aTe 4444

Reliability of Subsea BOP Systems

by Marvin Rausand, SINTEF, Safety & Reliability Section, and Gudmund Engen,
Aker Engineering AIS

Copyright 1983 Offshore Technology Conference

This paper was presented at the 15th Annual OTC in Houston, Texas, May 2-5,1983, The material is subject to correction by the author, Permission to
copy is restricted to an abstract of not more than 300 words,

ABSTRACT Statoil, Phillips Petroleum Company Norway and the

Safety Offshore Committee in Norway.
Subsea BOP stacks have experienced a significant
development process the last decade. Still, however, Besides being a safety problem, BOP failures and
BOP failures result in blowouts and costly rig down- malfunctions are costly. When a failure of the BOP or
time. A survev of North Sea BOP oerformance the last its control system is detected, drilling operations
5 years has been performed in order to identify the must usually cease in order to repair the failure.
most failureprone components and the types of problems Down-time on a tvoical North Sea ria costs in the order
that creates most downtime. of $ 50.000 per day. Even minor improvements in relia-
bility can thus result in large savings for the opera-
INTRODUCTION tor.

According to recently published blowout statistics The objectives of the study were then defined to
/1/, one out of 125 exploration wells experiences a be:
blowout. 25% of all exploration drilling blowouts are
socalled "shallow gas" blowouts, occuring while • Evaluate reasons why the BOP was not able to con-
drilling the shallow parts of the well, and before trol developing blowouts in the past, and whether
a BOP is installed. Another 10% are due to cement bond today's BOP designs have improved.
failures or casing rupture during kick control. The
remaining 65% of the blowouts occur through the BOP, • Quantify BOP component reliability experienced du-
either through the drillstring or through the annulus. ring drilling operations.

Theoretically, a modern subsea BOP stack should be • Quantify rig downtime due to BOP failures and
able to stop any type of threatening blowout through repair.
the drillstring or the annulus, even if one or more of
the BOP components have failed. Why then do blowouts The first of these objectives were reached through
still occur? There may be several answers, the most a study of the blowout material collected by E. Dahl
probable ones being: et.al. /1/. The next two by reviewing daily drilling
reports from 60 wells being drilled for various North
• During a blowout, several component failures Sea operators and by several contractors. These data
occur simultaneously, b;l:'eaking down built-in should give a realistic picture of the situation regar-
redundancy in the BOP system. ding BOP failures and downtime .

• A drilling blowout may be a result of human PAST BLOWOUTS

errors and misjudgements more than of technical
failures. Improved personnel education, training Through the years 1976 - 1980, 32 blowouts during
programs and procedures are solutions to the exploration drilling were experienced on a worldwide
problem. basis /1/. Not all these blowouts have been properly
reported, which unfortunately usually is the case with
• In the future the blowout frequency will decrease all types of blowouts. Of the relatively well reported
because recent BOP designs have resulted in im- blowouts, six can be referred to as a result of failure
proved BOP reliability. When these new designs or maloperation of the BOP during the handling of a
are entering the fields, we will experience this kick. Short summaries of these blowouts are given in
effect. Table 1, and a more thorough discussion is given below.

Probably all three of these answers apply, and

maybe several more. However, in order to enlighten the
problem of drilling blowouts, a study was initiated by References and illustrations at end of paper.
19

- -- --
----------=----=--=---=-=---
- ~ ~
Blowout 1 - west cameron 405, US/OCS, 1976 Blowout 5 - Ixtoc 1, Mexico, 1979

BOP configuration: One annular preventer, two BOP configuration: One annular preventer, pipe rams,
pipe ram preventers, one blind ram preventer. one blind/shear ram.

Short history: The 7" casing was cemented at Short history: Drilling was under progress at
8 978' and the crew was nippling down the BOP when the 11 860' when the well began to take mud. Circulation
well started to flow. The BOP was partially reinstallec was lost at 11 890'. Circulation was not regained, b\
before the rig was abandoned. The flowrate was too high the well appeared stable, and the drill pipe was
to allow complete reinstallation. pulled. When most of the pipe was pulled, the mud bee
flowing up the annulus. The ram preventers was attem]
Cause of blowout: Bad cementing job and improper ted closed, but could not close on the 4,75" drill
well stability testing procedures. collars, and the shear ram was unable to shear and
close across the same collars. The annular BOP sealee
Blowout 2 - Eugene lsI. 361, US/OCS, 1977 then off the annulus, but mud continued to flow up tJ
drill pipe. An adapter with safety valve was unsucce:
Short history: The 9 5/8" casing was set at fully attempted installed above the drill collars, b\
5 610'. Drilling of 8," hole at 6 241' was undertaken the threads jammed.
when a kick occurred. The annular preventer was closed
and mud pumping started when bubbles began to emerge Cause of blowout: The kelly disconnected, leavil
around the drilling rig. The well blew out as a result the drillpipe flowpath unprotected when the well was
of a leaking BX seal ring in the flange between the unstable.
bottom preventer and the wellhead.
Blowout 6 - Offshore Spain, 1980
BOP failure: Flange below bottom preventer
leaking. BOP configuration: Two annular preventers, threl
pipe rams, one blind/shear ram.
Blowout 3 - West Cameron 180, US/OCS, 1978
Short history: After the well had been tested a:
Short history: The 13 3/8" casing was set at the well killed, a routine pulling out of the hole
3 400', and drilling a 12 1/4" hole at 4 198' was began. A kick occurred, pushing out 50 bbl of mud, a:
undertaken. The blowout occurred during pulling out of the BOP was closed (shearing blind rams on plugged
the hole. Two stands were pulled and the well began to drillpipe). The well was circulated out. Pulling out
flow. The kelly bushing was blown out of the rotary continued, but a kick occurred again and the BOP was
table. The annular preventer and upper pipe ram was again closed. The rig had experienced some damage d
activated but failed to function. The rig was then to bad weather, and during the repair, BOP dccumulat<
abandoned. pressure dropped and the preventers began to creep
open. After some time, however, personnel on the rig
Cause of blowout: Negligency of drilling crew to managed to reestablish pressure on the closing unit
keep up gain/losses in mud pit. Failure of BOP. closed the shearing blind rams.

Blowout 4 - South Marsh Island 281, US/OCS, 1979

---
The causes of these blowouts may be categorized
into four different groups:
BOP configuration: One 5 000 psi annular preven-
ter, two 10 000 psi pipe rams and one 10 000 psi blind e Direct failure of the BOP equipment (blowouts 2
ram (without shearing capacity) • and 3) .

Short history: Drilling was taking place at eFailure in other pressure control equipment tha
14 288' with 8," drill bit, and a kick was noted (pit could not be compensated by the BOP used during
gain). Mud weight was raised and gas-cut mud circu- the blowout, but that is compensated by today's
lated out. The following day, at 14 615' a trip to designs (blowout 4) •
change bit was commenced. Eight stands had been pulled
when the well did not take_any mud. The drill string e Failure in other components that neither the BO
was run back and the well circulated bottoms up. Mud that was used,nor today's BOP designs can compe
began bubbling over the BOP and in an attempt to cir- sate for (blowouts 5 and 6) •
culate, the formation was fractured. After that,well
pressure was raising and falling several times. e Bad operating procedures (blowout 1).
Finally the pressure started increasing both on casing
and drill pipe, the BOP pipe ram was closed and mud These statistics, although sparse, indicate tha
was flowing uncontrolled through the drill pipe back tc improved design and improved BOP reliability are
the mud pits. All attempts on closing drill pipe possible means to reduce drilling blowouts. It will,
valves failed. however, take som years from a new design is launche
until is in general use, both because of the conserv
If a shear ram had been installed, the blowout tive attitudes within the petroleum industry and
probably would have been avoided. because a BOP is not a type of equipment that is dis
carded only in favour of new models.
Cause of blowout: Failure to close drill pipe valves.

20
DATA FOR THE RELIABILITY STUDY The uncertainty of the estimate A is measured by
a 90% confidence interval. Let Z denote the number of
A typical subsea BOP system as used on the failures during a total time in service t.
Norwegian Continental Shelf, Fig. 1, has a throughbore
of 18 3/4" and is stacked with four ram-type preven- A 90% confidence interval for A is given by
ters with rated working pressure 10.000 psi, and two
XO,95,2Z < A ~ ~t
1
annular preventers with rated working pressure 5.000 XO,05,2(Z + 1)
2t
psi. The four ram-type preventers are usually made up
of two double-body preventers. The typical BOP system
where X denotes the upper 1008% percentile of the
has three subsea choke/kill lines. Each of these lines
Chi-squ~t~d distribution with n degrees of freedom.
is connected to the BOP stack through two redundant
failsafe valves.
The mean time-to-failure, MTTF, for a component
is calculated as the inverse of the estimated failure
The BOP valves are pressure tested at least once a
rate for the component.
week during the drilling operations, according to
regulations by the Norwegian Petroleum Directorate.
The estimated MTTFs and failure rates, with 90%
confidenc~ intervals for the various BOP components
The reliability study is limited to the subsea
are given in Table 2.
BOP stack with its accompanying control system and
subsea choke and kill lines and valves. The choke
RIG DOWN-TIME CALCULATIONS
manifold and its related equipment on the platform
are not included in the study.
In Table 2 the rig down-times due to BOP failures
and malfunctions are estimated for the various BOP
Data regarding BOP failures and malfunctions
components. Included in the rig down-time is only the
have been collected by reviewing
time lost due to failures and malfunctions. Time lost
due to regular testing and maintenance is not included.
- Daily Drilling Reports
In order to identify a possible influence of bad
- BOP Test Reports and
weather conditions for both failure rate and repair-
- Well Completion Reports
time, the rig down-time per day in service is calcu-
lated for both winter and summer operations. Winter is
from 60 exploration wells drilled from 9 different
taken to be the time period from October 1st to
semi-sub rigs on the Norwegian Continental Shelf,
March 31st. The rest of the year is called summer.
mainly since January 1978.
In Table 3 is shown the rig down-time distribution
Together with each of the failures and malfunc-
due to BOP failures and malfunctions for a typical
tions are also recorded
subsea BOP system stacked with
-Why and how the failure/malfunction was dis-
1 Flexible Joint
covered
2 Annular Preventers
-What was done to repair or restore the function
4 Ram-type Preventers
-Rig down-time due to the failure/malfunction
2 Hydraulic Connectors
6 Choke/kill (Failsafe) Valves
The BOP performance data have been discussed
1 Control System
with, and commented by drilling engineers and rep-
resentatives from BOP manufacturers.
BOP COMPONENT RELIABILITIES
FAILURE RATE CALCULATIONS
Below is given a short description of the observed
performances of the major BOP components.
When calculating failure rates for the BOP com-
ponents, it is-assumed that the times between failures
Flexible joints
are exponentially distributed. The practical meaning
of this assumption is that the probability of a
Flexible joints from Cameron Iron Works, Regan
failure in a given period of time (e.g. 1 month) is
Industries and Vetco Offshore are included in the
the same regardless of how long the component has
study. The only relevant failure mode for a flexible
been in use.
joint is leakage to the sea. The study revealed signi-
ficant differences in performance of the flexible
The failure rate, A, for a component is esti-
joints supplied by the three manufacturers. The esti-
mated by
mated MTTFs varied from 400 days to 2110 days.
Number of failures
A = Total time in service The failure rate and rig down-time due to failures
/malfunctions of the flexible joint is from Table 2
To estimate the total time where a component seen to be higher for winter operations than for
actually has been in function and exposed to stress, summer operations. Since the flexible joint is taking
is in practice a difficult task. From discussions up rig movements during bad weather conditions this
with drilling engineers, it was, however, found app~ difference was to be expected.
ropriate to relate the number of failures to the
total time in service, i.e. from spud-in till the
drilling is completed.

21

-~ ~-2:- ,. --
 lnnular preventers Control system

Included in the study are the “GL” and “GK” The study shows significant differences im performance
mnular preventers from Hydril Company and the NL between the control systems from Koomey Inc.and from
;haffer spherical preventer. The 23 observed failures Cameron-Payne.
md malfunctions during a total time in service of
3 746 days are distributed on failure modes as shown The failures and malfunctions are distributed on
in Table 4. failure modes as shown in Table 6. Of special interes
for a future winter drilling on the northern part of
The most critical failure mode is “Fail to close”. the Norwegian Continental Shelf is the failure mode
Fortunately, this failure has not occurred more than “Frozen hydraulic system”. The two failures from this
mce. The most frequent critical failure mode is failure mode occurred while drilling on the southern
“Excessive leakage in closed position”. part of the shelf. Of interest is also the fact that
both the failure rate and the rig down-time due to
Although not critical, the failure mode “Could control system failures were found to be significantl
not be fully opened” has created a lot of trouble higher for winter operations than for summer opera-
=specially for one of the makes. tions. According to Table 3 the control system is res
ponsible for approximately 27% of the rig down-time
There are no overall significant differences in per– caused by BOP failures and malfunctions.
formance between the annular preventers included in
the study. There are, however, rather big differences Flanges and seals
when studying each failure mode. Both failure rates
and rig down-times due to failures/malfunctions of Most of the contractors operating on the Nor-
the annular preventers seem to be rather unaffected by wegian Continental Shalf seem to prefer clamp connec-
season variations. tions for their subsea stacks. There is no indication
of that these connections create severe problems. The
Ram-type preventers clamps are made for either AX, BX, Rx or VX rings. A
fair part of the BOP failures in the study were leak-
Data for the Cameron “u” preventer with rated ages through these ring gaskets. A new gasket, CX, is
working pressure of 10.I3CX3 psi and 15.000 psi together recently designed for use in mainline BOP stack
with the NL Shaffer “LWS” - 10.000 psi are studied. connections. According to some of the users, this new
The 28 observed failures and malfunctions during a CX gasket is considered to be a great improvement.
total time i service of 19 470 days are distributed
on failure modes as shown in Table 5. Two of the Remark
failures were due to more than one failure mode.
Significant differences in performance between the Some rigs are equipped with two BOP stacks, one
three makes were detected. The estimated total MTTFs stack with a rated working pressure of 10.000 psi,
varied from 160 days to 1 290 days. while the other is a 15.000 psi stack. The 15.000 psi
stack is used only when extremely high pressures are
The failure rate and rig down-time due to failu- expected. Comparing the reliabilities of the componen
res and malfunctions of ram-type preventers are from in the two stacks creates problems, as they have not
Table 2 seen to be higher for winter operations than been exposed to the same relative stress levels.
for summer operations. This finding is a bit surpri-
sing and could not be fully explained by the drilling OVERALL CONCLUSIONS
engineers which were contacted.
The study revealed rather big differences in BOP
Hydraulic connectors reliabilities on the nine drilling rigs. The mean
times between BOP failures varied from 11 to 45 days
The two hydraulic connectors which were studied, The rig down-time caused by BOP failures and mal-
the Vetco H4 mandrel-type connector and the Cameron functions varied from 0,20 to 1,28 hours per day in
Collet Connector, performed approximately equally service, with an average of 0,6 hours per day in
well. Failure rates for the hydraulic connectors are service.
higher for winter than for summer operations. Rig
down-time, however, seem to be rather unaffected by MI average exploration well with a depth of
season variations. 13 000’ is drilled in approximately four months. Tota
average rig down-time due to BOP failures and mal-
Choke/kill (failsafe) vaLves functions during this period is thus three days. With
today’s rig rates this produces an extra cost of
The failsafe valves included in the study, the $ 150.000 per well.
Cameron “F”, the Vet-co“VS” and the NL Shaffer “HB”
valve, performed significantly different. Their Some of the rigs showing significant difference
estimated MTTFs varied from 240 days to 4 030 days. A in BOP reliability, are equipped with approximately
fair part of the failures was due to washout in the equal BOP stacks and have drilled on the same fields
sealing area of the valves. TWO of the ValVe-tYPes Maintenance procedures and operational skill must,
in the study were rated for a working pressure of therefore, be of importance for the BOP reliability.
10.000 psi while the third was a 15.000 psi valve. It
may, perhaps, be unfair to compare these valves, It is often claimed that frequent pressure
since they are exposed to different stresses during testing of the BOP has a negative effect on the BOP
testing. reliability. The data from this study can not verify
or reject this hypothesis.

22

. ——

.
 REFERENCE ACKNOWLEDGEMENTS

/1/ Dahl, E. et.al.: “Risk of oil and gas blowouts The authors wish to thank Statoil, Phillips
on the Norwegian Continental Shelf”. Petroleum Company Norway and the Safety Offshore
SINTEF report STF88 F82C162. Committee in Norway for sponsoring the study of which
this paper is based. They also wish to thank represen-
tatives from Cameron Iron Works, Hydril &mpany and
NL Shaffer for informal discussions andrcomments.

TABLE 1. Snort sumiiary of six drillin~ Jlowouts.

Al-esa (’hal
a[$- L)uration Control
Year Country Well lleP
th Operation teri- (days)
stirs
West.
1976 us/ocs Cameron 8.978’ Cementinq Gas 0,5 Sridged
405 7,*
.—— —.._ . ———. ..
—__ .—
1977 us/ocs Eugen 6.241’ Lli:011 Gas 5
1s1. 361 bot Lom
.— - .------
——.— ...— ___ ___ -—
West
1978 us/ocs Cameron 4.198’ E’OOH Gas, fire 2 Bridge5
180
—-— —— — —.—- ..— _____
1978 us/ocs S. Marsh 14.615’ Circu- Gasr fire 12
1s1. 281 laLing
.—— — —— —. ..—. ——— ..
1979 NexicO Ixtoc 1 11.890’ Pool{ Oil/gas, 287 Relief
fire wells
— ———. —.
1980 Spain - POOH Oil/gas 0,2 BOP closed

TABLE 2. BOP failure rates and riy c70wn-ti:les.

Riu dovn~!F#i
lure rates. No of
time per failures !ber lo. oOO
clay in Meall +.i!w
Days in N!]mLerof service > LO fail!l]-c
Components iL
Season service failures (h) .MFTF (days)
FLEXIBLE JOINTS W~nter 2416 4 0,035
(Cameron, Vetco, Reqan) ——- --—— ——
Summer 2455 1 0,004 4,0 10,3 21,6 f3713
—— .—
frOt~l 4871 5 10,019
.- . .—— —___ __
ANNULAR FREV12NTERS Winter 4820 12 0,O24
(IlydrilGL c GK, ——— —— - -—-—,.-— —-—
NL shaffe~) Summer 4Q26 II O,O28 16,1 23,6 3.3,4 42’3
——— . .—— ——
Total 9746 23 0,026
—— —— .— — .——_
RAM-TYPE PREVENI’ERS Winter 9616 17 0,026
(Cameron, NL Shaffer) — ..—
Summer 9854 ‘11 0,008 10,2 14,4 19,7 70~
——. —— . -——
Total 19470 20 0,017
--—— . — ——-
HYORAULIC CONNECTORS Nin Ler 4832 15 0,032
(Cameron, Vetc:o, ————. .__—__ ,_ --——
NT., Shdffe~) Summer 4910 7 0,025 15,3 27,6 3?, ? 440
——. —— ___
Total 9742 22 I?,028
—— __ ____ __ —— ---
CIIOKE & KII,L VALVES Winter 14496 6 0,006
(Cameron, VetcO, .—— ——z
NL Shaffer) Summer 14730 10 0,009 3,4 5,5 8,3 1830
-—
Total 29276 16 0,007
.—— -..——- ——— ______
CONTROL SYSTEM Winter 2400 “74 0,150
(Koomey, Cameron-Payne) ——— —c
Summer .2433 28 0,034 1’?1,3 14’3,0 181,3 65
....—
To La] 4833 72 0,091

SEASONS:WINTEM: !. OcLuber - 31. Marc},,SUMMER: 1. April - 3CI

. sepLe~~[?r

23

✎
✎
✎
TABLE 3. Rig down-time distribution due to BOP failures and TABLE 5. Failure mode distribution for ram-type preventers
malfunctions for a typical subsea BOP system.

Observed failure modes Number of failures

Failures due to Rig down-time distribution
Leakage through pipe rams 7
Flexible ]oint 68 Leakage through shearing blind
ram seals 5
Annular pWPJeIIteL_S 16%
Ruptured shear blades 1
Ram-type preventers 21%
Leakage through bonnet seals 10
Hydraulic cOnneCtOrS 17%
Washout/corrosion on ram bodies 1
Failsafe (choke-/kill-) valves 138
Broken hose to automatic lock 3
Control system 2-I%
Preventer could not be fully
Subsea BOP-system 100% opened 2
Ram shaft damaged 1

TABLE 4. Failure mode distribution for annular preventers. TABLE 6. Failure mode distribution for the BOP control SYStem.

Observed failure modes Number of failures

Failure on pod selector valve 1

Pod failure 59
Failure on pilot valves/SPM
valves 26
Leakage/dirt on stingers 7
Failure on control h~se bundle 5
Failure on pressure regulator 3
Failure on shuttle valve 1
Failure on acOUStlC COntrOl
system 1
Frozen hydraulic system 2

Fig.1. A typical subsea BOP stack as used on the Norwegian

Continental Shelf.