 521 521 15,0 0,029

Total 5 212 94 1 305 55 13,9 0,250

Thirty-eight of the 94 failures, or 40%, are attributed to components in the main BOP control

system that operates the various BOP functions. Nineteen failures are observed in the choke

and kill lines that caused 40% of the total BOP downtime

The total downtime caused by BOP failures is 1305 hours (54 days). This corresponds to

approximately 1,05% of the total time in service for the BOP.

Table 4.2 shows that 81 failures with a total of 1115 hours of downtime occurred when the

BOP was on the wellhead. Twenty-five of these failures did not cause any downtime Such

failures represent instances where failures are accepted due to low criticality or that the BOP is

pulled due to another failure.

Table 4.2 Breakdown of failures based on BOP location

BOP location No. of

failures Total lost

time Percentage of total failure

No. of failure with no associated downtime

BOP is on the wellhead 81 1115 86% 25

While running/pulling BOP 12 189 13% 0

On rig, ready to run 1 1 1% 0

Total 94 1305 100% 25

The downtime caused by a single BOP failure varied between 0 and 125 hours.

Figure 4.1 shows the failure rates for the BOP subsystems. Although the main control systems

have the highest failure rate, the choke and kill lines, annular preventers, and the acoustic back-

up system are also represented with many failures.



Figure 4.1 BOP subsystem failure rate

The BOP subsystem downtime per BOP day is presented in Figure 4.2. The choke and kill lines

are the largest contributor to downtime, then the main control system.

Figure 4.2 Average downtime per BOP day



4.1 COMPARISON WITH THE PREVIOUS SUBSEA BOP RELIABILITY STUDIES

SINTEF and Exprosoft have carried out subsea BOP reliability studies since the early 80-ties.

Until the beginning of the 90s these were studies in Norwegian waters. After that, it has been

performed studies in Brazilian waters and the US GoM OCS. The Norwegian studies were

mainly in shallow waters, whereas the Brazilian and US GoM OCS studies were mainly in

deepwater (DW).

Table 4.3 compares some key results from the previous subsea BOP reliability studies with key

results from the present study.

Table 4.3 Comparison of key figures, subsea BOP reliability studies 1980 – 2018

Study BOP days

Total Lost Time (hrs)

No. of fail-ures

MTTF (BOP days)

Avg. down-time per

failure (hrs)

Avg. down-time per BOP

day (hrs) Years drilled and country

Phase II (/9/) 8 115 8 780 503 16,1 17,5 1,08 1979-1982, Norway

Phase IV (/7/) 3 809 2 735 139 27,4 19,7 0,72 1982-1986, Norway

Phase V (/6/) 2 636 2 142 74 35,6 29,0 0,81 1987-1989, Norway

DW I (/4/) 4 846 4 950 202 24,0 24,5 1,02 1992-1996, Brazil and Norway

DW II (/2/) 4 009 3 638 117 34,3 31,1 0,91 1997-1999, US GoM OCS

DW and kick (/1/) 15 056 13 448 156 96,5 86,2 0,89 2007-2009, US GoM OCS

Present study 5 212 1 305 94 55 13,9 0,250 2016-2018, Norway

TOTAL 43 683 36 998 1 285 34 28,8 0,706

Table 4.3 shows that in total 43 683 BOP days, or 120 years of drilling activity with the BOP

on the wellhead is represented in these studies. In total, 36 998 hours (i.e., 1540 days) have

been used for repairing these failures.

The MTTF in the present study has improved when comparing with the previous studies, except

for the DW and kick (/1/) study. The average downtime per BOP day is much lower than in all

the previous studies. It is important to observe that the main source of information for the DW

and kick study was the BSEE well activity reports (WARs), which is a weekly reporting system,

while for the all other studies it was the daily drilling reports. It can be assumed that many less

critical failures are not described in the WARs. These less critical failures typically produce

little downtime.

Figure 4.3 compares the BOP subsystem specific failure rates in the present study with the total

data from all the other BOP studies.

It may be observed that the failure rate is lower for all the subsystems in the present study

compared to total result from the previous studies previous studies.



Figure 4.3 Comparison of BOP item specific failure rate with previous studies

When comparing the average downtime per BOP day for the present study and all the previous

studies (Figure 4.4), it is observed that the downtime is far lower in the present study than in

the previous studies. It should be noted that most of the wells drilled in the 90ties and early

2000 were deepwater wells. Deeper water increases the repair time for the individual failures

because of the time needed to pull and run the BOP.

It seems that the reliability of the BOPs in general have improved compared with the previous

studies.

Figure 4.4 Comparison of BOP item specific downtime



4.2 ANNUAL TRENDS IN FAILURE RATES AND DOWNTIME

By combining the data from the present study and the data from the previous BOP studies

carried out by SINTEF and Exprosoft, an annual BOP failure rate since 1978 has been

established. In Table 4.4 the data for each of the years is listed.

Table 4.4 Annual overview of BOP data

Year BOP days Total Lost Time (hrs)

No. of failures

MTTF (BOP days)

Avg. downtime per failure (hrs.)

Avg. downtime per BOP day (hrs.)

Before1978 162 26 4 40,5 6,5 0,16

1978 322 123,5 23 14 5,37 0,38

1979 528 637,7 45 11,7 14,17 1,21

1980 919 778 53 17,3 14,68 0,85

1981 1935 2298 129 15 17,81 1,19

1982 2346 2858 145 16,2 19,71 1,22

1983 1973 2146,7 115 17,2 18,67 1,09

1984 1338 1251 54 24,8 23,17 0,93

1985 1432 803 40 35,8 20,08 0,56

1986 969 592,8 34 28,5 17,44 0,61

1987 1165 1073 38 30,7 28,24 0,92

1988 1029 436,5 20 51,5 21,83 0,42

1989 442 632,5 16 27,6 39,53 1,43

1990 -1991 No data

1992 962 1759 63 15,3 27,92 1,83

1993 1411 1293 48 29,4 26,94 0,92

1994 762 752 23 33,1 32,7 0,99

1995 801 154,5 13 61,6 11,88 0,19

1996 873 991 55 15,9 18,02 1,14

1997 1972 2529,75 61 32,3 41,47 1,28

1998 2074 1107,5 56 37 19,78 0,53

1999 - 2006 No data

2007 4923 4546 53 92,9 85,77 0,92

2008 6253 4574,5 60 104,2 76,24 0,73

2009 3162 4178 38 83,2 109,95 1,32

2010 718 149,5 5 143,6 29,90 0,21

2011 - 2015 No data

2016 2 169 558,5 41 52,9 13,62 0,26

2017 2 639 633,9 47 56,1 13,49 0,24

2018 404 112,5 6 67,3 18,75 0,28

Total 43 683 36 996,3 1285 33,99 28,79 0,85

The data in Table 4.4 has been used to create Figure 4.5. Figure 4.5 shows the annual failure

rates, alongside 90% confidence intervals, and linear and log linear trend lines for subsea BOP

stacks. Table 4.3 shows from which studies and from where the data stem. It has been decided

to disregard the data from 1978 because this year has few data. Further, observe that no data is

available from the years 1990, 1991, 1999-2006, and 2011-2015. After the Deepwater Horizon

accident in 2010 the industry started to focus more on BOP reliability. This have likely caused

an improvement in BOP reliability.



Figure 4.5 Annual failure rates, 90% confidence intervals, linear and log linear trend

lines for subsea BOP stacks for the period 1979 – 2018

The confidence bands for the years 2007-2009 are very narrow because the BOP service time

was substantially higher in this period. It is important to notice that the graph is based on the

average failure rate for each year. The total amount of experience within each year is thereby

not considered. However, the plotted data in Figure 4.5 indicates that the failure rate has been

significantly reduced over the years.

In Figure 4.6, the average downtime per year and the associated trend lines for the average

downtime per day in service are shown.



Figure 4.6 Average downtime per BOP day and associated trend lines for the period

1979 – 2009

As seen from Figure 4.6, a slight reduction in the downtime per day in service is indicated by

the trend lines. Most data from 1992 until 2010 come from deepwater wells. The BOP handling

times increase with the water depth.

4.3 INFLUENCES BY SEASON AND FIELD CONDITIONS

Water Depth

Table 4.5 shows an overview of the BOP reliability for various water depths. There is no clear

trend related to water depth and BOP reliability based on this table, even though the MTTF is

lowest and the downtime is highest for the 1200-1300 meters water depth range. There are,

however, few BOP days for this water depth range.

Table 4.5 Overview of BOP reliability for various water depths (Norwegian waters

2016-2018)

Water depth (m)

No. of BOP days Total lost time

(hrs) No of

failures MTTF (days)

Downtime per BOP day (hrs)

<200 1 239 279,92 23 53,9 0,226

200 - 300 345 1,5 8 43,1 0,004

300 - 400 3 086 874,7 49 63,0 0,283

400 - 500 359 39 9 39,9 0,109

1200 - 1300 183 109,75 5 36,6 0,600

Total 5 212 1 304,87 94 55,4 0,250

0

0,2

0,4

0,6

0,8

1

1,2

1,4

1,6

1,8

2A

vg.

do

wn

tim

e p

er

BO

P-d

ay (

hrs

)

Years

Avg. downtime per BOP day (hrs)

Linear (Avg. downtime per BOP day (hrs))



Seasonal Variation

Winter is defined to be from October 1st to March 31st. The remaining period is defined as

summer. Table 4.6 shows that 49 of the 94 failures were observed during winter and 45 during

summer.

Table 4.6 Overview of BOP reliability for winter and summer (Norwegian waters 2016-

2018)

Season No. of BOP days Total lost time

(hrs) No of failures MTTF (days)


Summer 2 761 653,1 45 61,4 0,237

Winter 2 451 651,8 49 50,0 0,266

Total 5 212 1 304,9 94 55,4 0,250

The influence of the winter and summer on the BOP reliability is limited. The slightly increased

failure rate and average downtime per BOP day can probably be explained by the rougher

weather. For four of the BOP failures that occurred during winter time, they had to wait on

weather (WOW) before they could run or land the BOP. Total BOP repair related WOW time

during winter was 86,5 hours, and 6,5 hours during summer.

Rough weather is also likely to increase the failure probability associated to rougher BOP

running conditions. Especially, the choke and kill lines, and parts of the control systems will

be exposed.

Area Variation

Table 4.7 shows an overview of the BOP reliability results for the various areas in the

Norwegian waters.

Table 4.7 Overview of BOP reliability for various areas in the Norwegian waters

Area No. of BOP days Total lost time

(hrs) No of failures MTTF (days)


Barents Sea 1 074 578 33 32,5 0,538

North Sea 2 999 424,9 46 65,2 0,142

Norwegian Sea 1 139 301,9 15 75,9 0,265

Total 5 212 1304,8 94 55,4 0,250

Both the failure rates and the average downtime per BOP day in service is much higher in the

Barents Sea than in the other areas. When investigating the cause for this high failure rate and

the high downtime, it was found to be caused by one rig with several problems related to choke

and kill lines and control system.

4.4 RIG SPECIFIC PERFORMANCE

The 15 rigs included in the present study show a highly varying failure rate and downtime per

BOP day in service, as illustrated in Figure 4.7. The left and right vertical axes represent



downtime and failure rate per BOP days, respectively, for each rig. The confidence bands for

the failure rates are also shown.

There is one rig without any failure, Rig M. This rig also has the lowest number of BOP days

in service.

Rig I has the highest failure rate and the highest downtime per day in service. This rig had

several problems with leaking choke and kill lines and control system failures.

Rig D has a high failure rate, but a very low rig downtime. They had several incidents where

the annular failed to fully open, and some control system failures that did not cause any

downtime.

The downtime is highly influenced by relatively few failures of long duration. The 10 failures

with the longest duration caused 59% of the total downtime.

Figure 4.7 Rig specific performance for downtime and failure rate per BOP day with

90% confidence interval



5. BOP SYSTEM SPECIFIC RELIABILITY

5.1 FLEXIBLE JOINT

Today, all rigs have a flexible joint with a flexible element. The use of ball joint as a flexible

joint is obsolete.

Table 5.1 shows an overview of flex joint manufacturers included in the study.

Table 5.1 Flex joint manufacturers and BOP days in service

Manufacturer BOP days in service

Oil states 2 606

Parker Cameron 1 581

Unknown 814

Vetco 211

Total 5 212

No failures were observed in the flexible joint in the present study. Modern flexible joints are

generally very reliable as indicated by no failures in the present study and very few failures in

earlier studies.

Historic Overview, Flex Joint Failures

Table 5.2 shows some key information related to flexible joint failures observed in the previous

subsea BOP reliability studies.



Table 5.2 Historic overview, flex joint failures

Study BOP days No of flex

joint failures

Lost time (hrs)

Comments Years drilled and

country

Phase II (/9/)

8 115 11 775 Most failures were related to ball joint type flexible joints (rarely in use anymore). Twice a joint parted. Many leaks

1979-1982, Norway

Phase IV (/7/)

3 809 2 111 Flexible type joint. Both was pulled and repaired due to wear

1982-1986, Norway

Phase V (/6/)

2 636 0 1987-1989, Norway

DW I (/4/) 4 846 1 50 The flex joint was twisted, and had to be replaced

1992-1996, Brazil and Norway

DW II (/2/)

4 009 1 248,5 This failure was in a ball joint type. The failure was an external leakage, most probably, a welding error. Lost mud and well kicked

1997-1999, US GoM OCS

DW and kick (/1/)

15 056 1 288 Failure of a threaded plug in test port 2007-2009, US GoM OCS

Present study

5 212 0 2016-2018, Norway

TOTAL 43 683 16 1 473

5.2 ANNULAR PREVENTER RELIABILITY

Six of the 15 rigs included in the study were equipped with one annular, while nine rigs were

equipped with two (Table 3.1, page 25). Table 5.3 shows the annular preventer manufacturer,

model, pressure rate, and service times included in the study.

Table 5.3 Annular preventer manufacturer, model, pressure rate and service times

Manufacturer Model Pressure rate

(psi) BOP item days in

service

Cameron

D 10 000 1 390

DL 10 000 3 428

Total 4 818

Hydril GX

5 000 211

10 000 211

Total 422

NL Shaffer

Spherical 5 000 164

10 000 164

Unknown 10 000 554

Wedge cover 5 000 510

10 000 1 220

Total 2 612

Total 7 852

Table 5.4 shows the failure mode distribution and associated lost time for annular preventer

failures. A total of 24 annular preventer failures occurred. The failed to fully open and internal

leakage (leakage through a closed annular) are the dominant failure modes.



Table 5.4 Annular Preventer failure modes and associated number of failures

Failure mode description No. of

failures Total lost time (hrs)

BOP days in service

Item days in Service

MTTF (Item days in service)

Avg. down-time per

failure (hrs)

Avg. downtime per BOP day

(hrs)

Failed to fully open 12 8,75

5 212 7 852

654 0,73 0,001679

Internal leakage (leakage through a closed annular)

2 2 3 926 1 0,000384

Internal hydraulic leakage (control fluid part)

1 14 7 852 14 0,002686

Total 15 24,75 523 1,65 0,004749

Failed to Fully Open

The failed to fully open annular preventers have been observed in all BOP studies. In the present

study, these failures were observed on six different BOPs. For one of the BOPs this occurred

several times, for the others one or twice.

Below, a brief description of Failed to fully open failures are given:

1. POOH with BOP test tool. Worked through LAP/UAP with max 5-ton

2. L/D single to deck and installed landing stand. Struggled to pass LAP

3. Pulled SLT (Spring Loaded Tool) to surface. Worked with SLT to max 7-tons through

annulars.

4. Pulled BOP test tool and bullnose to surface. Observed max 5-tons overpull in LAP/UAP.

5. Pulled SLT, worked through annulars - max 6-tons, racked back

6. POOH w/ LIT (Lead Impression Tool). Stopped in lower annular. Rotated, but, no-go.

Increased overpull in steps to 28-tons and passed lower annular slowly.

7. Experienced 12-tons overpull when attempting to POOH. Waited for element to retract.

8. Attempted to pull out of hole with 9 5/8 tie back casing. Took 5-tons overpull when pulling

seal assembly through LAP. Increased overpull in steps to max 65-tons overpull without

any progress. Verified string free down each time. Continued to work string. Came up 4 m

when pulling string up with 27-tons overpull.

9. Observed taking weight with seal assembly in UAP. Work string with max 62-tons

overpull. With 45 overpull came free (same problem in LAP)

10. Took 2-3-ton in annular but pulled through.

11. Caught up in LAP on the way out with tool. Attempted to pass 3 times, no go. Performed

20 t overpull. Re-landed test tool and closed LAP and opener again to remove potential

ovality. Still unable to pass LAP. Took 8-tons over pull and closed UAP to centralize string

in BOP, tool slid through when opening UAP.

12. RIH (Run in Hole) with MPT (Multi Purpose Tool) w 10 ¾ seal assembly and worked same

through both upper and lower annulars with up to 8-tons weight and 5-tons overpulls.

Landed off MPT in 10 ¾ casing hanger and set down 10-tons weight.



Internal leakage

Internal leakage (leakage through a closed annular) were observed twice. For both incidents,

the closing pressure of the annular preventer was increased. For one of them, the annular still

leaked. For the other, they continued with the operation.

13. During squeeze pressure dropped from 24 to 15 bar, an increase in trip tank was observed

indicating annular leaking. Increased closing pressure on annular. Continued squeeze

operation.

14. Pressure tested UAP to 30 bar/5 min, no leaks. Attempted to pressure test UAP to 241 bar,

observed leak. Increased closing pressure to 1500 psi and observed a better trend but leak

still above acceptance criteria.

Internal Hydraulic Leakage

Internal hydraulic leakage was observed once.

15. During a BOP test they observed leakage of BOP fluid at approx. 600 litres/hour while

applied open function on upper annular preventer (UAP). The failure was repaired one week

later when the BOP was pulled prior to run the X-mas tree. When opened the UAP it was

observed some metal swarf/junk stuck between annular piston and housing. Removed

piston, adaptor ring and packing element from UAP and replaced all with new parts.

Historic Overview, Annular Preventer Failures

Table 5.5 shows some key information related to annular preventer failures observed in the

previous subsea BOP reliability studies.



Table 5.5 Historic overview, annular preventer failures

Study BOP days No. of annular

preventer failures


Comments Years drilled and

country

Phase II (/9/)

8 115 52 458,0 Failure modes; Internal leak 17%, fail to close 4%, internal hydraulic leakage (control fluid part) 10%, failed to fully open 62%, other/unknown 7%

1979-1982, Norway

Phase IV (/7/)

3 809 35 111,0 Failure modes; Internal leak 3%, failed to fully open 90%, other/unknown 7%

1982-1986, Norway

Phase V (/6/)

2 636 8 534,5 Failure modes; Internal hydraulic leakage (control fluid part) 13%, failed to fully open 87%,

1987-1989, Norway

DW I (/4/) 4 846 20 146,0 Failure modes; Internal leak 55%, failed to fully open 40%, other/unknown 5%


DW II (/2/)

4 009 12 336,5

Failure modes; Internal leak 50%, failed to fully open 50%

1997-1999, US GoM OCS

DW and kick (/1/)

15 056 24 2344,5 Failure modes; Internal leak 46%, fail to close 4%, internal hydraulic leakage (control fluid part) 8%, failed to fully open 33%, other/unknown 8%

2007-2009, US GoM OCS

Present study

5 212 15 24,8 Failure modes; Internal leak 13%, internal hydraulic leakage (control fluid part) 7%, failed to fully open 80%

2016-2018, Norway

TOTAL 43 683 166 3 955,3

5.3 HYDRAULIC CONNECTOR RELIABILITY

All subsea BOPs are equipped with two hydraulic connectors. The wellhead connector connects

the BOP stack to the wellhead. The Lower Marine Riser Package (LMRP) connector connects

the riser to the BOP stack. These connectors are in principle identical, but usually the wellhead

connector is rated to a higher pressure. Typically, the wellhead connectors are rated to the same

pressure as the ram preventers, and the LMRP connectors are rated to the same pressure as the

annular preventers.

Table 5.6 shows an overview of the connector manufacturer included in the study and the

associated operational time.



Table 5.6 Hydraulic connector manufacturer, model, pressure rate and service times

Manufacturer Model Sum of Item-days in service

Pressure rate 10 000 psi Pressure rate 15 000 psi Total

Cameron

C-PRO HDH4 267 267

EVO 495 495

HC-Collet 495 425 920

HCH4 1 581 1 581

M70- Collet 2 620 2 620

Unknown 537 537

Total 5 233 1 187 6 420

Drill-Quip DX-DW 277 277

Total 277 277

Vetco

H4 255 211 466

H4 EXF 935 935

H4 HD (Heavy Duty) 695 695

Unknown 496 496 992

H4 HAR (High Angle Release) 362 362

Total 1 113 2 337 3 450

Unknown Unknown 277 277

Total 277 277

Total 6 623 3 801 10 424

Three hydraulic connector failures occurred in the present study resulting in a total lost time of

25,75 hours. The failure modes for the hydraulic connector failures are shown in Table 5.7.

Table 5.7 Hydraulic connector failure modes and associated number of failures

Failure mode description No. of


BOP days in service



Avg. down-time per

failure (hrs)


External leakage (leakage to environment)

1 22,5

5 212 10 424

10 424 22,5 0,004317

Failed to lock 1 0,25 10 424 0,25 0,000048

Spurious opening 1 3 10 424 3 0,000576

Total 3 25,75 3 475 9 0,004941

External Leakage

An external leak during normal operation in a wellhead connector is one of the most critical

failure modes in terms of controlling a well kick. This failure was, however, observed on the

BOP installation test so the well was not at risk. Such failures have been observed during

normal operation, but they are rare. After the wellhead and LMRP connector have been high-

pressure tested and accepted after installation, they rarely develop a leak during operation.

1. In this case, they attempted to perform a high-pressure installation test on the wellhead

connector to 128 bar that failed. During the failure investigation during a low-pressure test

to 20 bar it was observed dye at wellhead connector indicating a leak. Functioned wellhead

connector to unlatch and pulled BOP 2 m clear of the wellhead. Observed piece of rubber

hydrate seal compressed onto the VX ring gasket. An ROV removed the VX ring gasket

from the wellhead and removed additional pieces of rubber hydrate seal from within the

fingers of the BOP connector before reconnection and retesting.



Spurious opening

2. The LMRP had just been re-connected after WOW. Observed a sudden disconnect of

LMRP. It was noted that the secondary unlatch sequence was not vented. Moved the rig off

the template. Replaced the VX gasket w/ ROV and landed the LMRP on BOP. Locked

LMRP connector and performed a 50-ton overpull test.

During a drilling operation spurious disconnects of the LMRP connector may lead to severe

well control problems. Nowadays, most BOPs have an automatic function to close the blind

shear ram if this occurs (auto-shear function). Blowouts have resulted of such incidents when

drilling in deepwater without a riser margin, and with no auto-shear function. In all cases

drilling mud will be lost to the sea and cause pollution.

Failed to lock

3. They had checked the guidewires and wellhead connector prior to landing. Landed the BOP

and sat down 30-tons. Closed the wellhead connector and verified flag. When attempting

to take 50-tons overpull it was observed that the BOP moved up. Pulled up 1 meter and

checked wellhead and VX ring. Opened wellhead connector. Landed BOP again. Sat down

30-tons. Checked tombstone by ROV owl. All OK. Closed wellhead connector and took

50-tons overpull test.

Historic Overview, Hydraulic Connector Failures

Table 5.8 shows some key information related to hydraulic connector failures observed in the




Table 5.8 Historic overview, hydraulic connector failures

Study BOP days No. of

connector failures


Comments Years drilled and country

Phase II (/9/)

8 115 41 785,0 Failure modes; External leak 66% (majority related to installation), failed to unlock 7%, failed to lock 10%, other/unknown 15%

1979-1982, Norway

Phase IV (/7/)

3 809 11 100,5 Failure modes; External leak 36% (majority related to installation), failed to unlock 36%, failed to lock 18%, other/unknown 10%

1982-1986, Norway

Phase V (/6/)

2 636 6 111,5 Failure modes; External leak on installation test 50%, external leak during operation 17%, failed to unlock 17%, other/unknown 17%

1987-1989, Norway

DW I (/4/)

4 846 23 784,0 Failure modes; External leak on installation test 52%, external leak during operation 4%, failed to unlock 30%, other/unknown 4%


DW II (/2/)

4 009 4 40,5 Failure modes; External leak on installation test 25%, failed to unlock 75%

1997-1999, US GoM OCS

DW and kick (/1/)

15 056 8 638,0

Failure modes; External leak on installation test 25%, external leak during operation 13%, failed to unlock 13%, failed to lock 13%, spurious opening 13%, other/unknown 25%

2007-2009, US GoM OCS

Present study

5 212 3 25,8 Failure modes; External leak on installation test 33%, failed to lock 33%, spurious opening 33%

2016-2018, Norway

TOTAL 43 683 96 2 485,3

5.4 RAM PREVENTER RELIABILITY

The BOPs included in the present study have from four to six ram preventers. The configuration

of the rams is presented in Table 3.1, page 25.

Table 5.9 shows an overview of the ram preventer manufacturer included in the study and the

associated operational time.



Table 5.9 Overview of the manufacturers included and the associated operational time

Manu-facturer

Model Blind-shear ram Casing shear ram Pipe ram (fixed or variable) Total

10 000 psi 15 000 psi 10 000 psi 15 000 psi 10 000 psi 15 000 psi

Cameron

Compact Dual 425 425 850

Compact Triple 1 275 1 275

EVO 270 270 1 581 270 2 391

EVO Double 1 581 495 1 581 3 162 2 025 8 844

T 267 267

T double 267 267 534 1 068

U-II double 255 409 765 1 227 2 656

Total 1 836 1 866 1 581 962 5 508 5 598 17 351

Hydril Double/Dual 211 633 844

Total 211 633 844

NL Shaffer

NXT 277 277

NXT Double 496 773 277 1 546

NXT Triple 2 319 2 319

SLX double 526 1 578 2 104

Total 1 299 773 4 174 6 246

Total 2 047 3 165 1 581 1 735 6 141 9 772 24 441

Table 5.10 shows an overview of ram preventer reliability. Three of the failures were observed

in blind shear rams (BSR), two in pipe rams, and one in a casing shear ram preventer.

Table 5.10 Ram preventer failure modes and associated number of failures

Failure mode No. of


BOP days in service



Avg. down-time per

failure (hrs)


Failed to close 2 75,25

5 212 24 441

12 221 37,6 0,0144

Internal leakage (through a closed ram)

2 35,37 12 221 17,7 0,0068

Other 1 1,5 24 441 1,5 0,0030

Failed to fully open 1 15,5 24 441 15,5 0,0003

Total 6 127,62 4 074 21,3 0,0245

A brief description of observed failure mode is provided below:

Failed to Close

Two failures occurred with this failure mode, one in a casing shear ram and one in a blind shear

ram. Both failures were observed during installation testing.

1. During installation testing the BOP casing shear ram closing function system was leaking

on a flange. The BOP was pulled and the O-ring on casing shear ram high-pressure closing

system was changed. The BOP was then ran, landed, and tested. They used 39 hours from

observing the failure until the BOP was re-landed and tested.

2. During installation testing the BOP blind shear ram failed to close. Investigated with an

ROV and found the hydraulic hose not connected to the manifold. Pulled the BOP.

Connected the blue and yellow supply hoses on the blind shear ram and function tested.

Ran the BOP on the riser. Pressure tested the connector/casing/shear ram to 100 bar. It may

seem that this failure was introduced during BOP maintenance. It seems likely that the blind



shear ram was not function tested before the BOP was ran. They used 37 hours from

observing the failure until the BOP was re-landed and tested.

Internal Leakage (leakage through a closed ram)

Two failures occurred with this failure mode, one in a blind shear ram and one in a pipe ram.

Both failures were observed during installation testing.

3. This failure occurred during installation testing of the BOP. When testing the connector,

the BSR leaked. Pulled the BOP and replaced the seals on BSR. Pressure tested the BSR to

690 bar on the rig. Ran the BOP and tested connector. They used 33 hours from observing

the failure until the BOP was re-landed and tested.

4. Attempted to pressure test against UPR (Upper Pipe Ram) that leaked. Investigated leakage.

UPR did not pass final pressure test. The failure did not cause the BOP to be pulled.

Probably repaired when the BOP was on the rig the next time 13 days later

Failed to Fully Open

5. When attempting to run in hole with the MRT tool to pull the bore protector free, they failed

to pass the UPR at 366,5m. During investigation they ran in with the drill-pipe and function

tested the UPR. Then the ROV observed that the EVO lock on the UPR was not fully

retracted. Decided to pull out of hole to make another MRT tool run attempt. Ran through

BOP, observed no obstruction. Other

6. Function tested the BSR and observed flow meter on BOP panel continue to count the flow

after open BSR. Detected a leak through blind shear EVO lock motor when in unlock

position. The leak stopped venting the function after set the EVO lock in unlock position.

The failure was repaired 13 days later when the BOP was on the rig for other reasons.

Historic Overview, Ram Preventer Failures

Table 5.11 shows some key information related to ram preventer failures observed in the




Table 5.11 Historic overview, ram preventer failures

Study BOP days

No. of ram

preventer failures


Comments Years

drilled and country

Phase II (/9/)

8 115 70 1 487,5

Failure modes; External leak 34% (many bonnet seal problems), Internal leak pipe ram 19%, Internal leak BS ram 6%, failed to close 1,5%, spurious operation 1,5%, Failed to fully open 16%, other/unknown 22%

1979-1982, Norway

Phase IV (/7/)

3 809 6 185,0 Failure modes; External leak 17% (bonnet seal), Internal leak pipe ram 33%, Internal leak BS ram 33%, other/unknown 17%

1982-1986, Norway

Phase V (/6/)

2 636 4 146,0 Failure modes; Internal leak pipe ram 50%, Internal leak BS ram 25%, Failed to fully open 25%

1987-1989, Norway

DW I (/4/)

4 846 10 365,0

Failure modes; External leak 10% (bonnet seal), Internal leak, BS ram 20%, Internal leak, pipe ram 10%, Failed to shear pipe 10%, Failed to fully open 20%, Internal hydraulic leakage (control fluid part) 10%, Other/unknown 20%


DW II (/2/)

4 009 11 1 505,0

Failure modes; External leak 9% (bonnet seal), Internal leak, BS ram 9%, Internal leak, pipe ram 27%, Failed to close 9%, Failed to keep closed 9%, Failed to open 27%, Premature closure 9%

1997-1999, US GoM OCS

DW and kick (/1/)

15 056 23 1 765,5

Failure modes; External leak 9% (bonnet seal), Internal leak, BS ram 13%, Internal leak, pipe ram 39%, internal leak test ram 17%, Failed to close 4%, Failed to fully open 4%, Failed to open 4%, Other/unknown 9%

2007-2009, US GoM OCS

Present study

5 212 6 127,6 Failure modes; Internal leak, BS ram 17%, Internal leak, pipe ram 17%, Failed to close 33%, Failed to fully open 17%, Other/unknown 17%

2016-2018, Norway

TOTAL 43 683 130 5 581,6

5.5 CHOKE AND KILL VALVE RELIABILITY

The BOPs included in the present study has from six to 10 choke and kill valves. Seven rigs

have 10, three rigs have eight, and five rigs have six choke and kill valves. Typically, old BOPs

with four ram preventers have fewer choke and kill valves.

Table 3.1, page 25, gives an overview of the BOP stack configuration for the various rigs

included.

Table 5.12 shows an overview of the choke and kill valve manufacturers included in the study

and the associated operational time.



Table 5.12 Overview of the choke and kill valve manufacturers included and the

associated operational time

Manufacturer Model Choke/kill valve item days

10 000 psi 15 000 psi Total

Cameron

Dual Block FS 4 250 4 250

FCS 1 530 1 530

MCK single 2 454 2 454

MCS 15 810 2 136 17 946

Total 17 340 8 840 26 180

Control Flow Unknown 1 266 1 266

National Oilwell Varco HB 2 172 2 172

NL Shaffer Unknown 7 730 7 730

Stewart and Stevenson Double/Dual 984 984

Unknown Unknown 6 120 6 120

Total 17 340 27 112 44 452

Three failures were identified for choke & kill valves in the present study. Table 5.13 shows an

overview of the choke and kill valve failure modes and associated number of failures.

Table 5.13 Choke and kill valve failure modes and associated number of failures

Failure mode No. of


BOP days in service



Avg. down-time per

failure (hrs)


Internal leakage (leakage through a closed valve)

3 31,25 5 212 44 452 14 817 10,4 0,0060

Total 3 31,25 5 212 44 452 14 817 10,4 0,0060

All the experienced failures have the failure mode Internal leakage (leakage through a closed

valve). Since these valves are in series, there will always be a back-up if one of the valves leaks.

Normally, the BOP is not pulled from the seafloor to repair such failures if only one valve is

leaking. It is likely that some more of these failures have occurred, but they have not been

mentioned in the daily drilling reports.

The far more severe failure mode External leakage was not observed in the present study for

choke or kill valves.

Internal leakage (leakage through a closed valve)

Below a brief description of the three choke and kill valve failures observed in the present study

is provided.

1. They were unable to obtain a satisfactory test on the fail-safe valves during a BOP test

scheduled by time. Displaced the kill line to seawater and managed to obtain a good low-

pressure test on the kill line fail-safe, but the high-pressure test failed. Functioned the valves

and trouble shot. Repeated kill line fail-safe test with same result. Closed all four fail-safes

and performed a good high-pressure test, 1,18% drop in 10 min.

2. During an installation test they were unable to achieve a good pressure test on upper outer

choke line fail-safe valve from the wellbore side (OK when tested from above). They were

also unable to test the kill line fail-safe valves from above (OK when tested from wellbore



side). The lines were verified and OK. Cycled the upper outer choke valve multiple times

with 35 bars on the choke line. Achieved a good test to 20/210 bar from the wellbore side.

3. A leakage on the upper outer kill line fail-safe valve was observed during an installation

test. Cycled the valve several times and opened valve with differential pressure. Still not

able to achieve neither low nor high-pressure test. Pumped oil-based mud and water through

the valve. Then tested the upper outer kill line fail-safe valve to 20/292 bar for 5/10 mins.

OK.

Historic Overview, Choke and Kill Valve Failures

Table 5.14 shows some key information related to choke & kill valve failures observed in the


Table 5.14 Historic overview, choke & kill valve failures

Study BOP days

No. of choke & kill valve failures


Comments Years

drilled and country

Phase II (/9/)

8 115 57 1 556,0 Failure modes; External leak 30%, Internal leak 25%, unspecified leak 23%, Failed to close on demand 4%, Failed to open on command 4%, Unknown 14%

1979-1982, Norway

Phase IV (/7/)

3 809 13 593,5 Failure modes; External leak (clamp connection) 8%, Internal leak 85%, unknown 8%

1982-1986, Norway

Phase V (/6/)

2 636 2 67 Failure modes; Internal leak 50%, Unknown leak 50% 1987-1989, Norway

DW I (/4/)

4 846 13 255,5 Failure modes; External leak 31%, Internal leak 46%, Failed to close on demand 8%, Failed to open on command 8%, Unknown 8%


DW II (/2/)

4 009 9 281,5 Failure modes; External leak 33%, Internal leak 33%, Failed to open on command 22%, Unknown 11%

1997-1999, US GoM OCS

DW and kick (/1/)

15 056 4 136 Failure modes; Internal leak 100% 2007-2009, US GoM OCS

Present study

5 212 3 31,3 Failure modes; Internal leak 100% 2016-2018, Norway

TOTAL 43 683 101 1 364,8

5.6 CHOKE AND KILL LINE RELIABILITY

The choke and kill line systems are divided into three main parts in this study:

1. Flexible jumper hoses in the moon pool

2. Riser attached lines

3. BOP attached lines from the connection to the integral riser lines (flexible joint level)

to the outer choke and kill valve outlets

Figure 3.1, page 25, shows a typical configuration of a BOP system.



Table 5.15 shows an overview of the riser manufacturers included in the study and the

associated operational time. A similar overview of the BOP attached lines and the jumper hoses

have not been established.

Table 5.15 Overview of riser manufacturers included and the associated operational

time

Manufacturer Model Days in service

10 000 psi 15 000 psi Total

Aker Drilling Clip Riser 267 267

Total 267 267

Cameron

RD 409 409

Unknown 1 581 270 1 851

Total 1 581 679 2 260

Shaffer

FT 496 496

FT-G-3 495 495

Total 991 991

Vetco

FCH-8 362 362

MR-10 425 425

MR-6C 164 164

MR-6C-S 211 211

MR-6D 255 255

Total 255 1 162 1 417

Unknown Unknown 277 277

Total 277 277

Total 1 836 3 376 5 212

Table 5.16 shows an overview of failures in the choke and kill lines.

Table 5.16 Choke and kill line failure modes and associated number of failures

Line segment

Failure mode distribution No. of


BOP days in service

MTTF (BOP days in service)

Avg. downtime per BOP day

(hrs)

Avg. downtime per failure (hrs)

BOP attach-ed line


3 178,25 5 212 1737 0,034 59,4

Jumper hose line


4 127,75 5 212 1303 0,025 31,9

Riser attach-ed line

External leakage (leakage to environment) 11 229 5 212 474 0,044 20,8

Plugged line 1 3 5 212 5 212 0,001 3,0

Total 12 232 5 212 434 0,045 19,4

Total 19 538 5 212 274 0,103 28,3

Twelve out of 19 failures occurred in the riser attached lines. All except one failure were

external leakages. The last one was a plugged line. A brief description of the failures observed

in the present study is presented below. These failures caused 538 hours of downtime.

External Leaks, BOP Attached Line

1. The kill line failed on test after the LMRP had been landed on the stack. The LMRP had

just been pulled due to choke line failure. Pulled the LMRP again. When inspected the

LMRP a leak on the kill line kicker hose (co-flex) was observed. Had to wait for a new co-

flex, before repairing. Then ran, landed and tested the LMRP and line.



2. During the BOP installation test the choke/kill line leaked. Pulled the LMRP. Changed seals

on both kill and choke side of LMRP kick-out sub. Then re-ran and tested.

3. They had just performed the BOP installation test. While RIH with the running tool for the

shallow plug they were unable to get a good test on the choke or kill line. Investigated with

various testing. Pressured up to 20 bar down choke line. Inspected choke line with ROV

and observed dye coming out of the choke line swivel. Disconnected and Pulled BOP.

Repaired and re-ran BOP. Tested connector and re-ran RT for shallow plug.

External Leaks, Jumper Hose Line

4. During a test scheduled by time they were not able to get low-pressure tests on the kill line.

There was a leak on the swivel on ROPS (Remotely Operated Pull-in System). POOH the

BOP test plug, and ran a deep-set 10 ¾ time lock plug, and a shallow 10 ¾ time lock plug.

Disconnected the LMRP. Changed out swivel on the kill and choke hoses. Ran and landed

the LMRP, tested the BOP and pulled the plugs

5. A small leak from the top of the swivel between kill line co-flex and fixed pipe on rig was

observed during normal operation. Removed the swivel and connected the co-flex to the

fixed pipe. Pressure tested kill line to 20/345 bar for 5/10 minutes. Good test.

6. While running the BOP they attempted to pressure test the ROPS for the kill, choke, and

conduit lines to 20/345 bar for 5/10 minutes. Observed leak on swivel for kill line co-flex

hose (rig side of co-flex). Removed swivel and connected kill line co-flex hose directly to

kill manifold. Retested and it was OK. Observed also leak on swivel for choke line co-flex

hose with pressures below 10 bar. No leak observed with pressures above.

7. For the second failure they tested the fail-safe with 20/482 bar for 5/10 min after running

casing or liner. The test failed because a moonpool co-flex failed. Hung off drill-pipe in

wellhead. Disconnected the LMRP and replaced the leaking kill line co-flex in moonpool.

Re-landed and tested LMRP connector.

External Leaks, Riser Attached Line

Five off the failures occurred while running the BOP

8. The BOP was already disconnected due to a leak in the wellhead connector. When pressure

tested the kill line to 20 bar a low-pressure leak was observed. With the ROPS joint above

splash zone, it was observed that red dye was leaking out of the ROPS joint on the kill line

swivel union under hydrostatic pressure. Changed out of leaking swivel union on the ROPS

connector kill line.

9. They attempted to test kill/choke line while running the BOP and observed a leak. Pulled

from 355 to 309 m and observed a damage on the choke line pin on the riser slick joint.

Polished pin and box end on choke line on riser joint in rotary and installed new seals and

tested OK. Ran in sea to 355 m and retested to 560 bars OK.

10. Ran the BOP through splash zone, down to 45 m, and attempted to test choke/kill lines to

20/290 bar. Low-pressure test of the kill line failed. Suspected a leaking gasket in one of

the riser joints. Pulled the BOP back and repaired. Re-ran to splash zone. Tested OK after

replacement of test cap. Ran to 45 meters.



11. Pressure tested the kill, choke & boost lines. It was not possible to get good test. Pulled the

riser to find the leak point. Pulled BOP out of sea, observed leak on connection between

riser joint 1 and 2. Installed new seals and ran the BOP from 30m to 105m.

12. While running the BOP it was discovered on deck that a wrong riser joint, with possible

missing seals, had been run. Attempted to test kill- and choke line. Detected leaks. Pulled

three riser joints, changed out riser joint. Re- ran BOP.

Seven failures were observed when the BOP was on the wellhead

13. During a pressure test scheduled by time the pressure test on upper pipe ram failed due to

a leak on the riser choke line at 375 m. Pulled the riser. Checked and replaced seals on

leaking choke connection. Lip seal on choke line was worn. Re-ran LMRP and riser. Landed

test tool and commenced BOP testing.

14. During drilling they discovered a leak in the choke line at the bottom connection on the

modified riser joint. Stopped drilling and prepared for pulling CML (Controlled Mud Level)

riser with riser pump for repair. Ran EDPHOT (Emergency Drill pipe Hang Off Tool).

Pulled the riser and changed the seals on riser joint and 30 ft pup. Had problems with riser

pump valve during running. Pulled LMRP again, repaired and re-ran. Pulled EDPHOT. Ran

BOP test plug and tested LMRP. They waited on weather for 36 hours during this operation.

In total more than 5 days were used to rectify the failure.

15. During operation a leakage was observed in the choke line connection between CML riser

joint and slick riser joint below. The BOP should be pulled anyway, so this failure caused

minor lost time only.

16. During a BOP test after running casing they observed a leak when pressure testing the kill

line against the fail-safes. Pressure tested the choke line against fail-safes, no leaks.

Displaced kill and choke lines back to OBM. Pressure tested kill and choke lines against

fail-safes to 30 bar/5 min and 100 bar/10 min, no leaks.

17. While WOW for pulling the BOP, they attempted to pressure test the choke line with 200

bar. Observed a leak against lower outer choke (LOC) valve. Suspected a washed-out leak

in stab seals on choke line riser connectors.

18. During preparations for testing, the kill line failed to test against a closed fail-safe valve.

Launched ROV and observed fluid weeping from a kill line connection between 2 riser

joints (only when under 100 bar pressure). Estimated +/-1 litre leak. The BOP should be

pulled for installing the X-mas tree anyway, so the leak did not cause any lost time.

Plugged Line, Riser Attached Line

19. Observed that the kill and choke lines were plugged. Stopped the pumps and closed the

LAP. Lined up to pump up choke line, displaced same with 1,52 sg OBM (Oil-based mud),

pumped 1 m3. Lined up to take returns up kill line. Pressured up well to 30 bar, observed

kill line plugged. Bled off pressure and opened LAP. Lined up to pump/flush down kill

line. Increased pressure to 20 bar and operated valves to bleed off pressure, OK. Flushed

choke manifold with OBM.



Historic Overview, Choke and Kill Line Failures

Table 5.17 shows some key information related to choke and kill line failures observed in the


Table 5.17 Historic overview, choke and kill lines failures

Study BOP days

No. of choke and

kill line failures


Comments Years drilled and country

Phase II (/9/)

8 115 92 957,5 Failure modes; External leak 78%, Plugged line 11%, structural failure 10%, Unknown 10%

1979-1982, Norway

Phase IV (/7/)

3 809 28 269,5 Failure modes; External leak 86%, Plugged line 7%, structural failure 7%

1982-1986, Norway

Phase V (/6/)

2 636 19 627,0 Failure modes; External leak 89%, Plugged line 5%, Unknown 5%

1987-1989, Norway

DW I (/4/)

4 846 53 1 374,5 Failure modes; External leak 91%, Plugged line 4%, Other/Unknown 6%


DW II (/2/)

4 009 9 281,5 Failure modes; External leak 75%, Plugged line 13%, Burst 13%

1997-1999, US GoM OCS

DW and kick (/1/)

15 056 17 1 994,0 Failure modes; External leak 94%, Unknown 6% 2007-2009, US GoM OCS

Present study

5 212 19 538,3 Failure modes; External leak 95%, Plugged line 5% 2016-2018, Norway

TOTAL 43 683 237 6 042,3



5.7 MAIN CONTROL SYSTEM RELIABILITY

The two main BOP control system principles are:

• Multiplex control system (MUX)

• Pilot hydraulic control system

Table 3.1, page 25, gives an overview of the BOP stack configuration for the various rigs

included.

Table 5.18 shows an overview of the control system manufacturer included in the study and

the associated operational time.

Table 5.18 Overview of the main control system manufacturer and the associated

operational time

Manufacturer BOP days in service

Multiplex Pilot hydraulic Total

Cameron 962 1 990 2 952

Hydril 466 466

Koomey 164 164

National Oilwell Varco 858 858

Shaffer 277 277

Silvertec 495 495

Total 1 239 3 973 5 212

Most of the rigs were equipped with a pilot hydraulic system, 76%, while 24% of the service

time comes from multiplex systems. In the present study most of the wells are drilled in water-

depths below 500 meters, where the pilot control system will satisfy the closing time

requirements. Deepwater rigs will typically have a multiplex system to be able to satisfy the

closing time requirements.

Table 5.19 shows an overview of the different control system principles service times.

Table 5.19 Service time for Main Control System types

Control System Principle BOP days in service for various water depths

<300 m 300 – 500 m 1200 – 1300m Total

Multiplex 1 056 183 1 239

Pilot hydraulic 1 584 2 389 3 973

Total 1 584 3 445 183 5 212

A comparison of MTTFs for the different operating principles of the main control systems is

shown in Figure 5.1. There is no significant difference between the MTTFs since the confidence

bands are overlapping. This is the same observation as in DW and kick, and Phase I & II DW

studies (/1/, /4/, and /5/).



Figure 5.1 MTTF comparison, BOP control system principles with 90% confidence

limits

A comparison of control system failures with previous studies (/1/, /2/, /4/, and /5/) is shown in

Figure 5.2. Section 4.1 describes the various BOP studies.

Figure 5.2 Comparison of Control System MTTF (average with 90% confidence limits)

with Previous Studies

The current study has a significantly higher MTTF than the Phase I & II, but a bit lower than

DW and Kick study. It is here important to recall that the main source of information for the

DW and kick was the BSEE well activity reports (WARs), that is a weekly reporting system,

while for the all other studies it was the daily drilling reports. It can be assumed that many less



critical failures are not described in the WARs. These less critical failures typically produce

little downtime.

In terms of average downtime performance, the result for control system types is shown in

Figure 5.3. The multiplex system experienced the highest downtime. It should be noted that the

multiplex system was also used for the largest water depths. Generally, the average downtime

is dominated by some few failures of long durations.

Figure 5.3 Average downtime per BOP day caused by BOP main control system

failures

Also in the DW and Kick study (/1/) and the Phase II DW study (/2/) it was observed that the

multiplex systems caused more lost time than the pilot hydraulic systems. This was not

observed in the Phase I DW study (/4/). The previous studies are presented in Section 4.1.

Table 5.20 shows an overview of the different control system failure modes, the associated

number of failures and the lost time observed in the present study.



Table 5.20 Control system principle specific failure modes and associated number of

failures

Failure Mode Distribution No. of

failures Total lost

time (hrs.)

Days in Service

(BOP days)

MTTF (days)

Avg. Downtime per BOP day

(hrs.)

Avg. Downtime-per failure

Multiplex electro hydraulic

Emergency automated BOP function failed 2 83,00 1 239 620 0,067 41,50

Loss of all functions one pod 3 75,50 1 239 413 0,061 25,17

Loss of one function one pod 1 0,00 1 239 1 239 0,000 0,00

Loss of one function one topside panel/unit 1 0,50 1 239 1 239 0,000 0,50

Other 7 94,00 1 239 177 0,076 13,43

Total 14 253,00 1 239 89 0,204 18,07

Pilot hydraulic

Emergency automated BOP function failed 1 72,00 3 973 3 973 0,018 72,00

Loss of all functions both pods 1 2,00 3 973 3 973 0,001 2,00

Loss of all functions one pod 2 53,00 3 973 1 987 0,013 26,50

Loss of one function both pods 1 0,50 3 973 3 973 0,000 0,50

Loss of one function one pod 5 6,75 3 973 795 0,002 1,35

Other 6 11,17 3 973 662 0,003 1,86

Unknown 8 8,50 3 973 497 0,002 1,06

Total 24 153,92 3 973 166 0,039 6,41

Total control system 38 406,92 5 212 137 0,078 10,71

Loss of all Functions Both Pods

In the present study the loss of all functions both pods was experienced once in a pilot hydraulic

system. If the BOP is acting as a well barrier this is a critical failure mode, because the BOP

cannot be operated from the main control system.

1. In this case they experienced lost pressure on the BOP pods when pulling BOP/riser.

Troubleshoot on pod reels for BOP and had SJA meeting and meeting with town. It was

decided to continue to pull BOP.

This failure mode has been observed for multiplex systems and pilot hydraulic systems in Phase

I DW, Phase II DW, and DW and kick (/1/, /2/ and /4/). This failure mode was, however, not

observed during the Phase IV and Phase V studies (/6/ and /7/). In the mentioned studies, wells

were drilled in “normal” water depths, pilot systems were utilized, indicating that such failures

do not occur frequently in the pilot hydraulic control systems.

Loss of all Functions One Pod

A total of five failures with this failure mode were observed, three in multiplex systems, and

two in pilot hydraulic systems. This is a rather common failure mode that has been observed in

all BOP reliability studies. They are typically caused by major hydraulic leaks or some sort of

electric/electronic problems. Below the experienced failures are discussed:

2. A failure occurred in a Multiplex system during normal operation with the BOP on the

wellhead. They turned off the blue pod, likely because of a failure. Six hours later they

turned on blue pod back-up control unit and confirmed control unit was ok.

3. During running of the BOP a failure occurred in a Multiplex system. The BOP was at 229

meters when observed fault on SEM (Subsea Electronic Module) A & B on blue pod. Pulled



the BOP and troubleshot on connection error to blue pod. Changed pressure balanced oil

filled cable from riser mounted junction box to blue pod. Tested new cable - OK. Tested

and re-ran BOP to 229 m

4. The failure occurred in a Multiplex system during running of the BOP. Observed an error

with BOP blue pod. Pulled BOP back and changed the e-prom card in blue pod SEM B.

Observed also error on the solenoid valve for ram lock UPR. Pulled BOP out of the sea and

landed on BOP carrier. Troubleshoot and discussed way forward with BOP blue pod SEM

B. Not able to replicate system error. Entire system was checked without finding any faults.

Decided to run BOP. Ran BOP on riser to 69m.

5. This failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during

normal operation. Prior to drilling 8 1/2 section they observed leakage of BOP control fluid

from the yellow pod. Trouble shot same. Disconnected LMRP, pulled to surface and

changed out faulty gas relief vent valve. Re-ran LMRP.

6. The failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during

normal operation. It was only stated; troubleshot leakage observed on yellow pod. It was

not stated if the problem was repaired. The well was finished, and the BOP pulled three

days later. The failure mode is assumed

Loss of One Function Both Pods

One failure with this failure mode occurred in the present study. This failure mode is normally

caused by a failure in the shuttle valve or the line from the shuttle valve to the BOP function,

or other functions that are common for both pods. Below, this type of failure is described:


normal operation. They attempted to open the BSR but did not receive the correct return

flow. Investigated the problem and discovered that the BSR boost system was activated.

Turned off the boost. Found that the quick dump valve had hung up. Opened the BSR

Loss of One Function One Pod

The failure mode Loss of one function one pod occurred once for a multiplex control system,

and five times for a pilot hydraulic system. The failure mode is normally caused by a failure in

a pilot line, pilot valve, or solenoid valve. These failures are briefly described below:

8. The failure occurred in a Multiplex system when the BOP was on the wellhead during

normal operation. When performing a function test of the BOP stack they could not operate

the outer bleed valve from the blue pod.


an installation test (the LMRP had been re-connected after WOW). They performed the

LMRP connector test to 20/190 bar for 5/10 mins. When attempted to perform the BOP

function test issues with the SPM valve on blue pod for UPR was observed. Pulled above

the BOP and troubleshot SPM on blue pod. Function tested BOP from blue pod.


a BOP installation test. During the BOP function test, it was discovered that the LPR (Lower

Pipe Ram) did not function as it should on blue pod. Got no count on the flowmeter.



Switched to yellow pod and then everything worked as it should. During fault-finding it

was found that there were some issues related to connection plate and pilot lines.


a BOP installation test. The UPR did not close on yellow pod. It was tested again five days

later with the same result. There were no signs that the failure was repaired. The BOP was

pressure tested with the yellow pod three weeks after the initial failure was observed, with

no comments related to the failure


normal operation. They were not able to get pressure to open wellhead connector and

disconnect the BOP. Troubleshot on BOP system, leak observed. Opened wellhead

connector and pulled BOP above template.

13. This failure occurred in a Pilot hydraulic system when the BOP was on the rig ready to be

run. They were pressure testing the BOP and prepared it for running when observed leak

on SPM valve for LAP opening signal, changed SPM valve.

Loss of One Function One Topside Panel/Unit

14. The failure occurred in a Multiplex system when the BOP was on the wellhead during

normal operation. They were unable to open the UPR from toolpusher’s panel. Opened it

from the driller’s panel. Function tested UPR from toolpusher’s panel 2 days later.

Emergency Automated BOP Function Failed

Since the last study was carried out, emergency automated BOP functions have got much more

attention. Many old BOPs have been retrofitted with such systems while new BOPs have these

systems included. This focus was triggered by the Deepwater Horizon accident in 2010. These

systems are now tested more than before. Three failures were observed in the study.

15. This failure occurred in a Multiplex system during the BOP installation test. Performed

autoshear acceptance test. Observed that the BSR did not close during the test. Retested

function and BSR closed.

16. The failure occurred in a Multiplex system during normal operation it seems. The AMF

(Automatic Mode Function) obviously failed for some reason. Ran the RTTS plug.

Attempted to repair the AMF shuttle valve with an ROV. The attempt failed. Decided to

pull the BOP to surface to perform repair. Pulled the BOP and replaced the AMF shuttle

valve on BOP. Pressure tested same to 5000 psi/10 min. Commenced soak testing on BOP.

Ran the BOP. Tested the BOP and pulled the RTTS.


a BOP installation test. When landing the BOP and the setup of the Automatic Disconnect

System (ADS) failed. Attempted to operate the ADS reset function from the ROV panel.

Operation of the ROV valve ADS reset isolation did not give any indication of pressure on

subsea gauge ADS reset pressure. Further, troubleshooting confirmed hydraulic fluid vent

via ADS reset isolation valve to sea. However, due to concerns over the lack of system

functionality, further configuration of the system was done with positive weight on the

LMRP connector. When opening of the ROV valve ADS supply isolation the LMRP



connector and choke/kill connector unlatched prematurely and unintentionally. It was

decided to recover the LMRP to surface for further investigation.

Other

Thirteen failures are categorized with the failure mode Other, causing a total lost time of 105

hours. Seven of these 13 failures occurred in a multiplex system, and six in a pilot hydraulic

pilot hydraulic system.

For the multiplex system, four failures occurred when the BOP was on the wellhead, and three

while running the BOP. A brief description of these failures is provided below:

Multiplex system, BOP on the wellhead failures, normal operation:

18. A subsea engineer investigated a BOP leakage by operating BOP valves while ROV was

observing at the BOP. Found the leak at upper inner blue pod choke line fail-safe SPM

valve. Sat the function in open position, the leak disappeared.

19. Observed the HPU pump for BOP control fluid starting irregularly, indicating leak on

system. Troubleshot same. Isolated conduit lines on surface and on BOP. Observed a

pressure drop of 300 psi in 1 minute on yellow conduit. HPU was stable while yellow

conduit was isolated. Function tested BOP rams, annulars, and fail-safes with conduit lines

isolated and hot line as supply. Decided to continue operation with hot line as secondary

system. De-isolated blue conduit. The conduit line was repaired two weeks later, when the

BOP was pulled to repair the AMF shuttle valve.

20. Inspected the BOP blue pod with ROV. Found leak on 1/4 line to stack accumulator read

back gauge. Isolated charge line to accumulators in the lower stack, and the leak stopped.

21. They were in the process of P&A the well when they observed a leak on the hydraulic hot

line. Performed riser/BOP cleanout run and tagged cement at 504 m. Displaced well to

seawater. POOH with riser brush assembly. Prepared to disconnect LMRP. Pulled LMRP

and repaired leak on hydraulic hot line. Latched LMRP on BOP. Had to repair hot line three

times

Multiplex system, while running BOP failures, normal operation:

22. Attempted to pressure test the conduit lines taking pressure from BOP accumulator bank.

Observed 700 psi pressure drop/3 min. Pulled out four riser joints and tested, OK. Observed

damages on box ends on both conduit lines. Observed corresponding damages on pin ends

on both conduit lines on slick riser joint #4 (below modified joint). Ran riser joint and tested

conduit lines: Got a leak in yellow conduit line. The pilot operated check valve on surface

leaked. Repaired and got good test on conduit line.

23. Ran riser to 115 meters and observed a leak when pressure testing the conduit line. Pulled

out and laid out modified riser joint. Pressure tested conduit line on riser joint below

modified riser joint. OK. Ran modified riser joint. Pressure tested conduit line. Ran in with

BOP on riser to 366 m. Observed leak when pressure testing conduit line. Pulled out with

BOP to 252 m. Pressure tested conduit line. Pressure still leaking off. Continued pulling

out with BOP to 137 m. Pressure tested conduit lines. Tested ok.



24. While pressure testing conduit line to 345 bar a small leakage was discovered on the conduit

return line hose at the rig end. Performed risk assessment, decision made to continue

operations and repair hose at next convenient time.

Pilot hydraulic system, BOP on the wellhead failures, normal operation:

25. Pulled yellow BOP pod to surface due to leaking control line of the pod latch function.

Changed latch function to another control line, re-ran the pod, and latched to the LMRP.

26. Observed a leak in secondary unlatch line on blue pod when unlatching the LMRP due to

bad weather. While WOW retrieved blue pod to surface and changed line for secondary

unlatch. Ran blue pod to BOP and latched same.

27. Small leakage in BOP JIC fitting on high-pressure shear system. Pulled bottom hole

assembly through window due to inspection on leaking valve on BOP. Tightened fittings

on BOP shifting valve with ROV.

28. When landing BOP, it was discovered that the storm loop banana sheaves had slipped on

the pod wires. Had to pull BOP up to above PGB guideposts and redo the storm loops.

29. Observed erratic readback pressure on blue pod subsea annular regulator. Pulled blue pod

for inspection (subsea regulator suspected stuck). Function tested BOP via blue pod on

drillers panel, ok. Confirmed blue pod fully functional after repair.

Pilot hydraulic system, While running BOP failures, normal operation:

30. Observed that the conduit line leaked off and did not fill. Ran one more riser joint to 85m.

ROV functioned conduit valve on BOP stack. Tried to fill conduit line again, but it still

leaked off. Pulled BOP back to surface and picked up to working height. Trouble shot and

found the cause to be trapped pressure in pilot line 48 and valve 3.3 being in mid position.

Unknown

Eight failures are categorized with the failure mode Unknown, causing a total lost time of 8,5

hours. All these failures occurred in pilot hydraulic pilot hydraulic systems when the BOP was

on the wellhead. Four occurred during the installation test, and the remaining during other test

or normal operations.

31. The BOP had just been landed. Function tested the annular, UPR, LPR and fail-safes from

yellow pod. Switched over to blue pod and observed a leakage. Troubleshot blue pod and

reconfigured same. Continued the function test from blue pod.

32. During installation test a seepage through yellow-pod connector was observed. No more

information.

33. During installation test troubleshot fail-safe valves. Fail-safe valves tended to remain in

open position. Function tested BOP fail-safe valves from blue and yellow pods. It is

assumed that this is related to the control system.

34. While testing BOP DMAS (Deadman Autoshear) function on blue and yellow pod observed

a leak from stinger seals on yellow pod. Trouble shooting leak on yellow pod. Observed

the leak when using DMAS and wellhead connector close functions. Prepared for pulling

BOP. Awaited decision on further operations. Operated stingers on yellow pod to trouble

shoot leak. Managed to operate functions without seeing any leak.



35. During normal operation a leak was observed on the yellow pod. Investigated leak. There

was no more information.

36. A safety valve in the BOP main control room (set @3200 psi) blew (assumed while

switching from yellow to blue pod), and high-pressure hose installed upstream safety valve

burst (supposedly as an effect of high flowrate through restricted dimension). Thus, decided

to abort function testing for now, to replace defect hose and safety valve.

37. It was only stated ran and installed blue pod. This occurred just after they had finished

testing the BOP from the yellow pod. There is no indication why the pod was pulled in the

first place. The function tested the BOP on the blue pod the day after.

38. It is not known what failed. It was only stated that they ran the blue pod. The ROV followed

pod to seabed. Before running the blue pod, inspected the BOP down to BSR with the ROV,

and found no anomalies.

Rig Specific Failure Rates

The control system performance for the 15 rigs included in the study showed a highly variable

failure rate and downtime per BOP day in service, as illustrated in Figure 5.4. The confidence

intervals are overlapping, hence no significant difference in performance can be observed.

Figure 5.4 Rig specific control system performance

Historic Overview, Main Control System Failures

Table 5.21 shows some key information related to choke and kill line failures observed in the




Table 5.21 Historic overview, main control system failures

Study BOP days

No. of main control system failures


Comments

Years drilled

and country

Phase II (/9/)

8 115 149 1 445,3

Failure modes; Surface equipment failure 12,1%, Hose bundle failure 7,4, Plugged/frozen pilot line 4,7%, Unspecified pod failure/leakage 22,8%, Stinger failure 6,0%, Subsea pressure regulator failure 4,0%, Pilot/SPM failure 18,8%, Shuttle valve failure 3,4%, Pod selector valve failure 1,0%, Stack hydraulic line failure 10,1%, Accumulator leakage 2,0%, Unspecified leak 2,0%, Other failures 2,7%, Unknown 4,0%

1979-1982, Norway

Phase IV (/7/)

3 809 29 723,8

Failure modes; Hose bundle failure 24%, Plugged pilot line 17%, Stinger failure 3%, Regulator valve failure 3%, Pilot valve fail. 24%, Shuttle valve failure 3%, Stack hydraulic line failure 14%, Unspecified leakage 3%, Unknown 7%

1982-1986, Norway

Phase V (/6/)

2 636 28 521,6

Failure modes; Spurious activation of BOP function 4%, Loss of all functions one pod 21%, Loss of several functions one pod 7%, Loss of one function both pods 7%, Loss of one function one pod 36%, Loss of one topside panel 4%, Loss of one function topside panel 4%, Topside minor failures 7%, Other 4%, Unknown 7%

1987-1989, Norway

DW I (/4/)

4 846 73 1 688,0

Failure modes; Loss of all functions both pods 7%, Spurious operation of BOP function(s) 3%, Loss of all functions one pod 18%, Loss of one function both pods 3%, Loss of one function one pod 26%, Loss of several functions both pods 3%, Loss of several functions one pod 4%, Other 8%, Unknown 29%


DW II (/2/)

4 009 25 454,0

Failure modes; Loss of all functions both pods 4%, Spurious operation of BOP function(s) 8%, Loss of all functions one pod 16%, Loss of several functions both pods 4%, Loss of several functions one pod 12%, Loss of one function both pods 4%, Loss of one function one pod 28%, Unknown 8%, Other 16%

1997-1999, US GoM OCS

DW and kick (/1/)

15 056 72 4 712,0

Failure modes; Loss of all functions both pods 1%, Loss of all functions one pod 19%, Loss of one function both pods 8%, Loss of one function one pod 22%, Loss of several functions one pod 4%, Other 32%, Unknown 13%

2007-2009, US GoM OCS

Present study

5 212 38 406,92

Failure modes; Emergency automated BOP function failed 8%, Loss of all functions both pods 3%, Loss of all functions one pod 14%, Loss of one function both pods 3%, Loss of one function one pod 16%, Loss of one function one topside panel/unit 3%, Other 32%, Unknown 22%

2016-2018, Norway

TOTAL 43 683 414 9 951,6

5.8 BACK-UP CONTROL SYSTEM RELIABILITY

Acoustic back-up subsea BOP control systems have existed for more than 30 years, and have

been mandatory in Norway since 1981.

During the 1980s several subsea BOP reliability studies were carried out by SINTEF. It should

be noted that all the failure information collected involves the old generation of acoustic control

systems. Kongsberg Simrad was the major supplier of acoustic BOP back-up control systems

in the 80s and 90s (with approximately 70% of the total market). Until 1996 they had delivered

approximately 30 of the analogue ACS 300 systems. The failure data collected do, to a large

degree, stem from these Kongsberg Simrad systems. In 1996, the ACS 300 system was



substituted with the new generation, the all digital ACS 400 system, and in 2011 the ACS 400

system was substituted with the new generation ACS 500 system.

Nautronix is another supplier of BOP acoustic back-up system. Nautronix has delivered

acoustic BOP control systems since the 90s. Nautronix Emergency BOP (NASeBOP) Acoustic

Control system is the most recent system from Nautronix. NASeBOP uses the ADS² (Acoustic

Digital Spread Spectrum) signaling technology.

Sonardyne also supplies acoustic BOP control systems. They use something they call

Wideband™ signal technology.

The acoustic back-up control system consists of an acoustic communication part and a

hydraulic valve package part. The acoustic communication part is typically delivered by one

of the above suppliers, whereas the hydraulic valve package part is normally delivered by the

BOP supplier.

In the present study, the acoustic part of the system in use has been identified for 14 of the 15

rigs. All these 14 rigs have a Kongsberg (Simrad) system.

Table 5.22 shows the acoustic system manufacturer and model for the acoustic part.

Table 5.22 Acoustic system manufacturer and model

Manufacturer Model BOP days in service

Kongsberg ACS 400 2 292

Kongsberg ACS 433 362

Kongsberg ACS 500 2 077

Kongsberg (Simrad) ACS unknown 211

Unknown Unknown 270

Total 5 212

Acoustic Control System Reliability

Table 5.23 shows an overview of acoustic system failure modes and the part of the system

responsible for the failure.

Table 5.23 Acoustic system failure modes and part of the system failed

Failure Mode

Acoustic communication part

Hydraulic valve package part

Unknown Total

No. of failures

Lost time (hrs)

No. of failures

Lost time (hrs)

No. of failures

Lost time (hrs)

No. of failures

Lost time (hrs)

Failed to operate one BOP function by the acoustic system

1 1 2 71 3 72

One of two acoustic units on the BOP failed

1 0 1 0

Other 4 77,75 3 77,75

Unknown 1 0 1 0,5 3 0,5

Total 2 1 7 148,75 1 0,5 10 150,25



Most failures stem from failures in the hydraulic valve package part. None of the failures were

caused by poor acoustic communication through the water column. This used to be a problem

in the 80ties and early 90ties.

Table 5.24 Acoustic back-up system failure modes and associated number of failures



BOP days in service

MTTF (BOP days in service)


Avg. downtime per failure (hrs)

Failed to operate one BOP function by the acoustic system

3 72 5 212 1 737 0,0138 24,0

One of two acoustic units on the BOP failed

1 0 5 212 5 212 0,0000 0,0

Other 4 77,75 5 212 1 303 0,0149 19,4

Unknown 2 0,5 5 212 2 606 0,0001 0,3

Total 10 150,3 5 212 521 0,0288 15,0

Failed to Operate one BOP Function by the Acoustic System

The failure mode Failed to operate one BOP function by the acoustic system occurred three

times. Below the failures are briefly described:

1. The first failure occurred on a BOP test after running casing or liner during function testing.

It was only stated that they attempted to close the BSR with the acoustics from control

room. Re-tested function from the bridge.

2. The second failure occurred on a BOP installation test during function testing. They

attempted to close the blind shear ram on acoustic. It was observed that a valve for the

acoustic was closed (wrong valve set-up). Used the ROV to open the valve, then closed the

blind shear ram from acoustic panel located on bridge.

3. The third failure occurred on a BOP test after running casing or liner. A SPM valve on the

BOP acoustic control system leaked, and it was impossible to boost close the blind shear

ram. The well was plugged, and the BOP pulled to repair the failure.

One of two Acoustic Units on the BOP Failed

4. This failure occurred on a BOP installation test. They discovered that the communication

with the acoustic unit 1 on the BOP could not be established. Communication with unit 2

was tested and verified with both HIPAP (HIgh Precision Acoustic Positioning) and the

portable control unit.

Other

Four failures have been categorized with the failure mode Other. All failures occurred in the

hydraulic valve package part of the system. Below the failures are briefly described:

5. The first failure occurred during a test after running casing or liner. When function testing

the blind shear ram on the acoustic system a leakage between the blind shear ram and the

acoustic system was observed. Armed the acoustic unit and reset the acoustic system, and

the leakage disappeared.



6. The second failure was observed during normal operation. A leakage was observed in the

acoustic system. The subsea engineer investigated the hydraulic leakage. He armed the

acoustic system and observed that the leak stopped. Performed additional function tests of

the acoustic system and verified that the acoustic system was functional.

7. The third failure was observed during normal operation. While waiting on weather a

pressure drop on the BOP blue pod surface volume counter was observed. Investigated with

an ROV. Found leak on the solenoid supply line of the blue pod. Isolated the acoustic arm

opening function and the leak stopped. Blue pod was then back in service.

8. The forth failure was observed during normal operation. Observed a hydraulic leak on the

BOP controls. Identified leak to the accumulator bottles for the acoustic functions and the

DMAS. The leak was also observed by an ROV. Ran RTTS packer and pulled the BOP.

Dismantled and inspected the leaking SAE flange and found a burst O-ring between the

adapter plate and the T-piece. The connection was mounted with two different manufacture

parts. Repaired and re-ran BOP.

Unknown

Two failures are categorized with the failure mode Unknown. All failures occurred in the

hydraulic valve package part of the system. Below the failures are briefly described:

9. The first failure occurred during a BOP installation test. It was only stated observed that

hydraulic fluid vented from the BOP acoustic pod. Troubleshooted on acoustic pod system.

No more information.

10. The second failure was observed during a test scheduled by time. There were some issues

while testing acoustic system on BOP. Re-tested acoustic system on BOP. Function-tested

LPR and UPR acoustic. It was not listed what the issues were

Historic Overview, Acoustic Back-Up Control System Failures

The acoustic control system reliability data from previous studies stems from drilling in

Norway. The study DW I (/4/) included acoustic experience from some few wells only. The

study DW II (/2/) and DW and kick (/1/), based on US GoM drilling did not include any

acoustic experience at all since the BOPs were not equipped with acoustic back-up systems.

From 1992, there has been a requirement in Norway to function test the acoustic system weekly

when the BOP is located at the seafloor. Before 1992 the typical test of the acoustic system was

to close the blind-shear ram to test casing before drilling out of casing.

Table 5.25 shows an overview of the BOP location when acoustic system failures were

observed.



Table 5.25 Overview of the BOP location when observing acoustic system failures in 80s and early 90s

Study Location of BOP

Total On the rig prior to running On the wellhead During running BOP

Phase II 22 13 35

Phase IV 3 9 1 13

Phase V 7 1 8

Phase I DW 5 8 13

Total 29 38 2 69

Table 5.25 shows that more than 50% of the failures were observed when testing the BOP when

it was on the wellhead.

A general experience from the BOP reliability studies in the 80s and early 90s was that acoustic

back-up systems were given low priority. The training and education in electronic equipment

and hydro-acoustics varied from company to company.

Some of the failures listed may also be of human character and not technical as such.

Failure Modes

Table 5.26 shows the failure modes for the failures that were observed during the BOP

installation test and during regular BOP tests or operation.

Table 5.26 Failure modes for failures observed during the BOP installation test and

during regular BOP tests or operation in 80s and early 90s

Failure mode

BOP is on the wellhead

Installation test

Regular test or operation

Total

Failed to operate BOP 11 11 22

Failed to function on hull mounted transducer 3 3

Spurious operation one BOP function 2 2

Failed to operate one BOP function by the acoustic system 3 3 6

Loss of redundancy (one of two electronic channels dead) 1 1

Wrong valve position indication 1 1

No read back signal 1 1

Unknown 1 1

Total 18 19 37

When looking at the failure modes, it is observed that most failures affected the complete

system, and the result of the failure was that the system could not be operated. Only some few

failures were affecting one function only.



6. FAILURE CRITICALITY IN TERMS WELL CONTROL

Failures that occur when the BOP is on the rig, during running of the BOP or during the

installation testing are not regarded as critical failures in terms of well control. During these

phases of the operation the BOP is not acting as a well barrier. After the installation testing is

completed and accepted, the drilling starts and the BOP acts as a well barrier. This is regarded

as the safety-critical period. This section discusses failure detection and failure criticality in

terms of well control.

6.1 WHEN ARE BOP FAILURES OBSERVED?

Table 6.1 presents the location of the BOP and the tests during which the various BOP failures

occurred.

Table 6.1 Observation of BOP failures

BOP sub-system

BOP is on the rig

While running (and pulling)

BOP

BOP is on the wellhead

Total Instal-

lation test

Normal operation

(Non critical)

Normal operation

(Safety critical)

Test after running casing

or liner

Test scheduled

by time

Other test

Un-known

Safety non-critical period Safety-critical period

Flexible joint

Annular preventer 1 6 4 4 15

Ram preventer 4 1 1 6

Connector 2 1 3

Choke/kill valve 2 1 3

BOP attached line 3 1 1 5

Riser attached line 4 3 1 1 2 11

Jumper hose line 1 1 1 3

Multiplex electro hydraulic control

5 1 5 2 1 14

Pilot hydraulic 1 2 8 1 7 1 2 2 24

Acoustic 3 1 2 3 1 10

Total 1 12 23 6 24 11 12 2 3 94

44,7% 55,3%

As seen from Table 6.1, 55% of the failures occurred in the safety-critical period, i.e. the period

where the BOP shall act as a well barrier. The criticality of each failure will of course depend

on what part of the BOP system that fails and the failure mode.

An installation test is defined as the BOP test after landing the BOP the first time or during

subsequent landings of the BOP or the LMRP.

Failure Observation, Pressure Testing vs. Function Testing

In the safety-critical period, 26 of 52 were observed during normal operation or other test. The

two other test failures were observed because the choke- or kill line was pressure tested, but

this was related to the operation and not a BOP test. Twenty-three failures were observed during

a Test after running casing or liner or a Test scheduled by time. For three failures it was

unknown how the failures were observed.



When looking at the failures that were observed during a Test after running casing or liner or

a Test scheduled by time, six failures were observed because pressure was applied. Four of

these failures were in choke and kill lines, one was in a choke kill valve, and one in an annular

preventer.

Eleven failures were observed in association with BOP testing because the BOP functions were

activated. These failures are typically related to the control system and are observed because

hydraulic fluid is leaking, or they fail to operate a function.

Six of the failures were related to failed to fully open annular preventer in association with a

BOP test.

6.2 SAFETY-CRITICAL PERIOD FAILURES

This section discusses the failures that have occurred in the safety-critical period, as shown in

Table 6.1.

BOP Item, Safety-critical Period Failures

Table 6.2 shows the safety-critical failures in flexible joints, annular preventers, ram preventers,

and hydraulic connectors.

Table 6.2 Safety-critical period failures in the flexible joints, annular preventers, the

ram preventers and the hydraulic connectors



No of BOP days

No. of item days

Average downtime per BOP day (hrs)


Lower limit

Mean Upper limit

Flexible joint

All 0 5 212 5 212 0,0000 2 264 > 5 212

Annular preventer

Failed to fully open 11 6,75 5 212 7 852 0,0013 431 714 1 273

Internal hydraulic leakage (control fluid part) 1 14 5 212 7 852 0,0027 1 655 7 852 153 080

Internal leakage (leakage through a closed annular) 2 2 5 212 7 852 0,0004 1 247 3 926 22 096

All 14 22,75 5 212 7 852 0,0044 359 561 928

Ram preventer

Other 1 1,5 5 212 24 441 0,0003 5 152 24 441 476 495

All 1 1,5 5 212 24 441 0,0003 5 152 24 441 476 495

Connector, LMRP

All 0 5 212 5 212 0,0000 2 264 > 5 212

Connector, Wellhead

All 0 5 212 5 212 0,0000 2 264 > 5 212

BOP items total 15 24,25 5 212 0,0047

Flexible joint

Flexible joint failures are rare. No failures were observed in a flexible joint. The flexible joint

is not an element that shall be able to withstand the well pressure, only the differential

hydrostatic pressure between the mud column and the seawater.



Annular preventers

Internal leakage (leakage through a closed annular) were observed twice in the safety-critical

period. For both the incidents the closing pressure of the annular preventer was increased. For

one of them the annular still leaked.

1. During squeezing, pressure dropped from 24 to 15 bar, an increase in trip tank was

observed indicating annular leaking. Increased closing pressure on annular. Continued

squeeze operation.

2. Pressure tested UAP to 30 bar/5 min, no leaks. Attempted to pressure test UAP to 241

bar, observed leak. Increased closing pressure to 1500 psi and observed a better trend

but leak still above acceptance criteria.

Internal hydraulic leakage was observed once. During a BOP function test, they observed

leakage of BOP fluid at approx. 600 litre/hr while applied open function on upper annular

preventer (UAP). Some metal swarf/junk stuck between annular piston and housing. The failure

was repaired one week later when the BOP was pulled prior to run the X-mas tree.

Eleven annular preventer failures were observed as Failed to fully open failures in the safety-

critical period. These failures are not regarded as failures that reduce the safety availability.

Ram preventers

One ram preventer failure occurred in the safety-critical period. This was a failure categorized

with Other as failure mode. They function-tested the BSR and observed flow meter on BOP

panel continue to count the flow after the BSR was opened. Detected a leak through the BSR

EVO lock motor when in unlock position. The leak stopped venting the function after the EVO

lock was set in unlock position. The failure was repaired 13 days later when the BOP was on

the rig for other reasons.

None Failed to close, Leaking in closed position, or External leakage failures in ram preventers

were observed in the present study. These are failure modes that have been observed in earlier

studies.

Hydraulic connectors

No failures were observed in the hydraulic connectors in the safety-critical period.

The most critical failure in a wellhead connector is External leakage during normal drilling

operations. It is not uncommon to see these failures on the installation test, but they are rarely

observed in the safety-critical period. Such failures have been observed in earlier studies in the

safety-critical period.

No failed to unlock a connector was observed in the safety-critical period in the present study.

Such failures have been observed in earlier studies. If this failure mode occurs in a LMRP

connector it can be critical in association with an emergency disconnect situation.

Choke and Kill Valves and Lines, Safety-critical Failures

Table 6.3 shows the safety-critical failures of the choke and kill valves and choke and kill lines.



Table 6.3 Safety-critical failures in the choke and kill valves and choke and kill lines



No. of BOP days

No. of item days



Lower limit

Mean Upper limit

CHOKE/KILL VALVE

Internal leakage (leakage through a closed valve) 1 3 5 212 44 452 0,0006 9 370 44 452 866 624

Total 1 3 5 212 44 452 0,0006 9 370 44 452 866 624

BOP ATTACHED LINE

External leakage (leakage to environment) 1 80,75 5 212 5 212 0,0155 1 099 5 212 101 612

Total 1 80,75 5 212 5 212 0,0155 1 099 5 212 101 612

Jumper hose line

External leakage (leakage to environment) 2 46 5 212 5 212 0,0088 828 2 606 14 667

Total 2 46 5 212 5 212 0,0088 828 2 606 14 667

Riser attached line

External leakage (leakage to environment) 6 187 5 212 5 212 0,0359 440 869 1 995

Plugged line 1 3 5 212 5 212 0,0006 1 099 5 212 101 612

Total 7 190 5 212 5 212 0,0365 396 745 1 586

Total choke kill items 11 319,75 5 212 0,0613

Choke and kill valves

The only choke and kill valve failure in the safety-critical period was observed as a leakage

through a closed valve. This failure was detected during a test scheduled by time. It was unable

to obtain a satisfactory test on the fail-safes. Displaced the kill line to seawater a managed to

obtain a good low-pressure test on kill line fail-safe, however, high-pressure test failed.

Functioned valves and trouble shot. Repeated kill line fail-safe test with same result. Closed all

four kill line fail-safes and performed good high-pressure test, 1,18% drop in 10 min.

Choke and kill lines

There was no leakage in the BOP attached line during the safety-critical period.

There were three leakages in the jumper hose lines in moonpool during the safety-critical

period. For the first one, a small leak from the top of the swivel between the kill line co-flex

and fixed pipe on rig was observed during normal operations. Removed the swivel and

connected the co-flex to a fixed pipe and pressure tested.

For the second failure they tested the fail-safe valve with 20/482 bar for 5/10 min after running

casing or liner. The test failed because a moonpool co-flex failed. Hung off drill-pipe in

wellhead. Disconnected the LMRP and replaced the leaking kill line co-flex in moonpool. Re-

landed and tested LMRP connector. They used 43 hours to repair the failure.

For the third failure, during a test scheduled by time, they were not able to get low-pressure

tests on the kill line. The leak was on a swivel on ROPS. Plugged the well and pulled the LMRP,

repaired and re-ran the LMRP. They used 81 hours to repair the leak.

There were seven failures in the riser attached lines during the safety-critical period. One

failure was a plugged line, while the remaining six were external leakages. Three of the six

external leakages occurred on the same rig.

The plugged line failure was observed during normal operation. The line was opened by

displacing to different mud and pumping.



During a pressure test scheduled by time, a riser choke line leak at 375 m was discovered.

Pulled the riser and replaced seals on the leaking choke line connection. A lip seal on choke

line was worn down. Re-ran LMRP and riser, landed test tool and commenced BOP testing.

They used 58 hours to repair the leak.

During normal operation they observed a leakage in the choke line connection between CML

riser joint and slick riser joint below. The BOP should be pulled anyway, so this failure caused

minor lost time only.

During a test after running casing or liner a leak was observed when pressure tested the kill line

against fail-safes. The choke line was OK. Displaced kill and choke lines back to OBM and

pressure tested kill and choke lines against fail-safes to 30 bar/5 min and 100 bar/10 min, no

leaks.

While waited on weather for pulling the BOP they failed to pressure test the choke line with

200 bar. Suspect a washed-out leak in stab seals on choke line riser connectors.

During preparations for pulling the BOP to install the X-mas tree they failed to test the kill line

against a closed fail-safe valve. Launched an ROV and observed fluid weeping from kill line

connection between 2 riser joints (only when under 100 bar pressure). Estimated leak rate was

+/-1 liter leak.

During normal operation a leak in the choke line at bottom connection on the modified riser

joint was discovered. Stopped drilling and prepared for pulling riser with riser pump (SPM) for

repair. Pulled riser and changed seals on riser joint and 30 ft pup. Had problems with riser pump

valve during running. Pulled LMRP again, repaired and re-ran LMRP. Pulled EDPHOT and

tested LMRP. They used 125 hours to repair the leak.

All these external leaks reduce the BOP safety availability. However, the most important factor

is that these failures will cause extra problems in case a kick has to be circulated out of the well.

Main Control System, Safety-critical Failures

Table 6.4 shows the safety-critical failures that occurred in the BOP main control systems

during the study.



Table 6.4 Safety-critical Failures in the BOP Control Systems



No of BOP days


MTTF (days in service)

Lower limit

Mean Upper limit

Multiplex electro hydraulic

Emergency automated BOP function failed 1 81,5 1239 0,0658 261 1 239 24 155

Loss of all functions one pod 1 0 1239 0,0000 261 1 239 24 155

Loss of one function one pod 1 0 1239 0,0000 261 1 239 24 155

Loss of one function one topside panel/unit 1 0,5 1239 0,0004 261 1 239 24 155

Other 4 16 1239 0,0129 135 310 907

Total multiplex 8 98 1239 0,0791 86 155 311

Pilot hydraulic

Loss of all functions one pod 2 53 3 973 0,0133 631 1 987 11 180

Loss of one function both pods 1 0,5 3 973 0,0001 838 3 973 77 457

Loss of one function one pod 1 1,25 3 973 0,0003 838 3 973 77 457

Other 4 3,75 3 973 0,0009 434 993 2 908

Unknown 4 0 3 973 0,0000 434 993 2 908

Total pilot hydraulic 12 58,5 3 973 0,0147 204 331 574

Multiplex system failures

Emergency automated BOP function failed. This failure occurred during normal operation it

seems. The AMF (Automatic Mode Function) obviously failed for some reason. Ran the RTTS

plug. Attempted to repair the AMF shuttle valve with an ROV. The attempt failed. Decided to

pull the BOP to surface to repair. Pulled the BOP and replaced the AMF shuttle valve on the

BOP. Pressure tested same to 5000 psi/10 min. Commenced soak testing on BOP. Ran the BOP.

Tested the BOP and pulled the RTTS.

Loss of all functions one pod. This failure occurred during normal operation with the BOP on

the wellhead. They turned off the blue pod, likely because of a failure. Six hours later they

turned on blue pod back-up control unit and confirmed control unit was ok. There was no more

information. It is assumed that the blue pod failed to operate the BOP.

Loss of one function one pod. This failure occurred when the BOP was on the wellhead during

normal operation. When performing a function test of the BOP stack they could not operate the

outer bleed valve from the blue pod.

Loss of one function one topside panel/unit. This failure occurred when the BOP was on the

wellhead during normal operation. They were unable to open the UPR from tool pusher’s panel.

Opened it from the driller’s panel. Function tested UPR from tool pusher’s panel 2 days later.

Other. This failure occurred when the BOP was on the wellhead during normal operation. The

subsea engineer investigated a BOP leakage by operating BOP valves while observing the BOP

with the ROV. Found the leak at upper inner blue pod choke line fail-safe SPM valve. Sat the

function in open position, and the leak disappeared.

Other. This failure occurred when the BOP was on the wellhead during normal operation.

Observed the HPU pump for BOP control fluid starting irregularly, indicating leak on system.

Troubleshot same. Isolated conduit lines on surface and on BOP. Observed a pressure drop of

300 psi in 1 minute on yellow conduit. HPU was stable while yellow conduit was isolated.

Function tested BOP rams, annulars, and fail-safes with conduit lines isolated and hot line as

supply. Decided to continue operation with hot line as secondary system. De-isolated blue



conduit. The conduit line was repaired two weeks later, when the BOP was pulled to repair the

AMF shuttle valve.

Other. This failure occurred when the BOP was on the wellhead during normal operation.

Inspected the BOP blue pod with an ROV. Found a leak on 1/4 line to stack accumulator read

back gauge. Isolated charge line to accumulators in the lower stack and the leak stopped

Other. This failure occurred when the BOP was on the wellhead during normal operation. They

were in the process of P&A the well when a leak was observed on the hydraulic hot line.

Performed riser/BOP cleanout run and tagged cement at 504 m. Displaced well to seawater.

POOH with riser brush assembly. Prepared to disconnect LMRP. Pulled LMRP and repaired

leak on hydraulic hot line. Latched LMRP on BOP. Had to repair the hot line three times

Pilot hydraulic system failures

Loss of all functions one pod. This failure occurred when the BOP was on the wellhead during

normal operation. Prior to drilling 8 1/2 section they observed leakage of BOP control fluid

from the yellow pod. Trouble shot same. Disconnected LMRP, pulled to surface and changed

out faulty gas relief vent valve. Re-ran LMRP.

Loss of all functions one pod. This failure occurred when the BOP was on the wellhead during

normal operation. It was only stated troubleshot leakage on yellow pod. It was not stated if the

problem was repaired. The well was finished, and the BOP pulled three days later. The failure

mode is assumed

Loss of one function both pods. This failure occurred when the BOP was on the wellhead during

normal operation. They attempted to open the BSR but did not receive the correct return flow.

Investigated the problem and discovered that the BSR boost system was activated. Turned off

the boost. Found that the quick dump valve had hung up. Opened the BSR.

Loss of one function one pod. This failure occurred when the BOP was on the wellhead during

normal operation. They were not able to get pressure to open the wellhead connector and

disconnect the BOP. Troubleshot on BOP system, leak observed. Opened wellhead connector

and pulled BOP above template.

Other. Pulled yellow BOP pod to surface due to leaking control line of the pod latch function.

Changed latch function to another control line, ran pod into sea and latched onto LMRP.

Other. Observed leak in secondary unlatch line on blue pod when unlatching the LMRP due to

bad weather. While WOW retrieved blue pod to surface and changed line for secondary unlatch.

Ran blue pod to BOP and latched same.

Other. Small leakage in BOP JIC fitting on high-pressure shear system. Pulled bottom hole

assembly through window due to inspection of leaking valve on BOP. Tightened fittings on

BOP shifting valve with ROV.

Other. Observed erratic readback pressure on blue pod subsea annular regulator. Pulled blue

pod for inspection (subsea regulator suspected stuck). Function tested BOP via blue pod on

drillers panel, ok. Confirmed blue pod fully functional after repair.



Unknown. During normal operation a leak was observed on the yellow pod. Investigated leak.

There was no more information.

Unknown. A safety valve in the BOP main control room (set @3200 psi) blew (assumed while

switching from yellow to blue pod), and high-pressure hose installed upstream safety valve

burst (supposedly as an effect of high flowrate through restricted dimension). Thus, decided to

abort function testing for now, to replace defect hose and safety valve.

Unknown. It was only stated; ran and installed blue pod. This occurred just after they had

finished testing the BOP from the yellow pod. There is no indication why the pod was pulled

in the first place. Function tested the BOP on the blue pod the day after.

Unknown. It is not known what failed. It was only stated that they ran the blue pod. The ROV

followed pod to seabed. Before running the blue pod, inspected the BOP down to BSR with the

ROV, and found no anomalies.

Back-up Control System, Safety-critical Failures

Table 6.4 shows the safety-critical failures that occurred in the BOP back-up control systems

during the study.

Table 6.5 Safety-critical Failures in the BOP Control Systems



No of BOP days


MTTF (days in service)

Lower limit

Mean Upper limit

Acoustic

Failed to operate one BOP function by the acoustic system 2 71,5 5 212 0,0137 828 2 606 14 667

Other 3 77,75 5 212 0,0149 672 1 737 6 374

Unknown 1 0,5 5 212 0,0001 1 099 5 212 101 612

Total acoustic 6 149,75 5 212 0,0287 440 869 1 995

Failed to operate one BOP function by the acoustic system. The failure occurred on a BOP test

after running casing or liner during function testing. It was only stated that they attempted to

close the BSR with the acoustics from the control room. Re-tested function from the bridge.

Failed to operate one BOP function by the acoustic system. The failure occurred on a BOP test

after running casing or liner. A SPM valve on the BOP acoustic control system leaked, and it

was impossible to boost close the blind shear ram. The well was plugged, and the BOP pulled

to repair the failure.

Other. The failure was observed during a normal operation. A hydraulic leakage was observed

in the acoustic system. The subsea engineer investigated the leakage. He armed the acoustic

system and observed that the leak stopped. Performed additional function tests of the acoustic

system and verified that the acoustic system was functional.

Other. The failure was observed during a test after running casing or liner. When function

testing the blind shear ram on the acoustic system a leakage between the blind shear ram and

the acoustic system was observed. Armed the acoustic unit and reset the acoustic system, and

the leakage disappeared.



Other. The failure was observed during normal operation. Observed a hydraulic leak on the

BOP controls. Identified leak to the accumulator bottles for the acoustic functions and the

DMAS. The leak was also observed by an ROV. Ran RTTS packer and pulled the BOP.

Dismantled and inspected the leaking SAE flange and found a burst O-ring between the adapter

plate and the T-piece. The connection was mounted with two different manufacture parts.

Repaired and re-ran BOP.

Unknown. The failure was observed during a test scheduled by time. There were some issues

while testing the acoustic system on the BOP. Re-tested acoustic system on BOP. Function-

tested LPR and UPR acoustic. It was not listed what the issues were

6.3 RANKING OF FAILURES WITH RESPECT TO SAFETY CRITICALITY

The frequency of failures that occurred in the safety-critical period is higher than in the DW

and kick (/1/) study.

When comparing the overall frequency of failures that occurred in the safety-critical period

from the present study with the frequencies in the previous studies, Phase II DW and Phase I

DW, the frequencies are in the same order of magnitude. The frequencies are a bit higher

compared with the most recent DW and kick study.

It is noteworthy that, in the present study the most serious BOP failure modes were not

observed. Failure modes, such as leakage in the wellhead connector, external leakage in rams,

and total loss of BOP control through the main control system were not observed. Leaking

preventers or valves are rare in the present study. The most critical observation was a high

number of leaks in choke and kill lines.

Table 6.6 lists a coarse ranking of the most severe failures that occurred in the safety-critical

period in the present study. The same ranking from the previous studies, DW and kick, Phase

II DW, and Phase I DW, is presented alongside.



Table 6.6 Coarse ranking of most severe failures occurring in the safety-critical period

according to severity

Present study Norway (2016 – 2018) DW and kick (/1/) (2007-2009, US GoM OCS) 1. Nine external leaks in choke and kill lines 2. Two failures that caused loss of all functions

one pod 3. Internal leakage (leakage through a closed

annular) 4. Internal leakage (leakage through a closed

choke/kill valve) 5. One loss of one function both pods 6. Two loss of one function one pod


2. One spurious opening of the LMRP connector (Unknown cause, no autoshear in BOP)


4. One shear ram leakage in closed position 5. Upper and lower variable bore ram leaked at the

same time 6. Two incidents, pipe ram failed to close 7. Nine incidents, loss of all functions one pod 8. Two incidents, pipe rams leaked in closed

position 9. One flexible joint external leak 10. One failed to close annular incident 11. Four incidents, annular preventer leak 12. Six choke and kill line leaks 13. Five incidents with loss of one function both

pods

Phase II DW BOP study (/2/) (1997-1999, US GoM OCS)

Phase I DW BOP study (/4/) (1992-1996, Brazil and Norway)


2. One spurious opening of the LMRP connector (control system failure)

3. One shear ram failed to close 4. One shear ram leak in closed position 5. Two failures to open pipe ram 6. Two failures where the pipe ram leaked in

closed position 7. External leak in flexible joint 8. One failure to disconnect the LMRP 9. Four failures that caused loss of all functions

one pod 10. Loss of one function both pods (annular close) 11. Four annular preventer leaks in closed position 12. One choke and kill line leak (jumper hose)


2. One failure where they failed to shear the pipe during a disconnect situation

3. One external leakage in the connection between lower inner kill valve and the BOP stack

4. Five failures that caused total loss of the BOP control by the main control system

5. Two shear ram leakages in closed position 6. Two failures to disconnect the LMRP 7. Seven failures that caused loss of all functions

one pod 8. One UPR leakage 9. One spurious closure of the shear ram 10. Three annular preventers that leaked in closed

position 11. Six choke and kill line leakages



7. BOP TESTING EXPERIENCE

The subsea BOPs are tested regularly in Norwegian waters. The US GoM OCS BOP testing

regulations have been similar to the Norwegian regulations for many years. The past years the

US requirements have become stricter related to the initial test after landing the BOP and testing

of the BOP emergency features, as emergency disconnect system (EDS), automated mode

function (AMF/Deadman), auto shear, and ROV functions. In other parts of the world the BOP

may be tested according to governmental regulations, or according to operator practices.

7.1 BOP TESTING REGULATIONS

The testing requirements for the subsea BOPs are described in Norsok D-010, rev 4. (/11/).

Annex A to this report shows the detailed requirements. Below, the requirements are briefly

listed.

On stump, prior to running BOP

The BOP shall be pressure tested to the well design pressure. Function test the acoustic system.

Function test ram locking system and casing shear ram.

Installation on wellhead/drilling out of surface casing

Wellhead connector and choke and kill valves to be tested to well design pressure. The rest of

the BOP shall be function tested. Function test the acoustic system and the casing shear ram.

After cementing deeper casing or liner

Test BOP to section design pressure. Function test the acoustic system and the casing shear

ram.

Periodic test

Weekly: Function test the BOP (shall not exceed 7 days since last BOP function test). Check

acoustic communication.

Each 14 days: Pressure test the BOP to section design pressure (shall not exceed 14 days since

last BOP pressure test). Close one ram with the acoustic system.

Miscellaneous tests

Tests of the Emergency disconnect system, Deadman (electric and hydraulic power lost),

Autoshear (when disconnecting) shall be performed with BOP installed on wellhead and is only

required during commissioning or within 5 year of previous test.

A low-pressure test to 15–20 bar for minimum 5 minutes stable reading should be performed

prior to high-pressure testing in the drilling, completion, and intervention activities.

7.2 BOP TEST TIME CONSUMPTION

Table 7.1 presents the number of BOP tests and the test time consumption tests for the various

rigs included in the study. The various test types;



- Installation tests (tests after the BOP has been landed on wellhead the first or subsequent

times, and after the LMRP connector has been landed on the BOP stack)

- Tests after running casing or liner (before drilling out the cement)

- Pressure tests scheduled by time

- Function test scheduled by time

- Other tests (includes all other tests where a BOP component has been pressure tested directly

or as a result of testing other equipment, for instance a seal assembly, shallow well plug, etc.

Only time consumption from tests where the prime objective has been to test a BOP

component have been included)

It should be noted that time used/lost in connection with BOP failures are not recorded as a part

of the BOP test time. Only the test time itself, time for running/pulling of tools and time lost in

connection with tool problems are included in the BOP test time.

Table 7.1 No. of BOP subsea tests, test time consumption, and test type for pressure

tests for the individual rigs

Rig name

Installation test Test after running

casing or liner Test scheduled by

time

Function test scheduled by

time Other

BOP days in service

Average test time per BOP day (hrs)

No. of tests

Average t. time (hrs)

No. of tests


No. of tests


No. of tests


No. of tests


Rig A 5 1,50 12 3,67 7 6,21 8 0,56 8 0,00 211 0,472

Rig B 11 3,30 12 3,42 8 8,13 11 1,11 8 0,22 272 0,574

Rig C 16 0,93 20 4,89 4 7,19 10 0,83 12 0,00 362 0,414

Rig D 6 3,42 13 4,60 5 27,65 3 0,33 8 0,47 255 0,875

Rig E 18 5,89 20 2,20 2 9,13 6 0,54 16 0,13 277 0,626

Rig F 15 3,70 15 3,52 5 15,75 11 1,27 6 0,25 267 0,758

Rig G 10 2,83 6 5,00 23 5,96 29 0,63 19 0,05 496 0,433

Rig H 14 3,20 14 4,00 5 6,95 12 0,69 15 0,02 331 0,435

Rig I 15 8,35 13 7,58 8 7,56 30 0,50 8 0,50 425 0,714

Rig J 33 1,61 36 3,36 11 7,44 9 0,48 34 0,05 495 0,529

Rig K 18 2,85 13 4,50 8 7,38 18 0,96 12 0,00 409 0,455

Rig L 6 2,88 8 2,91 23 9,10 23 0,49 14 0,23 470 0,562

Rig M 8 2,47 6 5,08 3 7,83 4 1,06 5 0,00 164 0,476

Rig N 17 4,57 19 4,54 2 10,38 5 1,05 11 0,05 270 0,706

Rig O 8 2,59 9 3,31 24 7,19 38 0,37 16 0,00 508 0,467

Total 200 3,39 216 4,04 138 8,49 217 0,65 192 0,10 5 212 0,553

Table 7.2 shows the no. of BOP subsea tests, test time consumption, and time between tests for

pressure tests for the individual operators



Table 7.2 No. of BOP subsea tests, test time consumption, and test type for pressure

tests for the individual operators

Operator

Installation test Test after running

casing or liner Test scheduled by

time Function test

scheduled by time Other

BOP days in service

Average test time per BOP day (hrs)

No. of

tests


No. of tests


No. of tests


No. of tests


No. of tests


Operator A 3 0,83 4 7,00 2 4,50 5 1,20 3 0,00 99 0,460

Operator B 1 1,75 2 3,75

18 0,514

Operator C 17 4,57 19 4,54 2 10,38 5 1,05 11 0,05 270 0,706

Operator D 19 5,68 22 2,60 2 9,13 8 0,66 16 0,13 318 0,600

Operator E 23 2,93 16 4,45 10 7,90 18 0,94 16 0,00 491 0,478

Operator F 15 8,35 13 7,58 8 7,56 30 0,50 8 0,50 425 0,714

Operator G 120 2,43 135 3,66 111 8,48 148 0,58 135 0,10 3 494 0,523

Operator H 1 4,00 4 6,00 3 14,17 3 2,17 2 0,00 84 0,917

Operator I 1 1,00 1 6,50

1 0,00 13 0,577

Total 200 3,39 216 4,04 138 8,49 217 0,65 192 0,10 5 212 0,553

The total time used for testing is 2884 hours, representing on average 0,553 hours per BOP day,

that again represents 2,3% of the time.

It is a general impression that there are fewer problems with test tools than it used to be back

in the 80ties and 90ties. Also, the test tools have become more advanced so fewer runs are

required to land a test plug and to continue operation after testing.

An issue related to this dataset is that a lot of batch drilling has been carried out. This means

that the BOP has been moved around among several wells. Many of the tests that are regarded

as an installation test would for a “normal“ well be categorised as a test after running casing

and liner.

It is a large variation in average BOP test times among the various rigs and operators. Rig D

had the highest average test time per day in service. The main reason for this was an event

where a test tool seal ring was lost in hole and they used more than four days to retrieve it. Rig

F experienced a high average BOP test time for the pressure tests scheduled by time. This was

caused by two tests where they experienced severe test equipment problems and prolonged test

time.

For Rig I, they had the highest average test time consumption during both the installation test

and the test after running casing or liner. The main reason was that both for the installation test

and the test after they had been running casing or liner, they perform a full pressure test for

nearly all tests. Many of the rigs do not perform a full BOP pressure test after running casing

or liner. The full pressure tests were typically replaced by a well pressure test and a BOP

function test. This reduces the total test time consumption.

In addition, some perform a full BOP test after landing the BOP, when only a connector test is

required if the BOP has been fully pressure tested on rig prior to running.

Table 7.3 shows an overview of number of full BOP tests and partly BOP tests during

installation test and test after running casing and liner.



Table 7.3 Overview of number of full BOP tests and partly BOP tests during

installation test and test after running casing and liner

Operator

Installation test Test after running casing or liner

No. of tests Average test time per test No. of tests Average test time per test

Partly test*

Full test**

Total Partly test

Full test

Total Partly test

Full test

Total Partly test

Full test Total

Operator A 3

3 0,83

0,83

4 4

7,00 7,00

Operator B 1

1 1,75

1,75 1 1 2 0,75 6,75 3,75

Operator C 15 2 17 4,13 7,88 4,57 6 13 19 0,21 6,54 4,54

Operator D 9 10 19 1,69 9,28 5,68 12 10 22 0,44 5,20 2,60

Operator E 19 4 23 2,16 6,63 2,93 7 9 16 0,54 7,50 4,45

Operator F 3 12 15 3,83 9,48 8,35 1 12 13 0,00 8,21 7,58

Operator G 96 24 120 1,63 5,63 2,43 62 73 135 0,40 6,42 3,66

Operator H 1

1 4,00

4,00 2 2 4 0,00 12,00 6,00

Operator I 1

1 1,00

1,00

1 1

6,50 6,50

Total 148 52 200 1,99 7,38 3,39 91 125 216 0,40 6,70 4,04

* Partly test is typical a well and/or a connector test, and a BOP function test ** Full test is a test that includes a pressure test of the various BOP components

Ninety-one of the 216 tests after running casing were not a full BOP test. For the 91 tests the

operators had typically performed a full BOP test some few days earlier. The operators have

evaluated the risk related to not performing the full BOP test after running the casing or liner

and concluded that this will not significantly affect the risk if the time since the last full BOP

pressure test is less than two weeks.

A check of the time since the last full BOP tests was done for these partly tests. The average

time since the last full BOP test was found to be 6,8 days. Only two of the 91 tests exceeded

two weeks. For one, it was 19 days since last test and for the other, it was 17 days.

Twenty-one of the 200 installation tests were tests after the LMRP had been reconnected. Five

of these tests were full BOP tests while 16 were partly tests.

7.3 TESTING OF ACOUSTIC FUNCTION AND BLIND SHEAR RAM

When reviewing the various tests, it has been identified what tests that included some sort of

activation of the acoustic back-up system and activation of blind shear rams. Table 7.4 shows

an overview of tests identified.

Table 7.4 No. of tests that included some sort of activation of the acoustic back-up

system and activation of blind shear rams.

Test type Installation

test

Test after running

casing or liner

Test scheduled

by time

Function test scheduled by

time Other Total

Total number of BOP tests 200 216 138 217 192 963

No. of tests including some sort of acoustic activation

79 93 66 53 21 312

No. of tests including blind shear ram function test

50 79 92 125 41 387

No. of tests including blind shear ram pressure test

128 95 12 84 319



It is here important to note that the data is based on the text in the daily drilling reports and

course evaluations. There are likely several more activations of the acoustic systems and the

blind shear ram than shown in Table 7.4.

7.4 OTHER TESTS

There are 192 tests categorized as other tests. Of these other tests, 151 have been a pressure test

involving parts of the BOP. The primary objective of the test may have been to test specific

BOP preventers or equipment shallow or deep in the well.

When looking at these 151 pressure tests the uppermost preventer used were;

1. Annular, 14 tests

2. Blind shear ram, 83 tests

3. Upper pipe ram, 15 tests

4. Middle pipe ram, 28 tests

5. Lower pipe ram, 7 tests

6. Unknown preventer, 4 tests

All these tests involve a pressure that may reveal an external leak in the BOP. A coarse review

of the tests showed that approximately 50% involved equipment shallow in the well (seal

assembly, shallow plug, tubing hanger seals, etc), i.e. the test volume was small. Approximately

50% were tests including equipment deep in the well (casing, deep-set plugs, liner seal

assembly, production packer, etc.). The tests involving small volumes are better suited to reveal

minor external leaks in the BOP than the tests with large volumes.

7.5 COMPARISON WITH PREVIOUS STUDIES

In the several of the previous subsea BOP studies information about BOP test times have been

systematically collected. Table 7.5 and Table 7.6 shows some key data from the various studies.

Table 7.5 Test time consumption in various studies, including all test types

Study BOP days

Total test time (hrs)

Average test time per BOP day incl all

tests

% of drilling time

Years drilled and country

Phase IV (/7/)

3 809 2 676 0,70 2,9% 1982-1986 Norway (Weekly pressure test, no low-pressure test)

Phase V (/6/)

2 636 1 480 0,56 2,3% 1987-1989, Norway (Weekly pressure test, no low-pressure test)

DW I (/4/) 4 846 3 456 0,71 3,0% 1992-1996, Brazil and Norway, includes both

deep and shallow water

DW II (/2/) 4 009 4 981 1,24 5,2% 1997-1999, US GoM OCS, deeper than 300

meters of water

Present study*

5 212 2 884 0,553 2,3% 2016 – 2018 Norway, mostly 200 – 500 meters of water

* Includes 160,9 hours Function test scheduled by time and Other tests.

Table 7.5 shows that the average test time consumption in the present study is at the same low

level as the Phase V study from the 80ties.



Table 7.6 Time between pressure tests, and average pressure test time

Study BOP days

Total no. of BOP pressure tests (Installation, after running casing or liner and periodic tests)

Average no. of BOP days between a BOP test

Average BOP test time

Phase IV (/7/) 3 809 358 10,64 7,5

Phase V (/6/) 2 636 253 10,42 5,9

DW I (/4/) 4 846 420 11,54 8,1

DW II (/2/) 4 009 349 11,49 13,9

Present study 5 212 559 9,32 4,9

When comparing Phase V results with Phase IV results, the average BOP test time decreased

significantly, from 7,5 hours to 5,9 hours. This average BOP test time reduction may partly be

explained by that one of the rigs, during Phase IV of the study, had a more complex BOP test

than the other rigs. This rig had a significant influence on the average BOP test time. Further,

combined test tools that reduced the number of necessary runs associated to BOP became more

common.

Low-pressure tests were rarely performed in the 80ties. A low-pressure test will typically

prolong each BOP test time with approximately 0,5 - 1 hour. In the DW I study, all the BOP

pressure tests included a low-pressure test. This was a study where most of the data stemmed

from Brazilian deepwater wells. Increased water depth increases the handling times when

running test tools. The typical holding time for each high-pressure time for Brazilian BOP tests

wells was 5 minutes, and not 10 that is the normal in Norway. This reduces the total test time.

Further, very few BOP tests scheduled by time was carried out for the Brazilian wells, that also

will reduce the average test time per BOP day .

In the DW II study the average test time increased significantly compared to the DW I study.

The average water depths for the two studies were similar.

The main reasons for the differences between DW I and DW II are believed to be:

• In Phase II DW variable bore rams (VBRs) normally were tested on two diameters, thus

increasing the number of tests. Normally a telescopic type test joint was used for this

testing. Due to problems with a dart for this type of test joint for some rigs they frequently

made two test plug runs with different joint diameter.

• In Phase I DW relatively more tests were performed after running casing (periodic tests

were seldom performed) and the casing pack-off tool was then used. The average test time

when using the casing pack-off tool for BOP testing is lower than using the other tools.

• In Phase II DW the high-pressure holding times were 10 minutes vs. 5 minutes in Phase I

DW study. The blind-shear ram test pressures were held for 30 minutes.

The present study has on the average the shortest subsea BOP test times. Most of the drilling

has been in shallow water, reducing the tool handling time. The main reason is believed to be

that a large proportion of the tests after running casing or liner are partly tests, and not full tests

(see Table 7.3, page 81).



8. WELL KICKS

When collecting kick data, only the period when the BOP has been located on the wellhead has

been considered, i.e., shallow gas or shallow water-flows are not considered.

Table 3.2, page 26, shows the operators represented with drilling in the present study. A total

of 130 mother wells or 182 well paths (when sidetracks and multilaterals are counted as

separate wells) are included. A total of 5 212 BOP days is included.

It is also observed that far more development drilling is carried out than exploration drilling.

The main criteria for defining a well control incident as a kick is that the BOP was needed to

control the situation. The meaning of “Control the situation” is to both close in the well with the

BOP and to circulate the kick/let it be buoyed out (in case stripping failed) in a controlled way until

the situation is normalized.

8.1 KICKS OBSERVED

A total of five well kicks were observed, three in exploration wells and two in development

wells. Table 8.1 shows an overview of the kicks identified and key data related to the kicks.

For two of the exploration kicks (kick 1 and 2), they observed a sudden increase in the rate of

penetration during drilling (drilling break).

For the third kick (kick 4) in an exploration well, the well kicked during plugging and

abandoning the well. They were pulling the seal assembly when trapped gas below the seal

assembly caused the well to kick.

One of the two kicks in a development well occurred when plugging and abandoning the well

(kick 3). When pulling the tubing hanger plug gas below the plug caused the well to kick. It

was believed that the gas stemmed from the natural gas lift zone in the well through a leaking

gas lift valve.

The second development drilling kick (kick 5) occurred after they had just set a balanced

cement plug from 1943 to 1727 m. They then got losses after having pumped 28,3 m3 of 1,45

sg OBM. When diluting mud from 1,45 sg to 1,40 sg they observed a gain.



Table 8.1 Overview of the kicks identified and key data

Kick ID Activity and observations before kick Interpretation and handling of incident Phase Operation Activity

1

Drilled 12 1/4 hole. Observed drilling break. Stopped drilling to flow check well

Pressure built up gradually. Circulate kick out of well by Driller`s method,

Explor-ation

Drilling Drilling

Csg OD (inch)

Csg shoe TVD (m)

LOT eq MW (sg)

Well depth when kicked TVD (m)

Diameter pipe in BOP (inch)

Mud weight (sg)

Mud weight ECD (sg)

Kill mud weight (sg)

Kick size (BBL)

Kick med-ium

SIDPP (Bar)

SICP (Bar)

Killing method

Killing duration (days)

Comments

14 3147,4 1,883 3635 5 1,713 1,72 1,9 6,3 gas 67 71 Drillers method

3,778

Operator classified this as a yellow kick


2

Drilled 12 1/4 hole. Observed drilling break

Monitored pressure against. Circulated kick out using driller`s method.

Explor-ation

Drilling Actual drilling

Csg OD (inch)

Csg shoe TVD (m)

LOT eq MW (sg)



Mud weight (sg)

Mud weight ECD (sg)


Kick size (BBL)

Kick med-ium

SIDPP (Bar)

SICP (Bar)

Killing method


Comments

14 2995,5 1,82 3563 5 1,7 1,75 1,76 0,9 gas 11,5 10 Driller`s method

1,2466

Operator classified this as a green kick


3

POOH w/ TH plug with restricted speed on 5 1/2 HWDP from 350 m to 177 m.

Observed gain. Closed BSR and monitored pressure. Lined up and circulating down Kill line up Choke line to circulate out residual gas. Continued circulation until gas in mud decreased from to 0,5%. Gas assumed coming from natural gas lift zone in the well. Position of Gas Lift Valve uncertain when well handed over from operations.

Develop-ment

Plug and abandon

Pull tubing hanger plug

Csg OD (inch)

Csg shoe TVD (m)

LOT eq MW (sg)



Mud weight (sg)

Mud weight ECD (sg)


Kick size (BBL)

Kick med-ium

SIDPP (Bar)

SICP (Bar)

Killing method


Comments

1,08 Gas 30 Circulating

0,625


4

RIH with MPT and latched onto 9 5/8 Seal Assembly. Closed Lower Annular Preventer and pulled Seal Assembly free with 63-ton overpull. Observed pressure build up due to gas below Seal Assembly.

Pressure on closed choke increase from 0 to 17 bar. Closed fail-safes on kill line and lined up to pump down string and up choke line. Observed 29 bar on string and 16,4 bars on choke line. Pumped until gas in both choke line and string was choked out. Circulated until 1,20 sg mud in return and decreasing gas trend.

Explorat-ion

Plug and abandon

Pull seal assembly free

Csg OD (inch)

Csg shoe TVD (m)

LOT eq MW (sg)



Mud weight (sg)

Mud weight ECD (sg)


Kick size (BBL)

Kick med-ium

SIDPP (Bar)

SICP (Bar)

Killing method


Comments

5 1,2 1,2 Gas 17 17 Circulat-ing

0,354

Trapped gas below seal assembly


5

Just set a balanced cement plug from 1943 to 1727 m. Losses after having pumped 28,3 m3 of 1,45 sg OBM. Diluting mud from 1,45 sg to 1,40 sg. Observed gain.

Flow checked well. Unstable well. SPP: 4 bar, Kill: 4 bar, Choke: 3 bar. Displaced well to 1,43 sg OBM. Flow checked well. Unstable well. Flow back rate 0,3 m3/hrs. Pumped 45 m3 of 1,45 sg OBM through booster line. Flow checked well, well stable.

Develop-ment drilling

Cementing plug

Pull out cement string

Csg OD (inch)

Csg shoe TVD (m)

LOT eq MW (sg)



Mud weight (sg)

Mud weight ECD (sg)


Kick size (BBL)

Kick med-ium

SIDPP (Bar)

SICP (Bar)

Killing method


Comments

13,37 1284 1,52 3,5 1,4 1,43 Unknown

4 4 Circulat-ing

0,469 Small kick



8.2 KICK FREQUENCIES

By combining the kick information in Table 8.1 and the number of wells in Table 3.2, page 26,

kick frequencies have been established. Table 8.2 shows the kick frequencies.

Table 8.2 Kick frequencies in Norwegian wells spudded in 2016 and 2017

Operator No. of well

paths

No. of mother

wells

No. of BOP days

No of kicks

Kick frequencies

Per well path

Per mother well

Per 1000 BOP days

Development wells 137 95 3 930 2 0,015 0,021 0,509

Exploration wells 45 35 1 282 3 0,067 0,086 2,340

Total 182 130 5 212 5 0,027 0,038 0,959

8.3 COMPARISON OF THE KICK FREQUENCY VS. OTHER STATISTICS

Through a series of studies SINTEF and Exprosoft have established kick statistics from various

areas and periods. Below a brief description of the various datasets are given.

Canadian East Coast (1970 - 1993). These kick data originally stem from the Alberta Energy

and Utilities Board in Canada. A total of 55 kicks (included shallow kicks) were experienced

during drilling these 273 wells.

Canadian Beaufort wells deep (1973 - 1991). The kick data is based on a spreadsheet

extracted from the Canadian EUB and Downloaded Well files from Northwest Territories,

Geoscience Office (2007).

Norwegian offshore (1984 -1997). Most of the kick data was originally collected through a

Ph.D. work (/19/). The exploratory wells are typically drilled in water depths ranging from 50

to 400 meters. Most of the exploratory wells are drilled with semisubmersible rigs while the

development wells are mostly drilled from jackets or concrete structures.

US GoM OCS deepwater (1997 - 1998). This frequency is based on kick data collected by

SINTEF/Exprosoft in (/3/). Many of the US GoM deepwater wells are deep and HPHT wells.

US GoM OCS deepwater (2007 - 2009). This frequency is based on kick data collected by

Exprosoft in (/1/).

Kick data from the UK for the period 1999-2008 has been published (/14/). The UK drilling

activity can be found at the UK Oil and Gas Authority web page (/18/). By combining the UK

kick and well drilling information, overall kick frequencies were established.

Norwegian Offshore (2009 – 2014). The Petroleum Safety Authority (PSA) in Norway

published Norwegian kick statistics from the year 2000 in the project “Trends in risk level in

the petroleum activity (RNNP)” (/15/). The kick statistics was established when working with

the report (/16/) based on descriptions of the individual kicks provided by the PSA.

US GoM OCS (2011 - 2015). The kicks in this section have been identified from the verbal

description in the BSEE eWell WAR (Well Activity Reports) for wells spudded in the period

2011-2015 in US GoM OCS (/16/).



Table 8.3 shows an overview of all the kick frequencies.

Table 8.3 Kick frequencies per well drilled comparison

DATASET No. of kicks

No. of wells

Kick frequency per well drilled Shallow kick

included 5% conf

limit Estimate

95% conf limit

Canadian East Coast (1970 - 1993), Exploration wells (/12/) 55 273 0,159 0,201 0,252 Yes

US GoM OCS deepwater

Explorati-on wells

Well drilled 1997 - 1998 (/3/) 39 58 0,506 0,672 0,878

No

Wells drilled 2007 – 2009 (/1/) 74 206 0,293 0,359 0,436

TOTAL 113 264 0,364 0,428 0,500

Develop-ment wells

Well drilled 1997 - 1998 (/3/) 9 25 0,188 0,360 0,628

Wells drilled 2007 – 2009 (/1/) 7 53 0,062 0,132 0,248

TOTAL 16 78 0,129 0,205 0,312

Norwegian wells drilled 1984 -1997 (/13/)

Explorat-ion, Appraisal wells

Normal (Well depth < 4000m TVD) 15 121 0,076 0,124 0,191

No

Deep (Well depth > 4000m TVD, not incl. HPHT)

7 24 0,137 0,292 0,548

HPHT wells 4 5 0,273 0,800 1,831

Total 26 150 0,121 0,173 0,241

Explorat-ion, Wildcats



29 87 0,238 0,333 0,454

HPHT wells 64 44 1,169 1,455 1,791

Total 117 426 0,234 0,275 0,320

TOTAL exploration 143 576 0,215 0,248 0,285

Development wells 272 1,478 0,166 0,184 0,203

Canadian Beaufort wells deep (1973 - 1991), Exploration wells, (/12/)

42 86 0,371 0,488 0,632 No

UK wells (1999-2008) (/14/)

Exploration wells 74 862 0,070 0,086 0,104 Yes

Development wells 218 3,082 0,063 0,071 0,079

Norwegian wells drilled 2009 -2014 (/16/)

Explorat-ion, Appraisal


No Explorat-ion, Wildcat



7 41 0,080 0,171 0,321

HPHT wells 5 6 0,328 0,833 1,752

Total 22 229 0,065 0,096 0,137

TOTAL exploration 23 323 0,049 0,071 0,101

Development wells 50 875 0,045 0,057 0,072

US GoM OCS (2011 – 2015) (/16/)

Explorat-ion wells


Yes

Deep (Well depth > 4000m TVD 111 215 0,438 0,516 0,604

Total 143 300 0,413 0,477 0,548

Develop-ment wells


Deep (Well depth > 4000m TVD 44 157 0,215 0,280 0,360

Total 122 821 0,127 0,149 0,173

Norwegian wells drilled 2016 -2018 (this study)

Exploration wells 3 45 0,018 0,067 0,172

No Development wells 2 137 0,003 0,015 0,046

Total 5 182 0,011 0,027 0,058

All exploration well 596 2729 0,204 0,218 0,234 Yes and

no All development wells 602 5807 0,097 0,104 0,111

All wells and kicks 1198 8536 0,134 0,140 0,147

Figure 8.1 shows a graphical overview of the overall kick data from the various data sources

alongside the frequencies from the present study.



Figure 8.1 Overview of kick frequencies

The frequency of kicks in the present study is lower than in all other studies. However, the

number of occurrences is low, and the statistical uncertainty is high. The kick frequency is in

the same order of magnitude as the kick frequency from the Norwegian wells drilled in 2009 -

2014 and the kick frequency from the UK wells drilled in 1999 to 2008. When comparing with

the Norwegian kick frequency from 1984 – 1987, it is significantly lower.

By comparing the US GoM OCS 2011–2015 kick frequency with the most recent statistics

from Norway and the UK, the kick frequency is significantly higher in the US GoM OCS. The

US GoM OCS kick frequency in the earlier studies are also significantly higher.

It is not known why the observed kick frequency in the US GoM OCS is so much higher than

the most recent data Norway. There may be several reasons, including:

1. Many US GoM wells are extremely deep and take a long time to drill. This increases

the probability of having a kick due to the increased exposure time.

2. US GoM OCS may be a more complicated area to drill due to different formations.

Narrow margin between pore pressure and fracture gradient constitutes a typical

problem that causes many kicks.

3. Some of the shallow water wells in the US GoM OCS may be drilled with less

advanced instrumentation.

4. There may be different requirements for drilling personnel qualifications in the US

GoM OCS as compared to Norway and the UK.

5. The well control policies with respect to mud weight and casing program may be

different.

For the three US GoM OCS datasets and the dataset from the present study also the number of

days in service has been recorded, and not only the number of wells drilled. Table 8.4 shows a

comparison of the kick frequency per BOP day in service.



Table 8.4 Kick frequencies per BOP day comparison

* US GoM OCS (2011 – 2015) data includes time in service and kick from before the BOP was landed on the wellhead, likely

to give too low kick frequency compared to when using BOP days

It is observed that when measuring the kick frequency per BOP day in operation the 2016 –

2018 Norwegian kick frequency is much lower than any US kick frequency.

8.4 LEAK OFF PRESSURE VS. MAXIMUM MUD WEIGHT

The kick statistics shows that the kick frequencies in the US GoM OCS are higher than in

Norwegian waters. Some of the possible causes for this difference has briefly been mentioned

in the previous subsection.

In the deepwater BOP and kick study (/1/) information related to LOT (Leak Off Test) and FIT

(Formation Integrity Test) and mud weight (MW) was systematically collected for the various

casing sections. Further, the maximum mud weights used when drilling for the next casing

sections were identified. The same information was also collected in the present study. This

information was found for 518 casing sections in the US GoM OCS wells, and 228 casing

sections in the Norwegian wells. For the US GoM OCS wells there were 303 FITs, 201 LOTs,

and 14 unknown if FIT or LOT. For the Norwegian wells sections there were 189 FITs, 23

LOTs, and 16 XLOTs (Extended Leak Off Test). It should be noted that there are some

uncertainties related to the accuracy of these numbers. Table 8.5 shows and overview of the

data.



Table 8.5 Max mud weight – LOT or FIT for well sections, both exploration and

development wells

FIT/LOT - max MW (sg)

Norway (2016 – 2018) US GoM OCS (2007 – 2009)

Percentage of sections

Cumulative Percentage of

sections Cumulative

<=0,05 8,8% 8,8% 20,3% 20,3%

0,05-0,1 13,6% 22,4% 35,5% 55,8%

0,1-0,15 21,5% 43,9% 23,2% 79,0%

0,15-0,2 23,2% 67,1% 12,9% 91,9%

0,2-0,3 12,7% 79,8% 5,8% 97,7%

0,3-0,4 11,0% 90,8% 2,3% 100,0%

>0,4 9,2% 100,0% 0,0%

As seen from Table 8.5, the margins between FIT/LOT and max MW is in overall lower in the

US GoM wells than in the Norwegian wells. In the US 55,8% of the well sections have a

difference between the FIT/LOT and max MW lower than 0,1 sg. In Norway, this applies for

22.4%.

The drilling margin is in average lower in the US wells than in the Norwegian wells, that will

cause an increased probability of kick.

Table 8.6 and Table 8.7 shows the same data as in Table 8.5, but now split up in exploration

and development wells.

Table 8.6 Max mud weight – LOT or FIT for well sections, exploration wells


Norway (2016 – 2018) US GoM OCS (2007 – 2009)



sections Cumulative

<=0,05 10,8% 10,8% 19,0% 19,0%

0,05-0,1 20,0% 30,8% 35,2% 54,3%

0,1-0,15 18,5% 49,2% 24,3% 78,6%

0,15-0,2 23,1% 72,3% 13,6% 92,1%

0,2-0,3 13,8% 86,2% 6,9% 99,0%

0,3-0,4 7,7% 93,8% 1,0% 100,0%

>0,4 6,2% 100,0% 0,0%

Table 8.7 Max mud weight – LOT or FIT for well sections, development wells


Norway (2016 – 2018) US GoM OCS (2007 – 2009)



sections Cumulative

<=0,05 8,4% 8,4% 27,2% 27,2%

0,05-0,1 11,7% 20,1% 39,1% 66,3%

0,1-0,15 24,0% 44,2% 19,6% 85,9%

0,15-0,2 24,7% 68,8% 10,9% 96,7%

0,2-0,3 13,0% 81,8% 1,1% 97,8%

0,3-0,4 13,0% 94,8% 2,2% 100,0%

>0,4 5,2% 100,0% 0,0%



The reason for this difference has not been investigated, but it seems reasonable to believe that

difference in geology may be one contributing cause for this, another may be differences in

well casing design.



9. ABILITY TO CLOSE IN A KICK WITH THE BOP

9.1 INTRODUCTION

The primary barrier against blowouts during drilling is the hydrostatic pressure imposed by the

mud column. The BOP is a secondary barrier against blowouts alongside the casing, the

formation, the cement outside casing, etc. If the hydrostatic pressure from the mud column

becomes too low, a kick may occur. Then, if one of the secondary barriers fails a blowout may

result.

A fault tree models has been established, reflecting a typical BOP design used in the Norwegian

waters (as shown in Figure 3.1, page 24), to assess the probability of the BOP’s ability to close

in a well kick.

The reliability data used as input for the analyses are based on data collected during the various

BOP studies. Section 4.1, page 30, gives an overview of the various studies. The reliability data

from the data collection carried out during the present study has been given most weight.

With the blowout probability model, it is possible to better analyse how the various BOP system

assumptions and reliability data affect the total ability to close in kicks. The exact probability

of being able to close in a "normal" kick found from the analysis is not regarded as the important

parameter in the present study. The important aspect to focus is the relative differences between

the various cases analysed.

It is important to note that the model only considers kicks that may be confined by the BOP.

The following typical blowouts are not included in the model:

• Shallow gas blowouts (before the BOP is landed)

• Blowouts outside the casing

• Blowouts through the drill-pipe

• Underground blowouts

Fault tree analysis and symbols are briefly described in Annex B to this report. Several

textbooks related to fault tree construction and analyses exist, among them /10/. The CARA

FaultTree software has been used for constructing the fault tree.

9.2 PARAMETERS AFFECTING THE BOP’S ABILITY TO CLOSE IN A WELL

The subsea BOP stack is tested to verify that the BOP will be able to act as a well barrier in

case of a well kick. In general, it can be stated that the more frequently the BOP stack is tested,

the higher the availability of the BOP as a safety barrier will be. It is, however, important to

note that some parts of a BOP stack are not as important as other parts with respect to testing.

When pressure testing the BOP, both the ability to operate the BOP function and the ability to

seal off a pressure are tested. When function testing a BOP, only the ability to carry out the

function is tested, and not the ability to seal off a pressure.



The effect of the component testing on the BOP’s total ability to close in a well kick depends

on:

- The BOP stack design/configuration

- The tubular that runs through the BOP

- The reliability of the various BOP functions and controls

- The test frequency of the BOP function (both function and pressure test)

9.3 OPERATIONAL ASSUMPTIONS

The BOP Stack Design

The fault tree analyses are based on the Example two BOP design shown in Figure 3.1, page

24. The BOP includes one annular and, three pipe rams, one blind shear ram, and one casing

shear ram. It is assumed that all the pipe rams in the BOP are variable pipe rams (VBR) that

can seal around the tubular running through the BOP. All ram preventers can be closed by the

acoustic system. The control system is assumed to be a multiplex control system.

BOP Unavailability Calculation

There are four basic event types used in the fault tree

− Test interval

− Repairable

− Non-repairable

− On demand

Test interval is used to describe components that are tested periodically with test interval t*. A

failure may occur anywhere in the test interval. The failure will, however, not be detected until

the test is carried out or the component is needed. This is a typical situation for many types of

detectors, process sensors, and safety valves. The probability qi (t) is in this situation often

referred to as the mean fractional dead-time (MFDT) unavailability. The reliability parameters

entered are the failure rate (expected number of failures per time unit), the test interval t*,

and the repair time τ . CARA FaultTree calculates the MFDT by the formula:

+2

t (t)q

*

i

Notice that this formula is only valid if we have independent testing of each component. If

components are tested simultaneously, or if we have staggered testing, this formula will not be

correct, and the results will be too optimistic.

Repairable is used for components that are repaired when a failure occurs. If the failure rate is

denoted and the mean time to repair (MTTR) is denoted , qi(t) may be calculated by the

formula:



)e-(1 +1

= (t)q)t+(1

-

i

Notice that by letting t tend to infinity, we obtain the well-known approximation:

MTTF+MTTR

MTTR = (t)q

i

where

1 = MTTF

The reliability parameters entered to the CARA FaultTree program are the failure rate

(expected number of failures per time unit) and the mean time to repair, MTTR.

Non-repairable is used to describe components where failures of single components will not

be detected unless there is a leak/blowout to sea. In this period, the components may be

considered as so-called non-repairable components. If the failure rate of the component is

denoted by , then:

e-1 = (t)q t-

i

Where qi (t) denotes the probability that item no. i is not functioning at time t. The reliability

parameter entered to fault tree analysis software is the failure rate (expected number of

failures per hour). The time is represented by t.

On demand is used for components that have a certain probability to fail when they are

required.

BOP Testing Assumption

The following BOP test strategies are followed:

On rig (stump)

The BOP is fully function and pressure tested on the rig (on stump), prior to running.

Installation test

After landing the BOP the wellhead connector is tested against a closed BS ram. The choke

and kill lines are pressure tested.

The blind-shear ram closed by the acoustic control.

Test after running casing or liner

The BOP is fully function and pressure tested. BSR is tested against casing



Tests schedules by time

The subsea BOP, except the BSR, is fully pressure tested every second week against a plug in

the wellhead. One ram is closed by the acoustic system.

The subsea BOP is function tested on one pod weekly (every second test is done when the BOP

is pressure tested. The acoustic control system is function tested in unarmed state.

Failure Input Data

The reliability data used as input for the analyses for the subsea BOP components are based on

data from the subsea BOP reliability studies and partly engineering judgement. Table 9.1 shows

the base case reliability data used.

Table 9.1 Reliability data used for fault tree analyses

Component name in fault

tree

Component type

Failures/-day or on demand

prob.

Test interval (days)

Description

Acouaccu Test interval 6,67E-05 14 Acoustic accumulators fails to supply pressure when demanded (sudden rupture)

AcouCom On demand 0,3330% Acoustic communication fails

AE Test interval 9,64E-06 14 Annular leaks to sea

ARBP Test interval 2,00E-04 7 Annular regulator fails, blue pod

ARYP Test interval 2,00E-04 7 Annular regulator fails, yellow pod

BSRE Test interval 3,62E-06 14 BSR leaks to sea

BSRFTC* Test interval 9,80E-06 7 BSR fail to close

BSRFTS On demand 10,0% BSR fails to shear pipe

BSRIL Test interval 6,86E-05 20 BSR internal leakage

CLA1 Test interval 4,11E-06 14 Leakage in clamp connection between w.head conn. and LPR

CLA2 Test interval 4,11E-06 14 Leakage in clamp connection between LPR and MPR

CLA3b Test interval 4,11E-06 14 Leakage in clamp connection between CSR and the BSR

CLA4 Test interval 4,11E-06 14 Leakage in clamp connection below annular

CLA4b Test interval 4,11E-06 14 Leakage in clamp connection above BSR

CLINE Test interval 5,31E-04 14 Choke line leaks to sea

CONSYSTEL On demand 0,0013% Failure to operate BOP from control system. Caused by an electronic or electric failure.

CONSYSTHYD On demand 0,0110% Failure to operate BOP from control system. Caused hydraulic problems that can not be isolated

CRE Test interval 3,62E-06 14 Casing Shear rams leaks to sea

CSRFTS* On demand 1,0000% Casing shear ram fails to shear pipe

ELBP Test interval 3,00E-04 7 Electric or electronic pod failure, blue pod

Electfail On demand 0,1000% Electric or electronic failure on subsea control module fails when demanded (battery, SEM, water intrusion)

ELYP Test interval 3,00E-04 7 Electric or electronic pod failure, yellow pod

EXCLBP Test interval 7,50E-05 7 External leakage in blue conduit line or associated equipment

EXCLYP Test interval 7,50E-05 7 External leakage in yellow conduit line or associated equipment

EXTCBP Test interval 3,00E-04 7 Hydraulic leak that ruins the blue pod control

EXTCYP Test interval 3,00E-04 7 Hydraulic leak that ruins the yellow pod control

IBE Test interval 3,74E-06 14 Inner Bleed valve leaks to sea

IBI Test interval 3,69E-05 14 The inner bleed valve leaks internally

KLINE Test interval 5,31E-04 14 Kill line leaks to sea

LICE Test interval 3,74E-06 14 Lower inner choke valve leaks to sea

LICM Test interval 3,69E-05 14 The LIC fail-safe valve leaks internally

LIKE Test interval 3,74E-06 14 Lower inner kill valve leaks to sea

LIKIL Test interval 3,69E-05 14 The LIK valve leaks internally

LMRPE Test interval 2,47E-05 14 External leakage in LMRP connector

LOCE Test interval 3,74E-06 14 Lower outer choke valve leaks to sea

LOCM Test interval 3,69E-05 14 The LOC fail-safe valve leaks internally

LOKE Test interval 3,74E-06 14 Lower outer kill valve leaks to sea

LOKIL Test interval 3,69E-05 14 The LOK fail-safe valve leaks internally



LPRA Test interval 3,62E-06 14 Leakage to sea in lower pipe ram

LPRFTC Test interval 9,80E-06 7 LPR fail to close

LPRIL Test interval 6,86E-05 14 LPR internal leakage

LRBPfunction Test interval 2,00E-05 7 LPR function fails on blue pod

LRSVLE Test interval 1,00E-05 7 Shuttle valve or line to LPR leaks external

LRYPfunction Test interval 2,00E-05 7 LPR function fails on yellow pod

MPRE Test interval 3,62E-06 14 MPR leaks to sea

MRBP Test interval 2,00E-04 7 Manifold regulator fails, blue pod

MRBPfunction Test interval 2,00E-05 7 MPR function fails on blue pod

MRPFTC Test interval 9,80E-06 7 MPR fail to close

MRPIL Test interval 6,86E-05 14 MPR internal leakage

MRSVLE Test interval 1,00E-05 7 Shuttle valve or line to MPR leaks external

MRYP Test interval 2,00E-04 7 Manifold regulator fails, yellow pod

MRYPfunction Test interval 2,00E-05 7 MPR function fails on yellow pod

OBE Test interval 3,74E-06 14 Outer bleed valve leaks to sea

OBI Test interval 3,69E-05 14 The outer bleed valve leaks internally

PVA1 Test interval 1,00E-04 14 Pilot valve fails acoustic system



PVA4 Test interval 1,00E-04 14 Pilot valve fails acoustic system BSR close

PVSSBP Test interval 5,00E-06 7 Failed to open blue pod mounted pilot valve for blue pod

PVSSYP Test interval 5,00E-06 7 Failed to open yellow pod mounted pilot valve for yellow pod

PVTSBP Test interval 3,00E-06 7 Failed to open surface pilot valve for blue conduit line

PVTSYP Test interval 3,00E-06 7 Failed to open surface pilot valve for yellow conduit line

SEMABP Test interval 9,09E-05 7 SEM A blue pod fails

SEMAYP Test interval 9,09E-05 7 SEM A yellow pod fails

SEMBBP Test interval 9,09E-05 7 SEM B blue pod fails

SEMBYP Test interval 9,09E-05 7 SEM B yellow pod

SHVA Test interval 1,00E-04 14 Shuttle valve for acoustic/hyd.controlsystem stuck.

SHVA2 Test interval 1,00E-04 14 Shuttle valve for acoustic/hyd.controlsystem stuck.

SHVA3 Test interval 1,00E-04 14 Shuttle valve for acoustic/hyd.controlsystem stuck.

SHVA4 Test interval 1,00E-04 14 Shuttle valve for acoustic/hyd.controlsystem stuck. BSR close function

SRBPfunction Test interval 2,00E-05 7 BSR function fails on blue pod

SRSVLE Test interval 1,00E-05 7 Shuttle valve or line to BSR leaks external

SRYPfunction Test interval 2,00E-05 7 BSR function fails on yellow pod

SV1 Test interval 1,00E-04 14 Solenoid valve fails acoustic system



SV4 Test interval 1,00E-04 14 Solenoid valve fails acoustic system BSR Close

UABPfunction Test interval 2,00E-05 7 Annular preventer function fails on blue pod

UAPFTC Test interval 2,78E-05 7 Annular preventer fail to close

UAPIL Test interval 1,98E-04 14 Annular internal leakage

UASVLE Test interval 1,00E-05 7 Shuttle valve or line to annular preventer leaks external

UAYPfunction Test interval 2,00E-05 7 Annular preventer function fails on yellow pod

UICE Test interval 3,74E-06 14 Inner bleed off valve leaks to sea

UICIL Test interval 3,69E-05 14 The UIC valve leaks internally

UIKE Test interval 3,74E-06 14 Upper inner kill valve leaks to sea

UIKIL Test interval 3,69E-05 14 The UIK valve leaks internally

UOCE Test interval 3,74E-06 14 Upper outer choke valve leaks to sea

UOCIL Test interval 3,69E-05 14 The UOC valve leaks internally

UOKE Test interval 3,74E-06 14 Upper outer kill valve leaks to sea

UOKIL Test interval 3,69E-05 14 The UOK fail-safe valve leaks internally

UPRE Test interval 3,62E-06 14 UPR leaks to sea

URBPfunction Test interval 2,00E-05 7 UPR function fails on blue pod

URPFTC Test interval 9,80E-06 7 UPR fail to close

URPIL Test interval 6,86E-05 14 UPR internal leakage

URSVLE Test interval 1,00E-05 7 Shuttle valve or line to UPR leaks external

URYPfunction Test interval 2,00E-05 7 UPR function fails on yellow pod

WHCA Test interval 2,47E-05 14 Leakage in BOP wellhead connector

* It is assumed that the CSR will always be closed prior to the BSR in the BOP in an emergency. It is assumed that the pipe cut probability for the CSR is 99%. It is further assumed that when cut, the pipe will be lifted by the compensating system so no drill-pipe obstructing the BSR from closing on an empty hole. If the CSR fails to cut the pipe it is a 90% probability that the BSR will cut the pipe.



Initial Situation

The situation when the well kicks and the response of the BOP is required is as follows:

• There are no known failures in the subsea BOP stack or the control system

• The subsea BOP is tested according to Section 9.3.4

• Hard shut in, i.e., an annular preventer will be closed without opening the choke line first

Repair Strategies

For the purpose of the calculations presented, it has been assumed that whenever a subsea BOP

failure is observed, the failure is repaired before the operation continues.

From the subsea BOP reliability studies, it has been observed from time to time that the

operators select not to repair a failure immediately but postpone the repair. This decision is

typically based on a total evaluation of the failure and the ongoing operations. Typically, these

postponed repairs are only for situations where there are redundant components in the stack,

and/or the well was nearly completed. This will to some extent reduce the BOP safety

availability.

Failure Observation

Some of the failures in a subsea BOP will be observed during testing and others will be

observed when they occur. In the calculations it has been assumed that most failures that occur

are observed during tests only. This is not correct, because some of the failures are observed

during normal operations as well. Failures observed during normal operations are typically

failures observed because the BOP is operated for other reasons than testing, and that

pressurized control system equipment starts to leak.

The effect of this assumption is that the results will be conservative.

Other Assumptions

The model only considers the probability of a successful control of the initial kick situation.

This is a non-conservative assumption.

Another simplification, that adds conservatism to the result, is that when a kick occurs when

there is no drill-pipe in the well, only blind-shear rams can be used for sealing off the kick.

The annular is assumed not to be able to close on an empty wellbore. The BOP manufacturers

claim that an annular can be used for closing on a wellbore. During all the SINTEF/Exprosoft

BOP reliability studies (experience from around 1000 wells) it has not been observed that

they have tested this function, so the success probability of such an operation is unknown.

It is assumed that the well kicks are observed in reasonable time so normal well control

procedures can be initiated. (BOPs are not designed to close in flowing wells).



9.4 BLOWOUT PROBABILITY, BASE CASE

The analyses in this subsection relates to incidents where the BOP can be used to control a

"normal" well kick.

The blowout probability estimates presented in this chapter should be used with care. The

important aspect to focus is the relative differences between the various cases analysed.

Annex 2 presents the BOP fault tree used for the calculation. The BOP reliability data shown

in Table 9.1 have been fed into the fault tree model.

Probability of not Being Able to Close in a Well Kick

Table 9.2 shows the estimated probability of being able to close in a kick. Two situations have

been analysed;

• Drillpipe running through the subsea BOP (normal kick situation)

• Empty hole

Table 9.2 Blowout probability assuming a kick has occurred

Leak type

Probability of failing to close in a kick (%)

No. of kicks per blowout

Drill pipe in BOP

External leak to sea from BOP 0,02532% 3 950

Leak through BOP annulus 0,00006% 1 635 000

Total 0,02538% 3 940

Empty Hole

External leak to sea from BOP 0,04911% 2 036

Leak through BOP annulus 0,17550% 570

Total 0,22452% 445

The results in Table 9.2 show the largest contributor to the total ability to close in a normal kick

will be external leaks in the BOP. This is because there is no back-up for this type of leaks

below the LPR. The probability of an external leak in the subsea wellhead connector, the LPR,

the lower inner kill, and the flange between the wellhead connector and the LPR will totally

dominate this probability. All other potential external leak paths are backed up with other

preventers.

The results underline the importance of pressure testing the subsea BOP with respect to external

leaks, especially the lower parts of the BOP.

A leak through the annulus and the riser is a very unlikely outcome when there is a drill-pipe

running through the BOP. In principle, five preventers may seal off the well, and each of the

preventers can be controlled by three “independent” control systems.

Kick experiences from drilling with subsea BOPs (/1/ and /3/) show that approximately 4% of

the kicks occur when the drill-pipe is out of the hole. The results in Table 9.2 show that the



probability of a blowout is much higher for an empty hole situation than when a drill-pipe is

running through the BOP. The reason is that only one preventer, the BSR, can seal off the well.

If the BSR leaks there will be a blowout. In addition, also the probability of an external leak

that cannot be controlled increases, because the potential leakage paths below the BSR are now

exposed.

When comparing these results with the results in /1/, it is observed that the probability of a

blowout when assuming a kick has occurred, has significantly decreased. This is partly caused

by an improvement in BOP reliability over the years, and that in Norway an acoustic back

control system is used. An acoustic system is not required in the US OCS, and therefore not

used. In the US they rely on emergency systems as deadman/autoshear and EDS systems as

backup systems. The effect of these systems are not included in the reliability model. Such

systems are normally used when a well control situation cannot be handled by normal methods.

These systems may be tested before running the BOP or after the initial landing of the BOP,

and not during the tests after running casing or the periodic tests.

Probability of a Blowout per Time Unit

When including the kick frequency in the equation, the blowout probability per well, or per

BOP day in service, can be established.

Table 9.3 shows the estimated blowout probability, when combining the results from Table 9.2

with the experienced kick frequency in Norwegian waters (from Table 8.2, page 86).

Table 9.3 Blowout frequency/mean time between blowouts estimate

Frequency measure Blowout frequencies Mean time between blowout

Exploration Development Total Exploration Development Total

Per 1000 BOP days 0,0780% 0,0170% 0,0320% 1 282* 5 893* 3 126*

Per mother well 0,0029% 0,0007% 0,0013% 34 987 142 448 77 971

Per well path 0,0022% 0,0005% 0,0009% 44 983 205 424 109 160

*1000 BOP days

When comparing the results in in Table 9.3 with the results in /1/, it is observed that the blowout

probability in Norway is approximately only in the area of 10% of the US GoM 2007-2009

deepwater operations. The reason for this is the improved BOP as discussed in Section 9.4.1,

and the lower kick frequency as discussed in Section 8.3.

Discussion

The results assume that the BOP has been tested according to Table 9.1, page 95. When looking

at Table 7.1, page 79, there is a test category Other tests as well. Many of these other tests are

tests of plugs, packers, casings, and seal assemblies. These tests are typically carried out against

a closed ram preventer, and may also reveal leakages in the lower part of the BOP stack. These

type of tests are not included in the fault tree model. If including these tests in the model, the

leak blowout probability would become lower.

During the present study, many leakages in the choke and kill lines have been observed. These

failures have insignificant effect on the results of the fault tree analyses, because only the initial



closing of the BOP has been evaluated. When a kick is to be circulated out, a leaking choke or

kill line close to the sea surface or above will be critical.

The analyses assume that there are no parts of the control system that may fail and ruin both

the yellow pod, the blue pod, and the acoustic back-up system. This might be the case for some

BOPs, but such failures have not been observed in any of the BOP reliability studies.

And, as stated earlier, it is assumed that the well kicks are observed in reasonable time such

that normal well control procedures can be initiated. The BOPs are not designed to close in

flowing wells.

9.5 BOP TEST STRATEGIES AND BLOWOUT PROBABILITIES

The BOP stack is tested to verify that the BOP will be able to act as a well barrier in case of a

well kick.

In general, it can be stated that the more frequently the BOP stack is tested, the higher the

BOP’s ability to close in a well kick will be. It is, however, important to note that some parts

of a BOP stack are not as important as other parts with respect to testing.

When pressure testing the BOP both the ability to carry out the function and the ability to seal

off a pressure are tested. When function testing a BOP only the ability to carry out the function

is tested and not the ability to close in a pressure.

The effect of the component testing on the BOP’s total ability to close in a well kick depends

on:

- The BOP stack design/configuration

- The drill-pipe or tubular that runs through the BOP

- The reliability of the various BOP functions

- The test frequency of the BOP function (both function and pressure test)

Testing of the BOP is utmost important to verify that the BOP is operative, but the testing

takes time, and is therefore costly (Section 7.2, page 78).

As documented in Section 9.4, page 98, when a drill-pipe is running through the subsea BOP

the most likely blowout flow path is in the lower part of the BOP. A blowout through the

BOP during drilling with a drill-pipe running through the BOP is very unlikely, if the kick is

observed in due time, and the BOP is commanded to close.

Table 9.4 shows an alternative BOP test strategy alongside the base case BOP strategy.



Table 9.4 Subsea BOP test strategies

Base case test Test alternative 1

On rig (stump)

The BOP is fully function and pressure tested on the rig (on stump), prior to running.

As base case

Installation test

After landing the BOP the wellhead connector is tested against a closed BS ram. The choke and kill valves are pressure tested. The blind-shear ram closed by the acoustic control.

As base case

Test after running casing or liner

The BOP is fully function and pressure tested. BSR is tested against casing. The choke and kill valves are pressure tested.

BOP is fully function tested. BSR is tested against seal assembly running tool (alternatively a plug in the wellhead or casing). The choke and kill lines are pressure tested

Function test scheduled by time (weekly)

The BOP is function tested on one pod weekly (every second test is done when the BOP is pressure tested. The acoustic control system is function tested in unarmed state.

As base case

Pressure test scheduled by time (14 days)

The BOP, except the BSR, is fully pressure tested every second week against a plug in the wellhead. The choke and kill valves are pressure tested. One ram is closed by the acoustic system.

The BOP is fully function tested. The wellhead connector is pressure tested against UPR (alternatively BSR) and a well head test plug (alternative plug in casing). The choke and kill lines are pressure tested

Pressure test scheduled by time (50 days)

none

The BOP, except the BSR, is fully pressure tested 50 days against a plug in the wellhead. The choke and kill valves are pressure tested. One ram is closed by the acoustic system.

The reason for selecting 50 days is to ensure that a full BOP test is carried out from time to

time for wells with long duration, and for fields where the BOP is moved from well to well

without being brought to surface. In many cases the well will be finished before 50 days have

elapsed.

The main difference between the two test strategies is that test alternative 1 does not include a

detailed test of all preventer elements for the Test after running casing or liner and the Pressure

test scheduled by time (14 days). This is a test strategy that will reduce the total test time.

The results from the Test alternative 1 calculations are shown in Table 9.5 alongside the Base

case calculations.



Table 9.5 Blowout probability assuming a kick has occurred, base case vs. alternative

test strategy

Pipe in BOP

Leak type

Base case Test alternative 1

Probability of failing to close in

a kick (%)


Probability of failing to close in a

kick (%)


Drill pipe in BOP, all VBRs can seal

External leak to sea from BOP 0,02532% 3 950 0,02533% 3 949

Leak through BOP annulus 0,00006% 1 635 000 0,00006% 1 637 331

Total 0,02538% 3 940 0,02539% 3 939

Empty hole

External leak to sea from BOP 0,04911% 2 036 0,04912% 2 036

Leak through BOP annulus 0,17550% 570 0,17550% 570

Total 0,22452% 445 0,22453% 445

The results for the two alternatives are nearly identical, that means that the detailed testing of

the preventers have no effect on the safety availability for the above two test strategies. The

reason for this is the redundancy in the BOP stack with respect to flow through the BOP when

there is a drill-pipe in the BOP. It is assumed that all pipe rams have VBR packer and can all

close around the normal drill-pipe.

From time to time it may be necessary to run smaller strings in the well with a diameter that

only one of the VBRs can seal around. For such a situation the difference in safety availability

between the Base case and Test alternative 1 is 0,1%, i.e. also insignificant.

The most important test of the BOP is pressurizing the BOP to reveal leaks to the surroundings,

especially in the lower part of the BOP.

In the US some drilling rigs have replaced the lower pipe ram with a test ram. A test ram is an

inverted pipe ram that are used for testing the BOP. This eliminates the need for running a BOP

test plug in the wellhead, and thereby saves rig time. The test ram will, however, represent

additional potential leakage paths to the sea in the lower part of the BOP stack that cannot be

isolated by a ram preventer. The test alternative 1 will, however, still give the same results as

the Base case test strategy. As long as there are two pipe rams and one annular that can be used

for sealing around normal drillpipe the Base case and Test alternative 1 will give more or less

identical results.

A test alternative 2, that prolongs the time between the BOP pressure tests from 14 days to 21

days, was also analysed. This test strategy increases the risk for not being able to close in a

“normal” well kick with approximately 40%. The reason is the prolonged time between

pressure tests of the lower part of the BOP, including the wellhead connector, that reveals

external leaks.

9.6 BOP TEST STRATEGIES AND BOP TEST TIME SAVINGS

The BOP test time consumption is discussed in Section 7.2, page 78. Some of the tests after

running the casing were partly tests (Table 7.3, page 81), similar to the test after running casing

and the periodic pressure test proposed in Test alternative 1 (Table 9.4). As seen from Table

7.3, the partly tests reduce the BOP test time.



It is reasonable to assume that Test alternative 1 will reduce the test after running casing and

liner and the periodic pressure test with in the order of magnitude three hours per test.

Based on the number of tests and the BOP days in service in Table 7.2, page 80, the average

savings in BOP test time will then be 0,2 hours per BOP day (or 3 days per year) compared to

the Base case test alternative.

9.7 GUIDANCE FOR ACCEPTING SUBSEA BOP FAILURES OR NOT

When a failure in a BOP occurs the BOP’s ability to act as a safety barrier will be influenced.

Some failures have a large influence on safety availability whereas others have a limited or

insignificant influence on the safety availability.

A series of various failures have been introduced in the BOP fault tree model to quantify the

effect on the safety availability.

It is assumed that 4% of all kicks are empty hole kicks, while 96% are kicks with a normal

drill-pipe through the BOP.

The BOP design used assumed is Example two in Figure 3.1, page 24.

The results from the analyses are shown in Table 9.6.

Table 9.6 Effect of various BOP failures on the ability to close in a kick with subsea

BOP (Alternative 2 BOP in Figure 3.1, page 24)

Type of known failure in the BOP Probability of failing to close

in a kick Risk increase

No known failure in the BOP (base case, from Table 9.2, page 98 0,033% -

One pod is pulled for repair 0,034% 3,2%

The acoustic system has failed 0,046% 38,1%

One pod is pulled for repair and the acoustic system has failed 0,258% 674,5%

Lower inner kill valve leaks in closed position 0,036% 8,1%

Lower outer kill valve leaks in closed position 0,033% 0,3%

Lower inner choke valve leaks in closed position 0,033% 0,3%

Annular is leaking in closed position or has failed to close 0,033% 0,0%

Blind-shear ram is leaking in closed position or has failed to close 4,024% 11 969,0%

Upper pipe ram (UPR) is leaking in closed position or has failed to close 0,033% 0,0%

Middle pipe ram (MPR) is leaking in closed position or has failed to close 0,033% 0,0%

MPR and UPR is leaking in closed position or has failed to close 0,033% 0,0%

Lower pipe ram (LPR) is leaking in closed position or has failed to close 0,038% 14,8%

LPR and UPR is leaking in closed position or has failed to close 0,038% 14,8%

LPR and MPR is leaking in closed position or has failed to close 0,046% 37,9%

One pilot valve for lower pipe ram failed, or similar 0,033% 0,0%

One pilot valve for blind-shear ram failed, or similar 0,033% 0,0%

Manifold regulator one pod fails to supply pressure 0,033% 0,0%

Annular regulator one pod fails to supply pressure 0,033% 0,0%



As seen from Table 9.6 many failures in BOP components have an insignificant effect on the

BOP safety availability, and to continue the operations until the well is abandoned would be

the best choice. The results should, however, be combined with the engineering judgment

related to the specific situation and operations to be carried out.

External leakages in the BOP stack or the choke and kill line should always be repaired if

occurring.

If one pod is pulled for repair, the probability of not being able to close in a kick is

approximately three percent higher. This low increase is caused by the added redundancy the

acoustic back-up control system gives. This will only apply for areas where the acoustic back-

up system is mandatory, as in Norway.

It is observed that the relative increase in risk will be higher if the acoustic back-up system is

failing than if a pod is out of service. This is because the fault tree model assumes the acoustic

back-up system is independent of the main control system, while the yellow and blue pod have

some common parts that may jeopardize both the blue and yellow pod. There may be variations

among the various BOP stack control systems related to common cause failures.

If the lower inner kill valve is known to be leaking this will expose the leakage path external

leakage in the lower outer kill valve.

Further, the combination of an internal leak in the lower outer kill valve and leakage in the kill

line will also be more likely. It should be noted that from time to time the kill or choke valves

fail simultaneously. This has not been observed in the present study, but in earlier BOP studies.

The lower inner kill valve is the most critical choke and kill valve with respect to internal

leakage, because it is the lower-most valve.

If the lower inner choke valve leaks internally, the effect on the safety availability will be much

less than if the lower inner kill valve leaks. This because the valve is backed up by the LPR.

The BOP analysed (Figure 3.1, page 24, Example two) included one annular preventer. Many

BOPs have two annular preventers. Even with one annular preventer the analyses show that if

it is leaking it will have little effect on the ability to close in a kick. It is, however, important to

note that the annular is used for other purposes as well.

If the blind-shear ram is leaking this will have a large effect on the BOP safety availability. The

main reason for this effect is that 4% of the kicks are empty hole kicks. With one blind shear

ram only, there will be no preventers that can close in the well.

A leakage in the UPR or the MPR will have an insignificant effect on the risk. It should be

noticed that the analyses assume that all rams have VBRs that can all close around the drill-

pipe. If there are rams equipped with rams for specific purposes this will change the picture.

Also, a leak in both the UPR and MPR at the same time will have an insignificant impact

because the LPR will back-up these leaks.

A leak in both the LPR and the MPR will increase the risk because more potential external leak

paths in the lower part of the BOP will be exposed.



A failed pilot valve for any of the preventers, even the blind-shear ram will have an insignificant

effect on the risk. The result for the blind shear ram will only be valid for areas where the

acoustic back-up system is mandatory, as in Norway.

A failed annular regulator or manifold regulator of one pod has an insignificant effect on the

risk.

NOTE: The results must be combined with an evaluation of the present situation. The above

information should only be regarded as guidance. The guidance mainly considers single

failures. If one failure is present and a second different failure in the BOP occurs, the combined

effect of these two failures should at first be thoroughly investigated.

9.8 DISCUSSION

The results of this study show that the subsea BOP testing requirements are more

comprehensive than needed. The detailed pressure testing of the individual preventers can in

many cases be omitted. This detailed testing has no significant effect on the BOP’s ability to

act as a well barrier. The main reason for this is the built-in redundancy of the subsea BOP.

The most important tests are the tests that reveal an external leakage in the lower part of the

BOP and ensures that the control systems are functioning. By simplifying the BOP test

requirements, hours of rig time may be saved in each test.

Further, due to the redundancy in the BOP stack, failures of single BOP functions, or even a

combination of BOP functions, will in many cases have an insignificant effect on the subsea

BOP’s ability to act as a well barrier in case the well kicks. When these failures occur, the best

choice is in many cases to continue the operations until the BOP is pulled for other reason,

rather than plugging the well and pulling the BOP. Such decisions should, however, also be

based on a risk evaluation and engineering judgment related to the specific situation and

operations to be carried out.

The study is performed with “normal” operational situations in mind. If specific operations

shall be carried out that reduces the BOP barrier availability, specific testing or repair should

be evaluated before starting such operations.

The proposed test strategy will not have any effect on the BOP emergency features, as

emergency disconnect system (EDS), automated mode function (AMF/Deadman), auto shear,

and ROV functions. The requirements for verification of these systems remain unchanged.

It is important that all kicks are observed early, such that the BOP can be closed before the well

flow becomes too high. BOPs are not designed to close against flow. Many blowouts have

occurred because the kick was not detected early enough, and the BOP failed to close (/16/).

The simplified BOP testing will not have any effect on this.

If we look at the failures observed in this study in the safety-critical period, and assume that

the test strategy Test alternative 1 had been followed instead of the Base case (Table 9.4, page

101), only one annular preventer leakage, and maybe a leak in a choke kill valve would have

been observed delayed. The delayed observation of these failures would not have any

significant effect on the BOP safety availability. All the other failures occurring in the safety-

critical period would have been observed at the same time for the two test strategies.



REFERENCES

1. Holand, P., Awan H.: "Reliability of Deepwater Subsea BOP Systems and Well Kicks”.

Exprosoft Report ES201252, Trondheim, Norway, 2012

2. Holand, P.: "Reliability of Subsea BOP Systems for Deepwater Application, Phase II

DW" SINTEF Report STF38 A99426 (Unrestricted version).

3. Holand, P.: "Deepwater Kicks and BOP Performance" SINTEF Report STF38

AA01419, (Unrestricted version)

4. Holand, P., Reliability of Subsea BOP Systems for Deepwater Application, SINTEF

Report STF38 F97417, Trondheim, Norway, 1997. (Restricted)

5. Holand, P., Reliability of Subsea BOP Systems, Fault Tree Analysis, SINTEF Report

STF38 F97425, Trondheim, Norway, 1997. (Restricted)

6. Holand, P., Subsea BOP Systems, Reliability and Testing Phase V, revision 1 (this

revision 1 is based on a report with the same title published in 1990), SINTEF report

STF 75 A89054, Trondheim, Norway, 1995.

7. Holand, P.: "Reliability of Subsea BOP Systems – Phase IV". SINTEF Report STF75

F87007, Trondheim, Norway, 1987. (Restricted)

8. Holand, P.: "Reliability of Subsea BOP Systems - Phase III. Main Report". SINTEF

Report STF75 F86004 (Restricted).

9. M. Rausand, P. Holand, R. Husebye, S. Lydersen, E. Molnes, T. Ulleberg: "Reliability

of Subsea BOP Systems - Phase II, Main Report". STF18 F84515, 1985.

10. Rausand, M. and Høyland, A., System Reliability Theory; Models and Statistical

Methods, Second Edition, Wiley, Hoboken NJ, USA, 2004.

11. Norsok D-010 Well integrity in drilling and well operations (Rev. 4, June 2013)

12. Holand, P. “Analysis of Blowout Causes based on the SINTEF Offshore Blowout

Database” ExproSoft Report no.: 1611197/1 (Restricted)

13. Andersen L. B. (Alliance Technology) Holand, P. (SINTEF) Wicklund, J. Scandpower:

“Estimation of Blowout Probability for HPHT Wells”. SINTEF Report STF38 F98420.

(Restricted).

14. James Donald Dobson (HSE), “Kicks in Offshore UK Wells - Where Are They

Happening, And Why? “SPE-119942-MS, SPE/IADC Drilling Conference and

Exhibition, 17-19 March, Amsterdam, The Netherlands, 2009

15. Trends in risk level in the petroleum activity (RNNP), Petroleum Safety Authority

Norway (https://www.ptil.no/en/technical-competence/rnnp/)

16. Holand, P.: "Loss of Well Control Occurrence and Size Estimators”. Exprosoft Report

ES201471/2, Trondheim, Norway, 2017

17. SINTEF Offshore Blowout Database, https://www.sintef.no/en/projects/sintef-

offshore-blowout-database/

18. UK wells drilled https://www.gov.uk/guidance/oil-and-gas-wells.

19. Lasse Berg Andersen “Stochastic Modelling for the Analysis of Blowout Risk in

Exploration Drilling”, PhD Thesis, Robert Gordon University, Aberdeen, UK, 1995

https://www.ptil.no/en/technical-competence/rnnp/

https://www.sintef.no/en/projects/sintef-offshore-blowout-database/

https://www.sintef.no/en/projects/sintef-offshore-blowout-database/

https://www.gov.uk/guidance/oil-and-gas-wells



ANNEX A BOP TESTING REQUIREMENTS IN NORWAY (/11/)



ANNEX B SUBSEA BOP FAULT TREE

Fault Tree Construction

Fault Tree Symbols A fault tree is a logic diagram that displays the connections between a potential system failure

(TOP event) and the causes for this event. The causes (basic events) may be environmental

conditions, human errors, normal events and component failures. The graphical symbols used

to illustrate these connections are called "logic gates". The output from a logic gate is deter-

mined by the input events.

The graphical layout of the fault tree symbols is dependent on what standard we choose to

follow. Table B.1 shows the most commonly used fault tree symbols together with a brief

description of their interpretation.

Table B.1 Fault tree symbols

Symbol Description

Logic

Gates

"OR" gate

The OR-gate indicates that the output event A occurs

if any of the input events Ei occurs.

"AND" gate

The AND-gate indicates that the output event A

occurs only when all the input events Ei occur simul-

taneously.

Input

Events

"BASIC" event

The Basic event represents a basic equipment fault or

failure that requires no further development into more

basic faults or failures.

"HOUSE" event

The House event represents a condition or an event,

which is TRUE (ON) or FALSE (OFF) (not true).

"UNDEVEL-

OPED" event

The Undeveloped event represents a fault event that is

not examined further because information is unavail-

able or because its consequence is insignificant.

Descrip-

tion

of State

"COMMENT"

rectangle

The Comment rectangle is for supplementary infor-

mation.

Transfer

Symbols

"TRANSFER"

out

"TRANSFER" in

The Transfer out symbol indicates that the fault tree is

developed further at the occurrence of the corre-

sponding Transfer in symbol.



The logic events the basic events and the transfer symbol are the fault tree symbols mainly used

in the Fault Trees constructed and analysed in this report. Fault Tree construction and analyses

are described in many textbooks, among them /10/.

The CARA FaultTree (www.exprosoft.com) has been used for constructing and analysing the

fault trees.

BOP Fault Tree The fault tree utilized for the analyses are presented on the following pages. The fault tree is

based on example two BOP in Figure 3.1, page 24.

http://www.exprosoft.com/

http://www.exprosoft.com/



CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS

Blowout, given akick, while thedril lstring isrunning through theBOP.

HOVE

Subsea blowout

Blowout to the seavia the main BOPstack, the chokeline, or the kill l ine

P10

Blowout throughannulus

Annulus blowout

Local failure inUpper Pipe Ram orassociated controlsystem equipment

P4

Local failure inMiddle Pipe Ramor associatedcontrol systemequipment

P3

Local failure inLower Pipe Ram orassociated controlsystem equipment

P2

Local failure inAnnular orassociated controlsystem equipment

P6

Local failure inBlind Shear Ram orassociated controlsystem equipment

P5

BOP mux Example two BOP OK Nytt navn.CFTPagename: P1




P2

Local failure inLOWER PIPE RAMpreventer orassociated controlsystem equipment

LRPilot 1

LPR internalleakage

Lambda=6,9e-005Test intervall=14

LPRIL

LPR fail to c lose


LPRFTC

Both blue pod,yellow pod andacoustic systemfail to activatefunction

LRBAYP

Can not activatefunction by theblue pod

LROr 4

Major blue podfailure

P8

Manifold regulatorfails, blue pod

Lambda=0,0002Test intervall=7

MRBP

LPR function failson blue pod

Lambda=2e-005Test intervall=7

LRBPfunction

Can not activatefunction by theyellow pod

LROr 3

Major yellow podfailure

P9

Manifold regulatorfails, yellow pod


MRYP

LPR function failson yellow pod


LRYPfunction

Can not activatefunction byacoustic system

LAC1

Pilot valve failsacoustic system


PVA1

Solenoid valvefails acousticsystem


SV1

Shuttle valve foracoustic/hyd.controlsystemstuck.


SHVA

The BOP can notbe controlled byAcoustic system

P13

Shuttle valve orline to LPR leaksexternal


LRSVLE

Major failure inboth blue andyellow pod and theacoustic system

TOTCONT

Failure that ruinsboth yellow andblue pod

P7


P13





P3

Local failure inMIDDLE RAM orassociated controlsystem equipment

MRPilot 1

MPR internalleakage


MRPIL

MPR fail to c lose


MRPFTC


MRBAYP


MROr 3


P9



MRYP

MPR function failson yellow pod


MRYPfunction


MROr 4


P8



MRBP

MPR function failson blue pod


MRBPfunction


LAC2



PVA2



SV2



SHVA2


P13

Shuttle valve orline to MPR leaksexternal


MRSVLE


TOTCONT


P7


P13





P4

Local failure inUPPER RAMpreventer orassociated controlsystem equipment

URPilot 1

UPR internalleakage


URPIL

UPR fail to c lose


URPFTC


URBAYP


UROr 3


P9



MRYP

UPR function failson yellow pod


URYPfunction


UROr 4


P8



MRBP

UPR function failson blue pod


URBPfunction


LAC3



PVA3



SV3



SHVA3


P13

Shuttle valve orline to UPR leaksexternal


URSVLE


TOTCONT


P7


P13





P5

Local failure inBSR or associatedcontrol systemequipment

BSR

Fails to shear pipewith casing shearram blind shearram

FT SHEAR

BSR fails to shearpipe

Probability=0,1

BSRFTS

Casing shear ramfails to shear pipe

Probability=0,01

CSRFTS

BSR internalleakage


BSRIL

BSR fail to c lose


BSRFTC


SRBAYP


SROr 4


P8



MRBP

BSR function failson blue pod


SRBPfunction


SROr 3


P9



MRYP

BSR function failson yellow pod


SRYPfunction


LAC4

Pilot valve failsacoustic systemBSR close


PVA4

Solenoid valvefails acousticsystem BSR Close


SV4

Shuttle valve foracoustic/hyd.controlsystemstuck. BSR closefunction


SHVA4


P13

Shuttle valve orline to BSR leaksexternal


SRSVLE


TOTCONT


P7


P13





P6

Local failure inANNULAR orassociated controlsystem equipment

UAPilot 1

Annular internalleakage


UAPIL

Annular preventerfail to c lose


UAPFTC


UABAYP


UAOr 3


P9

Annular regulatorfails, yellow pod


ARYP

Annular preventerfunction fails onyellow pod


UAYPfunction


UAOr 4


P8

Annular regulatorfails, blue pod


ARBP

Annular preventerfunction fails onblue pod


UABPfunction

Shuttle valve orline to annularpreventer leaksexternal


UASVLE


P7





P7

The control systemfails to operate theBOP

aa1

Failure to operateBOP from controlsystem. Causedhydraulic problemsthat can not beisolated

Probability=0,00011

CONSYSTHYD

Failure to operateBOP from controlsystem. Caused byan electronic orelectric failure.

Probability=1,3e-005

CONSYSTEL

Combination offailures that willcause no supply ofhydraulic fluid forboth pods

KOMB

Blue pod conduitl ine can not supplyfluid to the pods

BPCOND

External leakage inblue conduit line orassociatedequipment


EXCLBP

Failed to opensurface pilot valvefor blue conduitl ine


PVTSBP

Failed to open bluepod munted pilotvalve for blue pod


PVSSBP

Yellow pod conduitl ine can not supplyfluid to the pods

YPCOND

External leakage inyellow conduit l ineor associatedequipment


EXCLYP

Failed to opensurface pilot valvefor yellow conduitl ine


PVTSYP

Failed to openyellow pod muntedpilot valve foryellow pod


PVSSYP





P8

Failed to operateBOP on blue pod

bluepod

Hydraulic leak thatruins the blue podcontrol


EXTCBP

Electric orelectronic podfailure, blue pod


ELBP

Failure in SEM Aand SEM B bluepod

SEMSBP

SEM A blue podfails


SEMABP

SEM B blue podfails


SEMBBP





P9

Failed to operateBOP on yellow pod

yellow pod

Hydraulic leak thatruins the yellowpod control


EXTCYP

Electric orelectronic podfailure, yellow pod


ELYP

Failure in SEM Aand SEM B yellowpod

SEMSYP

SEM A yellow podfails


SEMAYP

SEM B yellow pod


SEMBYP





P10

Subsea blowoutvia the main BOPstack

Subsea blowout

Leakage in BOPwellhead connector


WHCA

Leakage in clampconnectionbetween w.headconn. and LPR


CLA1

Lower inner kil lvalve leaks to sea


LIKE

Leakage to seathrough kil l l ineafter the lower innerkill valve (LIK)

LOK

Blowout via afailed kil l l ine

KILL1

The LIK valveleaks internally


LIKIL

The LOK failsafevalve leaksinternally


LOKIL

Kill l ine leaks tosea


KLINE

Blowout to sea inLower outer k il l(LOK) valve

LOKA

The LIK valveleaks internally


LIKIL

Lower outer k il lvalve leaks to sea


LOKE

Leakage to sea inlower pipe ram


LPRA

Blowout to seaabove the LowerPipe Ram

P11





P11

Blowout to seaabove the LowerPipe Ram

A2

One or moreequipment aboveLPR leaks

ABOVELPR

Leakage to seathrough choke lineafter the lower innerchoke valve (LOC)

LOCA

Blowout via afailed choke line

Choke1

The LOC failsafevalve leaksinternally


LOCM

The LIC failsafevalve leaksinternally


LICM

Choke line leaks tosea


CLINE

Blowout to sea vialower outer chokevalve

LOC

Lower outer chokevalve leaks to sea


LOCE

The LIC failsafevalve leaksinternally


LICM

MPR leaks to sea


MPRE

Lower inner chokevalve leaks to sea


LICE

Blowout to seaabove the MiddlePipe Ram

A3

One or moreequipment aboveMPR leaks

ABOVEMPR

Leakage in clampconnectionbetween LPR andMPR


CLA2

Leakage to seathrough kil l l ineafter the upperinner kil l valve(UIK)

Or 2

Blowout via afailed kil l l ine

KILL2

The UIK valveleaks internally


UIKIL

The UOK failsafevalve leaksinternally


UOKIL

Kill l ine leaks tosea


KLINE

Blowout to sea inupper outer k il l(UOK) valve

UOKA

The UIK valveleaks internally


UIKIL

Upper outer k il lvalve leaks to sea


UOKE

UPR leaks to sea


UPRE

Blowout to seaabove the UpperPipe Ram

P12

Upper inner kil lvalve leaks to sea


UIKE

Middle pipe ramsleaks

P3

Lower pipe ramsleaks

P2




CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS P12

Blowout to seaabove the UpperPipe Ram

A4

One or moreequipment aboveUPR leaks

ABOVEUPR

Blowout to sea inmiddle outer choke(MOC) valve

UOCA

Upper outer chokevalve leaks to sea


UOCE

The UIC valveleaks internally


UICIL

Inner bleed offvalve leaks to sea


UICE

Casing Shear ramsleaks to sea


CRE

Leakage to seaabove BSR

Above BSR

One or moreequipment aboveBSR leaks

ABOVEBSR

External leakage inLMRP connector


LMRPE

Leakage in clampconnection belowannular


CLA4

Leakage in clampconnection aboveBSR


CLA4b

Annular leaks tosea


AE

Inner Bleed valveleaks to sea


IBE

Leakage to seathrough choke lineafter the innerbleed valve (IB)

Bleed


Bleed1

The inner bleedvalve leaksinternally


IBI

The outer bleedvalve leaksinternally


OBI



CLINE

Blowout to sea inouter bleed valve

Bleed2

The inner bleedvalve leaksinternally


IBI

Outer bleed valveleaks to sea


OBE

Blind shear ramleaks

P5

BSR leaks to sea


BSRE

Leakage in clampconnectionbetween CSR andthe BSR


CLA3b


Choke2



CLINE

The UOC valveleaks internally


UOCIL

The UIC valveleaks internally


UICIL

Upper pipe ramsleaks

P4





P13


ACOU

Acousticaccumulators failsto supply pressurewhen demanded(sudden rupture)


Acouaccu

Electric orelectronic failureon subsea controlmodule fails whendemanded (battery,SEM, waterintrusion)

Probability=0,001

Electfail

Acousticcommunicationfails

Probability=0,0033

AcouCom


report title: subsea bop reliability, testing, and well kicks · bop days are defined as the number...

Documents