REPORT Title: Subsea BOP Reliability, Testing, and Well Kicks · BOP days are defined as the number...
Transcript of REPORT Title: Subsea BOP Reliability, Testing, and Well Kicks · BOP days are defined as the number...
Title: Subsea BOP Reliability, Testing, and Well Kicks
CLIENT: Authors: Multiclient Per Holand
Report no. Version Date ES20150201/1 Final 15-Oct-19
REPORT
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 4
PREFACE
The evaluation, analysis and calculations performed are based on several assumptions,
limitations, and definitions of system and environmental boundaries, all of which are stated
further in the report or in its references. Exprosoft will accept no liability for conclusions
being deduced by readers of the report. Caution should always be taken when using the results
from this report further, such that decisions are not made on an erroneous basis.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 5
TABLE OF CONTENTS
PREFACE ............................................................................................................................ 4
SUMMARY AND CONCLUSIONS ....................................................................................... 8
LIST OF ABBREVIATIONS ................................................................................................ 17
1. INTRODUCTION .......................................................................................... 19
1.1 BACKGROUND ....................................................................................................... 19 1.2 PROJECT PARTICIPANTS ........................................................................................ 19 1.3 STUDY OBJECTIVE ................................................................................................. 20
2. DATA COLLECTION AND ANALYSES ................................................... 21
2.1 DATA SOURCES ..................................................................................................... 21 2.2 STATISTICAL ESTIMATION PROCEDURE AND ASSUMPTIONS .................................. 21
3. SUBSEA BOPS ............................................................................................... 23
3.1 SYSTEM DESCRIPTION AND BOUNDARY CONDITIONS ........................................... 23 3.2 RELEVANT DEFINITIONS ........................................................................................ 25 3.3 OPERATORS AND WELLS ....................................................................................... 26
3.4 RIGS AND WATER DEPTHS EVALUATED ................................................................ 26 3.5 MAIN OPERATION AND WELL TYPE ...................................................................... 27
4. OVERVIEW OF BOP FAILURES ............................................................... 28
4.1 COMPARISON WITH THE PREVIOUS SUBSEA BOP RELIABILITY STUDIES............... 30 4.2 ANNUAL TRENDS IN FAILURE RATES AND DOWNTIME .......................................... 32
4.3 INFLUENCES BY SEASON AND FIELD CONDITIONS ................................................. 34
Water Depth ......................................................................................................... 34 Seasonal Variation ............................................................................................... 35 Area Variation ...................................................................................................... 35
4.4 RIG SPECIFIC PERFORMANCE ................................................................................ 35
5. BOP SYSTEM SPECIFIC RELIABILITY ................................................. 37
5.1 FLEXIBLE JOINT ..................................................................................................... 37
Historic Overview, Flex Joint Failures ................................................................ 37 5.2 ANNULAR PREVENTER RELIABILITY ..................................................................... 38
Failed to Fully Open ............................................................................................ 39 Internal leakage .................................................................................................... 40 Internal Hydraulic Leakage ................................................................................. 40
Historic Overview, Annular Preventer Failures .................................................. 40 5.3 HYDRAULIC CONNECTOR RELIABILITY ................................................................. 41
External Leakage .................................................................................................. 42 Spurious opening .................................................................................................. 43
Failed to lock ........................................................................................................ 43 Historic Overview, Hydraulic Connector Failures .............................................. 43
5.4 RAM PREVENTER RELIABILITY.............................................................................. 44 Failed to Close ..................................................................................................... 45 Internal Leakage (leakage through a closed ram) ............................................... 46
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 6
Failed to Fully Open ............................................................................................ 46
Other ..................................................................................................................... 46 Historic Overview, Ram Preventer Failures ........................................................ 46
5.5 CHOKE AND KILL VALVE RELIABILITY ................................................................. 47 Internal leakage (leakage through a closed valve) .............................................. 48 Historic Overview, Choke and Kill Valve Failures .............................................. 49
5.6 CHOKE AND KILL LINE RELIABILITY ..................................................................... 49 External Leaks, BOP Attached Line ..................................................................... 50
External Leaks, Jumper Hose Line ...................................................................... 51 External Leaks, Riser Attached Line .................................................................... 51 Plugged Line, Riser Attached Line ....................................................................... 52 Historic Overview, Choke and Kill Line Failures ................................................ 53
5.7 MAIN CONTROL SYSTEM RELIABILITY .................................................................. 54
Loss of all Functions Both Pods ........................................................................... 57 Loss of all Functions One Pod ............................................................................. 57
Loss of One Function Both Pods .......................................................................... 58 Loss of One Function One Pod ............................................................................ 58 Loss of One Function One Topside Panel/Unit ................................................... 59 Emergency Automated BOP Function Failed ...................................................... 59
Other ..................................................................................................................... 60 Unknown ............................................................................................................... 61 Rig Specific Failure Rates .................................................................................... 62
Historic Overview, Main Control System Failures .......................................... 62 5.8 BACK-UP CONTROL SYSTEM RELIABILITY ............................................................ 63
Acoustic Control System Reliability ..................................................................... 64 Failed to Operate one BOP Function by the Acoustic System ............................. 65 One of two Acoustic Units on the BOP Failed ..................................................... 65
Other ..................................................................................................................... 65
Unknown ............................................................................................................... 66 Historic Overview, Acoustic Back-Up Control System Failures ......................... 66 Failure Modes ...................................................................................................... 67
6. FAILURE CRITICALITY IN TERMS WELL CONTROL ..................... 68
6.1 WHEN ARE BOP FAILURES OBSERVED? ................................................................ 68
Failure Observation, Pressure Testing vs. Function Testing ............................... 68 6.2 SAFETY-CRITICAL PERIOD FAILURES .................................................................... 69
BOP Item, Safety-critical Period Failures ........................................................... 69
Choke and Kill Valves and Lines, Safety-critical Failures .................................. 70 Main Control System, Safety-critical Failures ..................................................... 72
Back-up Control System, Safety-critical Failures ................................................ 75 6.3 RANKING OF FAILURES WITH RESPECT TO SAFETY CRITICALITY .......................... 76
7. BOP TESTING EXPERIENCE .................................................................... 78
7.1 BOP TESTING REGULATIONS ................................................................................ 78 7.2 BOP TEST TIME CONSUMPTION ............................................................................ 78 7.3 TESTING OF ACOUSTIC FUNCTION AND BLIND SHEAR RAM .................................. 81 7.4 OTHER TESTS ........................................................................................................ 82
7.5 COMPARISON WITH PREVIOUS STUDIES................................................................. 82
8. WELL KICKS ................................................................................................ 84
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 7
8.1 KICKS OBSERVED .................................................................................................. 84
8.2 KICK FREQUENCIES ............................................................................................... 86 8.3 COMPARISON OF THE KICK FREQUENCY VS. OTHER STATISTICS ........................... 86
8.4 LEAK OFF PRESSURE VS. MAXIMUM MUD WEIGHT ............................................... 89
9. ABILITY TO CLOSE IN A KICK WITH THE BOP ................................ 92
9.1 INTRODUCTION ...................................................................................................... 92 9.2 PARAMETERS AFFECTING THE BOP’S ABILITY TO CLOSE IN A WELL ................... 92 9.3 OPERATIONAL ASSUMPTIONS ................................................................................ 93
The BOP Stack Design ......................................................................................... 93 BOP Unavailability Calculation .......................................................................... 93 BOP Testing Assumption ...................................................................................... 94 Failure Input Data ............................................................................................... 95 Initial Situation ..................................................................................................... 97
Repair Strategies .................................................................................................. 97
Failure Observation ............................................................................................. 97
Other Assumptions ............................................................................................... 97 9.4 BLOWOUT PROBABILITY, BASE CASE ................................................................... 98
Probability of not Being Able to Close in a Well Kick ......................................... 98 Probability of a Blowout per Time Unit ............................................................... 99
Discussion ............................................................................................................ 99 9.5 BOP TEST STRATEGIES AND BLOWOUT PROBABILITIES...................................... 100 9.6 BOP TEST STRATEGIES AND BOP TEST TIME SAVINGS ...................................... 102
9.7 GUIDANCE FOR ACCEPTING SUBSEA BOP FAILURES OR NOT .............................. 103 9.8 DISCUSSION ......................................................................................................... 105
REFERENCES ..................................................................................................................... 106
ANNEX A BOP TESTING REQUIREMENTS IN NORWAY (/11/) ............................. 107
ANNEX B SUBSEA BOP FAULT TREE .......................................................................... 108
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 8
SUMMARY AND CONCLUSIONS
Data from subsea BOP failures, subsea BOP testing, and well kicks have been systematically
collected for wells spudded in the period 2016-2017 in Norwegian waters. The main source of
information for the study has been the Petroleum Safety Authority Norway’s Daily Drilling
Reporting System.
Only the periods of the well when the BOPs are located on the wellhead/X-mas tree are
included in the study, so shallow gas incidents or shallow water flows are not considered.
Table 1.1 shows an overview of wells and days in service for the various water depths.
Table 1.1 Overview of no of wells and days in service
Development wells Exploration wells Total
No. of well paths
No. of mother wells
No. of BOP days
No. of well paths
No. of mother wells
No. of BOP days
No. of well paths
No. of mother wells
No. of BOP days
137 95 3 930 45 35 1 282 182 130 5 212
BOP days are defined as the number of days the BOP is located on the wellhead/X-mas tree
until it is pulled.
Nine different drilling contractors and 15 different semisubmersible rigs are included in the
study.
Most of the drilling is carried out in water depths less than 500 meters. The deepest water depth
in the data set is 1273 meters (Aasta Hansten field).
Overview of BOP failures
During the study, 94 subsea BOP-related failures were observed. The total time in service was
5 212 BOP days. The total downtime caused by BOP failures was 1305 hours, or 54 days. This
corresponds to approximately 1,05% of the total time in service for the BOP.
A BOP failure does not mean that the complete BOP safety barrier function failed, but a
component in the BOP or the BOP control system failed. For most of the BOP failures, there
are redundant or alternative components to ensure the overall safety and performance of the
BOP.
An overview of BOP subsystem specific contribution to reliability is shown in Figure 1.1.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 9
Figure 1.1 Distribution of BOP failures and downtime
Forty percent of the failures may be attributed to components in the main BOP control system.
The choke and kill lines also experience many failures and approximately 40% of the
downtime. Most of the annular preventer failures are failures where the annular failed to fully
open. These failures normally cause little downtime.
Comparison with previous BOP studies
SINTEF and Exprosoft have carried out subsea BOP reliability studies from the early 80-ties
until today. Until the beginning of the 90s these were studies in Norwegian waters. After that,
studies have been carried out in Brazilian waters and the US GoM OCS. The Norwegian studies
were mainly in shallow waters, whereas the Brazilian and US GoM OCS studies were mainly
in deepwater (DW).
Figure 1.2 compares some key results from the previous subsea BOP reliability studies with
key results from the present study.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 10
Figure 1.2 Comparison of key figures, subsea BOP reliability 1979 – 2018
Figure 1.2 is based on in total of 43 683 BOP days, or 120 BOP years of activity with the BOP
on the wellhead (or X-mas tree). A total of 1 285 failures were observed, causing 36 998 hours,
or 1 540 days of downtime.
The mean time to failure (MTTF) in the present study has improved compared with the previous
studies, except for the DW and kick (/1/) study. The average downtime per BOP day is now
much lower than in all the previous studies. It is important to observe that the main source of
information for the DW and kick study was the BSEE well activity reports (WARs) that is a
weekly reporting system, whereas for the all other studies it was the daily drilling reports. It
can be assumed that many less critical failures are not described in the WARs. These less
critical failures typically produce little downtime.
By combining the data from the present study and the data from the previous BOP studies, an
annual BOP failure rate since 1979 has been established. Figure 4.5 shows the annual failure
rates, alongside 90% confidence intervals, and linear and log linear trend lines for subsea BOP
stacks. Figure 4.5 shows from which studies and from where the data stem. Observe that no
data is available from the years 1990, 1991, 1999-2006, and 2011-2015.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 11
Figure 1.3 Annual failure rates, 90% confidence intervals, linear and log linear trend
lines for subsea BOP stacks for the period 1979 – 2018
The confidence band for the years 2007-2009 is very narrow because the BOP service time was
substantially higher than the other studies. It is important to notice that the graph is based on
the average failure rate for each year. The total amount of experience within each year is thereby
not considered. Figure 4.5 indicates that the failure rate has been significantly reduced over the
years.
Safety-critical failures
All failures that occur in the BOP after the installation test are regarded as safety-critical
failures. This is the period the BOP acts as a well barrier. The criticality of each failure will of
course depend on what part of the BOP system that fails and the failure mode.
Fifty-two or 55% of the 94 failures occurred in the safety-critical period. When looking at these
failures, 26 of 52 were observed during normal operation. Twenty-three failures were observed
during a Test after running casing or liner or a Test scheduled by time of the BOP. For three
failures, it was unknown how the failures were observed.
Two of the normal operation failures were observed because the choke- or kill line were
pressure tested, but this was related to the operation and not a BOP test.
When looking at the failures that were observed during a Test after running casing or liner or
a Test scheduled by time, six failures were observed because pressure was applied. Four of
these failures were in choke and kill lines, one was in a choke valve, and one in an annular
preventer.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 12
Eleven failures were observed in association with BOP testing because the BOP was
functioned. This is typically failures related to the control system. The failures are observed
because hydraulic fluid is leaking, or they fail to operate a function.
Six of the failures had failure mode Failed to fully open annular preventer in association with
a BOP test.
The frequency of failures that occurred in the safety-critical period is higher than in the DW
and kick (/1/) study. It is important to notice that the main source of information for the DW
and kick study was the BSEE well activity reports (WARs) – a weekly reporting system,
whereas for all the other studies, it was the daily drilling reports.
When comparing the overall frequency of failures that occurred in the safety-critical period in
the present study with the frequencies in the previous studies, Phase II DW and Phase I DW,
the frequencies are in the same order of magnitude. The frequencies in the present study are a
bit higher compared with the most recent DW and kick study.
It is noteworthy that, in the present study the most serious BOP failure modes were not
observed. Failures, such as leakage in the wellhead connector, external leakage in rams, and
total loss of BOP control through the main control system were not observed. Leaking
preventers or valves were rare in the present study. The most negative observation was a high
number of leaks in choke and kill lines.
Table 1.2 lists a coarse ranking of the most severe failures that occurred in the safety-critical
period in the present study. The same ranking from the previous studies, DW and kick, Phase
II DW, and Phase I DW, is presented alongside.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 13
Table 1.2 Coarse ranking of failures occurring in the safety-critical period according to
severity
Present study Norway (2016 – 2018) DW and kick (/1/) (2007-2009, US GoM OCS)
1. Nine external leaks in choke and kill lines 2. Two failures that caused loss of all functions
one pod 3. Internal leakage (leakage through a closed
annular) 4. Internal leakage (leakage through a closed
choke/kill valve) 5. One loss of one function both pods 6. Two losses of one function one pod
1. One failure causing wellhead connector external leakage
2. One spurious opening of the LMRP connector (Unknown cause, no autoshear in BOP)
3. One control system failure that caused total loss of the BOP control
4. One shear ram leakage in closed position 5. Upper and lower variable bore ram leaked at
the same time 6. Two incidents, pipe ram failed to close 7. Nine incidents, loss of all functions one pod 8. Two incidents, pipe rams leaked in closed
position 9. One flexible joint external leak 10. One failed to close annular incident 11. Four incidents, annular preventer leak 12. Six choke and kill line leaks 13. Five incidents with loss of one function both
pods
Phase II DW BOP study (/2/) (1997-1999, US GoM OCS)
Phase I DW BOP study (/4/) (1992-1996, Brazil and Norway)
1. One control system failure that caused total loss of the BOP control
2. One spurious opening of the LMRP connector (control system failure)
3. One shear ram failed to close 4. One shear ram leak in closed position 5. Two failures to open pipe ram 6. Two failures where the pipe ram leaked in
closed position 7. External leak in flexible joint 8. One failure to disconnect the LMRP 9. Four failures that caused loss of all functions
one pod 10. Loss of one function both pods (annular close) 11. Four annular preventer leaks in closed position
12. One choke and kill line leak (jumper hose)
1. One failure causing wellhead connector external leakage
2. One failure where they failed to shear the pipe during a disconnect situation
3. One external leakage in the connection between lower inner kill valve and the BOP stack
4. Five failures that caused total loss of the BOP control by the main control system
5. Two shear ram leakages in closed position 6. Two failures to disconnect the LMRP 7. Seven failures that caused loss of all functions
one pod 8. One UPR leakage 9. One spurious closure of the shear ram 10. Three annular preventers that leaked in closed
position 11. Six choke and kill line leakages
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 14
BOP testing experience
The total time used for testing was 2884 hours, this represents in average 0,553 hours per BOP
day, which represents 2,3% of the time. When comparing with test experience from earlier
studies, the present study has in average the shortest subsea BOP test times. Most of the wells
drilled have been in shallow waters, reducing the tool handling time. The main reason is,
however, believed to be that a large proportion of the tests after running casing or liner are
partly tests, and not full tests.
It is a large variation in average BOP test times among the various rigs and operators. Rig D
experienced the highest average test time per day in service. The main reason was an event
where a test tool seal ring was lost in hole and they used more than four days to retrieve it. Rig
F experienced a high average BOP test time because they had severe test equipment problems
and prolonged test time in two of the tests.
Rig I performed a full pressure test for nearly all the installation tests and tests after they had
been running casing or liner. Many of the rigs do not perform a full BOP pressure test after
running casing or liner. The full pressure tests were typically replaced by a well pressure test
and a BOP function test. This reduce the total test time consumption.
In addition, some perform a full BOP test after landing the BOP, when only a connector test is
required if the BOP has been fully pressure tested on the rig prior to running.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 15
Well kicks
Only five well kicks were observed, three in exploration wells and two in development wells.
For two of the exploration well kicks they observed a sudden increase in the rate of penetration
during drilling prior to the kick. For the third kick in an exploration well, the well kicked during
plugging and abandoning the well. They were pulling the seal assembly when trapped gas
below the seal assembly caused the well to kick.
One of the two kicks in a development well occurred when plugging and abandoning the well.
When pulling the tubing hanger plug, gas below the plug caused the well to kick. It was believed
that the gas stemmed from the natural gas lift zone in the well through a leaking gas lift valve.
The second development drilling kick occurred after they had just set a balanced cement plug
from 1943 to 1727 m. They then got losses after having pumped 28,3 m3 of 1,45 sg OBM.
When diluting mud from 1,45 sg to 1,40 sg they observed a gain.
Compared to other kick frequency data the kick frequency found in the present study is very
low. Figure 8.1 shows a graphical overview of the overall kick data from various data sources
alongside the frequencies from the present study.
Figure 1.4 Overview of kick frequencies
BOP testing strategy recommendations
An alternative subsea BOP test strategy has been compared with the test strategy reflected in
Norsok D-010, rev 4.
The analysis is performed with “normal” operational situations in mind. If specific operations
shall be carried out that reduces the BOP barrier availability, specific testing or repair should
be evaluated before starting such operations.
The proposed alternative test strategy will not have any effect on the BOP emergency features,
as emergency disconnect system (EDS), automated mode function (AMF/Deadman), auto
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 16
shear, and ROV functions. The requirements for verification of these systems remain
unchanged.
The main difference between the two test strategies is that the alternative test strategy does not
include a detailed test of all preventer elements for the Test after running casing or liner and
the Pressure test scheduled by time (14 days).
The analyses show that the two alternatives are nearly identical, which means that the detailed
testing of the preventers has no effect on the safety availability for the above two test strategies.
The reason for this is the redundancy in the BOP stack with respect to flow through the BOP
when there is a drill-pipe in the BOP. It is assumed that all three pipe rams have VBR packers
that can close around normal drill-pipes. A sensitivity evaluation shows the same result if only
two out of three rams can close around normal drill-pipes. The same will also apply for BOPs
with a test ram as long as two pipe rams and one annular can seal around the normal drillpipe.
The analysis assumes that kicks are observed in due time. It is important that all kicks are
observed early, such that the BOP can be closed before the well flow becomes too high. BOPs
are not designed to close against flow. Many blowouts have occurred because the kick was not
detected early enough, and the BOP failed to close (/16/). The simplified BOP testing will not
have any effect on this.
The most important test of the BOP is the pressurizing of the BOP to reveal leaks to the
surroundings, especially in the lower part of the BOP.
A test strategy that prolongs the time between the pressure tests to reveal external leaks in the
lower part of the BOP, including the wellhead connector, will reduce the probability of being
able to close in the BOP when a well kick.
A coarse evaluation indicates that this alternative test strategy will reduce the test time for each
of the tests with approximately 3 hours per test compared to the Norsok D010, rev 4
requirement. The average savings in BOP test time will be 0,2 hours per BOP day (or 3 days
per year).
Guidance for accepting subsea BOP failures or not
When a failure in a BOP occurs, the BOP’s ability to act as a safety barrier will be influenced.
Some failures have a large influence on safety availability, while others have a limited or
insignificant influence on the safety availability.
Eighteen different failure scenarios are analysed with fault tree analyses. The analyses show
that many failures in BOP components have an insignificant effect on the BOP safety
availability. When these failures occur, the best choice is in many cases to continue the
operations until the BOP is pulled for other reason, rather than plugging the well and pulling
the BOP. The results should, however, be combined with a risk evaluation and engineering
judgment related to the specific situation and operations to be carried out.
External leakages in the BOP stack or the choke and kill line should always be repaired if
occurring.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 17
LIST OF ABBREVIATIONS
AMF - Automatic Mode Function (deadman)
BOP - Blowout Preventer
BS - Blind-Shear
BSR - Blind-Shear Ram
BSEE - Bureau of Safety and Environmental Enforcement (US)
CARA - Computer Aided Reliability Analysis
CML - Controlled Mud Level
C/K - Choke and Kill
CR - Casing Ram
CSR - Casing Shear Ram
DDRS Daily Drilling Reporting System
DMAS - Deadman Autoshear
EDPHOT - Emergency Drill Pipe Hang-off Tool
EDS - Emergency Disconnect System
FIT - Formation Integrity Test
FTA - Fault Tree Analysis
HP - High-pressure
HIPAP - HIgh Precision Acoustic Positioning
HPHT - High-pressure High Temperature (A well with an expected
maximum shut-in pressure above 690 bar and/or formation
temperatures above 150oC is regarded as a HPHT well)
ID - Inner Diameter
IK - Inner Kill
ITT - Isolation Test Tool
JIP - Joint Industry Project
LAP - Lower Annular Preventer
Lbs - Pounds
LCL - Lower Confidence Limit
LIC - Lower Inner Choke
LMRP - Lower Marine Riser Package
LOC - Lower Outer Choke
LOT Leak Off Test
LPR - Lower Pipe Ram
MFDT - Mean Fractional Deadtime
MPR - Middle Pipe Ram
MPT - Multi Purpose Tool
MTBK - Mean Time Between Kicks
MTTF - Mean Time To Failure
MUX - Multiplex Control System
MW - Mud Weight
NCS - Norwegian Continental Shelf
NPD - Norwegian Petroleum Directorate
NTNU - Norwegian University of Science and Technology
OBM - Oil Based Mud
OCS - Outer Continental Shelf
OD - Outer Diameter
OK - Outer Kill
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 18
POOH - Pull out of hole
Ppg - Pounds per gallon
PSA - Petroleum Safety Authority Norway
RIH - Run in Hole
ROPS - Remotely Operated Pull-in System
ROV - Remotely Operated Vehicle
SEM - Subsea Electronic Module
sg - Specific gravity
SICP - Shut-in Casing Pressure
SIDPP Shut-in Drill Pipe Pressure
UAP - Upper Annular Preventer
UCL - Upper Confidence Limit
UIC - Upper Inner Choke
UOC - Upper Outer Choke
UPR - Upper Pipe Ram
VBR - Variable Bore Ram
Vs. - Versus
WAR - Well Activity Report
WOW - Wait On Weather
WOSP - Wait On Spare Parts
WOO - Wait On Other
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 19
1. INTRODUCTION
1.1 BACKGROUND
From 1983 to 2012, SINTEF and Exprosoft have documented results from several detailed
reliability studies of subsea blowout preventer (BOP) systems. The main subsea BOP reliability
publications are listed as references (/1/-/9/). In these studies, the reliability of subsea BOPs is
documented. A total of approximately 800 wells were reviewed with respect to BOP reliability.
All SINTEF’s property rights related to BOP studies were transferred to Exprosoft in April
2000. Continuity in this work is maintained through Exprosoft’s Per Holand, who was
responsible for this work at SINTEF through some 15 years.
The latest study that involved substantial collection of subsea BOP reliability and kick data was
performed on behalf of BSEE in the US and Eni in 2012, Reliability of Deepwater Subsea BOP
Systems and Well Kicks (/1/). Two studies (/2/ and /3/), concerning BOP reliability and well
kicks were performed on behalf of MMS (now BSEE) a bit earlier. The first one, Reliability of
Subsea Blowout Preventer Systems for Deepwater Applications--Phase II was completed in
1999. The second one Performance of Deepwater BOP Equipment During Well Control Events
was completed in 2001.
The three latest studies are public and have been widely used as references for nearly all other
studies involving subsea BOP reliability world-wide.
No detailed BOP reliability study has been carried out based on Norwegian wells since the
early 90’s, in spite of the fact that the subsea BOP is the most important safety barrier in floating
drilling.
Important parameters are;
• Rig downtime during drilling caused by BOP failures
• Time consumption during BOP testing
• The BOP must function always to be prepared to kill the well
1.2 PROJECT PARTICIPANTS
Exprosoft submitted a proposal for a new subsea BOP reliability project that should be based
on Norwegian activity to verify the reliability of current subsea BOPs. The proposal was
distributed in late winter 2018. The project was kicked off by the end of June 2018 with the
following participants:
• Equinor ASA
• Faroe Petroleum Norge as (now DNO North Sea)
• Aker BP ASA
• Lundin Norway AS
• Wellesley Petroleum AS
• VNG Norge AS (now Neptune Energy Norge AS)
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 20
1.3 STUDY OBJECTIVE
The main objectives of this study are to:
• Document the subsea BOP reliability in the Norwegian sector as input for a continuous
improvement in the reliability of subsea BOPs
• Compare performance of current BOPs in terms of downtime caused by BOP failures
and BOP test time consumption for the various rigs, with previous reliability study
results
• Establish a quantified overview of the kick frequencies and the important parameters
contributing to the kick frequency in the various areas
• Verify the BOP’s ability to act as a barrier
• Document and analyse the BOP testing in terms of test time consumption and BOP
safety availability for various BOP layouts
• Identify more efficient ways of testing the BOP without reducing the BOP safety
availability
• Establish a guidance for deciding to pull and repair the BOP or continue operation
with a failed BOP component
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 21
2. DATA COLLECTION AND ANALYSES
2.1 DATA SOURCES
The main information source for the study has been the Petroleum Safety Authority Norway
(PSA) Daily Drilling Reporting System (DDRS). All operating companies drilling wells on the
Norwegian Continental Shelf shall submit a daily report to the authorities. This reporting
scheme has been in operation since 1984.
The following DDRS tables were requested.
1. Element drillReport
2. Element wellAlias and wellboreAlias
3. Element WellboreInfo
4. Element StatusInfo
5. Element fluid
6. Element PorePressure
7. Element SurveyStation
8. Element activity
9. Element EquipFailureInfo
10. Element ControlIncidentInfo
11. Element GasReadingInf
The key information is found in file 8. Element activity. This file includes a verbal description
of the activities performed and the starting and stopping times for the activity. The file
comprises approximately 127 000 lines of activity descriptions.
The data for the study is collected from wells drilled with a semisubmersible, spudded in the
period 2016-2017. Approximately 89% of the wells are included.
Information about BOP equipment and the rigs stems from the operators and public sources.
Information related to the wells, BOP failures, BOP test, and well kicks is extracted from the
DDRS files.
2.2 STATISTICAL ESTIMATION PROCEDURE AND ASSUMPTIONS
For data sets where no trend is observed, the number of failures during a specific time period
may be modelled by a homogeneous Poisson process, with failure rate (/3/). The failure rate
is estimated by
�̂� = 𝑁𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑓𝑎𝑖𝑙𝑢𝑟𝑒𝑠
𝐴𝑐𝑐𝑢𝑚𝑢𝑙𝑎𝑡𝑒𝑑 𝑜𝑝𝑒𝑟𝑎𝑡𝑖𝑛𝑔 𝑡𝑖𝑚𝑒=
𝑛
𝑠
The number of BOP days multiplied with the number of items is used as the accumulated
operating time or days in service for the BOP failures.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 22
The uncertainty in the estimate, ̂, may be measured by a 90% confidence interval:
• If the number of failures n > 0, a 90% confidence interval is calculated by:
Lower limit: 𝜆𝐿 =1
2𝑠𝜒2
0.95,2𝑛
Upper limit: 𝜆𝐻 =1
2𝑠𝜒2
0.05,2(𝑛+1)
• If the number of failures n = 0, a 90% (single sided) confidence interval is calculated by:
Lower limit: 𝜆𝐿 = 0
Upper limit: 𝜆𝐻 = 1
2𝑠𝜒2
0.1,2
where ,𝑧 denotes the upper 100% percentile of the Chi-square distribution with z degrees of
freedom (/3/).
The meaning of the 90% confidence intervals is that the frequency is a member of the interval
with probability 90%, i.e., the probability that the frequency is lying outside the interval is 10%.
MTTF (Mean time to failure) is the inverse value of the failure rate, , i.e.:
𝑀𝑇𝑇𝐹 = 1
𝜆
The uncertainty in the MTTF may also be measured by a 90% confidence interval, and can be
expressed by H and L:
Lower limit: 𝑀𝑇𝑇𝐹𝐿 = 1
𝜆𝐻
Upper limit: 𝑀𝑇𝑇𝐹𝐻 = 1
𝜆𝐿
Example:
Assume that we want to find the failure rate and the MTTF of the annular preventers in a
specific BOP stack.
The BOP stack has been in service for 1000 BOP days, and the stack has two annular preventers.
A total of four failures have been observed during the time in operation. The accumulated
operating time then becomes 1000 BOP days x 2 annular preventers = 2000 days in service. The
estimated failure rate is
�̂� = 𝑁𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑓𝑎𝑖𝑙𝑢𝑟𝑒𝑠
𝐴𝑐𝑐𝑢𝑚𝑢𝑙𝑎𝑡𝑒𝑑 𝑜𝑝𝑒𝑟𝑎𝑡𝑖𝑛𝑔 𝑡𝑖𝑚𝑒=
𝑛
𝑠=
4
1000 × 2
= 0.002 𝑓𝑎𝑖𝑙𝑢𝑟𝑒𝑠 𝑝𝑒𝑟 𝑑𝑎𝑦 𝑖𝑛 𝑠𝑒𝑟𝑣𝑖𝑐𝑒
The corresponding estimated MTTF is
𝑀𝑇𝑇𝐹 = 1
𝜆 =
1
0.002 = 500 𝑑𝑎𝑦𝑠 𝑖𝑛 𝑠𝑒𝑟𝑣𝑖𝑐𝑒
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 23
3. SUBSEA BOPS
The wells forming the basis for the present study were drilled with floating rigs and spudded
in the Norwegian Continental Shelf (NCS) during the period January 1st, 2016 to January 1st,
2018.
3.1 SYSTEM DESCRIPTION AND BOUNDARY CONDITIONS
Figure 3.1 shows typical BOP configurations for drilling in Norwegian waters. Notice that these
are illustrative sketches of BOPs, because the actual configuration may vary from rig to rig.
The BOP equipment considered in the present study are:
1. Wellhead and LMRP connectors
2. Ram preventers
3. Annular preventers
4. Flexible joint
5. Choke and kill lines and valves
6. Main control system
7. Acoustic back-up control system
The drilling riser, except the choke and kill lines, is not a part of the present study.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 24
Figure 3.1 Typical BOP configurations
Table 3.1 shows an overview of the BOP configuration of rigs that are included in the study.
The BOP stacks were all 18 ¾” and rated for a pressure of either 15 000 or 10 000 psi. All the
drilling vessels were semisubmersible rigs.
Example one
Wellhead connector
Blind Shear ram
Jumper hose line
Riser
Flexible joint
Upper annular preventer
Lower annular preventer
BOP attached line
Lower pipe ram
Middle pipe ram
LMRP connector
Upper pipe ram
Casing shear ram
Riser attached line
Lower kill valves
Upper kill valves
Lower choke valves
Upper choke valves
Bleed off valves
Lower choke valves
Upper choke valves
Lower kill valves
Upper kill valves
Annular preventer
Example two
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 25
Table 3.1 BOP configuration of various rigs
Rig name BOP days in service
BOP make Pressure
rating (psi)
Control system principle
No of choke kill
valves
No. of annulars
No. of ram preventers
BSR CSR Pipe ram
Total
Rig A 211 Hydril 10 000 Pilot hydraulic 6 2 1 3 4
Rig B 272 Cameron 10 000 Pilot hydraulic 10 1 1 1 3 5
Rig C 362 NL Shaffer 15 000 Pilot hydraulic 6 2 1 3 4
Rig D 255 Cameron 10 000 Pilot hydraulic 6 2 1 3 4
Rig E 277 NL Shaffer 15 000 Multiplex 10 2 1 1 4 6
Rig F 267 Cameron 15 000 Multiplex 8 2 1 1 3 5
Rig G 496 NL Shaffer 15 000 Pilot hydraulic 10 1 1 1 3 5
Rig H 331 Cameron 10 000 Pilot hydraulic 10 1 1 1 3 5
Rig I 425 Cameron 15 000 Multiplex 10 2 1 1 3 5
Rig J 495 Cameron 15 000 Pilot hydraulic 8 1 1 3 4
Rig K 409 Cameron 15 000 Pilot hydraulic 6 2 1 3 4
Rig L 470 Cameron 10 000 Pilot hydraulic 10 1 1 1 3 5
Rig M 164 NL Shaffer 15 000 Pilot hydraulic 6 2 1 3 4
Rig N 270 Cameron 15 000 Multiplex 8 2 1 1 3 5
Rig O 508 Cameron 10 000 Pilot hydraulic 10 1 1 1 3 5
Total 5 212
Average 8,27 1,60 1 0,60 3,07 4,67
For the BOPs in the present study, the ram and annular preventers come from the same
manufacturer. A BOP stack can, however, have components from different manufacturers. As
seen from Table 3.1 the three major BOP manufacturers are represented in the study. Four
percent of BOP days in service stems from Hydril BOPs, 71% from Cameron, and 25% from
NL Shaffer.
There are two main principles of BOP control systems, pilot hydraulic or multiplex systems.
76% of the BOP days in service stems from pilot hydraulic systems, and the remaining 24%
from multiplex system. The main difference between these two systems is that in pilot systems
the BOP functions are activated by a hydraulic signal from the rig (pilot signal), whereas the
multiplex systems are activated by electronic/electronic signals that are sent to the BOP and
transformed to a pilot signal there. The multiplex system reduces the BOP closing time. To be
able to meet the closing time requirements, multiplex systems are normally needed in
deepwater drilling. For shallow water drilling, both the systems may be used. Most of the
drilling in Norwegian waters are shallow water drilling.
Six of the 15 rigs had only one annular preventer. All rigs had one blind shear ram (BSR)
preventer, and nine had a casing shear ram (CSR) in addition. All rigs, except one, had three
pipe rams, the last one had four.
The number of choke & kill valves varies between six and 10 for the various BOPs.
3.2 RELEVANT DEFINITIONS
• BOP days is defined as the number of days the BOP is located on the wellhead/X-mas
tree until it is pulled.
• Item days for a specific BOP item is the number of BOP days multiplied with the
number of items in the BOP stack.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 26
• BOP failure is an event when any component of the BOP system mentioned in Section
3.1 is not able to perform its intended function. The criticality of a BOP failure depends
on the activity when the failure occurred and the severity of the failure.
• BOP downtime is the lost time in hours due to BOP failure
3.3 OPERATORS AND WELLS
Table 3.2 shows the operators represented with drilling in the present study. A total of 130
mother wells or 182 well paths (when sidetracks and multilaterals are counted as separate wells)
are included. A total of 5 212 BOP days is included.
It is also observed that far more development drilling is carried out than exploration drilling.
Table 3.2 Operators vs. well types and BOP days
Operator
Development wells Exploration wells Total
No. of well paths
No. of mother
wells
No. of BOP days
No. of well paths
No. of mother
wells
No. of BOP days
No. of well paths
No. of mother
wells
No. of BOP days
Operator A 4 2 99 4 2 99
Operator B 1 1 18 1 1 18
Operator C 7 7 157 3 3 113 10 10 270
Operator D 7 7 277 1 1 41 8 8 318
Operator E 18 7 451 2 2 40 20 9 491
Operator F 11 8 425 11 8 425
Operator G 105 74 3 045 21 16 449 126 90 3 494
Operator H 1 1 84 1 1 84
Operator I 1 1 13 1 1 13
Total 137 95 3 930 45 35 1 282 182 130 5 212
3.4 RIGS AND WATER DEPTHS EVALUATED
Table 3.3 shows rigs and their time in service (BOP days) for various water depths.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 27
Table 3.3 Rigs and Water Depths
Rig name Water depth grouped (m)
< 200 200 - 300 300 - 400 400 - 500 1200 - 1300 Total
Rig A 154
57
211
Rig B
19 225 28
272
Rig C 58 56 248
362
Rig D
195 60
255
Rig E
277
277
Rig F
84 183 267
Rig G
496
496
Rig H
75 256
331
Rig I
310 115
425
Rig J 495
495
Rig K 368
41
409
Rig L
470
470
Rig M 164
164
Rig N
179 91
270
Rig O
508
508
Total 1239 345 3 086 359 183 5 212
Most of the drilling is carried out in water depths less than 500 m. The well drilled in the deepest
water depth is at 1273 m (Aasta Hansten field).
3.5 MAIN OPERATION AND WELL TYPE
Table 3.4 shows the time in service (BOP days) for the various main activities vs. well types.
Table 3.4 Time in service for the various main activities
Main operation BOP days in service
Development Exploration Total
Completion 759,4 61,7 821,0
Drilling 2 232,7 716,2 2 948,8
Formation evaluation 32,3 216,9 249,2
Interruption 813,7 122,1 935,8
Moving 10,3 1,5 11,8
Plug abandon 45,1 171,5 216,6
Workover 28,7 0,0 28,7
Total 3 922,1 1 289,9 5 212,0
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 28
4. OVERVIEW OF BOP FAILURES
A total of 94 BOP failures are identified during the present study during a total time in service
of 5 212 BOP days. An overview of key reliability parameters is provided in Table 4.1.
Table 4.1 Overview of failures
BOP Subsystem BOP days in service
Item days in service
No of failures
Total lost time (hrs)
MTTF (Item
days in service)
MTTF (BOP days)
Avg. downtime per failure
(hrs)
Avg. downtime
per BOP day (hrs)
Flexible joint 5 212 5 212 0 Annular preventer 5 212 7 852 15 25 523 347 1,7 0,005
Ram preventers 5 212 24 441 6 128 4 074 869 21,3 0,024
Connectors 5 212 10 424 3 26 3 475 1 737 8,6 0,005
Choke kill valves 5 212 44 452 3 31 14 817 1 737 10,4 0,006
Choke and kill lines 5 212 5 212 19 538 274 274 28,3 0,103
Main Control systems 5 212 5 212 38 407 137 137 10,7 0,078
Acoustic control system 5 212 5 212 10 150 521 521 15,0 0,029
Total 5 212 94 1 305 55 13,9 0,250
Thirty-eight of the 94 failures, or 40%, are attributed to components in the main BOP control
system that operates the various BOP functions. Nineteen failures are observed in the choke
and kill lines that caused 40% of the total BOP downtime
The total downtime caused by BOP failures is 1305 hours (54 days). This corresponds to
approximately 1,05% of the total time in service for the BOP.
Table 4.2 shows that 81 failures with a total of 1115 hours of downtime occurred when the
BOP was on the wellhead. Twenty-five of these failures did not cause any downtime Such
failures represent instances where failures are accepted due to low criticality or that the BOP is
pulled due to another failure.
Table 4.2 Breakdown of failures based on BOP location
BOP location No. of
failures Total lost
time Percentage of total failure
No. of failure with no associated downtime
BOP is on the wellhead 81 1115 86% 25
While running/pulling BOP 12 189 13% 0
On rig, ready to run 1 1 1% 0
Total 94 1305 100% 25
The downtime caused by a single BOP failure varied between 0 and 125 hours.
Figure 4.1 shows the failure rates for the BOP subsystems. Although the main control systems
have the highest failure rate, the choke and kill lines, annular preventers, and the acoustic back-
up system are also represented with many failures.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 29
Figure 4.1 BOP subsystem failure rate
The BOP subsystem downtime per BOP day is presented in Figure 4.2. The choke and kill lines
are the largest contributor to downtime, then the main control system.
Figure 4.2 Average downtime per BOP day
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 30
4.1 COMPARISON WITH THE PREVIOUS SUBSEA BOP RELIABILITY STUDIES
SINTEF and Exprosoft have carried out subsea BOP reliability studies since the early 80-ties.
Until the beginning of the 90s these were studies in Norwegian waters. After that, it has been
performed studies in Brazilian waters and the US GoM OCS. The Norwegian studies were
mainly in shallow waters, whereas the Brazilian and US GoM OCS studies were mainly in
deepwater (DW).
Table 4.3 compares some key results from the previous subsea BOP reliability studies with key
results from the present study.
Table 4.3 Comparison of key figures, subsea BOP reliability studies 1980 – 2018
Study BOP days
Total Lost Time (hrs)
No. of fail-ures
MTTF (BOP days)
Avg. down-time per
failure (hrs)
Avg. down-time per BOP
day (hrs) Years drilled and country
Phase II (/9/) 8 115 8 780 503 16,1 17,5 1,08 1979-1982, Norway
Phase IV (/7/) 3 809 2 735 139 27,4 19,7 0,72 1982-1986, Norway
Phase V (/6/) 2 636 2 142 74 35,6 29,0 0,81 1987-1989, Norway
DW I (/4/) 4 846 4 950 202 24,0 24,5 1,02 1992-1996, Brazil and Norway
DW II (/2/) 4 009 3 638 117 34,3 31,1 0,91 1997-1999, US GoM OCS
DW and kick (/1/) 15 056 13 448 156 96,5 86,2 0,89 2007-2009, US GoM OCS
Present study 5 212 1 305 94 55 13,9 0,250 2016-2018, Norway
TOTAL 43 683 36 998 1 285 34 28,8 0,706
Table 4.3 shows that in total 43 683 BOP days, or 120 years of drilling activity with the BOP
on the wellhead is represented in these studies. In total, 36 998 hours (i.e., 1540 days) have
been used for repairing these failures.
The MTTF in the present study has improved when comparing with the previous studies, except
for the DW and kick (/1/) study. The average downtime per BOP day is much lower than in all
the previous studies. It is important to observe that the main source of information for the DW
and kick study was the BSEE well activity reports (WARs), which is a weekly reporting system,
while for the all other studies it was the daily drilling reports. It can be assumed that many less
critical failures are not described in the WARs. These less critical failures typically produce
little downtime.
Figure 4.3 compares the BOP subsystem specific failure rates in the present study with the total
data from all the other BOP studies.
It may be observed that the failure rate is lower for all the subsystems in the present study
compared to total result from the previous studies previous studies.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 31
Figure 4.3 Comparison of BOP item specific failure rate with previous studies
When comparing the average downtime per BOP day for the present study and all the previous
studies (Figure 4.4), it is observed that the downtime is far lower in the present study than in
the previous studies. It should be noted that most of the wells drilled in the 90ties and early
2000 were deepwater wells. Deeper water increases the repair time for the individual failures
because of the time needed to pull and run the BOP.
It seems that the reliability of the BOPs in general have improved compared with the previous
studies.
Figure 4.4 Comparison of BOP item specific downtime
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 32
4.2 ANNUAL TRENDS IN FAILURE RATES AND DOWNTIME
By combining the data from the present study and the data from the previous BOP studies
carried out by SINTEF and Exprosoft, an annual BOP failure rate since 1978 has been
established. In Table 4.4 the data for each of the years is listed.
Table 4.4 Annual overview of BOP data
Year BOP days Total Lost Time (hrs)
No. of failures
MTTF (BOP days)
Avg. downtime per failure (hrs.)
Avg. downtime per BOP day (hrs.)
Before1978 162 26 4 40,5 6,5 0,16
1978 322 123,5 23 14 5,37 0,38
1979 528 637,7 45 11,7 14,17 1,21
1980 919 778 53 17,3 14,68 0,85
1981 1935 2298 129 15 17,81 1,19
1982 2346 2858 145 16,2 19,71 1,22
1983 1973 2146,7 115 17,2 18,67 1,09
1984 1338 1251 54 24,8 23,17 0,93
1985 1432 803 40 35,8 20,08 0,56
1986 969 592,8 34 28,5 17,44 0,61
1987 1165 1073 38 30,7 28,24 0,92
1988 1029 436,5 20 51,5 21,83 0,42
1989 442 632,5 16 27,6 39,53 1,43
1990 -1991 No data
1992 962 1759 63 15,3 27,92 1,83
1993 1411 1293 48 29,4 26,94 0,92
1994 762 752 23 33,1 32,7 0,99
1995 801 154,5 13 61,6 11,88 0,19
1996 873 991 55 15,9 18,02 1,14
1997 1972 2529,75 61 32,3 41,47 1,28
1998 2074 1107,5 56 37 19,78 0,53
1999 - 2006 No data
2007 4923 4546 53 92,9 85,77 0,92
2008 6253 4574,5 60 104,2 76,24 0,73
2009 3162 4178 38 83,2 109,95 1,32
2010 718 149,5 5 143,6 29,90 0,21
2011 - 2015 No data
2016 2 169 558,5 41 52,9 13,62 0,26
2017 2 639 633,9 47 56,1 13,49 0,24
2018 404 112,5 6 67,3 18,75 0,28
Total 43 683 36 996,3 1285 33,99 28,79 0,85
The data in Table 4.4 has been used to create Figure 4.5. Figure 4.5 shows the annual failure
rates, alongside 90% confidence intervals, and linear and log linear trend lines for subsea BOP
stacks. Table 4.3 shows from which studies and from where the data stem. It has been decided
to disregard the data from 1978 because this year has few data. Further, observe that no data is
available from the years 1990, 1991, 1999-2006, and 2011-2015. After the Deepwater Horizon
accident in 2010 the industry started to focus more on BOP reliability. This have likely caused
an improvement in BOP reliability.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 33
Figure 4.5 Annual failure rates, 90% confidence intervals, linear and log linear trend
lines for subsea BOP stacks for the period 1979 – 2018
The confidence bands for the years 2007-2009 are very narrow because the BOP service time
was substantially higher in this period. It is important to notice that the graph is based on the
average failure rate for each year. The total amount of experience within each year is thereby
not considered. However, the plotted data in Figure 4.5 indicates that the failure rate has been
significantly reduced over the years.
In Figure 4.6, the average downtime per year and the associated trend lines for the average
downtime per day in service are shown.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 34
Figure 4.6 Average downtime per BOP day and associated trend lines for the period
1979 – 2009
As seen from Figure 4.6, a slight reduction in the downtime per day in service is indicated by
the trend lines. Most data from 1992 until 2010 come from deepwater wells. The BOP handling
times increase with the water depth.
4.3 INFLUENCES BY SEASON AND FIELD CONDITIONS
Water Depth
Table 4.5 shows an overview of the BOP reliability for various water depths. There is no clear
trend related to water depth and BOP reliability based on this table, even though the MTTF is
lowest and the downtime is highest for the 1200-1300 meters water depth range. There are,
however, few BOP days for this water depth range.
Table 4.5 Overview of BOP reliability for various water depths (Norwegian waters
2016-2018)
Water depth (m)
No. of BOP days Total lost time
(hrs) No of
failures MTTF (days)
Downtime per BOP day (hrs)
<200 1 239 279,92 23 53,9 0,226
200 - 300 345 1,5 8 43,1 0,004
300 - 400 3 086 874,7 49 63,0 0,283
400 - 500 359 39 9 39,9 0,109
1200 - 1300 183 109,75 5 36,6 0,600
Total 5 212 1 304,87 94 55,4 0,250
0
0,2
0,4
0,6
0,8
1
1,2
1,4
1,6
1,8
2A
vg.
do
wn
tim
e p
er
BO
P-d
ay (
hrs
)
Years
Avg. downtime per BOP day (hrs)
Linear (Avg. downtime per BOP day (hrs))
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 35
Seasonal Variation
Winter is defined to be from October 1st to March 31st. The remaining period is defined as
summer. Table 4.6 shows that 49 of the 94 failures were observed during winter and 45 during
summer.
Table 4.6 Overview of BOP reliability for winter and summer (Norwegian waters 2016-
2018)
Season No. of BOP days Total lost time
(hrs) No of failures MTTF (days)
Downtime per BOP day (hrs)
Summer 2 761 653,1 45 61,4 0,237
Winter 2 451 651,8 49 50,0 0,266
Total 5 212 1 304,9 94 55,4 0,250
The influence of the winter and summer on the BOP reliability is limited. The slightly increased
failure rate and average downtime per BOP day can probably be explained by the rougher
weather. For four of the BOP failures that occurred during winter time, they had to wait on
weather (WOW) before they could run or land the BOP. Total BOP repair related WOW time
during winter was 86,5 hours, and 6,5 hours during summer.
Rough weather is also likely to increase the failure probability associated to rougher BOP
running conditions. Especially, the choke and kill lines, and parts of the control systems will
be exposed.
Area Variation
Table 4.7 shows an overview of the BOP reliability results for the various areas in the
Norwegian waters.
Table 4.7 Overview of BOP reliability for various areas in the Norwegian waters
Area No. of BOP days Total lost time
(hrs) No of failures MTTF (days)
Downtime per BOP day (hrs)
Barents Sea 1 074 578 33 32,5 0,538
North Sea 2 999 424,9 46 65,2 0,142
Norwegian Sea 1 139 301,9 15 75,9 0,265
Total 5 212 1304,8 94 55,4 0,250
Both the failure rates and the average downtime per BOP day in service is much higher in the
Barents Sea than in the other areas. When investigating the cause for this high failure rate and
the high downtime, it was found to be caused by one rig with several problems related to choke
and kill lines and control system.
4.4 RIG SPECIFIC PERFORMANCE
The 15 rigs included in the present study show a highly varying failure rate and downtime per
BOP day in service, as illustrated in Figure 4.7. The left and right vertical axes represent
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 36
downtime and failure rate per BOP days, respectively, for each rig. The confidence bands for
the failure rates are also shown.
There is one rig without any failure, Rig M. This rig also has the lowest number of BOP days
in service.
Rig I has the highest failure rate and the highest downtime per day in service. This rig had
several problems with leaking choke and kill lines and control system failures.
Rig D has a high failure rate, but a very low rig downtime. They had several incidents where
the annular failed to fully open, and some control system failures that did not cause any
downtime.
The downtime is highly influenced by relatively few failures of long duration. The 10 failures
with the longest duration caused 59% of the total downtime.
Figure 4.7 Rig specific performance for downtime and failure rate per BOP day with
90% confidence interval
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 37
5. BOP SYSTEM SPECIFIC RELIABILITY
5.1 FLEXIBLE JOINT
Today, all rigs have a flexible joint with a flexible element. The use of ball joint as a flexible
joint is obsolete.
Table 5.1 shows an overview of flex joint manufacturers included in the study.
Table 5.1 Flex joint manufacturers and BOP days in service
Manufacturer BOP days in service
Oil states 2 606
Parker Cameron 1 581
Unknown 814
Vetco 211
Total 5 212
No failures were observed in the flexible joint in the present study. Modern flexible joints are
generally very reliable as indicated by no failures in the present study and very few failures in
earlier studies.
Historic Overview, Flex Joint Failures
Table 5.2 shows some key information related to flexible joint failures observed in the previous
subsea BOP reliability studies.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 38
Table 5.2 Historic overview, flex joint failures
Study BOP days No of flex
joint failures
Lost time (hrs)
Comments Years drilled and
country
Phase II (/9/)
8 115 11 775 Most failures were related to ball joint type flexible joints (rarely in use anymore). Twice a joint parted. Many leaks
1979-1982, Norway
Phase IV (/7/)
3 809 2 111 Flexible type joint. Both was pulled and repaired due to wear
1982-1986, Norway
Phase V (/6/)
2 636 0 1987-1989, Norway
DW I (/4/) 4 846 1 50 The flex joint was twisted, and had to be replaced
1992-1996, Brazil and Norway
DW II (/2/)
4 009 1 248,5 This failure was in a ball joint type. The failure was an external leakage, most probably, a welding error. Lost mud and well kicked
1997-1999, US GoM OCS
DW and kick (/1/)
15 056 1 288 Failure of a threaded plug in test port 2007-2009, US GoM OCS
Present study
5 212 0 2016-2018, Norway
TOTAL 43 683 16 1 473
5.2 ANNULAR PREVENTER RELIABILITY
Six of the 15 rigs included in the study were equipped with one annular, while nine rigs were
equipped with two (Table 3.1, page 25). Table 5.3 shows the annular preventer manufacturer,
model, pressure rate, and service times included in the study.
Table 5.3 Annular preventer manufacturer, model, pressure rate and service times
Manufacturer Model Pressure rate
(psi) BOP item days in
service
Cameron
D 10 000 1 390
DL 10 000 3 428
Total 4 818
Hydril GX
5 000 211
10 000 211
Total 422
NL Shaffer
Spherical 5 000 164
10 000 164
Unknown 10 000 554
Wedge cover 5 000 510
10 000 1 220
Total 2 612
Total 7 852
Table 5.4 shows the failure mode distribution and associated lost time for annular preventer
failures. A total of 24 annular preventer failures occurred. The failed to fully open and internal
leakage (leakage through a closed annular) are the dominant failure modes.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 39
Table 5.4 Annular Preventer failure modes and associated number of failures
Failure mode description No. of
failures Total lost time (hrs)
BOP days in service
Item days in Service
MTTF (Item days in service)
Avg. down-time per
failure (hrs)
Avg. downtime per BOP day
(hrs)
Failed to fully open 12 8,75
5 212 7 852
654 0,73 0,001679
Internal leakage (leakage through a closed annular)
2 2 3 926 1 0,000384
Internal hydraulic leakage (control fluid part)
1 14 7 852 14 0,002686
Total 15 24,75 523 1,65 0,004749
Failed to Fully Open
The failed to fully open annular preventers have been observed in all BOP studies. In the present
study, these failures were observed on six different BOPs. For one of the BOPs this occurred
several times, for the others one or twice.
Below, a brief description of Failed to fully open failures are given:
1. POOH with BOP test tool. Worked through LAP/UAP with max 5-ton
2. L/D single to deck and installed landing stand. Struggled to pass LAP
3. Pulled SLT (Spring Loaded Tool) to surface. Worked with SLT to max 7-tons through
annulars.
4. Pulled BOP test tool and bullnose to surface. Observed max 5-tons overpull in LAP/UAP.
5. Pulled SLT, worked through annulars - max 6-tons, racked back
6. POOH w/ LIT (Lead Impression Tool). Stopped in lower annular. Rotated, but, no-go.
Increased overpull in steps to 28-tons and passed lower annular slowly.
7. Experienced 12-tons overpull when attempting to POOH. Waited for element to retract.
8. Attempted to pull out of hole with 9 5/8 tie back casing. Took 5-tons overpull when pulling
seal assembly through LAP. Increased overpull in steps to max 65-tons overpull without
any progress. Verified string free down each time. Continued to work string. Came up 4 m
when pulling string up with 27-tons overpull.
9. Observed taking weight with seal assembly in UAP. Work string with max 62-tons
overpull. With 45 overpull came free (same problem in LAP)
10. Took 2-3-ton in annular but pulled through.
11. Caught up in LAP on the way out with tool. Attempted to pass 3 times, no go. Performed
20 t overpull. Re-landed test tool and closed LAP and opener again to remove potential
ovality. Still unable to pass LAP. Took 8-tons over pull and closed UAP to centralize string
in BOP, tool slid through when opening UAP.
12. RIH (Run in Hole) with MPT (Multi Purpose Tool) w 10 ¾ seal assembly and worked same
through both upper and lower annulars with up to 8-tons weight and 5-tons overpulls.
Landed off MPT in 10 ¾ casing hanger and set down 10-tons weight.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 40
Internal leakage
Internal leakage (leakage through a closed annular) were observed twice. For both incidents,
the closing pressure of the annular preventer was increased. For one of them, the annular still
leaked. For the other, they continued with the operation.
13. During squeeze pressure dropped from 24 to 15 bar, an increase in trip tank was observed
indicating annular leaking. Increased closing pressure on annular. Continued squeeze
operation.
14. Pressure tested UAP to 30 bar/5 min, no leaks. Attempted to pressure test UAP to 241 bar,
observed leak. Increased closing pressure to 1500 psi and observed a better trend but leak
still above acceptance criteria.
Internal Hydraulic Leakage
Internal hydraulic leakage was observed once.
15. During a BOP test they observed leakage of BOP fluid at approx. 600 litres/hour while
applied open function on upper annular preventer (UAP). The failure was repaired one week
later when the BOP was pulled prior to run the X-mas tree. When opened the UAP it was
observed some metal swarf/junk stuck between annular piston and housing. Removed
piston, adaptor ring and packing element from UAP and replaced all with new parts.
Historic Overview, Annular Preventer Failures
Table 5.5 shows some key information related to annular preventer failures observed in the
previous subsea BOP reliability studies.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 41
Table 5.5 Historic overview, annular preventer failures
Study BOP days No. of annular
preventer failures
Total Lost Time (hrs)
Comments Years drilled and
country
Phase II (/9/)
8 115 52 458,0 Failure modes; Internal leak 17%, fail to close 4%, internal hydraulic leakage (control fluid part) 10%, failed to fully open 62%, other/unknown 7%
1979-1982, Norway
Phase IV (/7/)
3 809 35 111,0 Failure modes; Internal leak 3%, failed to fully open 90%, other/unknown 7%
1982-1986, Norway
Phase V (/6/)
2 636 8 534,5 Failure modes; Internal hydraulic leakage (control fluid part) 13%, failed to fully open 87%,
1987-1989, Norway
DW I (/4/) 4 846 20 146,0 Failure modes; Internal leak 55%, failed to fully open 40%, other/unknown 5%
1992-1996, Brazil and Norway
DW II (/2/)
4 009 12 336,5
Failure modes; Internal leak 50%, failed to fully open 50%
1997-1999, US GoM OCS
DW and kick (/1/)
15 056 24 2344,5 Failure modes; Internal leak 46%, fail to close 4%, internal hydraulic leakage (control fluid part) 8%, failed to fully open 33%, other/unknown 8%
2007-2009, US GoM OCS
Present study
5 212 15 24,8 Failure modes; Internal leak 13%, internal hydraulic leakage (control fluid part) 7%, failed to fully open 80%
2016-2018, Norway
TOTAL 43 683 166 3 955,3
5.3 HYDRAULIC CONNECTOR RELIABILITY
All subsea BOPs are equipped with two hydraulic connectors. The wellhead connector connects
the BOP stack to the wellhead. The Lower Marine Riser Package (LMRP) connector connects
the riser to the BOP stack. These connectors are in principle identical, but usually the wellhead
connector is rated to a higher pressure. Typically, the wellhead connectors are rated to the same
pressure as the ram preventers, and the LMRP connectors are rated to the same pressure as the
annular preventers.
Table 5.6 shows an overview of the connector manufacturer included in the study and the
associated operational time.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 42
Table 5.6 Hydraulic connector manufacturer, model, pressure rate and service times
Manufacturer Model Sum of Item-days in service
Pressure rate 10 000 psi Pressure rate 15 000 psi Total
Cameron
C-PRO HDH4 267 267
EVO 495 495
HC-Collet 495 425 920
HCH4 1 581 1 581
M70- Collet 2 620 2 620
Unknown 537 537
Total 5 233 1 187 6 420
Drill-Quip DX-DW 277 277
Total 277 277
Vetco
H4 255 211 466
H4 EXF 935 935
H4 HD (Heavy Duty) 695 695
Unknown 496 496 992
H4 HAR (High Angle Release) 362 362
Total 1 113 2 337 3 450
Unknown Unknown 277 277
Total 277 277
Total 6 623 3 801 10 424
Three hydraulic connector failures occurred in the present study resulting in a total lost time of
25,75 hours. The failure modes for the hydraulic connector failures are shown in Table 5.7.
Table 5.7 Hydraulic connector failure modes and associated number of failures
Failure mode description No. of
failures Total lost time (hrs)
BOP days in service
Item days in Service
MTTF (Item days in service)
Avg. down-time per
failure (hrs)
Avg. downtime per BOP day (hrs)
External leakage (leakage to environment)
1 22,5
5 212 10 424
10 424 22,5 0,004317
Failed to lock 1 0,25 10 424 0,25 0,000048
Spurious opening 1 3 10 424 3 0,000576
Total 3 25,75 3 475 9 0,004941
External Leakage
An external leak during normal operation in a wellhead connector is one of the most critical
failure modes in terms of controlling a well kick. This failure was, however, observed on the
BOP installation test so the well was not at risk. Such failures have been observed during
normal operation, but they are rare. After the wellhead and LMRP connector have been high-
pressure tested and accepted after installation, they rarely develop a leak during operation.
1. In this case, they attempted to perform a high-pressure installation test on the wellhead
connector to 128 bar that failed. During the failure investigation during a low-pressure test
to 20 bar it was observed dye at wellhead connector indicating a leak. Functioned wellhead
connector to unlatch and pulled BOP 2 m clear of the wellhead. Observed piece of rubber
hydrate seal compressed onto the VX ring gasket. An ROV removed the VX ring gasket
from the wellhead and removed additional pieces of rubber hydrate seal from within the
fingers of the BOP connector before reconnection and retesting.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 43
Spurious opening
2. The LMRP had just been re-connected after WOW. Observed a sudden disconnect of
LMRP. It was noted that the secondary unlatch sequence was not vented. Moved the rig off
the template. Replaced the VX gasket w/ ROV and landed the LMRP on BOP. Locked
LMRP connector and performed a 50-ton overpull test.
During a drilling operation spurious disconnects of the LMRP connector may lead to severe
well control problems. Nowadays, most BOPs have an automatic function to close the blind
shear ram if this occurs (auto-shear function). Blowouts have resulted of such incidents when
drilling in deepwater without a riser margin, and with no auto-shear function. In all cases
drilling mud will be lost to the sea and cause pollution.
Failed to lock
3. They had checked the guidewires and wellhead connector prior to landing. Landed the BOP
and sat down 30-tons. Closed the wellhead connector and verified flag. When attempting
to take 50-tons overpull it was observed that the BOP moved up. Pulled up 1 meter and
checked wellhead and VX ring. Opened wellhead connector. Landed BOP again. Sat down
30-tons. Checked tombstone by ROV owl. All OK. Closed wellhead connector and took
50-tons overpull test.
Historic Overview, Hydraulic Connector Failures
Table 5.8 shows some key information related to hydraulic connector failures observed in the
previous subsea BOP reliability studies.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 44
Table 5.8 Historic overview, hydraulic connector failures
Study BOP days No. of
connector failures
Total Lost Time (hrs)
Comments Years drilled and country
Phase II (/9/)
8 115 41 785,0 Failure modes; External leak 66% (majority related to installation), failed to unlock 7%, failed to lock 10%, other/unknown 15%
1979-1982, Norway
Phase IV (/7/)
3 809 11 100,5 Failure modes; External leak 36% (majority related to installation), failed to unlock 36%, failed to lock 18%, other/unknown 10%
1982-1986, Norway
Phase V (/6/)
2 636 6 111,5 Failure modes; External leak on installation test 50%, external leak during operation 17%, failed to unlock 17%, other/unknown 17%
1987-1989, Norway
DW I (/4/)
4 846 23 784,0 Failure modes; External leak on installation test 52%, external leak during operation 4%, failed to unlock 30%, other/unknown 4%
1992-1996, Brazil and Norway
DW II (/2/)
4 009 4 40,5 Failure modes; External leak on installation test 25%, failed to unlock 75%
1997-1999, US GoM OCS
DW and kick (/1/)
15 056 8 638,0
Failure modes; External leak on installation test 25%, external leak during operation 13%, failed to unlock 13%, failed to lock 13%, spurious opening 13%, other/unknown 25%
2007-2009, US GoM OCS
Present study
5 212 3 25,8 Failure modes; External leak on installation test 33%, failed to lock 33%, spurious opening 33%
2016-2018, Norway
TOTAL 43 683 96 2 485,3
5.4 RAM PREVENTER RELIABILITY
The BOPs included in the present study have from four to six ram preventers. The configuration
of the rams is presented in Table 3.1, page 25.
Table 5.9 shows an overview of the ram preventer manufacturer included in the study and the
associated operational time.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 45
Table 5.9 Overview of the manufacturers included and the associated operational time
Manu-facturer
Model Blind-shear ram Casing shear ram Pipe ram (fixed or variable) Total
10 000 psi 15 000 psi 10 000 psi 15 000 psi 10 000 psi 15 000 psi
Cameron
Compact Dual 425 425 850
Compact Triple 1 275 1 275
EVO 270 270 1 581 270 2 391
EVO Double 1 581 495 1 581 3 162 2 025 8 844
T 267 267
T double 267 267 534 1 068
U-II double 255 409 765 1 227 2 656
Total 1 836 1 866 1 581 962 5 508 5 598 17 351
Hydril Double/Dual 211 633 844
Total 211 633 844
NL Shaffer
NXT 277 277
NXT Double 496 773 277 1 546
NXT Triple 2 319 2 319
SLX double 526 1 578 2 104
Total 1 299 773 4 174 6 246
Total 2 047 3 165 1 581 1 735 6 141 9 772 24 441
Table 5.10 shows an overview of ram preventer reliability. Three of the failures were observed
in blind shear rams (BSR), two in pipe rams, and one in a casing shear ram preventer.
Table 5.10 Ram preventer failure modes and associated number of failures
Failure mode No. of
failures Total lost time (hrs)
BOP days in service
Item days in Service
MTTF (Item days in service)
Avg. down-time per
failure (hrs)
Avg. downtime per BOP day (hrs)
Failed to close 2 75,25
5 212 24 441
12 221 37,6 0,0144
Internal leakage (through a closed ram)
2 35,37 12 221 17,7 0,0068
Other 1 1,5 24 441 1,5 0,0030
Failed to fully open 1 15,5 24 441 15,5 0,0003
Total 6 127,62 4 074 21,3 0,0245
A brief description of observed failure mode is provided below:
Failed to Close
Two failures occurred with this failure mode, one in a casing shear ram and one in a blind shear
ram. Both failures were observed during installation testing.
1. During installation testing the BOP casing shear ram closing function system was leaking
on a flange. The BOP was pulled and the O-ring on casing shear ram high-pressure closing
system was changed. The BOP was then ran, landed, and tested. They used 39 hours from
observing the failure until the BOP was re-landed and tested.
2. During installation testing the BOP blind shear ram failed to close. Investigated with an
ROV and found the hydraulic hose not connected to the manifold. Pulled the BOP.
Connected the blue and yellow supply hoses on the blind shear ram and function tested.
Ran the BOP on the riser. Pressure tested the connector/casing/shear ram to 100 bar. It may
seem that this failure was introduced during BOP maintenance. It seems likely that the blind
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 46
shear ram was not function tested before the BOP was ran. They used 37 hours from
observing the failure until the BOP was re-landed and tested.
Internal Leakage (leakage through a closed ram)
Two failures occurred with this failure mode, one in a blind shear ram and one in a pipe ram.
Both failures were observed during installation testing.
3. This failure occurred during installation testing of the BOP. When testing the connector,
the BSR leaked. Pulled the BOP and replaced the seals on BSR. Pressure tested the BSR to
690 bar on the rig. Ran the BOP and tested connector. They used 33 hours from observing
the failure until the BOP was re-landed and tested.
4. Attempted to pressure test against UPR (Upper Pipe Ram) that leaked. Investigated leakage.
UPR did not pass final pressure test. The failure did not cause the BOP to be pulled.
Probably repaired when the BOP was on the rig the next time 13 days later
Failed to Fully Open
5. When attempting to run in hole with the MRT tool to pull the bore protector free, they failed
to pass the UPR at 366,5m. During investigation they ran in with the drill-pipe and function
tested the UPR. Then the ROV observed that the EVO lock on the UPR was not fully
retracted. Decided to pull out of hole to make another MRT tool run attempt. Ran through
BOP, observed no obstruction. Other
6. Function tested the BSR and observed flow meter on BOP panel continue to count the flow
after open BSR. Detected a leak through blind shear EVO lock motor when in unlock
position. The leak stopped venting the function after set the EVO lock in unlock position.
The failure was repaired 13 days later when the BOP was on the rig for other reasons.
Historic Overview, Ram Preventer Failures
Table 5.11 shows some key information related to ram preventer failures observed in the
previous subsea BOP reliability studies.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 47
Table 5.11 Historic overview, ram preventer failures
Study BOP days
No. of ram
preventer failures
Total Lost Time (hrs)
Comments Years
drilled and country
Phase II (/9/)
8 115 70 1 487,5
Failure modes; External leak 34% (many bonnet seal problems), Internal leak pipe ram 19%, Internal leak BS ram 6%, failed to close 1,5%, spurious operation 1,5%, Failed to fully open 16%, other/unknown 22%
1979-1982, Norway
Phase IV (/7/)
3 809 6 185,0 Failure modes; External leak 17% (bonnet seal), Internal leak pipe ram 33%, Internal leak BS ram 33%, other/unknown 17%
1982-1986, Norway
Phase V (/6/)
2 636 4 146,0 Failure modes; Internal leak pipe ram 50%, Internal leak BS ram 25%, Failed to fully open 25%
1987-1989, Norway
DW I (/4/)
4 846 10 365,0
Failure modes; External leak 10% (bonnet seal), Internal leak, BS ram 20%, Internal leak, pipe ram 10%, Failed to shear pipe 10%, Failed to fully open 20%, Internal hydraulic leakage (control fluid part) 10%, Other/unknown 20%
1992-1996, Brazil and Norway
DW II (/2/)
4 009 11 1 505,0
Failure modes; External leak 9% (bonnet seal), Internal leak, BS ram 9%, Internal leak, pipe ram 27%, Failed to close 9%, Failed to keep closed 9%, Failed to open 27%, Premature closure 9%
1997-1999, US GoM OCS
DW and kick (/1/)
15 056 23 1 765,5
Failure modes; External leak 9% (bonnet seal), Internal leak, BS ram 13%, Internal leak, pipe ram 39%, internal leak test ram 17%, Failed to close 4%, Failed to fully open 4%, Failed to open 4%, Other/unknown 9%
2007-2009, US GoM OCS
Present study
5 212 6 127,6 Failure modes; Internal leak, BS ram 17%, Internal leak, pipe ram 17%, Failed to close 33%, Failed to fully open 17%, Other/unknown 17%
2016-2018, Norway
TOTAL 43 683 130 5 581,6
5.5 CHOKE AND KILL VALVE RELIABILITY
The BOPs included in the present study has from six to 10 choke and kill valves. Seven rigs
have 10, three rigs have eight, and five rigs have six choke and kill valves. Typically, old BOPs
with four ram preventers have fewer choke and kill valves.
Table 3.1, page 25, gives an overview of the BOP stack configuration for the various rigs
included.
Table 5.12 shows an overview of the choke and kill valve manufacturers included in the study
and the associated operational time.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 48
Table 5.12 Overview of the choke and kill valve manufacturers included and the
associated operational time
Manufacturer Model Choke/kill valve item days
10 000 psi 15 000 psi Total
Cameron
Dual Block FS 4 250 4 250
FCS 1 530 1 530
MCK single 2 454 2 454
MCS 15 810 2 136 17 946
Total 17 340 8 840 26 180
Control Flow Unknown 1 266 1 266
National Oilwell Varco HB 2 172 2 172
NL Shaffer Unknown 7 730 7 730
Stewart and Stevenson Double/Dual 984 984
Unknown Unknown 6 120 6 120
Total 17 340 27 112 44 452
Three failures were identified for choke & kill valves in the present study. Table 5.13 shows an
overview of the choke and kill valve failure modes and associated number of failures.
Table 5.13 Choke and kill valve failure modes and associated number of failures
Failure mode No. of
failures Total lost time (hrs)
BOP days in service
Item days in Service
MTTF (Item days in service)
Avg. down-time per
failure (hrs)
Avg. downtime per BOP day (hrs)
Internal leakage (leakage through a closed valve)
3 31,25 5 212 44 452 14 817 10,4 0,0060
Total 3 31,25 5 212 44 452 14 817 10,4 0,0060
All the experienced failures have the failure mode Internal leakage (leakage through a closed
valve). Since these valves are in series, there will always be a back-up if one of the valves leaks.
Normally, the BOP is not pulled from the seafloor to repair such failures if only one valve is
leaking. It is likely that some more of these failures have occurred, but they have not been
mentioned in the daily drilling reports.
The far more severe failure mode External leakage was not observed in the present study for
choke or kill valves.
Internal leakage (leakage through a closed valve)
Below a brief description of the three choke and kill valve failures observed in the present study
is provided.
1. They were unable to obtain a satisfactory test on the fail-safe valves during a BOP test
scheduled by time. Displaced the kill line to seawater and managed to obtain a good low-
pressure test on the kill line fail-safe, but the high-pressure test failed. Functioned the valves
and trouble shot. Repeated kill line fail-safe test with same result. Closed all four fail-safes
and performed a good high-pressure test, 1,18% drop in 10 min.
2. During an installation test they were unable to achieve a good pressure test on upper outer
choke line fail-safe valve from the wellbore side (OK when tested from above). They were
also unable to test the kill line fail-safe valves from above (OK when tested from wellbore
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 49
side). The lines were verified and OK. Cycled the upper outer choke valve multiple times
with 35 bars on the choke line. Achieved a good test to 20/210 bar from the wellbore side.
3. A leakage on the upper outer kill line fail-safe valve was observed during an installation
test. Cycled the valve several times and opened valve with differential pressure. Still not
able to achieve neither low nor high-pressure test. Pumped oil-based mud and water through
the valve. Then tested the upper outer kill line fail-safe valve to 20/292 bar for 5/10 mins.
OK.
Historic Overview, Choke and Kill Valve Failures
Table 5.14 shows some key information related to choke & kill valve failures observed in the
previous subsea BOP reliability studies.
Table 5.14 Historic overview, choke & kill valve failures
Study BOP days
No. of choke & kill valve failures
Total Lost Time (hrs)
Comments Years
drilled and country
Phase II (/9/)
8 115 57 1 556,0 Failure modes; External leak 30%, Internal leak 25%, unspecified leak 23%, Failed to close on demand 4%, Failed to open on command 4%, Unknown 14%
1979-1982, Norway
Phase IV (/7/)
3 809 13 593,5 Failure modes; External leak (clamp connection) 8%, Internal leak 85%, unknown 8%
1982-1986, Norway
Phase V (/6/)
2 636 2 67 Failure modes; Internal leak 50%, Unknown leak 50% 1987-1989, Norway
DW I (/4/)
4 846 13 255,5 Failure modes; External leak 31%, Internal leak 46%, Failed to close on demand 8%, Failed to open on command 8%, Unknown 8%
1992-1996, Brazil and Norway
DW II (/2/)
4 009 9 281,5 Failure modes; External leak 33%, Internal leak 33%, Failed to open on command 22%, Unknown 11%
1997-1999, US GoM OCS
DW and kick (/1/)
15 056 4 136 Failure modes; Internal leak 100% 2007-2009, US GoM OCS
Present study
5 212 3 31,3 Failure modes; Internal leak 100% 2016-2018, Norway
TOTAL 43 683 101 1 364,8
5.6 CHOKE AND KILL LINE RELIABILITY
The choke and kill line systems are divided into three main parts in this study:
1. Flexible jumper hoses in the moon pool
2. Riser attached lines
3. BOP attached lines from the connection to the integral riser lines (flexible joint level)
to the outer choke and kill valve outlets
Figure 3.1, page 25, shows a typical configuration of a BOP system.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 50
Table 5.15 shows an overview of the riser manufacturers included in the study and the
associated operational time. A similar overview of the BOP attached lines and the jumper hoses
have not been established.
Table 5.15 Overview of riser manufacturers included and the associated operational
time
Manufacturer Model Days in service
10 000 psi 15 000 psi Total
Aker Drilling Clip Riser 267 267
Total 267 267
Cameron
RD 409 409
Unknown 1 581 270 1 851
Total 1 581 679 2 260
Shaffer
FT 496 496
FT-G-3 495 495
Total 991 991
Vetco
FCH-8 362 362
MR-10 425 425
MR-6C 164 164
MR-6C-S 211 211
MR-6D 255 255
Total 255 1 162 1 417
Unknown Unknown 277 277
Total 277 277
Total 1 836 3 376 5 212
Table 5.16 shows an overview of failures in the choke and kill lines.
Table 5.16 Choke and kill line failure modes and associated number of failures
Line segment
Failure mode distribution No. of
failures Total lost time (hrs)
BOP days in service
MTTF (BOP days in service)
Avg. downtime per BOP day
(hrs)
Avg. downtime per failure (hrs)
BOP attach-ed line
External leakage (leakage to environment)
3 178,25 5 212 1737 0,034 59,4
Jumper hose line
External leakage (leakage to environment)
4 127,75 5 212 1303 0,025 31,9
Riser attach-ed line
External leakage (leakage to environment) 11 229 5 212 474 0,044 20,8
Plugged line 1 3 5 212 5 212 0,001 3,0
Total 12 232 5 212 434 0,045 19,4
Total 19 538 5 212 274 0,103 28,3
Twelve out of 19 failures occurred in the riser attached lines. All except one failure were
external leakages. The last one was a plugged line. A brief description of the failures observed
in the present study is presented below. These failures caused 538 hours of downtime.
External Leaks, BOP Attached Line
1. The kill line failed on test after the LMRP had been landed on the stack. The LMRP had
just been pulled due to choke line failure. Pulled the LMRP again. When inspected the
LMRP a leak on the kill line kicker hose (co-flex) was observed. Had to wait for a new co-
flex, before repairing. Then ran, landed and tested the LMRP and line.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 51
2. During the BOP installation test the choke/kill line leaked. Pulled the LMRP. Changed seals
on both kill and choke side of LMRP kick-out sub. Then re-ran and tested.
3. They had just performed the BOP installation test. While RIH with the running tool for the
shallow plug they were unable to get a good test on the choke or kill line. Investigated with
various testing. Pressured up to 20 bar down choke line. Inspected choke line with ROV
and observed dye coming out of the choke line swivel. Disconnected and Pulled BOP.
Repaired and re-ran BOP. Tested connector and re-ran RT for shallow plug.
External Leaks, Jumper Hose Line
4. During a test scheduled by time they were not able to get low-pressure tests on the kill line.
There was a leak on the swivel on ROPS (Remotely Operated Pull-in System). POOH the
BOP test plug, and ran a deep-set 10 ¾ time lock plug, and a shallow 10 ¾ time lock plug.
Disconnected the LMRP. Changed out swivel on the kill and choke hoses. Ran and landed
the LMRP, tested the BOP and pulled the plugs
5. A small leak from the top of the swivel between kill line co-flex and fixed pipe on rig was
observed during normal operation. Removed the swivel and connected the co-flex to the
fixed pipe. Pressure tested kill line to 20/345 bar for 5/10 minutes. Good test.
6. While running the BOP they attempted to pressure test the ROPS for the kill, choke, and
conduit lines to 20/345 bar for 5/10 minutes. Observed leak on swivel for kill line co-flex
hose (rig side of co-flex). Removed swivel and connected kill line co-flex hose directly to
kill manifold. Retested and it was OK. Observed also leak on swivel for choke line co-flex
hose with pressures below 10 bar. No leak observed with pressures above.
7. For the second failure they tested the fail-safe with 20/482 bar for 5/10 min after running
casing or liner. The test failed because a moonpool co-flex failed. Hung off drill-pipe in
wellhead. Disconnected the LMRP and replaced the leaking kill line co-flex in moonpool.
Re-landed and tested LMRP connector.
External Leaks, Riser Attached Line
Five off the failures occurred while running the BOP
8. The BOP was already disconnected due to a leak in the wellhead connector. When pressure
tested the kill line to 20 bar a low-pressure leak was observed. With the ROPS joint above
splash zone, it was observed that red dye was leaking out of the ROPS joint on the kill line
swivel union under hydrostatic pressure. Changed out of leaking swivel union on the ROPS
connector kill line.
9. They attempted to test kill/choke line while running the BOP and observed a leak. Pulled
from 355 to 309 m and observed a damage on the choke line pin on the riser slick joint.
Polished pin and box end on choke line on riser joint in rotary and installed new seals and
tested OK. Ran in sea to 355 m and retested to 560 bars OK.
10. Ran the BOP through splash zone, down to 45 m, and attempted to test choke/kill lines to
20/290 bar. Low-pressure test of the kill line failed. Suspected a leaking gasket in one of
the riser joints. Pulled the BOP back and repaired. Re-ran to splash zone. Tested OK after
replacement of test cap. Ran to 45 meters.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 52
11. Pressure tested the kill, choke & boost lines. It was not possible to get good test. Pulled the
riser to find the leak point. Pulled BOP out of sea, observed leak on connection between
riser joint 1 and 2. Installed new seals and ran the BOP from 30m to 105m.
12. While running the BOP it was discovered on deck that a wrong riser joint, with possible
missing seals, had been run. Attempted to test kill- and choke line. Detected leaks. Pulled
three riser joints, changed out riser joint. Re- ran BOP.
Seven failures were observed when the BOP was on the wellhead
13. During a pressure test scheduled by time the pressure test on upper pipe ram failed due to
a leak on the riser choke line at 375 m. Pulled the riser. Checked and replaced seals on
leaking choke connection. Lip seal on choke line was worn. Re-ran LMRP and riser. Landed
test tool and commenced BOP testing.
14. During drilling they discovered a leak in the choke line at the bottom connection on the
modified riser joint. Stopped drilling and prepared for pulling CML (Controlled Mud Level)
riser with riser pump for repair. Ran EDPHOT (Emergency Drill pipe Hang Off Tool).
Pulled the riser and changed the seals on riser joint and 30 ft pup. Had problems with riser
pump valve during running. Pulled LMRP again, repaired and re-ran. Pulled EDPHOT. Ran
BOP test plug and tested LMRP. They waited on weather for 36 hours during this operation.
In total more than 5 days were used to rectify the failure.
15. During operation a leakage was observed in the choke line connection between CML riser
joint and slick riser joint below. The BOP should be pulled anyway, so this failure caused
minor lost time only.
16. During a BOP test after running casing they observed a leak when pressure testing the kill
line against the fail-safes. Pressure tested the choke line against fail-safes, no leaks.
Displaced kill and choke lines back to OBM. Pressure tested kill and choke lines against
fail-safes to 30 bar/5 min and 100 bar/10 min, no leaks.
17. While WOW for pulling the BOP, they attempted to pressure test the choke line with 200
bar. Observed a leak against lower outer choke (LOC) valve. Suspected a washed-out leak
in stab seals on choke line riser connectors.
18. During preparations for testing, the kill line failed to test against a closed fail-safe valve.
Launched ROV and observed fluid weeping from a kill line connection between 2 riser
joints (only when under 100 bar pressure). Estimated +/-1 litre leak. The BOP should be
pulled for installing the X-mas tree anyway, so the leak did not cause any lost time.
Plugged Line, Riser Attached Line
19. Observed that the kill and choke lines were plugged. Stopped the pumps and closed the
LAP. Lined up to pump up choke line, displaced same with 1,52 sg OBM (Oil-based mud),
pumped 1 m3. Lined up to take returns up kill line. Pressured up well to 30 bar, observed
kill line plugged. Bled off pressure and opened LAP. Lined up to pump/flush down kill
line. Increased pressure to 20 bar and operated valves to bleed off pressure, OK. Flushed
choke manifold with OBM.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 53
Historic Overview, Choke and Kill Line Failures
Table 5.17 shows some key information related to choke and kill line failures observed in the
previous subsea BOP reliability studies.
Table 5.17 Historic overview, choke and kill lines failures
Study BOP days
No. of choke and
kill line failures
Total Lost Time (hrs)
Comments Years drilled and country
Phase II (/9/)
8 115 92 957,5 Failure modes; External leak 78%, Plugged line 11%, structural failure 10%, Unknown 10%
1979-1982, Norway
Phase IV (/7/)
3 809 28 269,5 Failure modes; External leak 86%, Plugged line 7%, structural failure 7%
1982-1986, Norway
Phase V (/6/)
2 636 19 627,0 Failure modes; External leak 89%, Plugged line 5%, Unknown 5%
1987-1989, Norway
DW I (/4/)
4 846 53 1 374,5 Failure modes; External leak 91%, Plugged line 4%, Other/Unknown 6%
1992-1996, Brazil and Norway
DW II (/2/)
4 009 9 281,5 Failure modes; External leak 75%, Plugged line 13%, Burst 13%
1997-1999, US GoM OCS
DW and kick (/1/)
15 056 17 1 994,0 Failure modes; External leak 94%, Unknown 6% 2007-2009, US GoM OCS
Present study
5 212 19 538,3 Failure modes; External leak 95%, Plugged line 5% 2016-2018, Norway
TOTAL 43 683 237 6 042,3
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 54
5.7 MAIN CONTROL SYSTEM RELIABILITY
The two main BOP control system principles are:
• Multiplex control system (MUX)
• Pilot hydraulic control system
Table 3.1, page 25, gives an overview of the BOP stack configuration for the various rigs
included.
Table 5.18 shows an overview of the control system manufacturer included in the study and
the associated operational time.
Table 5.18 Overview of the main control system manufacturer and the associated
operational time
Manufacturer BOP days in service
Multiplex Pilot hydraulic Total
Cameron 962 1 990 2 952
Hydril 466 466
Koomey 164 164
National Oilwell Varco 858 858
Shaffer 277 277
Silvertec 495 495
Total 1 239 3 973 5 212
Most of the rigs were equipped with a pilot hydraulic system, 76%, while 24% of the service
time comes from multiplex systems. In the present study most of the wells are drilled in water-
depths below 500 meters, where the pilot control system will satisfy the closing time
requirements. Deepwater rigs will typically have a multiplex system to be able to satisfy the
closing time requirements.
Table 5.19 shows an overview of the different control system principles service times.
Table 5.19 Service time for Main Control System types
Control System Principle BOP days in service for various water depths
<300 m 300 – 500 m 1200 – 1300m Total
Multiplex 1 056 183 1 239
Pilot hydraulic 1 584 2 389 3 973
Total 1 584 3 445 183 5 212
A comparison of MTTFs for the different operating principles of the main control systems is
shown in Figure 5.1. There is no significant difference between the MTTFs since the confidence
bands are overlapping. This is the same observation as in DW and kick, and Phase I & II DW
studies (/1/, /4/, and /5/).
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 55
Figure 5.1 MTTF comparison, BOP control system principles with 90% confidence
limits
A comparison of control system failures with previous studies (/1/, /2/, /4/, and /5/) is shown in
Figure 5.2. Section 4.1 describes the various BOP studies.
Figure 5.2 Comparison of Control System MTTF (average with 90% confidence limits)
with Previous Studies
The current study has a significantly higher MTTF than the Phase I & II, but a bit lower than
DW and Kick study. It is here important to recall that the main source of information for the
DW and kick was the BSEE well activity reports (WARs), that is a weekly reporting system,
while for the all other studies it was the daily drilling reports. It can be assumed that many less
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 56
critical failures are not described in the WARs. These less critical failures typically produce
little downtime.
In terms of average downtime performance, the result for control system types is shown in
Figure 5.3. The multiplex system experienced the highest downtime. It should be noted that the
multiplex system was also used for the largest water depths. Generally, the average downtime
is dominated by some few failures of long durations.
Figure 5.3 Average downtime per BOP day caused by BOP main control system
failures
Also in the DW and Kick study (/1/) and the Phase II DW study (/2/) it was observed that the
multiplex systems caused more lost time than the pilot hydraulic systems. This was not
observed in the Phase I DW study (/4/). The previous studies are presented in Section 4.1.
Table 5.20 shows an overview of the different control system failure modes, the associated
number of failures and the lost time observed in the present study.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 57
Table 5.20 Control system principle specific failure modes and associated number of
failures
Failure Mode Distribution No. of
failures Total lost
time (hrs.)
Days in Service
(BOP days)
MTTF (days)
Avg. Downtime per BOP day
(hrs.)
Avg. Downtime-per failure
Multiplex electro hydraulic
Emergency automated BOP function failed 2 83,00 1 239 620 0,067 41,50
Loss of all functions one pod 3 75,50 1 239 413 0,061 25,17
Loss of one function one pod 1 0,00 1 239 1 239 0,000 0,00
Loss of one function one topside panel/unit 1 0,50 1 239 1 239 0,000 0,50
Other 7 94,00 1 239 177 0,076 13,43
Total 14 253,00 1 239 89 0,204 18,07
Pilot hydraulic
Emergency automated BOP function failed 1 72,00 3 973 3 973 0,018 72,00
Loss of all functions both pods 1 2,00 3 973 3 973 0,001 2,00
Loss of all functions one pod 2 53,00 3 973 1 987 0,013 26,50
Loss of one function both pods 1 0,50 3 973 3 973 0,000 0,50
Loss of one function one pod 5 6,75 3 973 795 0,002 1,35
Other 6 11,17 3 973 662 0,003 1,86
Unknown 8 8,50 3 973 497 0,002 1,06
Total 24 153,92 3 973 166 0,039 6,41
Total control system 38 406,92 5 212 137 0,078 10,71
Loss of all Functions Both Pods
In the present study the loss of all functions both pods was experienced once in a pilot hydraulic
system. If the BOP is acting as a well barrier this is a critical failure mode, because the BOP
cannot be operated from the main control system.
1. In this case they experienced lost pressure on the BOP pods when pulling BOP/riser.
Troubleshoot on pod reels for BOP and had SJA meeting and meeting with town. It was
decided to continue to pull BOP.
This failure mode has been observed for multiplex systems and pilot hydraulic systems in Phase
I DW, Phase II DW, and DW and kick (/1/, /2/ and /4/). This failure mode was, however, not
observed during the Phase IV and Phase V studies (/6/ and /7/). In the mentioned studies, wells
were drilled in “normal” water depths, pilot systems were utilized, indicating that such failures
do not occur frequently in the pilot hydraulic control systems.
Loss of all Functions One Pod
A total of five failures with this failure mode were observed, three in multiplex systems, and
two in pilot hydraulic systems. This is a rather common failure mode that has been observed in
all BOP reliability studies. They are typically caused by major hydraulic leaks or some sort of
electric/electronic problems. Below the experienced failures are discussed:
2. A failure occurred in a Multiplex system during normal operation with the BOP on the
wellhead. They turned off the blue pod, likely because of a failure. Six hours later they
turned on blue pod back-up control unit and confirmed control unit was ok.
3. During running of the BOP a failure occurred in a Multiplex system. The BOP was at 229
meters when observed fault on SEM (Subsea Electronic Module) A & B on blue pod. Pulled
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 58
the BOP and troubleshot on connection error to blue pod. Changed pressure balanced oil
filled cable from riser mounted junction box to blue pod. Tested new cable - OK. Tested
and re-ran BOP to 229 m
4. The failure occurred in a Multiplex system during running of the BOP. Observed an error
with BOP blue pod. Pulled BOP back and changed the e-prom card in blue pod SEM B.
Observed also error on the solenoid valve for ram lock UPR. Pulled BOP out of the sea and
landed on BOP carrier. Troubleshoot and discussed way forward with BOP blue pod SEM
B. Not able to replicate system error. Entire system was checked without finding any faults.
Decided to run BOP. Ran BOP on riser to 69m.
5. This failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during
normal operation. Prior to drilling 8 1/2 section they observed leakage of BOP control fluid
from the yellow pod. Trouble shot same. Disconnected LMRP, pulled to surface and
changed out faulty gas relief vent valve. Re-ran LMRP.
6. The failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during
normal operation. It was only stated; troubleshot leakage observed on yellow pod. It was
not stated if the problem was repaired. The well was finished, and the BOP pulled three
days later. The failure mode is assumed
Loss of One Function Both Pods
One failure with this failure mode occurred in the present study. This failure mode is normally
caused by a failure in the shuttle valve or the line from the shuttle valve to the BOP function,
or other functions that are common for both pods. Below, this type of failure is described:
7. This failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during
normal operation. They attempted to open the BSR but did not receive the correct return
flow. Investigated the problem and discovered that the BSR boost system was activated.
Turned off the boost. Found that the quick dump valve had hung up. Opened the BSR
Loss of One Function One Pod
The failure mode Loss of one function one pod occurred once for a multiplex control system,
and five times for a pilot hydraulic system. The failure mode is normally caused by a failure in
a pilot line, pilot valve, or solenoid valve. These failures are briefly described below:
8. The failure occurred in a Multiplex system when the BOP was on the wellhead during
normal operation. When performing a function test of the BOP stack they could not operate
the outer bleed valve from the blue pod.
9. This failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during
an installation test (the LMRP had been re-connected after WOW). They performed the
LMRP connector test to 20/190 bar for 5/10 mins. When attempted to perform the BOP
function test issues with the SPM valve on blue pod for UPR was observed. Pulled above
the BOP and troubleshot SPM on blue pod. Function tested BOP from blue pod.
10. The failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during
a BOP installation test. During the BOP function test, it was discovered that the LPR (Lower
Pipe Ram) did not function as it should on blue pod. Got no count on the flowmeter.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 59
Switched to yellow pod and then everything worked as it should. During fault-finding it
was found that there were some issues related to connection plate and pilot lines.
11. This failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during
a BOP installation test. The UPR did not close on yellow pod. It was tested again five days
later with the same result. There were no signs that the failure was repaired. The BOP was
pressure tested with the yellow pod three weeks after the initial failure was observed, with
no comments related to the failure
12. The failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during
normal operation. They were not able to get pressure to open wellhead connector and
disconnect the BOP. Troubleshot on BOP system, leak observed. Opened wellhead
connector and pulled BOP above template.
13. This failure occurred in a Pilot hydraulic system when the BOP was on the rig ready to be
run. They were pressure testing the BOP and prepared it for running when observed leak
on SPM valve for LAP opening signal, changed SPM valve.
Loss of One Function One Topside Panel/Unit
14. The failure occurred in a Multiplex system when the BOP was on the wellhead during
normal operation. They were unable to open the UPR from toolpusher’s panel. Opened it
from the driller’s panel. Function tested UPR from toolpusher’s panel 2 days later.
Emergency Automated BOP Function Failed
Since the last study was carried out, emergency automated BOP functions have got much more
attention. Many old BOPs have been retrofitted with such systems while new BOPs have these
systems included. This focus was triggered by the Deepwater Horizon accident in 2010. These
systems are now tested more than before. Three failures were observed in the study.
15. This failure occurred in a Multiplex system during the BOP installation test. Performed
autoshear acceptance test. Observed that the BSR did not close during the test. Retested
function and BSR closed.
16. The failure occurred in a Multiplex system during normal operation it seems. The AMF
(Automatic Mode Function) obviously failed for some reason. Ran the RTTS plug.
Attempted to repair the AMF shuttle valve with an ROV. The attempt failed. Decided to
pull the BOP to surface to perform repair. Pulled the BOP and replaced the AMF shuttle
valve on BOP. Pressure tested same to 5000 psi/10 min. Commenced soak testing on BOP.
Ran the BOP. Tested the BOP and pulled the RTTS.
17. This failure occurred in a Pilot hydraulic system when the BOP was on the wellhead during
a BOP installation test. When landing the BOP and the setup of the Automatic Disconnect
System (ADS) failed. Attempted to operate the ADS reset function from the ROV panel.
Operation of the ROV valve ADS reset isolation did not give any indication of pressure on
subsea gauge ADS reset pressure. Further, troubleshooting confirmed hydraulic fluid vent
via ADS reset isolation valve to sea. However, due to concerns over the lack of system
functionality, further configuration of the system was done with positive weight on the
LMRP connector. When opening of the ROV valve ADS supply isolation the LMRP
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 60
connector and choke/kill connector unlatched prematurely and unintentionally. It was
decided to recover the LMRP to surface for further investigation.
Other
Thirteen failures are categorized with the failure mode Other, causing a total lost time of 105
hours. Seven of these 13 failures occurred in a multiplex system, and six in a pilot hydraulic
pilot hydraulic system.
For the multiplex system, four failures occurred when the BOP was on the wellhead, and three
while running the BOP. A brief description of these failures is provided below:
Multiplex system, BOP on the wellhead failures, normal operation:
18. A subsea engineer investigated a BOP leakage by operating BOP valves while ROV was
observing at the BOP. Found the leak at upper inner blue pod choke line fail-safe SPM
valve. Sat the function in open position, the leak disappeared.
19. Observed the HPU pump for BOP control fluid starting irregularly, indicating leak on
system. Troubleshot same. Isolated conduit lines on surface and on BOP. Observed a
pressure drop of 300 psi in 1 minute on yellow conduit. HPU was stable while yellow
conduit was isolated. Function tested BOP rams, annulars, and fail-safes with conduit lines
isolated and hot line as supply. Decided to continue operation with hot line as secondary
system. De-isolated blue conduit. The conduit line was repaired two weeks later, when the
BOP was pulled to repair the AMF shuttle valve.
20. Inspected the BOP blue pod with ROV. Found leak on 1/4 line to stack accumulator read
back gauge. Isolated charge line to accumulators in the lower stack, and the leak stopped.
21. They were in the process of P&A the well when they observed a leak on the hydraulic hot
line. Performed riser/BOP cleanout run and tagged cement at 504 m. Displaced well to
seawater. POOH with riser brush assembly. Prepared to disconnect LMRP. Pulled LMRP
and repaired leak on hydraulic hot line. Latched LMRP on BOP. Had to repair hot line three
times
Multiplex system, while running BOP failures, normal operation:
22. Attempted to pressure test the conduit lines taking pressure from BOP accumulator bank.
Observed 700 psi pressure drop/3 min. Pulled out four riser joints and tested, OK. Observed
damages on box ends on both conduit lines. Observed corresponding damages on pin ends
on both conduit lines on slick riser joint #4 (below modified joint). Ran riser joint and tested
conduit lines: Got a leak in yellow conduit line. The pilot operated check valve on surface
leaked. Repaired and got good test on conduit line.
23. Ran riser to 115 meters and observed a leak when pressure testing the conduit line. Pulled
out and laid out modified riser joint. Pressure tested conduit line on riser joint below
modified riser joint. OK. Ran modified riser joint. Pressure tested conduit line. Ran in with
BOP on riser to 366 m. Observed leak when pressure testing conduit line. Pulled out with
BOP to 252 m. Pressure tested conduit line. Pressure still leaking off. Continued pulling
out with BOP to 137 m. Pressure tested conduit lines. Tested ok.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 61
24. While pressure testing conduit line to 345 bar a small leakage was discovered on the conduit
return line hose at the rig end. Performed risk assessment, decision made to continue
operations and repair hose at next convenient time.
Pilot hydraulic system, BOP on the wellhead failures, normal operation:
25. Pulled yellow BOP pod to surface due to leaking control line of the pod latch function.
Changed latch function to another control line, re-ran the pod, and latched to the LMRP.
26. Observed a leak in secondary unlatch line on blue pod when unlatching the LMRP due to
bad weather. While WOW retrieved blue pod to surface and changed line for secondary
unlatch. Ran blue pod to BOP and latched same.
27. Small leakage in BOP JIC fitting on high-pressure shear system. Pulled bottom hole
assembly through window due to inspection on leaking valve on BOP. Tightened fittings
on BOP shifting valve with ROV.
28. When landing BOP, it was discovered that the storm loop banana sheaves had slipped on
the pod wires. Had to pull BOP up to above PGB guideposts and redo the storm loops.
29. Observed erratic readback pressure on blue pod subsea annular regulator. Pulled blue pod
for inspection (subsea regulator suspected stuck). Function tested BOP via blue pod on
drillers panel, ok. Confirmed blue pod fully functional after repair.
Pilot hydraulic system, While running BOP failures, normal operation:
30. Observed that the conduit line leaked off and did not fill. Ran one more riser joint to 85m.
ROV functioned conduit valve on BOP stack. Tried to fill conduit line again, but it still
leaked off. Pulled BOP back to surface and picked up to working height. Trouble shot and
found the cause to be trapped pressure in pilot line 48 and valve 3.3 being in mid position.
Unknown
Eight failures are categorized with the failure mode Unknown, causing a total lost time of 8,5
hours. All these failures occurred in pilot hydraulic pilot hydraulic systems when the BOP was
on the wellhead. Four occurred during the installation test, and the remaining during other test
or normal operations.
31. The BOP had just been landed. Function tested the annular, UPR, LPR and fail-safes from
yellow pod. Switched over to blue pod and observed a leakage. Troubleshot blue pod and
reconfigured same. Continued the function test from blue pod.
32. During installation test a seepage through yellow-pod connector was observed. No more
information.
33. During installation test troubleshot fail-safe valves. Fail-safe valves tended to remain in
open position. Function tested BOP fail-safe valves from blue and yellow pods. It is
assumed that this is related to the control system.
34. While testing BOP DMAS (Deadman Autoshear) function on blue and yellow pod observed
a leak from stinger seals on yellow pod. Trouble shooting leak on yellow pod. Observed
the leak when using DMAS and wellhead connector close functions. Prepared for pulling
BOP. Awaited decision on further operations. Operated stingers on yellow pod to trouble
shoot leak. Managed to operate functions without seeing any leak.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 62
35. During normal operation a leak was observed on the yellow pod. Investigated leak. There
was no more information.
36. A safety valve in the BOP main control room (set @3200 psi) blew (assumed while
switching from yellow to blue pod), and high-pressure hose installed upstream safety valve
burst (supposedly as an effect of high flowrate through restricted dimension). Thus, decided
to abort function testing for now, to replace defect hose and safety valve.
37. It was only stated ran and installed blue pod. This occurred just after they had finished
testing the BOP from the yellow pod. There is no indication why the pod was pulled in the
first place. The function tested the BOP on the blue pod the day after.
38. It is not known what failed. It was only stated that they ran the blue pod. The ROV followed
pod to seabed. Before running the blue pod, inspected the BOP down to BSR with the ROV,
and found no anomalies.
Rig Specific Failure Rates
The control system performance for the 15 rigs included in the study showed a highly variable
failure rate and downtime per BOP day in service, as illustrated in Figure 5.4. The confidence
intervals are overlapping, hence no significant difference in performance can be observed.
Figure 5.4 Rig specific control system performance
Historic Overview, Main Control System Failures
Table 5.21 shows some key information related to choke and kill line failures observed in the
previous subsea BOP reliability studies.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 63
Table 5.21 Historic overview, main control system failures
Study BOP days
No. of main control system failures
Total Lost Time (hrs)
Comments
Years drilled
and country
Phase II (/9/)
8 115 149 1 445,3
Failure modes; Surface equipment failure 12,1%, Hose bundle failure 7,4, Plugged/frozen pilot line 4,7%, Unspecified pod failure/leakage 22,8%, Stinger failure 6,0%, Subsea pressure regulator failure 4,0%, Pilot/SPM failure 18,8%, Shuttle valve failure 3,4%, Pod selector valve failure 1,0%, Stack hydraulic line failure 10,1%, Accumulator leakage 2,0%, Unspecified leak 2,0%, Other failures 2,7%, Unknown 4,0%
1979-1982, Norway
Phase IV (/7/)
3 809 29 723,8
Failure modes; Hose bundle failure 24%, Plugged pilot line 17%, Stinger failure 3%, Regulator valve failure 3%, Pilot valve fail. 24%, Shuttle valve failure 3%, Stack hydraulic line failure 14%, Unspecified leakage 3%, Unknown 7%
1982-1986, Norway
Phase V (/6/)
2 636 28 521,6
Failure modes; Spurious activation of BOP function 4%, Loss of all functions one pod 21%, Loss of several functions one pod 7%, Loss of one function both pods 7%, Loss of one function one pod 36%, Loss of one topside panel 4%, Loss of one function topside panel 4%, Topside minor failures 7%, Other 4%, Unknown 7%
1987-1989, Norway
DW I (/4/)
4 846 73 1 688,0
Failure modes; Loss of all functions both pods 7%, Spurious operation of BOP function(s) 3%, Loss of all functions one pod 18%, Loss of one function both pods 3%, Loss of one function one pod 26%, Loss of several functions both pods 3%, Loss of several functions one pod 4%, Other 8%, Unknown 29%
1992-1996, Brazil and Norway
DW II (/2/)
4 009 25 454,0
Failure modes; Loss of all functions both pods 4%, Spurious operation of BOP function(s) 8%, Loss of all functions one pod 16%, Loss of several functions both pods 4%, Loss of several functions one pod 12%, Loss of one function both pods 4%, Loss of one function one pod 28%, Unknown 8%, Other 16%
1997-1999, US GoM OCS
DW and kick (/1/)
15 056 72 4 712,0
Failure modes; Loss of all functions both pods 1%, Loss of all functions one pod 19%, Loss of one function both pods 8%, Loss of one function one pod 22%, Loss of several functions one pod 4%, Other 32%, Unknown 13%
2007-2009, US GoM OCS
Present study
5 212 38 406,92
Failure modes; Emergency automated BOP function failed 8%, Loss of all functions both pods 3%, Loss of all functions one pod 14%, Loss of one function both pods 3%, Loss of one function one pod 16%, Loss of one function one topside panel/unit 3%, Other 32%, Unknown 22%
2016-2018, Norway
TOTAL 43 683 414 9 951,6
5.8 BACK-UP CONTROL SYSTEM RELIABILITY
Acoustic back-up subsea BOP control systems have existed for more than 30 years, and have
been mandatory in Norway since 1981.
During the 1980s several subsea BOP reliability studies were carried out by SINTEF. It should
be noted that all the failure information collected involves the old generation of acoustic control
systems. Kongsberg Simrad was the major supplier of acoustic BOP back-up control systems
in the 80s and 90s (with approximately 70% of the total market). Until 1996 they had delivered
approximately 30 of the analogue ACS 300 systems. The failure data collected do, to a large
degree, stem from these Kongsberg Simrad systems. In 1996, the ACS 300 system was
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 64
substituted with the new generation, the all digital ACS 400 system, and in 2011 the ACS 400
system was substituted with the new generation ACS 500 system.
Nautronix is another supplier of BOP acoustic back-up system. Nautronix has delivered
acoustic BOP control systems since the 90s. Nautronix Emergency BOP (NASeBOP) Acoustic
Control system is the most recent system from Nautronix. NASeBOP uses the ADS² (Acoustic
Digital Spread Spectrum) signaling technology.
Sonardyne also supplies acoustic BOP control systems. They use something they call
Wideband™ signal technology.
The acoustic back-up control system consists of an acoustic communication part and a
hydraulic valve package part. The acoustic communication part is typically delivered by one
of the above suppliers, whereas the hydraulic valve package part is normally delivered by the
BOP supplier.
In the present study, the acoustic part of the system in use has been identified for 14 of the 15
rigs. All these 14 rigs have a Kongsberg (Simrad) system.
Table 5.22 shows the acoustic system manufacturer and model for the acoustic part.
Table 5.22 Acoustic system manufacturer and model
Manufacturer Model BOP days in service
Kongsberg ACS 400 2 292
Kongsberg ACS 433 362
Kongsberg ACS 500 2 077
Kongsberg (Simrad) ACS unknown 211
Unknown Unknown 270
Total 5 212
Acoustic Control System Reliability
Table 5.23 shows an overview of acoustic system failure modes and the part of the system
responsible for the failure.
Table 5.23 Acoustic system failure modes and part of the system failed
Failure Mode
Acoustic communication part
Hydraulic valve package part
Unknown Total
No. of failures
Lost time (hrs)
No. of failures
Lost time (hrs)
No. of failures
Lost time (hrs)
No. of failures
Lost time (hrs)
Failed to operate one BOP function by the acoustic system
1 1 2 71 3 72
One of two acoustic units on the BOP failed
1 0 1 0
Other 4 77,75 3 77,75
Unknown 1 0 1 0,5 3 0,5
Total 2 1 7 148,75 1 0,5 10 150,25
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 65
Most failures stem from failures in the hydraulic valve package part. None of the failures were
caused by poor acoustic communication through the water column. This used to be a problem
in the 80ties and early 90ties.
Table 5.24 Acoustic back-up system failure modes and associated number of failures
Failure mode distribution No. of
failures Total lost time (hrs)
BOP days in service
MTTF (BOP days in service)
Avg. downtime per BOP day (hrs)
Avg. downtime per failure (hrs)
Failed to operate one BOP function by the acoustic system
3 72 5 212 1 737 0,0138 24,0
One of two acoustic units on the BOP failed
1 0 5 212 5 212 0,0000 0,0
Other 4 77,75 5 212 1 303 0,0149 19,4
Unknown 2 0,5 5 212 2 606 0,0001 0,3
Total 10 150,3 5 212 521 0,0288 15,0
Failed to Operate one BOP Function by the Acoustic System
The failure mode Failed to operate one BOP function by the acoustic system occurred three
times. Below the failures are briefly described:
1. The first failure occurred on a BOP test after running casing or liner during function testing.
It was only stated that they attempted to close the BSR with the acoustics from control
room. Re-tested function from the bridge.
2. The second failure occurred on a BOP installation test during function testing. They
attempted to close the blind shear ram on acoustic. It was observed that a valve for the
acoustic was closed (wrong valve set-up). Used the ROV to open the valve, then closed the
blind shear ram from acoustic panel located on bridge.
3. The third failure occurred on a BOP test after running casing or liner. A SPM valve on the
BOP acoustic control system leaked, and it was impossible to boost close the blind shear
ram. The well was plugged, and the BOP pulled to repair the failure.
One of two Acoustic Units on the BOP Failed
4. This failure occurred on a BOP installation test. They discovered that the communication
with the acoustic unit 1 on the BOP could not be established. Communication with unit 2
was tested and verified with both HIPAP (HIgh Precision Acoustic Positioning) and the
portable control unit.
Other
Four failures have been categorized with the failure mode Other. All failures occurred in the
hydraulic valve package part of the system. Below the failures are briefly described:
5. The first failure occurred during a test after running casing or liner. When function testing
the blind shear ram on the acoustic system a leakage between the blind shear ram and the
acoustic system was observed. Armed the acoustic unit and reset the acoustic system, and
the leakage disappeared.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 66
6. The second failure was observed during normal operation. A leakage was observed in the
acoustic system. The subsea engineer investigated the hydraulic leakage. He armed the
acoustic system and observed that the leak stopped. Performed additional function tests of
the acoustic system and verified that the acoustic system was functional.
7. The third failure was observed during normal operation. While waiting on weather a
pressure drop on the BOP blue pod surface volume counter was observed. Investigated with
an ROV. Found leak on the solenoid supply line of the blue pod. Isolated the acoustic arm
opening function and the leak stopped. Blue pod was then back in service.
8. The forth failure was observed during normal operation. Observed a hydraulic leak on the
BOP controls. Identified leak to the accumulator bottles for the acoustic functions and the
DMAS. The leak was also observed by an ROV. Ran RTTS packer and pulled the BOP.
Dismantled and inspected the leaking SAE flange and found a burst O-ring between the
adapter plate and the T-piece. The connection was mounted with two different manufacture
parts. Repaired and re-ran BOP.
Unknown
Two failures are categorized with the failure mode Unknown. All failures occurred in the
hydraulic valve package part of the system. Below the failures are briefly described:
9. The first failure occurred during a BOP installation test. It was only stated observed that
hydraulic fluid vented from the BOP acoustic pod. Troubleshooted on acoustic pod system.
No more information.
10. The second failure was observed during a test scheduled by time. There were some issues
while testing acoustic system on BOP. Re-tested acoustic system on BOP. Function-tested
LPR and UPR acoustic. It was not listed what the issues were
Historic Overview, Acoustic Back-Up Control System Failures
The acoustic control system reliability data from previous studies stems from drilling in
Norway. The study DW I (/4/) included acoustic experience from some few wells only. The
study DW II (/2/) and DW and kick (/1/), based on US GoM drilling did not include any
acoustic experience at all since the BOPs were not equipped with acoustic back-up systems.
From 1992, there has been a requirement in Norway to function test the acoustic system weekly
when the BOP is located at the seafloor. Before 1992 the typical test of the acoustic system was
to close the blind-shear ram to test casing before drilling out of casing.
Table 5.25 shows an overview of the BOP location when acoustic system failures were
observed.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 67
Table 5.25 Overview of the BOP location when observing acoustic system failures in 80s and early 90s
Study Location of BOP
Total On the rig prior to running On the wellhead During running BOP
Phase II 22 13 35
Phase IV 3 9 1 13
Phase V 7 1 8
Phase I DW 5 8 13
Total 29 38 2 69
Table 5.25 shows that more than 50% of the failures were observed when testing the BOP when
it was on the wellhead.
A general experience from the BOP reliability studies in the 80s and early 90s was that acoustic
back-up systems were given low priority. The training and education in electronic equipment
and hydro-acoustics varied from company to company.
Some of the failures listed may also be of human character and not technical as such.
Failure Modes
Table 5.26 shows the failure modes for the failures that were observed during the BOP
installation test and during regular BOP tests or operation.
Table 5.26 Failure modes for failures observed during the BOP installation test and
during regular BOP tests or operation in 80s and early 90s
Failure mode
BOP is on the wellhead
Installation test
Regular test or operation
Total
Failed to operate BOP 11 11 22
Failed to function on hull mounted transducer 3 3
Spurious operation one BOP function 2 2
Failed to operate one BOP function by the acoustic system 3 3 6
Loss of redundancy (one of two electronic channels dead) 1 1
Wrong valve position indication 1 1
No read back signal 1 1
Unknown 1 1
Total 18 19 37
When looking at the failure modes, it is observed that most failures affected the complete
system, and the result of the failure was that the system could not be operated. Only some few
failures were affecting one function only.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 68
6. FAILURE CRITICALITY IN TERMS WELL CONTROL
Failures that occur when the BOP is on the rig, during running of the BOP or during the
installation testing are not regarded as critical failures in terms of well control. During these
phases of the operation the BOP is not acting as a well barrier. After the installation testing is
completed and accepted, the drilling starts and the BOP acts as a well barrier. This is regarded
as the safety-critical period. This section discusses failure detection and failure criticality in
terms of well control.
6.1 WHEN ARE BOP FAILURES OBSERVED?
Table 6.1 presents the location of the BOP and the tests during which the various BOP failures
occurred.
Table 6.1 Observation of BOP failures
BOP sub-system
BOP is on the rig
While running (and pulling)
BOP
BOP is on the wellhead
Total Instal-
lation test
Normal operation
(Non critical)
Normal operation
(Safety critical)
Test after running casing
or liner
Test scheduled
by time
Other test
Un-known
Safety non-critical period Safety-critical period
Flexible joint
Annular preventer 1 6 4 4 15
Ram preventer 4 1 1 6
Connector 2 1 3
Choke/kill valve 2 1 3
BOP attached line 3 1 1 5
Riser attached line 4 3 1 1 2 11
Jumper hose line 1 1 1 3
Multiplex electro hydraulic control
5 1 5 2 1 14
Pilot hydraulic 1 2 8 1 7 1 2 2 24
Acoustic 3 1 2 3 1 10
Total 1 12 23 6 24 11 12 2 3 94
44,7% 55,3%
As seen from Table 6.1, 55% of the failures occurred in the safety-critical period, i.e. the period
where the BOP shall act as a well barrier. The criticality of each failure will of course depend
on what part of the BOP system that fails and the failure mode.
An installation test is defined as the BOP test after landing the BOP the first time or during
subsequent landings of the BOP or the LMRP.
Failure Observation, Pressure Testing vs. Function Testing
In the safety-critical period, 26 of 52 were observed during normal operation or other test. The
two other test failures were observed because the choke- or kill line was pressure tested, but
this was related to the operation and not a BOP test. Twenty-three failures were observed during
a Test after running casing or liner or a Test scheduled by time. For three failures it was
unknown how the failures were observed.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 69
When looking at the failures that were observed during a Test after running casing or liner or
a Test scheduled by time, six failures were observed because pressure was applied. Four of
these failures were in choke and kill lines, one was in a choke kill valve, and one in an annular
preventer.
Eleven failures were observed in association with BOP testing because the BOP functions were
activated. These failures are typically related to the control system and are observed because
hydraulic fluid is leaking, or they fail to operate a function.
Six of the failures were related to failed to fully open annular preventer in association with a
BOP test.
6.2 SAFETY-CRITICAL PERIOD FAILURES
This section discusses the failures that have occurred in the safety-critical period, as shown in
Table 6.1.
BOP Item, Safety-critical Period Failures
Table 6.2 shows the safety-critical failures in flexible joints, annular preventers, ram preventers,
and hydraulic connectors.
Table 6.2 Safety-critical period failures in the flexible joints, annular preventers, the
ram preventers and the hydraulic connectors
Failure mode distribution No. of
failures Total lost time (hrs)
No of BOP days
No. of item days
Average downtime per BOP day (hrs)
MTTF (Item days in service)
Lower limit
Mean Upper limit
Flexible joint
All 0 5 212 5 212 0,0000 2 264 > 5 212
Annular preventer
Failed to fully open 11 6,75 5 212 7 852 0,0013 431 714 1 273
Internal hydraulic leakage (control fluid part) 1 14 5 212 7 852 0,0027 1 655 7 852 153 080
Internal leakage (leakage through a closed annular) 2 2 5 212 7 852 0,0004 1 247 3 926 22 096
All 14 22,75 5 212 7 852 0,0044 359 561 928
Ram preventer
Other 1 1,5 5 212 24 441 0,0003 5 152 24 441 476 495
All 1 1,5 5 212 24 441 0,0003 5 152 24 441 476 495
Connector, LMRP
All 0 5 212 5 212 0,0000 2 264 > 5 212
Connector, Wellhead
All 0 5 212 5 212 0,0000 2 264 > 5 212
BOP items total 15 24,25 5 212 0,0047
Flexible joint
Flexible joint failures are rare. No failures were observed in a flexible joint. The flexible joint
is not an element that shall be able to withstand the well pressure, only the differential
hydrostatic pressure between the mud column and the seawater.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 70
Annular preventers
Internal leakage (leakage through a closed annular) were observed twice in the safety-critical
period. For both the incidents the closing pressure of the annular preventer was increased. For
one of them the annular still leaked.
1. During squeezing, pressure dropped from 24 to 15 bar, an increase in trip tank was
observed indicating annular leaking. Increased closing pressure on annular. Continued
squeeze operation.
2. Pressure tested UAP to 30 bar/5 min, no leaks. Attempted to pressure test UAP to 241
bar, observed leak. Increased closing pressure to 1500 psi and observed a better trend
but leak still above acceptance criteria.
Internal hydraulic leakage was observed once. During a BOP function test, they observed
leakage of BOP fluid at approx. 600 litre/hr while applied open function on upper annular
preventer (UAP). Some metal swarf/junk stuck between annular piston and housing. The failure
was repaired one week later when the BOP was pulled prior to run the X-mas tree.
Eleven annular preventer failures were observed as Failed to fully open failures in the safety-
critical period. These failures are not regarded as failures that reduce the safety availability.
Ram preventers
One ram preventer failure occurred in the safety-critical period. This was a failure categorized
with Other as failure mode. They function-tested the BSR and observed flow meter on BOP
panel continue to count the flow after the BSR was opened. Detected a leak through the BSR
EVO lock motor when in unlock position. The leak stopped venting the function after the EVO
lock was set in unlock position. The failure was repaired 13 days later when the BOP was on
the rig for other reasons.
None Failed to close, Leaking in closed position, or External leakage failures in ram preventers
were observed in the present study. These are failure modes that have been observed in earlier
studies.
Hydraulic connectors
No failures were observed in the hydraulic connectors in the safety-critical period.
The most critical failure in a wellhead connector is External leakage during normal drilling
operations. It is not uncommon to see these failures on the installation test, but they are rarely
observed in the safety-critical period. Such failures have been observed in earlier studies in the
safety-critical period.
No failed to unlock a connector was observed in the safety-critical period in the present study.
Such failures have been observed in earlier studies. If this failure mode occurs in a LMRP
connector it can be critical in association with an emergency disconnect situation.
Choke and Kill Valves and Lines, Safety-critical Failures
Table 6.3 shows the safety-critical failures of the choke and kill valves and choke and kill lines.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 71
Table 6.3 Safety-critical failures in the choke and kill valves and choke and kill lines
Failure mode distribution No. of
failures Total lost time (hrs)
No. of BOP days
No. of item days
Average downtime per BOP day (hrs)
MTTF (Item days in service)
Lower limit
Mean Upper limit
CHOKE/KILL VALVE
Internal leakage (leakage through a closed valve) 1 3 5 212 44 452 0,0006 9 370 44 452 866 624
Total 1 3 5 212 44 452 0,0006 9 370 44 452 866 624
BOP ATTACHED LINE
External leakage (leakage to environment) 1 80,75 5 212 5 212 0,0155 1 099 5 212 101 612
Total 1 80,75 5 212 5 212 0,0155 1 099 5 212 101 612
Jumper hose line
External leakage (leakage to environment) 2 46 5 212 5 212 0,0088 828 2 606 14 667
Total 2 46 5 212 5 212 0,0088 828 2 606 14 667
Riser attached line
External leakage (leakage to environment) 6 187 5 212 5 212 0,0359 440 869 1 995
Plugged line 1 3 5 212 5 212 0,0006 1 099 5 212 101 612
Total 7 190 5 212 5 212 0,0365 396 745 1 586
Total choke kill items 11 319,75 5 212 0,0613
Choke and kill valves
The only choke and kill valve failure in the safety-critical period was observed as a leakage
through a closed valve. This failure was detected during a test scheduled by time. It was unable
to obtain a satisfactory test on the fail-safes. Displaced the kill line to seawater a managed to
obtain a good low-pressure test on kill line fail-safe, however, high-pressure test failed.
Functioned valves and trouble shot. Repeated kill line fail-safe test with same result. Closed all
four kill line fail-safes and performed good high-pressure test, 1,18% drop in 10 min.
Choke and kill lines
There was no leakage in the BOP attached line during the safety-critical period.
There were three leakages in the jumper hose lines in moonpool during the safety-critical
period. For the first one, a small leak from the top of the swivel between the kill line co-flex
and fixed pipe on rig was observed during normal operations. Removed the swivel and
connected the co-flex to a fixed pipe and pressure tested.
For the second failure they tested the fail-safe valve with 20/482 bar for 5/10 min after running
casing or liner. The test failed because a moonpool co-flex failed. Hung off drill-pipe in
wellhead. Disconnected the LMRP and replaced the leaking kill line co-flex in moonpool. Re-
landed and tested LMRP connector. They used 43 hours to repair the failure.
For the third failure, during a test scheduled by time, they were not able to get low-pressure
tests on the kill line. The leak was on a swivel on ROPS. Plugged the well and pulled the LMRP,
repaired and re-ran the LMRP. They used 81 hours to repair the leak.
There were seven failures in the riser attached lines during the safety-critical period. One
failure was a plugged line, while the remaining six were external leakages. Three of the six
external leakages occurred on the same rig.
The plugged line failure was observed during normal operation. The line was opened by
displacing to different mud and pumping.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 72
During a pressure test scheduled by time, a riser choke line leak at 375 m was discovered.
Pulled the riser and replaced seals on the leaking choke line connection. A lip seal on choke
line was worn down. Re-ran LMRP and riser, landed test tool and commenced BOP testing.
They used 58 hours to repair the leak.
During normal operation they observed a leakage in the choke line connection between CML
riser joint and slick riser joint below. The BOP should be pulled anyway, so this failure caused
minor lost time only.
During a test after running casing or liner a leak was observed when pressure tested the kill line
against fail-safes. The choke line was OK. Displaced kill and choke lines back to OBM and
pressure tested kill and choke lines against fail-safes to 30 bar/5 min and 100 bar/10 min, no
leaks.
While waited on weather for pulling the BOP they failed to pressure test the choke line with
200 bar. Suspect a washed-out leak in stab seals on choke line riser connectors.
During preparations for pulling the BOP to install the X-mas tree they failed to test the kill line
against a closed fail-safe valve. Launched an ROV and observed fluid weeping from kill line
connection between 2 riser joints (only when under 100 bar pressure). Estimated leak rate was
+/-1 liter leak.
During normal operation a leak in the choke line at bottom connection on the modified riser
joint was discovered. Stopped drilling and prepared for pulling riser with riser pump (SPM) for
repair. Pulled riser and changed seals on riser joint and 30 ft pup. Had problems with riser pump
valve during running. Pulled LMRP again, repaired and re-ran LMRP. Pulled EDPHOT and
tested LMRP. They used 125 hours to repair the leak.
All these external leaks reduce the BOP safety availability. However, the most important factor
is that these failures will cause extra problems in case a kick has to be circulated out of the well.
Main Control System, Safety-critical Failures
Table 6.4 shows the safety-critical failures that occurred in the BOP main control systems
during the study.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 73
Table 6.4 Safety-critical Failures in the BOP Control Systems
Failure mode distribution No. of
failures Total lost time (hrs)
No of BOP days
Average downtime per BOP day (hrs)
MTTF (days in service)
Lower limit
Mean Upper limit
Multiplex electro hydraulic
Emergency automated BOP function failed 1 81,5 1239 0,0658 261 1 239 24 155
Loss of all functions one pod 1 0 1239 0,0000 261 1 239 24 155
Loss of one function one pod 1 0 1239 0,0000 261 1 239 24 155
Loss of one function one topside panel/unit 1 0,5 1239 0,0004 261 1 239 24 155
Other 4 16 1239 0,0129 135 310 907
Total multiplex 8 98 1239 0,0791 86 155 311
Pilot hydraulic
Loss of all functions one pod 2 53 3 973 0,0133 631 1 987 11 180
Loss of one function both pods 1 0,5 3 973 0,0001 838 3 973 77 457
Loss of one function one pod 1 1,25 3 973 0,0003 838 3 973 77 457
Other 4 3,75 3 973 0,0009 434 993 2 908
Unknown 4 0 3 973 0,0000 434 993 2 908
Total pilot hydraulic 12 58,5 3 973 0,0147 204 331 574
Multiplex system failures
Emergency automated BOP function failed. This failure occurred during normal operation it
seems. The AMF (Automatic Mode Function) obviously failed for some reason. Ran the RTTS
plug. Attempted to repair the AMF shuttle valve with an ROV. The attempt failed. Decided to
pull the BOP to surface to repair. Pulled the BOP and replaced the AMF shuttle valve on the
BOP. Pressure tested same to 5000 psi/10 min. Commenced soak testing on BOP. Ran the BOP.
Tested the BOP and pulled the RTTS.
Loss of all functions one pod. This failure occurred during normal operation with the BOP on
the wellhead. They turned off the blue pod, likely because of a failure. Six hours later they
turned on blue pod back-up control unit and confirmed control unit was ok. There was no more
information. It is assumed that the blue pod failed to operate the BOP.
Loss of one function one pod. This failure occurred when the BOP was on the wellhead during
normal operation. When performing a function test of the BOP stack they could not operate the
outer bleed valve from the blue pod.
Loss of one function one topside panel/unit. This failure occurred when the BOP was on the
wellhead during normal operation. They were unable to open the UPR from tool pusher’s panel.
Opened it from the driller’s panel. Function tested UPR from tool pusher’s panel 2 days later.
Other. This failure occurred when the BOP was on the wellhead during normal operation. The
subsea engineer investigated a BOP leakage by operating BOP valves while observing the BOP
with the ROV. Found the leak at upper inner blue pod choke line fail-safe SPM valve. Sat the
function in open position, and the leak disappeared.
Other. This failure occurred when the BOP was on the wellhead during normal operation.
Observed the HPU pump for BOP control fluid starting irregularly, indicating leak on system.
Troubleshot same. Isolated conduit lines on surface and on BOP. Observed a pressure drop of
300 psi in 1 minute on yellow conduit. HPU was stable while yellow conduit was isolated.
Function tested BOP rams, annulars, and fail-safes with conduit lines isolated and hot line as
supply. Decided to continue operation with hot line as secondary system. De-isolated blue
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 74
conduit. The conduit line was repaired two weeks later, when the BOP was pulled to repair the
AMF shuttle valve.
Other. This failure occurred when the BOP was on the wellhead during normal operation.
Inspected the BOP blue pod with an ROV. Found a leak on 1/4 line to stack accumulator read
back gauge. Isolated charge line to accumulators in the lower stack and the leak stopped
Other. This failure occurred when the BOP was on the wellhead during normal operation. They
were in the process of P&A the well when a leak was observed on the hydraulic hot line.
Performed riser/BOP cleanout run and tagged cement at 504 m. Displaced well to seawater.
POOH with riser brush assembly. Prepared to disconnect LMRP. Pulled LMRP and repaired
leak on hydraulic hot line. Latched LMRP on BOP. Had to repair the hot line three times
Pilot hydraulic system failures
Loss of all functions one pod. This failure occurred when the BOP was on the wellhead during
normal operation. Prior to drilling 8 1/2 section they observed leakage of BOP control fluid
from the yellow pod. Trouble shot same. Disconnected LMRP, pulled to surface and changed
out faulty gas relief vent valve. Re-ran LMRP.
Loss of all functions one pod. This failure occurred when the BOP was on the wellhead during
normal operation. It was only stated troubleshot leakage on yellow pod. It was not stated if the
problem was repaired. The well was finished, and the BOP pulled three days later. The failure
mode is assumed
Loss of one function both pods. This failure occurred when the BOP was on the wellhead during
normal operation. They attempted to open the BSR but did not receive the correct return flow.
Investigated the problem and discovered that the BSR boost system was activated. Turned off
the boost. Found that the quick dump valve had hung up. Opened the BSR.
Loss of one function one pod. This failure occurred when the BOP was on the wellhead during
normal operation. They were not able to get pressure to open the wellhead connector and
disconnect the BOP. Troubleshot on BOP system, leak observed. Opened wellhead connector
and pulled BOP above template.
Other. Pulled yellow BOP pod to surface due to leaking control line of the pod latch function.
Changed latch function to another control line, ran pod into sea and latched onto LMRP.
Other. Observed leak in secondary unlatch line on blue pod when unlatching the LMRP due to
bad weather. While WOW retrieved blue pod to surface and changed line for secondary unlatch.
Ran blue pod to BOP and latched same.
Other. Small leakage in BOP JIC fitting on high-pressure shear system. Pulled bottom hole
assembly through window due to inspection of leaking valve on BOP. Tightened fittings on
BOP shifting valve with ROV.
Other. Observed erratic readback pressure on blue pod subsea annular regulator. Pulled blue
pod for inspection (subsea regulator suspected stuck). Function tested BOP via blue pod on
drillers panel, ok. Confirmed blue pod fully functional after repair.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 75
Unknown. During normal operation a leak was observed on the yellow pod. Investigated leak.
There was no more information.
Unknown. A safety valve in the BOP main control room (set @3200 psi) blew (assumed while
switching from yellow to blue pod), and high-pressure hose installed upstream safety valve
burst (supposedly as an effect of high flowrate through restricted dimension). Thus, decided to
abort function testing for now, to replace defect hose and safety valve.
Unknown. It was only stated; ran and installed blue pod. This occurred just after they had
finished testing the BOP from the yellow pod. There is no indication why the pod was pulled
in the first place. Function tested the BOP on the blue pod the day after.
Unknown. It is not known what failed. It was only stated that they ran the blue pod. The ROV
followed pod to seabed. Before running the blue pod, inspected the BOP down to BSR with the
ROV, and found no anomalies.
Back-up Control System, Safety-critical Failures
Table 6.4 shows the safety-critical failures that occurred in the BOP back-up control systems
during the study.
Table 6.5 Safety-critical Failures in the BOP Control Systems
Failure mode distribution No. of
failures Total lost time (hrs)
No of BOP days
Average downtime per BOP day (hrs)
MTTF (days in service)
Lower limit
Mean Upper limit
Acoustic
Failed to operate one BOP function by the acoustic system 2 71,5 5 212 0,0137 828 2 606 14 667
Other 3 77,75 5 212 0,0149 672 1 737 6 374
Unknown 1 0,5 5 212 0,0001 1 099 5 212 101 612
Total acoustic 6 149,75 5 212 0,0287 440 869 1 995
Failed to operate one BOP function by the acoustic system. The failure occurred on a BOP test
after running casing or liner during function testing. It was only stated that they attempted to
close the BSR with the acoustics from the control room. Re-tested function from the bridge.
Failed to operate one BOP function by the acoustic system. The failure occurred on a BOP test
after running casing or liner. A SPM valve on the BOP acoustic control system leaked, and it
was impossible to boost close the blind shear ram. The well was plugged, and the BOP pulled
to repair the failure.
Other. The failure was observed during a normal operation. A hydraulic leakage was observed
in the acoustic system. The subsea engineer investigated the leakage. He armed the acoustic
system and observed that the leak stopped. Performed additional function tests of the acoustic
system and verified that the acoustic system was functional.
Other. The failure was observed during a test after running casing or liner. When function
testing the blind shear ram on the acoustic system a leakage between the blind shear ram and
the acoustic system was observed. Armed the acoustic unit and reset the acoustic system, and
the leakage disappeared.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 76
Other. The failure was observed during normal operation. Observed a hydraulic leak on the
BOP controls. Identified leak to the accumulator bottles for the acoustic functions and the
DMAS. The leak was also observed by an ROV. Ran RTTS packer and pulled the BOP.
Dismantled and inspected the leaking SAE flange and found a burst O-ring between the adapter
plate and the T-piece. The connection was mounted with two different manufacture parts.
Repaired and re-ran BOP.
Unknown. The failure was observed during a test scheduled by time. There were some issues
while testing the acoustic system on the BOP. Re-tested acoustic system on BOP. Function-
tested LPR and UPR acoustic. It was not listed what the issues were
6.3 RANKING OF FAILURES WITH RESPECT TO SAFETY CRITICALITY
The frequency of failures that occurred in the safety-critical period is higher than in the DW
and kick (/1/) study.
When comparing the overall frequency of failures that occurred in the safety-critical period
from the present study with the frequencies in the previous studies, Phase II DW and Phase I
DW, the frequencies are in the same order of magnitude. The frequencies are a bit higher
compared with the most recent DW and kick study.
It is noteworthy that, in the present study the most serious BOP failure modes were not
observed. Failure modes, such as leakage in the wellhead connector, external leakage in rams,
and total loss of BOP control through the main control system were not observed. Leaking
preventers or valves are rare in the present study. The most critical observation was a high
number of leaks in choke and kill lines.
Table 6.6 lists a coarse ranking of the most severe failures that occurred in the safety-critical
period in the present study. The same ranking from the previous studies, DW and kick, Phase
II DW, and Phase I DW, is presented alongside.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 77
Table 6.6 Coarse ranking of most severe failures occurring in the safety-critical period
according to severity
Present study Norway (2016 – 2018) DW and kick (/1/) (2007-2009, US GoM OCS) 1. Nine external leaks in choke and kill lines 2. Two failures that caused loss of all functions
one pod 3. Internal leakage (leakage through a closed
annular) 4. Internal leakage (leakage through a closed
choke/kill valve) 5. One loss of one function both pods 6. Two loss of one function one pod
1. One failure causing wellhead connector external leakage
2. One spurious opening of the LMRP connector (Unknown cause, no autoshear in BOP)
3. One control system failure that caused total loss of the BOP control
4. One shear ram leakage in closed position 5. Upper and lower variable bore ram leaked at the
same time 6. Two incidents, pipe ram failed to close 7. Nine incidents, loss of all functions one pod 8. Two incidents, pipe rams leaked in closed
position 9. One flexible joint external leak 10. One failed to close annular incident 11. Four incidents, annular preventer leak 12. Six choke and kill line leaks 13. Five incidents with loss of one function both
pods
Phase II DW BOP study (/2/) (1997-1999, US GoM OCS)
Phase I DW BOP study (/4/) (1992-1996, Brazil and Norway)
1. One control system failure that caused total loss of the BOP control
2. One spurious opening of the LMRP connector (control system failure)
3. One shear ram failed to close 4. One shear ram leak in closed position 5. Two failures to open pipe ram 6. Two failures where the pipe ram leaked in
closed position 7. External leak in flexible joint 8. One failure to disconnect the LMRP 9. Four failures that caused loss of all functions
one pod 10. Loss of one function both pods (annular close) 11. Four annular preventer leaks in closed position 12. One choke and kill line leak (jumper hose)
1. One failure causing wellhead connector external leakage
2. One failure where they failed to shear the pipe during a disconnect situation
3. One external leakage in the connection between lower inner kill valve and the BOP stack
4. Five failures that caused total loss of the BOP control by the main control system
5. Two shear ram leakages in closed position 6. Two failures to disconnect the LMRP 7. Seven failures that caused loss of all functions
one pod 8. One UPR leakage 9. One spurious closure of the shear ram 10. Three annular preventers that leaked in closed
position 11. Six choke and kill line leakages
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 78
7. BOP TESTING EXPERIENCE
The subsea BOPs are tested regularly in Norwegian waters. The US GoM OCS BOP testing
regulations have been similar to the Norwegian regulations for many years. The past years the
US requirements have become stricter related to the initial test after landing the BOP and testing
of the BOP emergency features, as emergency disconnect system (EDS), automated mode
function (AMF/Deadman), auto shear, and ROV functions. In other parts of the world the BOP
may be tested according to governmental regulations, or according to operator practices.
7.1 BOP TESTING REGULATIONS
The testing requirements for the subsea BOPs are described in Norsok D-010, rev 4. (/11/).
Annex A to this report shows the detailed requirements. Below, the requirements are briefly
listed.
On stump, prior to running BOP
The BOP shall be pressure tested to the well design pressure. Function test the acoustic system.
Function test ram locking system and casing shear ram.
Installation on wellhead/drilling out of surface casing
Wellhead connector and choke and kill valves to be tested to well design pressure. The rest of
the BOP shall be function tested. Function test the acoustic system and the casing shear ram.
After cementing deeper casing or liner
Test BOP to section design pressure. Function test the acoustic system and the casing shear
ram.
Periodic test
Weekly: Function test the BOP (shall not exceed 7 days since last BOP function test). Check
acoustic communication.
Each 14 days: Pressure test the BOP to section design pressure (shall not exceed 14 days since
last BOP pressure test). Close one ram with the acoustic system.
Miscellaneous tests
Tests of the Emergency disconnect system, Deadman (electric and hydraulic power lost),
Autoshear (when disconnecting) shall be performed with BOP installed on wellhead and is only
required during commissioning or within 5 year of previous test.
A low-pressure test to 15–20 bar for minimum 5 minutes stable reading should be performed
prior to high-pressure testing in the drilling, completion, and intervention activities.
7.2 BOP TEST TIME CONSUMPTION
Table 7.1 presents the number of BOP tests and the test time consumption tests for the various
rigs included in the study. The various test types;
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 79
- Installation tests (tests after the BOP has been landed on wellhead the first or subsequent
times, and after the LMRP connector has been landed on the BOP stack)
- Tests after running casing or liner (before drilling out the cement)
- Pressure tests scheduled by time
- Function test scheduled by time
- Other tests (includes all other tests where a BOP component has been pressure tested directly
or as a result of testing other equipment, for instance a seal assembly, shallow well plug, etc.
Only time consumption from tests where the prime objective has been to test a BOP
component have been included)
It should be noted that time used/lost in connection with BOP failures are not recorded as a part
of the BOP test time. Only the test time itself, time for running/pulling of tools and time lost in
connection with tool problems are included in the BOP test time.
Table 7.1 No. of BOP subsea tests, test time consumption, and test type for pressure
tests for the individual rigs
Rig name
Installation test Test after running
casing or liner Test scheduled by
time
Function test scheduled by
time Other
BOP days in service
Average test time per BOP day (hrs)
No. of tests
Average t. time (hrs)
No. of tests
Average t. time (hrs)
No. of tests
Average t. time (hrs)
No. of tests
Average t. time (hrs)
No. of tests
Average t. time (hrs)
Rig A 5 1,50 12 3,67 7 6,21 8 0,56 8 0,00 211 0,472
Rig B 11 3,30 12 3,42 8 8,13 11 1,11 8 0,22 272 0,574
Rig C 16 0,93 20 4,89 4 7,19 10 0,83 12 0,00 362 0,414
Rig D 6 3,42 13 4,60 5 27,65 3 0,33 8 0,47 255 0,875
Rig E 18 5,89 20 2,20 2 9,13 6 0,54 16 0,13 277 0,626
Rig F 15 3,70 15 3,52 5 15,75 11 1,27 6 0,25 267 0,758
Rig G 10 2,83 6 5,00 23 5,96 29 0,63 19 0,05 496 0,433
Rig H 14 3,20 14 4,00 5 6,95 12 0,69 15 0,02 331 0,435
Rig I 15 8,35 13 7,58 8 7,56 30 0,50 8 0,50 425 0,714
Rig J 33 1,61 36 3,36 11 7,44 9 0,48 34 0,05 495 0,529
Rig K 18 2,85 13 4,50 8 7,38 18 0,96 12 0,00 409 0,455
Rig L 6 2,88 8 2,91 23 9,10 23 0,49 14 0,23 470 0,562
Rig M 8 2,47 6 5,08 3 7,83 4 1,06 5 0,00 164 0,476
Rig N 17 4,57 19 4,54 2 10,38 5 1,05 11 0,05 270 0,706
Rig O 8 2,59 9 3,31 24 7,19 38 0,37 16 0,00 508 0,467
Total 200 3,39 216 4,04 138 8,49 217 0,65 192 0,10 5 212 0,553
Table 7.2 shows the no. of BOP subsea tests, test time consumption, and time between tests for
pressure tests for the individual operators
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 80
Table 7.2 No. of BOP subsea tests, test time consumption, and test type for pressure
tests for the individual operators
Operator
Installation test Test after running
casing or liner Test scheduled by
time Function test
scheduled by time Other
BOP days in service
Average test time per BOP day (hrs)
No. of
tests
Average t. time (hrs)
No. of tests
Average t. time (hrs)
No. of tests
Average t. time (hrs)
No. of tests
Average t. time (hrs)
No. of tests
Average t. time (hrs)
Operator A 3 0,83 4 7,00 2 4,50 5 1,20 3 0,00 99 0,460
Operator B 1 1,75 2 3,75
18 0,514
Operator C 17 4,57 19 4,54 2 10,38 5 1,05 11 0,05 270 0,706
Operator D 19 5,68 22 2,60 2 9,13 8 0,66 16 0,13 318 0,600
Operator E 23 2,93 16 4,45 10 7,90 18 0,94 16 0,00 491 0,478
Operator F 15 8,35 13 7,58 8 7,56 30 0,50 8 0,50 425 0,714
Operator G 120 2,43 135 3,66 111 8,48 148 0,58 135 0,10 3 494 0,523
Operator H 1 4,00 4 6,00 3 14,17 3 2,17 2 0,00 84 0,917
Operator I 1 1,00 1 6,50
1 0,00 13 0,577
Total 200 3,39 216 4,04 138 8,49 217 0,65 192 0,10 5 212 0,553
The total time used for testing is 2884 hours, representing on average 0,553 hours per BOP day,
that again represents 2,3% of the time.
It is a general impression that there are fewer problems with test tools than it used to be back
in the 80ties and 90ties. Also, the test tools have become more advanced so fewer runs are
required to land a test plug and to continue operation after testing.
An issue related to this dataset is that a lot of batch drilling has been carried out. This means
that the BOP has been moved around among several wells. Many of the tests that are regarded
as an installation test would for a “normal“ well be categorised as a test after running casing
and liner.
It is a large variation in average BOP test times among the various rigs and operators. Rig D
had the highest average test time per day in service. The main reason for this was an event
where a test tool seal ring was lost in hole and they used more than four days to retrieve it. Rig
F experienced a high average BOP test time for the pressure tests scheduled by time. This was
caused by two tests where they experienced severe test equipment problems and prolonged test
time.
For Rig I, they had the highest average test time consumption during both the installation test
and the test after running casing or liner. The main reason was that both for the installation test
and the test after they had been running casing or liner, they perform a full pressure test for
nearly all tests. Many of the rigs do not perform a full BOP pressure test after running casing
or liner. The full pressure tests were typically replaced by a well pressure test and a BOP
function test. This reduces the total test time consumption.
In addition, some perform a full BOP test after landing the BOP, when only a connector test is
required if the BOP has been fully pressure tested on rig prior to running.
Table 7.3 shows an overview of number of full BOP tests and partly BOP tests during
installation test and test after running casing and liner.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 81
Table 7.3 Overview of number of full BOP tests and partly BOP tests during
installation test and test after running casing and liner
Operator
Installation test Test after running casing or liner
No. of tests Average test time per test No. of tests Average test time per test
Partly test*
Full test**
Total Partly test
Full test
Total Partly test
Full test
Total Partly test
Full test Total
Operator A 3
3 0,83
0,83
4 4
7,00 7,00
Operator B 1
1 1,75
1,75 1 1 2 0,75 6,75 3,75
Operator C 15 2 17 4,13 7,88 4,57 6 13 19 0,21 6,54 4,54
Operator D 9 10 19 1,69 9,28 5,68 12 10 22 0,44 5,20 2,60
Operator E 19 4 23 2,16 6,63 2,93 7 9 16 0,54 7,50 4,45
Operator F 3 12 15 3,83 9,48 8,35 1 12 13 0,00 8,21 7,58
Operator G 96 24 120 1,63 5,63 2,43 62 73 135 0,40 6,42 3,66
Operator H 1
1 4,00
4,00 2 2 4 0,00 12,00 6,00
Operator I 1
1 1,00
1,00
1 1
6,50 6,50
Total 148 52 200 1,99 7,38 3,39 91 125 216 0,40 6,70 4,04
* Partly test is typical a well and/or a connector test, and a BOP function test ** Full test is a test that includes a pressure test of the various BOP components
Ninety-one of the 216 tests after running casing were not a full BOP test. For the 91 tests the
operators had typically performed a full BOP test some few days earlier. The operators have
evaluated the risk related to not performing the full BOP test after running the casing or liner
and concluded that this will not significantly affect the risk if the time since the last full BOP
pressure test is less than two weeks.
A check of the time since the last full BOP tests was done for these partly tests. The average
time since the last full BOP test was found to be 6,8 days. Only two of the 91 tests exceeded
two weeks. For one, it was 19 days since last test and for the other, it was 17 days.
Twenty-one of the 200 installation tests were tests after the LMRP had been reconnected. Five
of these tests were full BOP tests while 16 were partly tests.
7.3 TESTING OF ACOUSTIC FUNCTION AND BLIND SHEAR RAM
When reviewing the various tests, it has been identified what tests that included some sort of
activation of the acoustic back-up system and activation of blind shear rams. Table 7.4 shows
an overview of tests identified.
Table 7.4 No. of tests that included some sort of activation of the acoustic back-up
system and activation of blind shear rams.
Test type Installation
test
Test after running
casing or liner
Test scheduled
by time
Function test scheduled by
time Other Total
Total number of BOP tests 200 216 138 217 192 963
No. of tests including some sort of acoustic activation
79 93 66 53 21 312
No. of tests including blind shear ram function test
50 79 92 125 41 387
No. of tests including blind shear ram pressure test
128 95 12 84 319
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 82
It is here important to note that the data is based on the text in the daily drilling reports and
course evaluations. There are likely several more activations of the acoustic systems and the
blind shear ram than shown in Table 7.4.
7.4 OTHER TESTS
There are 192 tests categorized as other tests. Of these other tests, 151 have been a pressure test
involving parts of the BOP. The primary objective of the test may have been to test specific
BOP preventers or equipment shallow or deep in the well.
When looking at these 151 pressure tests the uppermost preventer used were;
1. Annular, 14 tests
2. Blind shear ram, 83 tests
3. Upper pipe ram, 15 tests
4. Middle pipe ram, 28 tests
5. Lower pipe ram, 7 tests
6. Unknown preventer, 4 tests
All these tests involve a pressure that may reveal an external leak in the BOP. A coarse review
of the tests showed that approximately 50% involved equipment shallow in the well (seal
assembly, shallow plug, tubing hanger seals, etc), i.e. the test volume was small. Approximately
50% were tests including equipment deep in the well (casing, deep-set plugs, liner seal
assembly, production packer, etc.). The tests involving small volumes are better suited to reveal
minor external leaks in the BOP than the tests with large volumes.
7.5 COMPARISON WITH PREVIOUS STUDIES
In the several of the previous subsea BOP studies information about BOP test times have been
systematically collected. Table 7.5 and Table 7.6 shows some key data from the various studies.
Table 7.5 Test time consumption in various studies, including all test types
Study BOP days
Total test time (hrs)
Average test time per BOP day incl all
tests
% of drilling time
Years drilled and country
Phase IV (/7/)
3 809 2 676 0,70 2,9% 1982-1986 Norway (Weekly pressure test, no low-pressure test)
Phase V (/6/)
2 636 1 480 0,56 2,3% 1987-1989, Norway (Weekly pressure test, no low-pressure test)
DW I (/4/) 4 846 3 456 0,71 3,0% 1992-1996, Brazil and Norway, includes both
deep and shallow water
DW II (/2/) 4 009 4 981 1,24 5,2% 1997-1999, US GoM OCS, deeper than 300
meters of water
Present study*
5 212 2 884 0,553 2,3% 2016 – 2018 Norway, mostly 200 – 500 meters of water
* Includes 160,9 hours Function test scheduled by time and Other tests.
Table 7.5 shows that the average test time consumption in the present study is at the same low
level as the Phase V study from the 80ties.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 83
Table 7.6 Time between pressure tests, and average pressure test time
Study BOP days
Total no. of BOP pressure tests (Installation, after running casing or liner and periodic tests)
Average no. of BOP days between a BOP test
Average BOP test time
Phase IV (/7/) 3 809 358 10,64 7,5
Phase V (/6/) 2 636 253 10,42 5,9
DW I (/4/) 4 846 420 11,54 8,1
DW II (/2/) 4 009 349 11,49 13,9
Present study 5 212 559 9,32 4,9
When comparing Phase V results with Phase IV results, the average BOP test time decreased
significantly, from 7,5 hours to 5,9 hours. This average BOP test time reduction may partly be
explained by that one of the rigs, during Phase IV of the study, had a more complex BOP test
than the other rigs. This rig had a significant influence on the average BOP test time. Further,
combined test tools that reduced the number of necessary runs associated to BOP became more
common.
Low-pressure tests were rarely performed in the 80ties. A low-pressure test will typically
prolong each BOP test time with approximately 0,5 - 1 hour. In the DW I study, all the BOP
pressure tests included a low-pressure test. This was a study where most of the data stemmed
from Brazilian deepwater wells. Increased water depth increases the handling times when
running test tools. The typical holding time for each high-pressure time for Brazilian BOP tests
wells was 5 minutes, and not 10 that is the normal in Norway. This reduces the total test time.
Further, very few BOP tests scheduled by time was carried out for the Brazilian wells, that also
will reduce the average test time per BOP day .
In the DW II study the average test time increased significantly compared to the DW I study.
The average water depths for the two studies were similar.
The main reasons for the differences between DW I and DW II are believed to be:
• In Phase II DW variable bore rams (VBRs) normally were tested on two diameters, thus
increasing the number of tests. Normally a telescopic type test joint was used for this
testing. Due to problems with a dart for this type of test joint for some rigs they frequently
made two test plug runs with different joint diameter.
• In Phase I DW relatively more tests were performed after running casing (periodic tests
were seldom performed) and the casing pack-off tool was then used. The average test time
when using the casing pack-off tool for BOP testing is lower than using the other tools.
• In Phase II DW the high-pressure holding times were 10 minutes vs. 5 minutes in Phase I
DW study. The blind-shear ram test pressures were held for 30 minutes.
The present study has on the average the shortest subsea BOP test times. Most of the drilling
has been in shallow water, reducing the tool handling time. The main reason is believed to be
that a large proportion of the tests after running casing or liner are partly tests, and not full tests
(see Table 7.3, page 81).
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 84
8. WELL KICKS
When collecting kick data, only the period when the BOP has been located on the wellhead has
been considered, i.e., shallow gas or shallow water-flows are not considered.
Table 3.2, page 26, shows the operators represented with drilling in the present study. A total
of 130 mother wells or 182 well paths (when sidetracks and multilaterals are counted as
separate wells) are included. A total of 5 212 BOP days is included.
It is also observed that far more development drilling is carried out than exploration drilling.
The main criteria for defining a well control incident as a kick is that the BOP was needed to
control the situation. The meaning of “Control the situation” is to both close in the well with the
BOP and to circulate the kick/let it be buoyed out (in case stripping failed) in a controlled way until
the situation is normalized.
8.1 KICKS OBSERVED
A total of five well kicks were observed, three in exploration wells and two in development
wells. Table 8.1 shows an overview of the kicks identified and key data related to the kicks.
For two of the exploration kicks (kick 1 and 2), they observed a sudden increase in the rate of
penetration during drilling (drilling break).
For the third kick (kick 4) in an exploration well, the well kicked during plugging and
abandoning the well. They were pulling the seal assembly when trapped gas below the seal
assembly caused the well to kick.
One of the two kicks in a development well occurred when plugging and abandoning the well
(kick 3). When pulling the tubing hanger plug gas below the plug caused the well to kick. It
was believed that the gas stemmed from the natural gas lift zone in the well through a leaking
gas lift valve.
The second development drilling kick (kick 5) occurred after they had just set a balanced
cement plug from 1943 to 1727 m. They then got losses after having pumped 28,3 m3 of 1,45
sg OBM. When diluting mud from 1,45 sg to 1,40 sg they observed a gain.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 85
Table 8.1 Overview of the kicks identified and key data
Kick ID Activity and observations before kick Interpretation and handling of incident Phase Operation Activity
1
Drilled 12 1/4 hole. Observed drilling break. Stopped drilling to flow check well
Pressure built up gradually. Circulate kick out of well by Driller`s method,
Explor-ation
Drilling Drilling
Csg OD (inch)
Csg shoe TVD (m)
LOT eq MW (sg)
Well depth when kicked TVD (m)
Diameter pipe in BOP (inch)
Mud weight (sg)
Mud weight ECD (sg)
Kill mud weight (sg)
Kick size (BBL)
Kick med-ium
SIDPP (Bar)
SICP (Bar)
Killing method
Killing duration (days)
Comments
14 3147,4 1,883 3635 5 1,713 1,72 1,9 6,3 gas 67 71 Drillers method
3,778
Operator classified this as a yellow kick
Kick ID Activity and observations before kick Interpretation and handling of incident Phase Operation Activity
2
Drilled 12 1/4 hole. Observed drilling break
Monitored pressure against. Circulated kick out using driller`s method.
Explor-ation
Drilling Actual drilling
Csg OD (inch)
Csg shoe TVD (m)
LOT eq MW (sg)
Well depth when kicked TVD (m)
Diameter pipe in BOP (inch)
Mud weight (sg)
Mud weight ECD (sg)
Kill mud weight (sg)
Kick size (BBL)
Kick med-ium
SIDPP (Bar)
SICP (Bar)
Killing method
Killing duration (days)
Comments
14 2995,5 1,82 3563 5 1,7 1,75 1,76 0,9 gas 11,5 10 Driller`s method
1,2466
Operator classified this as a green kick
Kick ID Activity and observations before kick Interpretation and handling of incident Phase Operation Activity
3
POOH w/ TH plug with restricted speed on 5 1/2 HWDP from 350 m to 177 m.
Observed gain. Closed BSR and monitored pressure. Lined up and circulating down Kill line up Choke line to circulate out residual gas. Continued circulation until gas in mud decreased from to 0,5%. Gas assumed coming from natural gas lift zone in the well. Position of Gas Lift Valve uncertain when well handed over from operations.
Develop-ment
Plug and abandon
Pull tubing hanger plug
Csg OD (inch)
Csg shoe TVD (m)
LOT eq MW (sg)
Well depth when kicked TVD (m)
Diameter pipe in BOP (inch)
Mud weight (sg)
Mud weight ECD (sg)
Kill mud weight (sg)
Kick size (BBL)
Kick med-ium
SIDPP (Bar)
SICP (Bar)
Killing method
Killing duration (days)
Comments
1,08 Gas 30 Circulating
0,625
Kick ID Activity and observations before kick Interpretation and handling of incident Phase Operation Activity
4
RIH with MPT and latched onto 9 5/8 Seal Assembly. Closed Lower Annular Preventer and pulled Seal Assembly free with 63-ton overpull. Observed pressure build up due to gas below Seal Assembly.
Pressure on closed choke increase from 0 to 17 bar. Closed fail-safes on kill line and lined up to pump down string and up choke line. Observed 29 bar on string and 16,4 bars on choke line. Pumped until gas in both choke line and string was choked out. Circulated until 1,20 sg mud in return and decreasing gas trend.
Explorat-ion
Plug and abandon
Pull seal assembly free
Csg OD (inch)
Csg shoe TVD (m)
LOT eq MW (sg)
Well depth when kicked TVD (m)
Diameter pipe in BOP (inch)
Mud weight (sg)
Mud weight ECD (sg)
Kill mud weight (sg)
Kick size (BBL)
Kick med-ium
SIDPP (Bar)
SICP (Bar)
Killing method
Killing duration (days)
Comments
5 1,2 1,2 Gas 17 17 Circulat-ing
0,354
Trapped gas below seal assembly
Kick ID Activity and observations before kick Interpretation and handling of incident Phase Operation Activity
5
Just set a balanced cement plug from 1943 to 1727 m. Losses after having pumped 28,3 m3 of 1,45 sg OBM. Diluting mud from 1,45 sg to 1,40 sg. Observed gain.
Flow checked well. Unstable well. SPP: 4 bar, Kill: 4 bar, Choke: 3 bar. Displaced well to 1,43 sg OBM. Flow checked well. Unstable well. Flow back rate 0,3 m3/hrs. Pumped 45 m3 of 1,45 sg OBM through booster line. Flow checked well, well stable.
Develop-ment drilling
Cementing plug
Pull out cement string
Csg OD (inch)
Csg shoe TVD (m)
LOT eq MW (sg)
Well depth when kicked TVD (m)
Diameter pipe in BOP (inch)
Mud weight (sg)
Mud weight ECD (sg)
Kill mud weight (sg)
Kick size (BBL)
Kick med-ium
SIDPP (Bar)
SICP (Bar)
Killing method
Killing duration (days)
Comments
13,37 1284 1,52 3,5 1,4 1,43 Unknown
4 4 Circulat-ing
0,469 Small kick
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 86
8.2 KICK FREQUENCIES
By combining the kick information in Table 8.1 and the number of wells in Table 3.2, page 26,
kick frequencies have been established. Table 8.2 shows the kick frequencies.
Table 8.2 Kick frequencies in Norwegian wells spudded in 2016 and 2017
Operator No. of well
paths
No. of mother
wells
No. of BOP days
No of kicks
Kick frequencies
Per well path
Per mother well
Per 1000 BOP days
Development wells 137 95 3 930 2 0,015 0,021 0,509
Exploration wells 45 35 1 282 3 0,067 0,086 2,340
Total 182 130 5 212 5 0,027 0,038 0,959
8.3 COMPARISON OF THE KICK FREQUENCY VS. OTHER STATISTICS
Through a series of studies SINTEF and Exprosoft have established kick statistics from various
areas and periods. Below a brief description of the various datasets are given.
Canadian East Coast (1970 - 1993). These kick data originally stem from the Alberta Energy
and Utilities Board in Canada. A total of 55 kicks (included shallow kicks) were experienced
during drilling these 273 wells.
Canadian Beaufort wells deep (1973 - 1991). The kick data is based on a spreadsheet
extracted from the Canadian EUB and Downloaded Well files from Northwest Territories,
Geoscience Office (2007).
Norwegian offshore (1984 -1997). Most of the kick data was originally collected through a
Ph.D. work (/19/). The exploratory wells are typically drilled in water depths ranging from 50
to 400 meters. Most of the exploratory wells are drilled with semisubmersible rigs while the
development wells are mostly drilled from jackets or concrete structures.
US GoM OCS deepwater (1997 - 1998). This frequency is based on kick data collected by
SINTEF/Exprosoft in (/3/). Many of the US GoM deepwater wells are deep and HPHT wells.
US GoM OCS deepwater (2007 - 2009). This frequency is based on kick data collected by
Exprosoft in (/1/).
Kick data from the UK for the period 1999-2008 has been published (/14/). The UK drilling
activity can be found at the UK Oil and Gas Authority web page (/18/). By combining the UK
kick and well drilling information, overall kick frequencies were established.
Norwegian Offshore (2009 – 2014). The Petroleum Safety Authority (PSA) in Norway
published Norwegian kick statistics from the year 2000 in the project “Trends in risk level in
the petroleum activity (RNNP)” (/15/). The kick statistics was established when working with
the report (/16/) based on descriptions of the individual kicks provided by the PSA.
US GoM OCS (2011 - 2015). The kicks in this section have been identified from the verbal
description in the BSEE eWell WAR (Well Activity Reports) for wells spudded in the period
2011-2015 in US GoM OCS (/16/).
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 87
Table 8.3 shows an overview of all the kick frequencies.
Table 8.3 Kick frequencies per well drilled comparison
DATASET No. of kicks
No. of wells
Kick frequency per well drilled Shallow kick
included 5% conf
limit Estimate
95% conf limit
Canadian East Coast (1970 - 1993), Exploration wells (/12/) 55 273 0,159 0,201 0,252 Yes
US GoM OCS deepwater
Explorati-on wells
Well drilled 1997 - 1998 (/3/) 39 58 0,506 0,672 0,878
No
Wells drilled 2007 – 2009 (/1/) 74 206 0,293 0,359 0,436
TOTAL 113 264 0,364 0,428 0,500
Develop-ment wells
Well drilled 1997 - 1998 (/3/) 9 25 0,188 0,360 0,628
Wells drilled 2007 – 2009 (/1/) 7 53 0,062 0,132 0,248
TOTAL 16 78 0,129 0,205 0,312
Norwegian wells drilled 1984 -1997 (/13/)
Explorat-ion, Appraisal wells
Normal (Well depth < 4000m TVD) 15 121 0,076 0,124 0,191
No
Deep (Well depth > 4000m TVD, not incl. HPHT)
7 24 0,137 0,292 0,548
HPHT wells 4 5 0,273 0,800 1,831
Total 26 150 0,121 0,173 0,241
Explorat-ion, Wildcats
Normal (Well depth < 4000m TVD) 24 295 0,056 0,081 0,114
Deep (Well depth > 4000m TVD, not incl. HPHT)
29 87 0,238 0,333 0,454
HPHT wells 64 44 1,169 1,455 1,791
Total 117 426 0,234 0,275 0,320
TOTAL exploration 143 576 0,215 0,248 0,285
Development wells 272 1,478 0,166 0,184 0,203
Canadian Beaufort wells deep (1973 - 1991), Exploration wells, (/12/)
42 86 0,371 0,488 0,632 No
UK wells (1999-2008) (/14/)
Exploration wells 74 862 0,070 0,086 0,104 Yes
Development wells 218 3,082 0,063 0,071 0,079
Norwegian wells drilled 2009 -2014 (/16/)
Explorat-ion, Appraisal
Normal (Well depth < 4000m TVD) 1 94 0,001 0,011 0,050
No Explorat-ion, Wildcat
Normal (Well depth < 4000m TVD) 10 182 0,030 0,055 0,093
Deep (Well depth > 4000m TVD, not incl. HPHT)
7 41 0,080 0,171 0,321
HPHT wells 5 6 0,328 0,833 1,752
Total 22 229 0,065 0,096 0,137
TOTAL exploration 23 323 0,049 0,071 0,101
Development wells 50 875 0,045 0,057 0,072
US GoM OCS (2011 – 2015) (/16/)
Explorat-ion wells
Normal (Well depth < 4000m TVD) 32 85 0,274 0,376 0,506
Yes
Deep (Well depth > 4000m TVD 111 215 0,438 0,516 0,604
Total 143 300 0,413 0,477 0,548
Develop-ment wells
Normal (Well depth < 4000m TVD) 78 664 0,096 0,117 0,142
Deep (Well depth > 4000m TVD 44 157 0,215 0,280 0,360
Total 122 821 0,127 0,149 0,173
Norwegian wells drilled 2016 -2018 (this study)
Exploration wells 3 45 0,018 0,067 0,172
No Development wells 2 137 0,003 0,015 0,046
Total 5 182 0,011 0,027 0,058
All exploration well 596 2729 0,204 0,218 0,234 Yes and
no All development wells 602 5807 0,097 0,104 0,111
All wells and kicks 1198 8536 0,134 0,140 0,147
Figure 8.1 shows a graphical overview of the overall kick data from the various data sources
alongside the frequencies from the present study.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 88
Figure 8.1 Overview of kick frequencies
The frequency of kicks in the present study is lower than in all other studies. However, the
number of occurrences is low, and the statistical uncertainty is high. The kick frequency is in
the same order of magnitude as the kick frequency from the Norwegian wells drilled in 2009 -
2014 and the kick frequency from the UK wells drilled in 1999 to 2008. When comparing with
the Norwegian kick frequency from 1984 – 1987, it is significantly lower.
By comparing the US GoM OCS 2011–2015 kick frequency with the most recent statistics
from Norway and the UK, the kick frequency is significantly higher in the US GoM OCS. The
US GoM OCS kick frequency in the earlier studies are also significantly higher.
It is not known why the observed kick frequency in the US GoM OCS is so much higher than
the most recent data Norway. There may be several reasons, including:
1. Many US GoM wells are extremely deep and take a long time to drill. This increases
the probability of having a kick due to the increased exposure time.
2. US GoM OCS may be a more complicated area to drill due to different formations.
Narrow margin between pore pressure and fracture gradient constitutes a typical
problem that causes many kicks.
3. Some of the shallow water wells in the US GoM OCS may be drilled with less
advanced instrumentation.
4. There may be different requirements for drilling personnel qualifications in the US
GoM OCS as compared to Norway and the UK.
5. The well control policies with respect to mud weight and casing program may be
different.
For the three US GoM OCS datasets and the dataset from the present study also the number of
days in service has been recorded, and not only the number of wells drilled. Table 8.4 shows a
comparison of the kick frequency per BOP day in service.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 89
Table 8.4 Kick frequencies per BOP day comparison
* US GoM OCS (2011 – 2015) data includes time in service and kick from before the BOP was landed on the wellhead, likely
to give too low kick frequency compared to when using BOP days
It is observed that when measuring the kick frequency per BOP day in operation the 2016 –
2018 Norwegian kick frequency is much lower than any US kick frequency.
8.4 LEAK OFF PRESSURE VS. MAXIMUM MUD WEIGHT
The kick statistics shows that the kick frequencies in the US GoM OCS are higher than in
Norwegian waters. Some of the possible causes for this difference has briefly been mentioned
in the previous subsection.
In the deepwater BOP and kick study (/1/) information related to LOT (Leak Off Test) and FIT
(Formation Integrity Test) and mud weight (MW) was systematically collected for the various
casing sections. Further, the maximum mud weights used when drilling for the next casing
sections were identified. The same information was also collected in the present study. This
information was found for 518 casing sections in the US GoM OCS wells, and 228 casing
sections in the Norwegian wells. For the US GoM OCS wells there were 303 FITs, 201 LOTs,
and 14 unknown if FIT or LOT. For the Norwegian wells sections there were 189 FITs, 23
LOTs, and 16 XLOTs (Extended Leak Off Test). It should be noted that there are some
uncertainties related to the accuracy of these numbers. Table 8.5 shows and overview of the
data.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 90
Table 8.5 Max mud weight – LOT or FIT for well sections, both exploration and
development wells
FIT/LOT - max MW (sg)
Norway (2016 – 2018) US GoM OCS (2007 – 2009)
Percentage of sections
Cumulative Percentage of
sections Cumulative
<=0,05 8,8% 8,8% 20,3% 20,3%
0,05-0,1 13,6% 22,4% 35,5% 55,8%
0,1-0,15 21,5% 43,9% 23,2% 79,0%
0,15-0,2 23,2% 67,1% 12,9% 91,9%
0,2-0,3 12,7% 79,8% 5,8% 97,7%
0,3-0,4 11,0% 90,8% 2,3% 100,0%
>0,4 9,2% 100,0% 0,0%
As seen from Table 8.5, the margins between FIT/LOT and max MW is in overall lower in the
US GoM wells than in the Norwegian wells. In the US 55,8% of the well sections have a
difference between the FIT/LOT and max MW lower than 0,1 sg. In Norway, this applies for
22.4%.
The drilling margin is in average lower in the US wells than in the Norwegian wells, that will
cause an increased probability of kick.
Table 8.6 and Table 8.7 shows the same data as in Table 8.5, but now split up in exploration
and development wells.
Table 8.6 Max mud weight – LOT or FIT for well sections, exploration wells
FIT/LOT - max MW (sg)
Norway (2016 – 2018) US GoM OCS (2007 – 2009)
Percentage of sections
Cumulative Percentage of
sections Cumulative
<=0,05 10,8% 10,8% 19,0% 19,0%
0,05-0,1 20,0% 30,8% 35,2% 54,3%
0,1-0,15 18,5% 49,2% 24,3% 78,6%
0,15-0,2 23,1% 72,3% 13,6% 92,1%
0,2-0,3 13,8% 86,2% 6,9% 99,0%
0,3-0,4 7,7% 93,8% 1,0% 100,0%
>0,4 6,2% 100,0% 0,0%
Table 8.7 Max mud weight – LOT or FIT for well sections, development wells
FIT/LOT - max MW (sg)
Norway (2016 – 2018) US GoM OCS (2007 – 2009)
Percentage of sections
Cumulative Percentage of
sections Cumulative
<=0,05 8,4% 8,4% 27,2% 27,2%
0,05-0,1 11,7% 20,1% 39,1% 66,3%
0,1-0,15 24,0% 44,2% 19,6% 85,9%
0,15-0,2 24,7% 68,8% 10,9% 96,7%
0,2-0,3 13,0% 81,8% 1,1% 97,8%
0,3-0,4 13,0% 94,8% 2,2% 100,0%
>0,4 5,2% 100,0% 0,0%
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 91
The reason for this difference has not been investigated, but it seems reasonable to believe that
difference in geology may be one contributing cause for this, another may be differences in
well casing design.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 92
9. ABILITY TO CLOSE IN A KICK WITH THE BOP
9.1 INTRODUCTION
The primary barrier against blowouts during drilling is the hydrostatic pressure imposed by the
mud column. The BOP is a secondary barrier against blowouts alongside the casing, the
formation, the cement outside casing, etc. If the hydrostatic pressure from the mud column
becomes too low, a kick may occur. Then, if one of the secondary barriers fails a blowout may
result.
A fault tree models has been established, reflecting a typical BOP design used in the Norwegian
waters (as shown in Figure 3.1, page 24), to assess the probability of the BOP’s ability to close
in a well kick.
The reliability data used as input for the analyses are based on data collected during the various
BOP studies. Section 4.1, page 30, gives an overview of the various studies. The reliability data
from the data collection carried out during the present study has been given most weight.
With the blowout probability model, it is possible to better analyse how the various BOP system
assumptions and reliability data affect the total ability to close in kicks. The exact probability
of being able to close in a "normal" kick found from the analysis is not regarded as the important
parameter in the present study. The important aspect to focus is the relative differences between
the various cases analysed.
It is important to note that the model only considers kicks that may be confined by the BOP.
The following typical blowouts are not included in the model:
• Shallow gas blowouts (before the BOP is landed)
• Blowouts outside the casing
• Blowouts through the drill-pipe
• Underground blowouts
Fault tree analysis and symbols are briefly described in Annex B to this report. Several
textbooks related to fault tree construction and analyses exist, among them /10/. The CARA
FaultTree software has been used for constructing the fault tree.
9.2 PARAMETERS AFFECTING THE BOP’S ABILITY TO CLOSE IN A WELL
The subsea BOP stack is tested to verify that the BOP will be able to act as a well barrier in
case of a well kick. In general, it can be stated that the more frequently the BOP stack is tested,
the higher the availability of the BOP as a safety barrier will be. It is, however, important to
note that some parts of a BOP stack are not as important as other parts with respect to testing.
When pressure testing the BOP, both the ability to operate the BOP function and the ability to
seal off a pressure are tested. When function testing a BOP, only the ability to carry out the
function is tested, and not the ability to seal off a pressure.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 93
The effect of the component testing on the BOP’s total ability to close in a well kick depends
on:
- The BOP stack design/configuration
- The tubular that runs through the BOP
- The reliability of the various BOP functions and controls
- The test frequency of the BOP function (both function and pressure test)
9.3 OPERATIONAL ASSUMPTIONS
The BOP Stack Design
The fault tree analyses are based on the Example two BOP design shown in Figure 3.1, page
24. The BOP includes one annular and, three pipe rams, one blind shear ram, and one casing
shear ram. It is assumed that all the pipe rams in the BOP are variable pipe rams (VBR) that
can seal around the tubular running through the BOP. All ram preventers can be closed by the
acoustic system. The control system is assumed to be a multiplex control system.
BOP Unavailability Calculation
There are four basic event types used in the fault tree
− Test interval
− Repairable
− Non-repairable
− On demand
Test interval is used to describe components that are tested periodically with test interval t*. A
failure may occur anywhere in the test interval. The failure will, however, not be detected until
the test is carried out or the component is needed. This is a typical situation for many types of
detectors, process sensors, and safety valves. The probability qi (t) is in this situation often
referred to as the mean fractional dead-time (MFDT) unavailability. The reliability parameters
entered are the failure rate (expected number of failures per time unit), the test interval t*,
and the repair time τ . CARA FaultTree calculates the MFDT by the formula:
+2
t (t)q
*
i
Notice that this formula is only valid if we have independent testing of each component. If
components are tested simultaneously, or if we have staggered testing, this formula will not be
correct, and the results will be too optimistic.
Repairable is used for components that are repaired when a failure occurs. If the failure rate is
denoted and the mean time to repair (MTTR) is denoted , qi(t) may be calculated by the
formula:
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 94
)e-(1 +1
= (t)q)t+(1
-
i
Notice that by letting t tend to infinity, we obtain the well-known approximation:
MTTF+MTTR
MTTR = (t)q
i
where
1 = MTTF
The reliability parameters entered to the CARA FaultTree program are the failure rate
(expected number of failures per time unit) and the mean time to repair, MTTR.
Non-repairable is used to describe components where failures of single components will not
be detected unless there is a leak/blowout to sea. In this period, the components may be
considered as so-called non-repairable components. If the failure rate of the component is
denoted by , then:
e-1 = (t)q t-
i
Where qi (t) denotes the probability that item no. i is not functioning at time t. The reliability
parameter entered to fault tree analysis software is the failure rate (expected number of
failures per hour). The time is represented by t.
On demand is used for components that have a certain probability to fail when they are
required.
BOP Testing Assumption
The following BOP test strategies are followed:
On rig (stump)
The BOP is fully function and pressure tested on the rig (on stump), prior to running.
Installation test
After landing the BOP the wellhead connector is tested against a closed BS ram. The choke
and kill lines are pressure tested.
The blind-shear ram closed by the acoustic control.
Test after running casing or liner
The BOP is fully function and pressure tested. BSR is tested against casing
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 95
Tests schedules by time
The subsea BOP, except the BSR, is fully pressure tested every second week against a plug in
the wellhead. One ram is closed by the acoustic system.
The subsea BOP is function tested on one pod weekly (every second test is done when the BOP
is pressure tested. The acoustic control system is function tested in unarmed state.
Failure Input Data
The reliability data used as input for the analyses for the subsea BOP components are based on
data from the subsea BOP reliability studies and partly engineering judgement. Table 9.1 shows
the base case reliability data used.
Table 9.1 Reliability data used for fault tree analyses
Component name in fault
tree
Component type
Failures/-day or on demand
prob.
Test interval (days)
Description
Acouaccu Test interval 6,67E-05 14 Acoustic accumulators fails to supply pressure when demanded (sudden rupture)
AcouCom On demand 0,3330% Acoustic communication fails
AE Test interval 9,64E-06 14 Annular leaks to sea
ARBP Test interval 2,00E-04 7 Annular regulator fails, blue pod
ARYP Test interval 2,00E-04 7 Annular regulator fails, yellow pod
BSRE Test interval 3,62E-06 14 BSR leaks to sea
BSRFTC* Test interval 9,80E-06 7 BSR fail to close
BSRFTS On demand 10,0% BSR fails to shear pipe
BSRIL Test interval 6,86E-05 20 BSR internal leakage
CLA1 Test interval 4,11E-06 14 Leakage in clamp connection between w.head conn. and LPR
CLA2 Test interval 4,11E-06 14 Leakage in clamp connection between LPR and MPR
CLA3b Test interval 4,11E-06 14 Leakage in clamp connection between CSR and the BSR
CLA4 Test interval 4,11E-06 14 Leakage in clamp connection below annular
CLA4b Test interval 4,11E-06 14 Leakage in clamp connection above BSR
CLINE Test interval 5,31E-04 14 Choke line leaks to sea
CONSYSTEL On demand 0,0013% Failure to operate BOP from control system. Caused by an electronic or electric failure.
CONSYSTHYD On demand 0,0110% Failure to operate BOP from control system. Caused hydraulic problems that can not be isolated
CRE Test interval 3,62E-06 14 Casing Shear rams leaks to sea
CSRFTS* On demand 1,0000% Casing shear ram fails to shear pipe
ELBP Test interval 3,00E-04 7 Electric or electronic pod failure, blue pod
Electfail On demand 0,1000% Electric or electronic failure on subsea control module fails when demanded (battery, SEM, water intrusion)
ELYP Test interval 3,00E-04 7 Electric or electronic pod failure, yellow pod
EXCLBP Test interval 7,50E-05 7 External leakage in blue conduit line or associated equipment
EXCLYP Test interval 7,50E-05 7 External leakage in yellow conduit line or associated equipment
EXTCBP Test interval 3,00E-04 7 Hydraulic leak that ruins the blue pod control
EXTCYP Test interval 3,00E-04 7 Hydraulic leak that ruins the yellow pod control
IBE Test interval 3,74E-06 14 Inner Bleed valve leaks to sea
IBI Test interval 3,69E-05 14 The inner bleed valve leaks internally
KLINE Test interval 5,31E-04 14 Kill line leaks to sea
LICE Test interval 3,74E-06 14 Lower inner choke valve leaks to sea
LICM Test interval 3,69E-05 14 The LIC fail-safe valve leaks internally
LIKE Test interval 3,74E-06 14 Lower inner kill valve leaks to sea
LIKIL Test interval 3,69E-05 14 The LIK valve leaks internally
LMRPE Test interval 2,47E-05 14 External leakage in LMRP connector
LOCE Test interval 3,74E-06 14 Lower outer choke valve leaks to sea
LOCM Test interval 3,69E-05 14 The LOC fail-safe valve leaks internally
LOKE Test interval 3,74E-06 14 Lower outer kill valve leaks to sea
LOKIL Test interval 3,69E-05 14 The LOK fail-safe valve leaks internally
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 96
LPRA Test interval 3,62E-06 14 Leakage to sea in lower pipe ram
LPRFTC Test interval 9,80E-06 7 LPR fail to close
LPRIL Test interval 6,86E-05 14 LPR internal leakage
LRBPfunction Test interval 2,00E-05 7 LPR function fails on blue pod
LRSVLE Test interval 1,00E-05 7 Shuttle valve or line to LPR leaks external
LRYPfunction Test interval 2,00E-05 7 LPR function fails on yellow pod
MPRE Test interval 3,62E-06 14 MPR leaks to sea
MRBP Test interval 2,00E-04 7 Manifold regulator fails, blue pod
MRBPfunction Test interval 2,00E-05 7 MPR function fails on blue pod
MRPFTC Test interval 9,80E-06 7 MPR fail to close
MRPIL Test interval 6,86E-05 14 MPR internal leakage
MRSVLE Test interval 1,00E-05 7 Shuttle valve or line to MPR leaks external
MRYP Test interval 2,00E-04 7 Manifold regulator fails, yellow pod
MRYPfunction Test interval 2,00E-05 7 MPR function fails on yellow pod
OBE Test interval 3,74E-06 14 Outer bleed valve leaks to sea
OBI Test interval 3,69E-05 14 The outer bleed valve leaks internally
PVA1 Test interval 1,00E-04 14 Pilot valve fails acoustic system
PVA2 Test interval 1,00E-04 14 Pilot valve fails acoustic system
PVA3 Test interval 1,00E-04 14 Pilot valve fails acoustic system
PVA4 Test interval 1,00E-04 14 Pilot valve fails acoustic system BSR close
PVSSBP Test interval 5,00E-06 7 Failed to open blue pod mounted pilot valve for blue pod
PVSSYP Test interval 5,00E-06 7 Failed to open yellow pod mounted pilot valve for yellow pod
PVTSBP Test interval 3,00E-06 7 Failed to open surface pilot valve for blue conduit line
PVTSYP Test interval 3,00E-06 7 Failed to open surface pilot valve for yellow conduit line
SEMABP Test interval 9,09E-05 7 SEM A blue pod fails
SEMAYP Test interval 9,09E-05 7 SEM A yellow pod fails
SEMBBP Test interval 9,09E-05 7 SEM B blue pod fails
SEMBYP Test interval 9,09E-05 7 SEM B yellow pod
SHVA Test interval 1,00E-04 14 Shuttle valve for acoustic/hyd.controlsystem stuck.
SHVA2 Test interval 1,00E-04 14 Shuttle valve for acoustic/hyd.controlsystem stuck.
SHVA3 Test interval 1,00E-04 14 Shuttle valve for acoustic/hyd.controlsystem stuck.
SHVA4 Test interval 1,00E-04 14 Shuttle valve for acoustic/hyd.controlsystem stuck. BSR close function
SRBPfunction Test interval 2,00E-05 7 BSR function fails on blue pod
SRSVLE Test interval 1,00E-05 7 Shuttle valve or line to BSR leaks external
SRYPfunction Test interval 2,00E-05 7 BSR function fails on yellow pod
SV1 Test interval 1,00E-04 14 Solenoid valve fails acoustic system
SV2 Test interval 1,00E-04 14 Solenoid valve fails acoustic system
SV3 Test interval 1,00E-04 14 Solenoid valve fails acoustic system
SV4 Test interval 1,00E-04 14 Solenoid valve fails acoustic system BSR Close
UABPfunction Test interval 2,00E-05 7 Annular preventer function fails on blue pod
UAPFTC Test interval 2,78E-05 7 Annular preventer fail to close
UAPIL Test interval 1,98E-04 14 Annular internal leakage
UASVLE Test interval 1,00E-05 7 Shuttle valve or line to annular preventer leaks external
UAYPfunction Test interval 2,00E-05 7 Annular preventer function fails on yellow pod
UICE Test interval 3,74E-06 14 Inner bleed off valve leaks to sea
UICIL Test interval 3,69E-05 14 The UIC valve leaks internally
UIKE Test interval 3,74E-06 14 Upper inner kill valve leaks to sea
UIKIL Test interval 3,69E-05 14 The UIK valve leaks internally
UOCE Test interval 3,74E-06 14 Upper outer choke valve leaks to sea
UOCIL Test interval 3,69E-05 14 The UOC valve leaks internally
UOKE Test interval 3,74E-06 14 Upper outer kill valve leaks to sea
UOKIL Test interval 3,69E-05 14 The UOK fail-safe valve leaks internally
UPRE Test interval 3,62E-06 14 UPR leaks to sea
URBPfunction Test interval 2,00E-05 7 UPR function fails on blue pod
URPFTC Test interval 9,80E-06 7 UPR fail to close
URPIL Test interval 6,86E-05 14 UPR internal leakage
URSVLE Test interval 1,00E-05 7 Shuttle valve or line to UPR leaks external
URYPfunction Test interval 2,00E-05 7 UPR function fails on yellow pod
WHCA Test interval 2,47E-05 14 Leakage in BOP wellhead connector
* It is assumed that the CSR will always be closed prior to the BSR in the BOP in an emergency. It is assumed that the pipe cut probability for the CSR is 99%. It is further assumed that when cut, the pipe will be lifted by the compensating system so no drill-pipe obstructing the BSR from closing on an empty hole. If the CSR fails to cut the pipe it is a 90% probability that the BSR will cut the pipe.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 97
Initial Situation
The situation when the well kicks and the response of the BOP is required is as follows:
• There are no known failures in the subsea BOP stack or the control system
• The subsea BOP is tested according to Section 9.3.4
• Hard shut in, i.e., an annular preventer will be closed without opening the choke line first
Repair Strategies
For the purpose of the calculations presented, it has been assumed that whenever a subsea BOP
failure is observed, the failure is repaired before the operation continues.
From the subsea BOP reliability studies, it has been observed from time to time that the
operators select not to repair a failure immediately but postpone the repair. This decision is
typically based on a total evaluation of the failure and the ongoing operations. Typically, these
postponed repairs are only for situations where there are redundant components in the stack,
and/or the well was nearly completed. This will to some extent reduce the BOP safety
availability.
Failure Observation
Some of the failures in a subsea BOP will be observed during testing and others will be
observed when they occur. In the calculations it has been assumed that most failures that occur
are observed during tests only. This is not correct, because some of the failures are observed
during normal operations as well. Failures observed during normal operations are typically
failures observed because the BOP is operated for other reasons than testing, and that
pressurized control system equipment starts to leak.
The effect of this assumption is that the results will be conservative.
Other Assumptions
The model only considers the probability of a successful control of the initial kick situation.
This is a non-conservative assumption.
Another simplification, that adds conservatism to the result, is that when a kick occurs when
there is no drill-pipe in the well, only blind-shear rams can be used for sealing off the kick.
The annular is assumed not to be able to close on an empty wellbore. The BOP manufacturers
claim that an annular can be used for closing on a wellbore. During all the SINTEF/Exprosoft
BOP reliability studies (experience from around 1000 wells) it has not been observed that
they have tested this function, so the success probability of such an operation is unknown.
It is assumed that the well kicks are observed in reasonable time so normal well control
procedures can be initiated. (BOPs are not designed to close in flowing wells).
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 98
9.4 BLOWOUT PROBABILITY, BASE CASE
The analyses in this subsection relates to incidents where the BOP can be used to control a
"normal" well kick.
The blowout probability estimates presented in this chapter should be used with care. The
important aspect to focus is the relative differences between the various cases analysed.
Annex 2 presents the BOP fault tree used for the calculation. The BOP reliability data shown
in Table 9.1 have been fed into the fault tree model.
Probability of not Being Able to Close in a Well Kick
Table 9.2 shows the estimated probability of being able to close in a kick. Two situations have
been analysed;
• Drillpipe running through the subsea BOP (normal kick situation)
• Empty hole
Table 9.2 Blowout probability assuming a kick has occurred
Leak type
Probability of failing to close in a kick (%)
No. of kicks per blowout
Drill pipe in BOP
External leak to sea from BOP 0,02532% 3 950
Leak through BOP annulus 0,00006% 1 635 000
Total 0,02538% 3 940
Empty Hole
External leak to sea from BOP 0,04911% 2 036
Leak through BOP annulus 0,17550% 570
Total 0,22452% 445
The results in Table 9.2 show the largest contributor to the total ability to close in a normal kick
will be external leaks in the BOP. This is because there is no back-up for this type of leaks
below the LPR. The probability of an external leak in the subsea wellhead connector, the LPR,
the lower inner kill, and the flange between the wellhead connector and the LPR will totally
dominate this probability. All other potential external leak paths are backed up with other
preventers.
The results underline the importance of pressure testing the subsea BOP with respect to external
leaks, especially the lower parts of the BOP.
A leak through the annulus and the riser is a very unlikely outcome when there is a drill-pipe
running through the BOP. In principle, five preventers may seal off the well, and each of the
preventers can be controlled by three “independent” control systems.
Kick experiences from drilling with subsea BOPs (/1/ and /3/) show that approximately 4% of
the kicks occur when the drill-pipe is out of the hole. The results in Table 9.2 show that the
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 99
probability of a blowout is much higher for an empty hole situation than when a drill-pipe is
running through the BOP. The reason is that only one preventer, the BSR, can seal off the well.
If the BSR leaks there will be a blowout. In addition, also the probability of an external leak
that cannot be controlled increases, because the potential leakage paths below the BSR are now
exposed.
When comparing these results with the results in /1/, it is observed that the probability of a
blowout when assuming a kick has occurred, has significantly decreased. This is partly caused
by an improvement in BOP reliability over the years, and that in Norway an acoustic back
control system is used. An acoustic system is not required in the US OCS, and therefore not
used. In the US they rely on emergency systems as deadman/autoshear and EDS systems as
backup systems. The effect of these systems are not included in the reliability model. Such
systems are normally used when a well control situation cannot be handled by normal methods.
These systems may be tested before running the BOP or after the initial landing of the BOP,
and not during the tests after running casing or the periodic tests.
Probability of a Blowout per Time Unit
When including the kick frequency in the equation, the blowout probability per well, or per
BOP day in service, can be established.
Table 9.3 shows the estimated blowout probability, when combining the results from Table 9.2
with the experienced kick frequency in Norwegian waters (from Table 8.2, page 86).
Table 9.3 Blowout frequency/mean time between blowouts estimate
Frequency measure Blowout frequencies Mean time between blowout
Exploration Development Total Exploration Development Total
Per 1000 BOP days 0,0780% 0,0170% 0,0320% 1 282* 5 893* 3 126*
Per mother well 0,0029% 0,0007% 0,0013% 34 987 142 448 77 971
Per well path 0,0022% 0,0005% 0,0009% 44 983 205 424 109 160
*1000 BOP days
When comparing the results in in Table 9.3 with the results in /1/, it is observed that the blowout
probability in Norway is approximately only in the area of 10% of the US GoM 2007-2009
deepwater operations. The reason for this is the improved BOP as discussed in Section 9.4.1,
and the lower kick frequency as discussed in Section 8.3.
Discussion
The results assume that the BOP has been tested according to Table 9.1, page 95. When looking
at Table 7.1, page 79, there is a test category Other tests as well. Many of these other tests are
tests of plugs, packers, casings, and seal assemblies. These tests are typically carried out against
a closed ram preventer, and may also reveal leakages in the lower part of the BOP stack. These
type of tests are not included in the fault tree model. If including these tests in the model, the
leak blowout probability would become lower.
During the present study, many leakages in the choke and kill lines have been observed. These
failures have insignificant effect on the results of the fault tree analyses, because only the initial
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 100
closing of the BOP has been evaluated. When a kick is to be circulated out, a leaking choke or
kill line close to the sea surface or above will be critical.
The analyses assume that there are no parts of the control system that may fail and ruin both
the yellow pod, the blue pod, and the acoustic back-up system. This might be the case for some
BOPs, but such failures have not been observed in any of the BOP reliability studies.
And, as stated earlier, it is assumed that the well kicks are observed in reasonable time such
that normal well control procedures can be initiated. The BOPs are not designed to close in
flowing wells.
9.5 BOP TEST STRATEGIES AND BLOWOUT PROBABILITIES
The BOP stack is tested to verify that the BOP will be able to act as a well barrier in case of a
well kick.
In general, it can be stated that the more frequently the BOP stack is tested, the higher the
BOP’s ability to close in a well kick will be. It is, however, important to note that some parts
of a BOP stack are not as important as other parts with respect to testing.
When pressure testing the BOP both the ability to carry out the function and the ability to seal
off a pressure are tested. When function testing a BOP only the ability to carry out the function
is tested and not the ability to close in a pressure.
The effect of the component testing on the BOP’s total ability to close in a well kick depends
on:
- The BOP stack design/configuration
- The drill-pipe or tubular that runs through the BOP
- The reliability of the various BOP functions
- The test frequency of the BOP function (both function and pressure test)
Testing of the BOP is utmost important to verify that the BOP is operative, but the testing
takes time, and is therefore costly (Section 7.2, page 78).
As documented in Section 9.4, page 98, when a drill-pipe is running through the subsea BOP
the most likely blowout flow path is in the lower part of the BOP. A blowout through the
BOP during drilling with a drill-pipe running through the BOP is very unlikely, if the kick is
observed in due time, and the BOP is commanded to close.
Table 9.4 shows an alternative BOP test strategy alongside the base case BOP strategy.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 101
Table 9.4 Subsea BOP test strategies
Base case test Test alternative 1
On rig (stump)
The BOP is fully function and pressure tested on the rig (on stump), prior to running.
As base case
Installation test
After landing the BOP the wellhead connector is tested against a closed BS ram. The choke and kill valves are pressure tested. The blind-shear ram closed by the acoustic control.
As base case
Test after running casing or liner
The BOP is fully function and pressure tested. BSR is tested against casing. The choke and kill valves are pressure tested.
BOP is fully function tested. BSR is tested against seal assembly running tool (alternatively a plug in the wellhead or casing). The choke and kill lines are pressure tested
Function test scheduled by time (weekly)
The BOP is function tested on one pod weekly (every second test is done when the BOP is pressure tested. The acoustic control system is function tested in unarmed state.
As base case
Pressure test scheduled by time (14 days)
The BOP, except the BSR, is fully pressure tested every second week against a plug in the wellhead. The choke and kill valves are pressure tested. One ram is closed by the acoustic system.
The BOP is fully function tested. The wellhead connector is pressure tested against UPR (alternatively BSR) and a well head test plug (alternative plug in casing). The choke and kill lines are pressure tested
Pressure test scheduled by time (50 days)
none
The BOP, except the BSR, is fully pressure tested 50 days against a plug in the wellhead. The choke and kill valves are pressure tested. One ram is closed by the acoustic system.
The reason for selecting 50 days is to ensure that a full BOP test is carried out from time to
time for wells with long duration, and for fields where the BOP is moved from well to well
without being brought to surface. In many cases the well will be finished before 50 days have
elapsed.
The main difference between the two test strategies is that test alternative 1 does not include a
detailed test of all preventer elements for the Test after running casing or liner and the Pressure
test scheduled by time (14 days). This is a test strategy that will reduce the total test time.
The results from the Test alternative 1 calculations are shown in Table 9.5 alongside the Base
case calculations.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 102
Table 9.5 Blowout probability assuming a kick has occurred, base case vs. alternative
test strategy
Pipe in BOP
Leak type
Base case Test alternative 1
Probability of failing to close in
a kick (%)
No. of kicks per blowout
Probability of failing to close in a
kick (%)
No. of kicks per blowout
Drill pipe in BOP, all VBRs can seal
External leak to sea from BOP 0,02532% 3 950 0,02533% 3 949
Leak through BOP annulus 0,00006% 1 635 000 0,00006% 1 637 331
Total 0,02538% 3 940 0,02539% 3 939
Empty hole
External leak to sea from BOP 0,04911% 2 036 0,04912% 2 036
Leak through BOP annulus 0,17550% 570 0,17550% 570
Total 0,22452% 445 0,22453% 445
The results for the two alternatives are nearly identical, that means that the detailed testing of
the preventers have no effect on the safety availability for the above two test strategies. The
reason for this is the redundancy in the BOP stack with respect to flow through the BOP when
there is a drill-pipe in the BOP. It is assumed that all pipe rams have VBR packer and can all
close around the normal drill-pipe.
From time to time it may be necessary to run smaller strings in the well with a diameter that
only one of the VBRs can seal around. For such a situation the difference in safety availability
between the Base case and Test alternative 1 is 0,1%, i.e. also insignificant.
The most important test of the BOP is pressurizing the BOP to reveal leaks to the surroundings,
especially in the lower part of the BOP.
In the US some drilling rigs have replaced the lower pipe ram with a test ram. A test ram is an
inverted pipe ram that are used for testing the BOP. This eliminates the need for running a BOP
test plug in the wellhead, and thereby saves rig time. The test ram will, however, represent
additional potential leakage paths to the sea in the lower part of the BOP stack that cannot be
isolated by a ram preventer. The test alternative 1 will, however, still give the same results as
the Base case test strategy. As long as there are two pipe rams and one annular that can be used
for sealing around normal drillpipe the Base case and Test alternative 1 will give more or less
identical results.
A test alternative 2, that prolongs the time between the BOP pressure tests from 14 days to 21
days, was also analysed. This test strategy increases the risk for not being able to close in a
“normal” well kick with approximately 40%. The reason is the prolonged time between
pressure tests of the lower part of the BOP, including the wellhead connector, that reveals
external leaks.
9.6 BOP TEST STRATEGIES AND BOP TEST TIME SAVINGS
The BOP test time consumption is discussed in Section 7.2, page 78. Some of the tests after
running the casing were partly tests (Table 7.3, page 81), similar to the test after running casing
and the periodic pressure test proposed in Test alternative 1 (Table 9.4). As seen from Table
7.3, the partly tests reduce the BOP test time.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 103
It is reasonable to assume that Test alternative 1 will reduce the test after running casing and
liner and the periodic pressure test with in the order of magnitude three hours per test.
Based on the number of tests and the BOP days in service in Table 7.2, page 80, the average
savings in BOP test time will then be 0,2 hours per BOP day (or 3 days per year) compared to
the Base case test alternative.
9.7 GUIDANCE FOR ACCEPTING SUBSEA BOP FAILURES OR NOT
When a failure in a BOP occurs the BOP’s ability to act as a safety barrier will be influenced.
Some failures have a large influence on safety availability whereas others have a limited or
insignificant influence on the safety availability.
A series of various failures have been introduced in the BOP fault tree model to quantify the
effect on the safety availability.
It is assumed that 4% of all kicks are empty hole kicks, while 96% are kicks with a normal
drill-pipe through the BOP.
The BOP design used assumed is Example two in Figure 3.1, page 24.
The results from the analyses are shown in Table 9.6.
Table 9.6 Effect of various BOP failures on the ability to close in a kick with subsea
BOP (Alternative 2 BOP in Figure 3.1, page 24)
Type of known failure in the BOP Probability of failing to close
in a kick Risk increase
No known failure in the BOP (base case, from Table 9.2, page 98 0,033% -
One pod is pulled for repair 0,034% 3,2%
The acoustic system has failed 0,046% 38,1%
One pod is pulled for repair and the acoustic system has failed 0,258% 674,5%
Lower inner kill valve leaks in closed position 0,036% 8,1%
Lower outer kill valve leaks in closed position 0,033% 0,3%
Lower inner choke valve leaks in closed position 0,033% 0,3%
Annular is leaking in closed position or has failed to close 0,033% 0,0%
Blind-shear ram is leaking in closed position or has failed to close 4,024% 11 969,0%
Upper pipe ram (UPR) is leaking in closed position or has failed to close 0,033% 0,0%
Middle pipe ram (MPR) is leaking in closed position or has failed to close 0,033% 0,0%
MPR and UPR is leaking in closed position or has failed to close 0,033% 0,0%
Lower pipe ram (LPR) is leaking in closed position or has failed to close 0,038% 14,8%
LPR and UPR is leaking in closed position or has failed to close 0,038% 14,8%
LPR and MPR is leaking in closed position or has failed to close 0,046% 37,9%
One pilot valve for lower pipe ram failed, or similar 0,033% 0,0%
One pilot valve for blind-shear ram failed, or similar 0,033% 0,0%
Manifold regulator one pod fails to supply pressure 0,033% 0,0%
Annular regulator one pod fails to supply pressure 0,033% 0,0%
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 104
As seen from Table 9.6 many failures in BOP components have an insignificant effect on the
BOP safety availability, and to continue the operations until the well is abandoned would be
the best choice. The results should, however, be combined with the engineering judgment
related to the specific situation and operations to be carried out.
External leakages in the BOP stack or the choke and kill line should always be repaired if
occurring.
If one pod is pulled for repair, the probability of not being able to close in a kick is
approximately three percent higher. This low increase is caused by the added redundancy the
acoustic back-up control system gives. This will only apply for areas where the acoustic back-
up system is mandatory, as in Norway.
It is observed that the relative increase in risk will be higher if the acoustic back-up system is
failing than if a pod is out of service. This is because the fault tree model assumes the acoustic
back-up system is independent of the main control system, while the yellow and blue pod have
some common parts that may jeopardize both the blue and yellow pod. There may be variations
among the various BOP stack control systems related to common cause failures.
If the lower inner kill valve is known to be leaking this will expose the leakage path external
leakage in the lower outer kill valve.
Further, the combination of an internal leak in the lower outer kill valve and leakage in the kill
line will also be more likely. It should be noted that from time to time the kill or choke valves
fail simultaneously. This has not been observed in the present study, but in earlier BOP studies.
The lower inner kill valve is the most critical choke and kill valve with respect to internal
leakage, because it is the lower-most valve.
If the lower inner choke valve leaks internally, the effect on the safety availability will be much
less than if the lower inner kill valve leaks. This because the valve is backed up by the LPR.
The BOP analysed (Figure 3.1, page 24, Example two) included one annular preventer. Many
BOPs have two annular preventers. Even with one annular preventer the analyses show that if
it is leaking it will have little effect on the ability to close in a kick. It is, however, important to
note that the annular is used for other purposes as well.
If the blind-shear ram is leaking this will have a large effect on the BOP safety availability. The
main reason for this effect is that 4% of the kicks are empty hole kicks. With one blind shear
ram only, there will be no preventers that can close in the well.
A leakage in the UPR or the MPR will have an insignificant effect on the risk. It should be
noticed that the analyses assume that all rams have VBRs that can all close around the drill-
pipe. If there are rams equipped with rams for specific purposes this will change the picture.
Also, a leak in both the UPR and MPR at the same time will have an insignificant impact
because the LPR will back-up these leaks.
A leak in both the LPR and the MPR will increase the risk because more potential external leak
paths in the lower part of the BOP will be exposed.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 105
A failed pilot valve for any of the preventers, even the blind-shear ram will have an insignificant
effect on the risk. The result for the blind shear ram will only be valid for areas where the
acoustic back-up system is mandatory, as in Norway.
A failed annular regulator or manifold regulator of one pod has an insignificant effect on the
risk.
NOTE: The results must be combined with an evaluation of the present situation. The above
information should only be regarded as guidance. The guidance mainly considers single
failures. If one failure is present and a second different failure in the BOP occurs, the combined
effect of these two failures should at first be thoroughly investigated.
9.8 DISCUSSION
The results of this study show that the subsea BOP testing requirements are more
comprehensive than needed. The detailed pressure testing of the individual preventers can in
many cases be omitted. This detailed testing has no significant effect on the BOP’s ability to
act as a well barrier. The main reason for this is the built-in redundancy of the subsea BOP.
The most important tests are the tests that reveal an external leakage in the lower part of the
BOP and ensures that the control systems are functioning. By simplifying the BOP test
requirements, hours of rig time may be saved in each test.
Further, due to the redundancy in the BOP stack, failures of single BOP functions, or even a
combination of BOP functions, will in many cases have an insignificant effect on the subsea
BOP’s ability to act as a well barrier in case the well kicks. When these failures occur, the best
choice is in many cases to continue the operations until the BOP is pulled for other reason,
rather than plugging the well and pulling the BOP. Such decisions should, however, also be
based on a risk evaluation and engineering judgment related to the specific situation and
operations to be carried out.
The study is performed with “normal” operational situations in mind. If specific operations
shall be carried out that reduces the BOP barrier availability, specific testing or repair should
be evaluated before starting such operations.
The proposed test strategy will not have any effect on the BOP emergency features, as
emergency disconnect system (EDS), automated mode function (AMF/Deadman), auto shear,
and ROV functions. The requirements for verification of these systems remain unchanged.
It is important that all kicks are observed early, such that the BOP can be closed before the well
flow becomes too high. BOPs are not designed to close against flow. Many blowouts have
occurred because the kick was not detected early enough, and the BOP failed to close (/16/).
The simplified BOP testing will not have any effect on this.
If we look at the failures observed in this study in the safety-critical period, and assume that
the test strategy Test alternative 1 had been followed instead of the Base case (Table 9.4, page
101), only one annular preventer leakage, and maybe a leak in a choke kill valve would have
been observed delayed. The delayed observation of these failures would not have any
significant effect on the BOP safety availability. All the other failures occurring in the safety-
critical period would have been observed at the same time for the two test strategies.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 106
REFERENCES
1. Holand, P., Awan H.: "Reliability of Deepwater Subsea BOP Systems and Well Kicks”.
Exprosoft Report ES201252, Trondheim, Norway, 2012
2. Holand, P.: "Reliability of Subsea BOP Systems for Deepwater Application, Phase II
DW" SINTEF Report STF38 A99426 (Unrestricted version).
3. Holand, P.: "Deepwater Kicks and BOP Performance" SINTEF Report STF38
AA01419, (Unrestricted version)
4. Holand, P., Reliability of Subsea BOP Systems for Deepwater Application, SINTEF
Report STF38 F97417, Trondheim, Norway, 1997. (Restricted)
5. Holand, P., Reliability of Subsea BOP Systems, Fault Tree Analysis, SINTEF Report
STF38 F97425, Trondheim, Norway, 1997. (Restricted)
6. Holand, P., Subsea BOP Systems, Reliability and Testing Phase V, revision 1 (this
revision 1 is based on a report with the same title published in 1990), SINTEF report
STF 75 A89054, Trondheim, Norway, 1995.
7. Holand, P.: "Reliability of Subsea BOP Systems – Phase IV". SINTEF Report STF75
F87007, Trondheim, Norway, 1987. (Restricted)
8. Holand, P.: "Reliability of Subsea BOP Systems - Phase III. Main Report". SINTEF
Report STF75 F86004 (Restricted).
9. M. Rausand, P. Holand, R. Husebye, S. Lydersen, E. Molnes, T. Ulleberg: "Reliability
of Subsea BOP Systems - Phase II, Main Report". STF18 F84515, 1985.
10. Rausand, M. and Høyland, A., System Reliability Theory; Models and Statistical
Methods, Second Edition, Wiley, Hoboken NJ, USA, 2004.
11. Norsok D-010 Well integrity in drilling and well operations (Rev. 4, June 2013)
12. Holand, P. “Analysis of Blowout Causes based on the SINTEF Offshore Blowout
Database” ExproSoft Report no.: 1611197/1 (Restricted)
13. Andersen L. B. (Alliance Technology) Holand, P. (SINTEF) Wicklund, J. Scandpower:
“Estimation of Blowout Probability for HPHT Wells”. SINTEF Report STF38 F98420.
(Restricted).
14. James Donald Dobson (HSE), “Kicks in Offshore UK Wells - Where Are They
Happening, And Why? “SPE-119942-MS, SPE/IADC Drilling Conference and
Exhibition, 17-19 March, Amsterdam, The Netherlands, 2009
15. Trends in risk level in the petroleum activity (RNNP), Petroleum Safety Authority
Norway (https://www.ptil.no/en/technical-competence/rnnp/)
16. Holand, P.: "Loss of Well Control Occurrence and Size Estimators”. Exprosoft Report
ES201471/2, Trondheim, Norway, 2017
17. SINTEF Offshore Blowout Database, https://www.sintef.no/en/projects/sintef-
offshore-blowout-database/
18. UK wells drilled https://www.gov.uk/guidance/oil-and-gas-wells.
19. Lasse Berg Andersen “Stochastic Modelling for the Analysis of Blowout Risk in
Exploration Drilling”, PhD Thesis, Robert Gordon University, Aberdeen, UK, 1995
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 107
ANNEX A BOP TESTING REQUIREMENTS IN NORWAY (/11/)
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 108
ANNEX B SUBSEA BOP FAULT TREE
Fault Tree Construction
Fault Tree Symbols A fault tree is a logic diagram that displays the connections between a potential system failure
(TOP event) and the causes for this event. The causes (basic events) may be environmental
conditions, human errors, normal events and component failures. The graphical symbols used
to illustrate these connections are called "logic gates". The output from a logic gate is deter-
mined by the input events.
The graphical layout of the fault tree symbols is dependent on what standard we choose to
follow. Table B.1 shows the most commonly used fault tree symbols together with a brief
description of their interpretation.
Table B.1 Fault tree symbols
Symbol Description
Logic
Gates
"OR" gate
The OR-gate indicates that the output event A occurs
if any of the input events Ei occurs.
"AND" gate
The AND-gate indicates that the output event A
occurs only when all the input events Ei occur simul-
taneously.
Input
Events
"BASIC" event
The Basic event represents a basic equipment fault or
failure that requires no further development into more
basic faults or failures.
"HOUSE" event
The House event represents a condition or an event,
which is TRUE (ON) or FALSE (OFF) (not true).
"UNDEVEL-
OPED" event
The Undeveloped event represents a fault event that is
not examined further because information is unavail-
able or because its consequence is insignificant.
Descrip-
tion
of State
"COMMENT"
rectangle
The Comment rectangle is for supplementary infor-
mation.
Transfer
Symbols
"TRANSFER"
out
"TRANSFER" in
The Transfer out symbol indicates that the fault tree is
developed further at the occurrence of the corre-
sponding Transfer in symbol.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 109
The logic events the basic events and the transfer symbol are the fault tree symbols mainly used
in the Fault Trees constructed and analysed in this report. Fault Tree construction and analyses
are described in many textbooks, among them /10/.
The CARA FaultTree (www.exprosoft.com) has been used for constructing and analysing the
fault trees.
BOP Fault Tree The fault tree utilized for the analyses are presented on the following pages. The fault tree is
based on example two BOP in Figure 3.1, page 24.
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 110
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
Blowout, given akick, while thedril lstring isrunning through theBOP.
HOVE
Subsea blowout
Blowout to the seavia the main BOPstack, the chokeline, or the kill l ine
P10
Blowout throughannulus
Annulus blowout
Local failure inUpper Pipe Ram orassociated controlsystem equipment
P4
Local failure inMiddle Pipe Ramor associatedcontrol systemequipment
P3
Local failure inLower Pipe Ram orassociated controlsystem equipment
P2
Local failure inAnnular orassociated controlsystem equipment
P6
Local failure inBlind Shear Ram orassociated controlsystem equipment
P5
BOP mux Example two BOP OK Nytt navn.CFTPagename: P1
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 111
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P2
Local failure inLOWER PIPE RAMpreventer orassociated controlsystem equipment
LRPilot 1
LPR internalleakage
Lambda=6,9e-005Test intervall=14
LPRIL
LPR fail to c lose
Lambda=9,8e-006Test intervall=7
LPRFTC
Both blue pod,yellow pod andacoustic systemfail to activatefunction
LRBAYP
Can not activatefunction by theblue pod
LROr 4
Major blue podfailure
P8
Manifold regulatorfails, blue pod
Lambda=0,0002Test intervall=7
MRBP
LPR function failson blue pod
Lambda=2e-005Test intervall=7
LRBPfunction
Can not activatefunction by theyellow pod
LROr 3
Major yellow podfailure
P9
Manifold regulatorfails, yellow pod
Lambda=0,0002Test intervall=7
MRYP
LPR function failson yellow pod
Lambda=2e-005Test intervall=7
LRYPfunction
Can not activatefunction byacoustic system
LAC1
Pilot valve failsacoustic system
Lambda=0,0001Test intervall=14
PVA1
Solenoid valvefails acousticsystem
Lambda=0,0001Test intervall=14
SV1
Shuttle valve foracoustic/hyd.controlsystemstuck.
Lambda=0,0001Test intervall=14
SHVA
The BOP can notbe controlled byAcoustic system
P13
Shuttle valve orline to LPR leaksexternal
Lambda=1e-005Test intervall=7
LRSVLE
Major failure inboth blue andyellow pod and theacoustic system
TOTCONT
Failure that ruinsboth yellow andblue pod
P7
The BOP can notbe controlled byAcoustic system
P13
BOP mux Example two BOP OK Nytt navn.CFTPagename: P2
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 112
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P3
Local failure inMIDDLE RAM orassociated controlsystem equipment
MRPilot 1
MPR internalleakage
Lambda=6,9e-005Test intervall=14
MRPIL
MPR fail to c lose
Lambda=9,8e-006Test intervall=7
MRPFTC
Both blue pod,yellow pod andacoustic systemfail to activatefunction
MRBAYP
Can not activatefunction by theyellow pod
MROr 3
Major yellow podfailure
P9
Manifold regulatorfails, yellow pod
Lambda=0,0002Test intervall=7
MRYP
MPR function failson yellow pod
Lambda=2e-005Test intervall=7
MRYPfunction
Can not activatefunction by theblue pod
MROr 4
Major blue podfailure
P8
Manifold regulatorfails, blue pod
Lambda=0,0002Test intervall=7
MRBP
MPR function failson blue pod
Lambda=2e-005Test intervall=7
MRBPfunction
Can not activatefunction byacoustic system
LAC2
Pilot valve failsacoustic system
Lambda=0,0001Test intervall=14
PVA2
Solenoid valvefails acousticsystem
Lambda=0,0001Test intervall=14
SV2
Shuttle valve foracoustic/hyd.controlsystemstuck.
Lambda=0,0001Test intervall=14
SHVA2
The BOP can notbe controlled byAcoustic system
P13
Shuttle valve orline to MPR leaksexternal
Lambda=1e-005Test intervall=7
MRSVLE
Major failure inboth blue andyellow pod and theacoustic system
TOTCONT
Failure that ruinsboth yellow andblue pod
P7
The BOP can notbe controlled byAcoustic system
P13
BOP mux Example two BOP OK Nytt navn.CFTPagename: P3
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 113
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P4
Local failure inUPPER RAMpreventer orassociated controlsystem equipment
URPilot 1
UPR internalleakage
Lambda=6,9e-005Test intervall=14
URPIL
UPR fail to c lose
Lambda=9,8e-006Test intervall=7
URPFTC
Both blue pod,yellow pod andacoustic systemfail to activatefunction
URBAYP
Can not activatefunction by theyellow pod
UROr 3
Major yellow podfailure
P9
Manifold regulatorfails, yellow pod
Lambda=0,0002Test intervall=7
MRYP
UPR function failson yellow pod
Lambda=2e-005Test intervall=7
URYPfunction
Can not activatefunction by theblue pod
UROr 4
Major blue podfailure
P8
Manifold regulatorfails, blue pod
Lambda=0,0002Test intervall=7
MRBP
UPR function failson blue pod
Lambda=2e-005Test intervall=7
URBPfunction
Can not activatefunction byacoustic system
LAC3
Pilot valve failsacoustic system
Lambda=0,0001Test intervall=14
PVA3
Solenoid valvefails acousticsystem
Lambda=0,0001Test intervall=14
SV3
Shuttle valve foracoustic/hyd.controlsystemstuck.
Lambda=0,0001Test intervall=14
SHVA3
The BOP can notbe controlled byAcoustic system
P13
Shuttle valve orline to UPR leaksexternal
Lambda=1e-005Test intervall=7
URSVLE
Major failure inboth blue andyellow pod and theacoustic system
TOTCONT
Failure that ruinsboth yellow andblue pod
P7
The BOP can notbe controlled byAcoustic system
P13
BOP mux Example two BOP OK Nytt navn.CFTPagename: P4
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 114
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P5
Local failure inBSR or associatedcontrol systemequipment
BSR
Fails to shear pipewith casing shearram blind shearram
FT SHEAR
BSR fails to shearpipe
Probability=0,1
BSRFTS
Casing shear ramfails to shear pipe
Probability=0,01
CSRFTS
BSR internalleakage
Lambda=6,9e-005Test intervall=20
BSRIL
BSR fail to c lose
Lambda=9,8e-006Test intervall=7
BSRFTC
Both blue pod,yellow pod andacoustic systemfail to activatefunction
SRBAYP
Can not activatefunction by theblue pod
SROr 4
Major blue podfailure
P8
Manifold regulatorfails, blue pod
Lambda=0,0002Test intervall=7
MRBP
BSR function failson blue pod
Lambda=2e-005Test intervall=7
SRBPfunction
Can not activatefunction by theyellow pod
SROr 3
Major yellow podfailure
P9
Manifold regulatorfails, yellow pod
Lambda=0,0002Test intervall=7
MRYP
BSR function failson yellow pod
Lambda=2e-005Test intervall=7
SRYPfunction
Can not activatefunction byacoustic system
LAC4
Pilot valve failsacoustic systemBSR close
Lambda=0,0001Test intervall=14
PVA4
Solenoid valvefails acousticsystem BSR Close
Lambda=0,0001Test intervall=14
SV4
Shuttle valve foracoustic/hyd.controlsystemstuck. BSR closefunction
Lambda=0,0001Test intervall=14
SHVA4
The BOP can notbe controlled byAcoustic system
P13
Shuttle valve orline to BSR leaksexternal
Lambda=1e-005Test intervall=7
SRSVLE
Major failure inboth blue andyellow pod and theacoustic system
TOTCONT
Failure that ruinsboth yellow andblue pod
P7
The BOP can notbe controlled byAcoustic system
P13
BOP mux Example two BOP OK Nytt navn.CFTPagename: P5
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 115
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P6
Local failure inANNULAR orassociated controlsystem equipment
UAPilot 1
Annular internalleakage
Lambda=0,0002Test intervall=14
UAPIL
Annular preventerfail to c lose
Lambda=2,8e-005Test intervall=7
UAPFTC
Both blue pod,yellow pod andacoustic systemfail to activatefunction
UABAYP
Can not activatefunction by theyellow pod
UAOr 3
Major yellow podfailure
P9
Annular regulatorfails, yellow pod
Lambda=0,0002Test intervall=7
ARYP
Annular preventerfunction fails onyellow pod
Lambda=2e-005Test intervall=7
UAYPfunction
Can not activatefunction by theblue pod
UAOr 4
Major blue podfailure
P8
Annular regulatorfails, blue pod
Lambda=0,0002Test intervall=7
ARBP
Annular preventerfunction fails onblue pod
Lambda=2e-005Test intervall=7
UABPfunction
Shuttle valve orline to annularpreventer leaksexternal
Lambda=1e-005Test intervall=7
UASVLE
Failure that ruinsboth yellow andblue pod
P7
BOP mux Example two BOP OK Nytt navn.CFTPagename: P6
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 116
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P7
The control systemfails to operate theBOP
aa1
Failure to operateBOP from controlsystem. Causedhydraulic problemsthat can not beisolated
Probability=0,00011
CONSYSTHYD
Failure to operateBOP from controlsystem. Caused byan electronic orelectric failure.
Probability=1,3e-005
CONSYSTEL
Combination offailures that willcause no supply ofhydraulic fluid forboth pods
KOMB
Blue pod conduitl ine can not supplyfluid to the pods
BPCOND
External leakage inblue conduit line orassociatedequipment
Lambda=7,5e-005Test intervall=7
EXCLBP
Failed to opensurface pilot valvefor blue conduitl ine
Lambda=3e-006Test intervall=7
PVTSBP
Failed to open bluepod munted pilotvalve for blue pod
Lambda=5e-006Test intervall=7
PVSSBP
Yellow pod conduitl ine can not supplyfluid to the pods
YPCOND
External leakage inyellow conduit l ineor associatedequipment
Lambda=7,5e-005Test intervall=7
EXCLYP
Failed to opensurface pilot valvefor yellow conduitl ine
Lambda=3e-006Test intervall=7
PVTSYP
Failed to openyellow pod muntedpilot valve foryellow pod
Lambda=5e-006Test intervall=7
PVSSYP
BOP mux Example two BOP OK Nytt navn.CFTPagename: P7
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 117
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P8
Failed to operateBOP on blue pod
bluepod
Hydraulic leak thatruins the blue podcontrol
Lambda=0,0003Test intervall=7
EXTCBP
Electric orelectronic podfailure, blue pod
Lambda=0,0003Test intervall=7
ELBP
Failure in SEM Aand SEM B bluepod
SEMSBP
SEM A blue podfails
Lambda=9,1e-005Test intervall=7
SEMABP
SEM B blue podfails
Lambda=9,1e-005Test intervall=7
SEMBBP
BOP mux Example two BOP OK Nytt navn.CFTPagename: P8
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 118
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P9
Failed to operateBOP on yellow pod
yellow pod
Hydraulic leak thatruins the yellowpod control
Lambda=0,0003Test intervall=7
EXTCYP
Electric orelectronic podfailure, yellow pod
Lambda=0,0003Test intervall=7
ELYP
Failure in SEM Aand SEM B yellowpod
SEMSYP
SEM A yellow podfails
Lambda=9,1e-005Test intervall=7
SEMAYP
SEM B yellow pod
Lambda=9,1e-005Test intervall=7
SEMBYP
BOP mux Example two BOP OK Nytt navn.CFTPagename: P9
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 119
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P10
Subsea blowoutvia the main BOPstack
Subsea blowout
Leakage in BOPwellhead connector
Lambda=2,5e-005Test intervall=14
WHCA
Leakage in clampconnectionbetween w.headconn. and LPR
Lambda=4,1e-006Test intervall=14
CLA1
Lower inner kil lvalve leaks to sea
Lambda=3,7e-006Test intervall=14
LIKE
Leakage to seathrough kil l l ineafter the lower innerkill valve (LIK)
LOK
Blowout via afailed kil l l ine
KILL1
The LIK valveleaks internally
Lambda=3,7e-005Test intervall=14
LIKIL
The LOK failsafevalve leaksinternally
Lambda=3,7e-005Test intervall=14
LOKIL
Kill l ine leaks tosea
Lambda=0,00053Test intervall=14
KLINE
Blowout to sea inLower outer k il l(LOK) valve
LOKA
The LIK valveleaks internally
Lambda=3,7e-005Test intervall=14
LIKIL
Lower outer k il lvalve leaks to sea
Lambda=3,7e-006Test intervall=14
LOKE
Leakage to sea inlower pipe ram
Lambda=3,6e-006Test intervall=14
LPRA
Blowout to seaabove the LowerPipe Ram
P11
BOP mux Example two BOP OK Nytt navn.CFTPagename: P10
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 120
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P11
Blowout to seaabove the LowerPipe Ram
A2
One or moreequipment aboveLPR leaks
ABOVELPR
Leakage to seathrough choke lineafter the lower innerchoke valve (LOC)
LOCA
Blowout via afailed choke line
Choke1
The LOC failsafevalve leaksinternally
Lambda=3,7e-005Test intervall=14
LOCM
The LIC failsafevalve leaksinternally
Lambda=3,7e-005Test intervall=14
LICM
Choke line leaks tosea
Lambda=0,00053Test intervall=14
CLINE
Blowout to sea vialower outer chokevalve
LOC
Lower outer chokevalve leaks to sea
Lambda=3,7e-006Test intervall=14
LOCE
The LIC failsafevalve leaksinternally
Lambda=3,7e-005Test intervall=14
LICM
MPR leaks to sea
Lambda=3,6e-006Test intervall=14
MPRE
Lower inner chokevalve leaks to sea
Lambda=3,7e-006Test intervall=14
LICE
Blowout to seaabove the MiddlePipe Ram
A3
One or moreequipment aboveMPR leaks
ABOVEMPR
Leakage in clampconnectionbetween LPR andMPR
Lambda=4,1e-006Test intervall=14
CLA2
Leakage to seathrough kil l l ineafter the upperinner kil l valve(UIK)
Or 2
Blowout via afailed kil l l ine
KILL2
The UIK valveleaks internally
Lambda=3,7e-005Test intervall=14
UIKIL
The UOK failsafevalve leaksinternally
Lambda=3,7e-005Test intervall=14
UOKIL
Kill l ine leaks tosea
Lambda=0,00053Test intervall=14
KLINE
Blowout to sea inupper outer k il l(UOK) valve
UOKA
The UIK valveleaks internally
Lambda=3,7e-005Test intervall=14
UIKIL
Upper outer k il lvalve leaks to sea
Lambda=3,7e-006Test intervall=14
UOKE
UPR leaks to sea
Lambda=3,6e-006Test intervall=14
UPRE
Blowout to seaabove the UpperPipe Ram
P12
Upper inner kil lvalve leaks to sea
Lambda=3,7e-006Test intervall=14
UIKE
Middle pipe ramsleaks
P3
Lower pipe ramsleaks
P2
BOP mux Example two BOP OK Nytt navn.CFTPagename: P11
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 121
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS P12
Blowout to seaabove the UpperPipe Ram
A4
One or moreequipment aboveUPR leaks
ABOVEUPR
Blowout to sea inmiddle outer choke(MOC) valve
UOCA
Upper outer chokevalve leaks to sea
Lambda=3,7e-006Test intervall=14
UOCE
The UIC valveleaks internally
Lambda=3,7e-005Test intervall=14
UICIL
Inner bleed offvalve leaks to sea
Lambda=3,7e-006Test intervall=14
UICE
Casing Shear ramsleaks to sea
Lambda=3,6e-006Test intervall=14
CRE
Leakage to seaabove BSR
Above BSR
One or moreequipment aboveBSR leaks
ABOVEBSR
External leakage inLMRP connector
Lambda=2,5e-005Test intervall=14
LMRPE
Leakage in clampconnection belowannular
Lambda=4,1e-006Test intervall=14
CLA4
Leakage in clampconnection aboveBSR
Lambda=4,1e-006Test intervall=14
CLA4b
Annular leaks tosea
Lambda=9,6e-006Test intervall=14
AE
Inner Bleed valveleaks to sea
Lambda=3,7e-006Test intervall=14
IBE
Leakage to seathrough choke lineafter the innerbleed valve (IB)
Bleed
Blowout via afailed choke line
Bleed1
The inner bleedvalve leaksinternally
Lambda=3,7e-005Test intervall=14
IBI
The outer bleedvalve leaksinternally
Lambda=3,7e-005Test intervall=14
OBI
Choke line leaks tosea
Lambda=0,00053Test intervall=14
CLINE
Blowout to sea inouter bleed valve
Bleed2
The inner bleedvalve leaksinternally
Lambda=3,7e-005Test intervall=14
IBI
Outer bleed valveleaks to sea
Lambda=3,7e-006Test intervall=14
OBE
Blind shear ramleaks
P5
BSR leaks to sea
Lambda=3,6e-006Test intervall=14
BSRE
Leakage in clampconnectionbetween CSR andthe BSR
Lambda=4,1e-006Test intervall=14
CLA3b
Blowout via afailed choke line
Choke2
Choke line leaks tosea
Lambda=0,00053Test intervall=14
CLINE
The UOC valveleaks internally
Lambda=3,7e-005Test intervall=14
UOCIL
The UIC valveleaks internally
Lambda=3,7e-005Test intervall=14
UICIL
Upper pipe ramsleaks
P4
BOP mux Example two BOP OK Nytt navn.CFTPagename: P12
Subsea BOP Reliability, Testing, and Well Kicks
Final report Page 122
CARA Fault Tree version 4.2 (c) ExproSoft AS 2008Single license.ExproSoft AS
P13
The BOP can notbe controlled byAcoustic system
ACOU
Acousticaccumulators failsto supply pressurewhen demanded(sudden rupture)
Lambda=6,7e-005Test intervall=14
Acouaccu
Electric orelectronic failureon subsea controlmodule fails whendemanded (battery,SEM, waterintrusion)
Probability=0,001
Electfail
Acousticcommunicationfails
Probability=0,0033
AcouCom
BOP mux Example two BOP OK Nytt navn.CFTPagename: P13