Faculty of Science and Technology

MASTER’S THESIS

Study program/ Specialization: Spring semester, 2012

Offshore Technology/ Risk Management

Open / Restricted access

Writer:

Yahya Januarilham
…………………………………………
(Writer’s signature)
Faculty supervisor:
Terje Aven

External supervisor(s):
Thomas Black Fylking (Scandpower AS)
Louise Bengtsson (Scandpower AS)
Title of thesis:

Analysis of Component Criticality in the Blowout Preventer

Credits (ECTS): 30 ECTS

Key words:
Pages : 92
Blowout Preventer
Criticality + enclosure : 44
FMECA
Kick Stavanger, 15.06.2012
Reliability Date/year

Page | i
 ABSTRACT

During well drilling operation, there is a possibility of a kick (influx). When a kick is not
controlled properly it will become a blow out. This is an uncontrolled and sudden flow of
formation fluid that releases from a reservoir through a well bore into surface as a result of
pressure difference in formation and well. The kick could flow to surface and create
explosions causing fatality, environment damage and loss of asset resulting in high cost.
There are procedures and methods to deal with the occurrence of kicks and blowouts in
order to control a well flow. Moreover, well barriers should be established and designed
based on the characteristics of the reservoir and rock formation. The last line of protection in
well barriers is known as Blowout Preventer (BOP). It is one of the most important barriers to
prevent unintentional hydrocarbon release when all well barriers in a well have failed. There
are many factors that influence the performance of a BOP. The purpose of this thesis is to
determine the criticality of components in BOP related to the redundancies they have during
well shut in, stripping, snubbing and BOP testing operation. By knowing the criticality of BOP
components, we can assure which components that should be focused on for maintenance
and testing. It will also indicate which components that gives redundancy to the BOP during
well shut in, stripping, snubbing and BOP testing operation, if one or more components are
failed. A literature study is the main work of this thesis. Studying the principal, functions,
operations and factors related to drilling activity with respect to the use of BOP. In addition,
relevant regulations and standards are also describes to specify the required specification of
BOP. The analysis of criticality is done by using risk tools such as reliability block diagram,
FMECA, criticality matrix, redundancy and effect table. All of these risk tools complement
each other to give the final conclusion of critical component in a BOP. The result of the
analysis shows five critical components in a BOP with the prioritization start from shuttle
valve (blind shear ram function), blind shear ram (ram piston), flange (BOP stack), gasket
(BOP stack) and annular preventer (rubber housing) respectively. In the event of kick and
well shut in is initiated, the above critical component is very critical to the safety of personnel.
Stripping and snubbing operation also require the critical components to be function properly,
but with less critical when well shut in has been done earlier. During BOP testing operation,
the critical components might not be critical if it fail as there are many safety measure and
procedure for safety.

Page | ii
 ACKNOWLEDGMENT

Praise and gratitude I prayed to God Almighty for His blessings so I can finish the thesis
report. The thesis report is done in order to meet one of the requirements to achieve Master
of Science (M.Sc) degree in Offshore Technology, Risk Management specialization from the
University of Stavanger. I realize that without the help and guidance from various parties, it
would be very difficult for me to finish the thesis report. Thus, I would like to thank to:

1. My supervisor at UiS, Prof. Terje Aven, who has provided his time, idea and
advice to guide me in the writing and preparation of the thesis
2. My supervisor at Scandpower, Thomas Black Fylking and Louise Bengtsson, for
providing their time to guide me in the construction of the thesis in general and the
analysis part of the thesis
3. My parents and sisters who have provided material assistance and moral support
in the completion of the thesis
4. My friends and colleagues at UiS and Scandpower who gave me supports

I hope that God Almighty is pleased to reply to all the good of those who have helped.
Hopefully this project can bring benefits to the development of science.

Stavanger, June 2012

Yahya Januarilham

Page | iii
 TABLE OF CONTENT

Contents
ABSTRACT ........................................................................................................................................................ II
ACKNOWLEDGMENT ....................................................................................................................................... III
TABLE OF CONTENT ......................................................................................................................................... IV
LIST OF FIGURES .............................................................................................................................................. VI
LIST OF TABLES .............................................................................................................................................. VIII
TERMINOLOGY ................................................................................................................................................ IX
ABBREVIATIONS ............................................................................................................................................ XIII
1. INTRODUCTION ....................................................................................................................................... 1
1.1 BACKGROUND ............................................................................................................................................ 1
1.2 PURPOSE .................................................................................................................................................. 2
1.3 CONTENT .................................................................................................................................................. 2
1.4 METHODOLOGY ......................................................................................................................................... 3
1.5 LIMITATION ............................................................................................................................................... 3
2. BASIC WELL DRILLING CONCEPT............................................................................................................... 4
2.1 DRILLING AND COMPLETION ......................................................................................................................... 4
2.2 KICKS AND BLOWOUTS ................................................................................................................................ 8
2.2.1 Causes of Kick .................................................................................................................................... 9
2.2.2 Kick Warning Signs .......................................................................................................................... 12
2.2.3 Indication of Kicks............................................................................................................................ 13
3. BASIC WELL CONTROL PRINCIPLES ......................................................................................................... 14
4. KICK CONTROL EQUIPMENTS ................................................................................................................. 18
4.1 BLOWOUT PREVENTER (BOP) STACK ........................................................................................................... 18
4.1.1 Annular Preventer ........................................................................................................................... 23
4.1.2 Ram Preventer ................................................................................................................................. 27
4.1.3 Choke Lines and Kill Lines ................................................................................................................ 30
4.2 BLOWOUT PREVENTER (BOP) CONTROL SYSTEM............................................................................................ 31
4.2.1 Hydraulic subsea BOP Control System Overview for BOP Function ................................................. 34
4.2.2 Control Fluid Circuit and Subsea Accumulator Recharge ................................................................ 40
4.2.3 Pilot Fluid Circuit.............................................................................................................................. 41
5. REQUIREMENTS FOR BOP ...................................................................................................................... 43
5.1 REDUNDANCY REQUIREMENTS FOR BOP....................................................................................................... 43
5.2 GENERAL REQUIREMENTS FOR BOP ............................................................................................................. 45
6. THE USE OF BOP IN DRILLING OPERATION ............................................................................................. 46
6.1 SHUT IN .................................................................................................................................................. 46
6.2 STRIPPING AND SNUBBING ......................................................................................................................... 47
6.2.1 Stripping in the hole with the annular preventer ............................................................................ 47
6.2.2 Stripping out of the hole with the annular ...................................................................................... 48
6.2.3 Stripping in the hole with pipe rams................................................................................................ 48
6.2.4 Stripping out of the hole with pipe rams ......................................................................................... 49
6.3 TESTING OF BOP ...................................................................................................................................... 50
6.3.1 BOP Simulation ................................................................................................................................ 50
6.3.2 BOP Testing ..................................................................................................................................... 52

Page | iv
7. SUGGESTED RISK ANALYSIS TOOLS FOR BOP CRITICALITY ASSESSMENT ................................................ 56
7.1 RELIABILITY BLOCK DIAGRAM (RBD) ............................................................................................................ 57
7.2 FAILURE MODES, EFFECTS AND CRITICALITY ANALYSIS (FMECA)....................................................................... 59
7.2.1 Failure Modes, Effects and Criticality Analysis (FMECA) Methodology ........................................... 61
7.3 CRITICALITY RANKING AND CRITICALITY MATRIX ............................................................................................. 64
7.4 REDUNDANCY AND EFFECT TABLE ................................................................................................................ 66
7.5 DISCUSSION OF THE SUGGESTED RISK ANALYSIS TOOLS FOR BOP CRITICALITY ASSESSMENT .................................... 66
8. ANALYSIS OF CRITICALITY COMPONENT IN BOP .................................................................................... 70
8.1 RELIABILITY BLOCK DIAGRAM ...................................................................................................................... 71
8.1.1 Reliability Block Diagram for Close Function of Subsea BOP control System .................................. 71
8.1.2 Reliability Block Diagram for Control Fluid Circuit and Subsea Accumulator Recharge System ..... 73
8.1.3 Reliability Block Diagram for Annular Preventer ............................................................................. 75
8.1.4 Reliability Block Diagram for Ram Preventer .................................................................................. 75
8.2 FAILURE MODES, EFFECTS AND CRITICALITY ANALYSIS (FMECA)....................................................................... 76
8.2.1 System Breakdown .......................................................................................................................... 76
8.2.2 FMECA Sheet ................................................................................................................................... 77
8.2.3 Criticality Ranking and Criticality Matrix ......................................................................................... 78
8.3 REDUNDANCY AND EFFECT TABLE ................................................................................................................ 79
9. DISCUSSION ........................................................................................................................................... 84
9.1 RESULT OF CRITICALITY ANALYSIS................................................................................................................. 84
9.2 BOP CRITICALITY COMPONENT WITH REGARDS TO THE USE OF BOP FOR WELL SHUT-IN, STRIPPING, SNUBBING AND
BOP TESTING ....................................................................................................................................................... 87
10. CONCLUSIONS ................................................................................................................................... 88
10.1 RECOMMENDATION .................................................................................................................................. 88
10.2 SUGGESTION FOR FURTHER WORKS .............................................................................................................. 89
11. REFERENCES ...................................................................................................................................... 90
12. APPENDICES ...................................................................................................................................... 93
12.1 FMECA SHEET......................................................................................................................................... 93
12.2 WELL BARRIER ELEMENTS IN DRILLING OPERATION ........................................................................................ 124
12.2.1 Fluid column .............................................................................................................................. 126
12.2.2 Casing cement ........................................................................................................................... 126
12.2.3 Casing........................................................................................................................................ 126
12.2.4 Wellhead ................................................................................................................................... 128
12.2.5 Riser (High Pressure Riser) ........................................................................................................ 128
12.2.6 Drilling BOP ............................................................................................................................... 128
12.2.7 Drill String ................................................................................................................................. 128
12.2.8 Stab in safety valve ................................................................................................................... 128
12.2.9 Casing float valves .................................................................................................................... 129
12.2.10 Production tree ......................................................................................................................... 129
12.2.11 Annulus access line and valve (AAV) ......................................................................................... 129
12.2.12 Tubing hanger ........................................................................................................................... 129
12.2.13 Diverters .................................................................................................................................... 130
12.2.14 Drilling Spools ........................................................................................................................... 130
12.2.15 Relief Lines ................................................................................................................................ 130
12.2.16 Rotating Preventer (Rotating Head/Stripper) ........................................................................... 131
12.2.17 Flex Joints .................................................................................................................................. 132
12.2.18 Wellhead Connector.................................................................................................................. 132
12.3 PRESSURES ACTED IN THE WELL ................................................................................................................ 133
12.4 BASIC WELL CONTROL METHODS .............................................................................................................. 136

Page | v
 LIST OF FIGURES

FIGURE 1.1 BARRIER FAILURES IN THE DEEPWATER MACONDO ACCIDENT (BP INVESTIGATION TEAM, 2010)................................ 1
FIGURE 2.1 THE IMPORTANT PARTS OF THE DRILLING RIG (STONELEY, R., 1995) ...................................................................... 4
FIGURE 2.2 COMPLETION BY USING LANDING STRING SYSTEMS FOR RUNNING IN MARINE RISER (SUBSEA1, 2010) .......................... 6
FIGURE 2.3 SURFACE AND SUBSEA TREE (ODLAND, J., 2010) .............................................................................................. 6
FIGURE 2.4 UNDERGROUND BLOWOUTS FROM A WELL REACH SURFACE (CHU, D., L., 2010) ..................................................... 8
FIGURE 2.5 LOSS OF STABILITY IN SHALLOW GAS KICK (RIG TRAIN, 2001) ............................................................................. 11
FIGURE 3.1 U-TUBE MODEL OF THE BOTTOM HOLE PRESSURE (GRACE, R., D., 2003) ............................................................ 15
FIGURE 3.2 FLOW CHART OF KICK CONTROL PROCEDURE (SCHLUMBERGER, 2012) ................................................................. 17
FIGURE 4.1 TYPICAL MAIN COMPONENTS IN SUBSEA BOP AND LMRP (SUBSEA1, 2010) (TRANSOCEAN, 2011)......................... 18
FIGURE 4.2 EXAMPLE OF CUTAWAY VIEW OF BLOWOUT PREVENTER STACK COMPONENTS (TRANSOCEAN, 2011) ......................... 19
FIGURE 4.3 BLOWOUT PREVENTER STACK WITH PREVENTER AND RAMS CLOSE (GOINS, W.,C., SHEFFIELD, R., 1983) ................... 21
FIGURE 4.4 TYPICAL SUBSEA BOP STACK (REES, A., DANIEL, M., 2011).............................................................................. 22
FIGURE 4.5 TYPICAL KILL AND CHOKE LINES CONFIGURATION (GOINS, W.,C., SHEFFIELD, R., 1983) .......................................... 22
FIGURE 4.6 SEALING ELEMENT AND STEEL REINFORCEMENT SEGMENTS IN AN ANNULAR PREVENTER (VUJASINOVIC, A., 1986) ....... 24
FIGURE 4.7 SHAFFER SPHERICAL BOP (RIG TRAIN, 2001) ................................................................................................. 24
FIGURE 4.8 THE CLOSING OF SHAFFER SPHERICAL BOP (RIG TRAIN, 2001) .......................................................................... 24
FIGURE 4.9 DL ANNULAR BLOWOUT PREVENTER (RIG TRAIN, 2001) .................................................................................. 25
FIGURE 4.10 PACKING ELEMENT COMPONENTS AND OPERATIONS (RIG TRAIN, 2001) ............................................................ 25
FIGURE 4.11 ANNULAR HYDRIL GK TYPE (RIG TRAIN, 2001) ............................................................................................. 26
FIGURE 4.12 ANNULAR HYDRIL GL TYPE (RIG TRAIN, 2001) ............................................................................................. 26
FIGURE 4.13 TYPICAL PIPE/CASING RAMS (RIG TRAIN, 2001) ............................................................................................ 27
FIGURE 4.14 TYPICAL BLIND/SHEAR RAM (TRANSOCEAN, 2011) ........................................................................................ 27
FIGURE 4.15 TYPICAL VARIABLE BORE RAMS (RIG TRAIN, 2001) (TRANSOCEAN, 2011).......................................................... 28
FIGURE 4.16 TYPICAL FLEX PACKER (RIG TRAIN, 2001) ..................................................................................................... 28
FIGURE 4.17 TYPICAL DUAL BORE FLEX PACKER (RIG TRAIN, 2001) ..................................................................................... 28
FIGURE 4.18 BLIND SHEAR RAMS CLOSING (GRÖNDAHL, M., ET AL., 2010) (RIG TRAIN, 2001) ............................................... 29
FIGURE 4.19 BOP CONTROL SYSTEM IN MACONDO DEEPWATER HORIZON (GRÖNDAHL, M., ET AL., 2010) .............................. 31
FIGURE 4.20 TYPICAL ELECTRO HYDRAULIC CABLE (TOP LEFT), MUX CABLE (TOP RIGHT) AND HYDRAULIC HOSE (BOTTOM) (GOINS,
W.,C., SHEFFIELD, R., 1983) (UMBILICALS, 2009) (RIG TRAIN, 2001)...................................................................... 32
FIGURE 4.21 EXAMPLE OF REDUNDANCY BETWEEN PODS AND STACK (RIG TRAIN, 2001) ........................................................ 33
FIGURE 4.22 GENERAL ARRANGMENT OF HYDRAULIC SUBSEA BOP CONTROL SYSTEM (RIG TRAIN, 2001) .................................. 35
FIGURE 4.23 SCHEMATIC OF BLOCK FUNCTION FOR SUBSEA BOP CONTROL SYSTEM (RIG TRAIN, 2001) ..................................... 36
FIGURE 4.24 SCHEMATIC OF OPEN FUNCTION FOR SUBSEA BOP CONTROL SYSTEM (RIG TRAIN, 2001) ...................................... 37
FIGURE 4.25 SCHEMATIC OF CLOSE FUNCTION FOR SUBSEA BOP CONTROL SYSTEM (RIG TRAIN, 2001) ..................................... 38
FIGURE 4.26 SCHEMATIC FLOWS OF CONTROL FLUID CIRCUIT AND ACCUMULATOR RECHARGE SYSTEM (RIG TRAIN, 2001) ............. 40
FIGURE 4.27 SCHEMATIC FLOWS OF PILOT FLUID CIRCUIT (RIG TRAIN, 2001) ........................................................................ 42
FIGURE 5.1 SUBSEA BOP STACK ARRANGEMENT (SEDCO FOREX, 1999) .............................................................................. 43
FIGURE 6.0.1 TESTING BLIND RAM (GOINS, W.,C., SHEFFIELD, R., 1983) ........................................................................... 54
FIGURE 6.0.2 TESTING PIPE RAMS, ANNULAR AND ALL CHOKE AND KILL MANIFOLDS, FLOWLINES AND BOP WING VALVES (GOINS,
W.,C., SHEFFIELD, R., 1983).............................................................................................................................. 55
FIGURE 7.1 STEP TO DETERMINE APPROPRIATE RISK ASSESSMENT (HSE, 2006) ..................................................................... 56
FIGURE 7.2 EXAMPLE OF RELIABILITY BLOCK DIAGRAM OF BOP ACTIVATION (TUMER, I., ET AL., 2010) ...................................... 58
FIGURE 7.3 FLOWCHART OF FMECA (IEC 60812, 2006) ................................................................................................ 60
FIGURE 7.4 CRITICALITY MATRIX ................................................................................................................................... 65
FIGURE 8.1 RELIABILITY BLOCK DIAGRAM FOR BOP RAMS CLOSE FUNCTION .......................................................................... 71
FIGURE 8.2 RELIABILITY BLOCK DIAGRAM FOR CONTROL FLUID CIRCUIT AND SUBSEA ACCUMULATOR RECHARGE SYSTEM ................. 73
FIGURE 8.3 RELIABILITY BLOCK DIAGRAM FOR ANNULAR PREVENTER CLOSE AND OPEN FUNCTION .............................................. 75
FIGURE 8.4 RELIABILITY BLOCK DIAGRAM FOR RAM PREVENTER ........................................................................................... 75
FIGURE 8.5 CRITICALITY MATRIX FOR BOP CONTROL SYSTEM FAILURE MODES ....................................................................... 78
FIGURE 12.1 WELL BARRIER SCHEMATIC FOR RUNNING NON-SHEARABLE DRILL STRING (LEFT) AND DRILLING, CORING AND TRIPPING
WITH SHEARABLE DRILL STRING (RIGHT) (NORSOK D-010, 2004) ............................................................................. 124
FIGURE 12.2 WELL BARRIER SCHEMATIC FOR RUNNING NON-SHEARABLE CASING (LEFT) AND DRILLING THROUGH TUBING DRILLING AND
CORING (RIGHT) (NORSOK D-010, 2004) ........................................................................................................... 125
FIGURE 12.3 CASINGS INSIDE WELLBORE (SCHLUMBERGER, 2012) ................................................................................... 127
FIGURE 12.4 FLOW OF DIVERTED GAS (LEFT) AND SCHEMATIC OF TYPICAL INSTALLATION FOR FLOATING DRILLING PLATFORM (RIGHT)
(RIG TRAIN, 2010) (HAWKER, 2001)................................................................................................................. 130

Page | vi
FIGURE 12.5 HAFFER ROTATING HEAD AND STRIPPER (GOINS, W.,C., SHEFFIELD, R., 1983).................................................. 131
FIGURE 12.6 SOME TYPE OF FLEX JOINT (OIL STATES, 2012) ........................................................................................... 132
FIGURE 12.7 WELLHEAD CONNECTOR AND ITS CONNECTION SEQUENCE (RADOIL, 2009) ...................................................... 132
FIGURE 12.8 PRESSURES ACTED IN A WELLBORE (HAWKER, D., 2001)............................................................................... 133
FIGURE 12.9 RELATIONSHIP BETWEEN DEPTH AND PRESSURE FOR DIFFERENT PRESSURES ACTING IN A WELLBORE (HAWKER, D., 2001)
.................................................................................................................................................................... 134

Page | vii
 LIST OF TABLES

TABLE 2.1 INDICATORS OF THE OCCURRENCE POSSIBILITY OF KICKS (HAWKER, D., 2001)......................................................... 12
TABLE 2.2 INDICATORS OF THE OCCURRENCE POSSIBILITY OF KICKS (GOINS, W.,C., SHEFFIELD, R., 1983) .................................. 12
TABLE 6.1 SHUT IN PROCEDURES (WELL CONTROL SCHOOL, 2004) .................................................................................... 47
TABLE 7.1 FIGURE AND FORMULA OF SERIES AND PARALLEL STRUCTURE IN RBD ..................................................................... 58
TABLE 7.2 FAILURE PROBABILITY RANK ........................................................................................................................... 64
TABLE 7.3 EFFECT SEVERITY RANK ................................................................................................................................. 64
TABLE 7.4 PROS AND CONS OF FMECA ......................................................................................................................... 67
TABLE 8.1 OPERATION MODES OF COMPONENTS FOR DIFFERENT BOP FUNCTIONS ................................................................. 72
TABLE 8.2 LISTS OF COMPONENTS AND THE CORRESPONDING FAILURE MODES ....................................................................... 76
TABLE 8.4 PRIORITIZATION OF BOP COMPONENT CRITICALITY FROM CRITICALITY MATRIX ........................................................ 78
TABLE 8.5 REDUNDANCY AND EFFECT TABLE OF SUBSEA BOP ............................................................................................. 79
TABLE 8.6 SUMMARY OF CRITICAL COMPONENT FROM REDUNDANCY AND EFFECT TABLE ......................................................... 83
TABLE 9.1 LIST OF CRITICAL COMPONENTS BASED ON THE USED RISK TOOLS ........................................................................... 84
TABLE 12.1 FMECA OF HYDRAULIC BOP SYSTEM ........................................................................................................... 93

Page | viii
 TERMINOLOGY

Annulus The space between two concentric objects, such as between the
wellbore and casing or between casing and tubing, where fluid can
flow (Schlumberger, 2012)

Blow out A flow of formation fluids into the wellbore that cannot be controlled at
surface (Schlumberger, 2012)

Bell Nipple A pipe located on the top of a casing string that provides guidance for
drilling tools into the hole .It is also called mud riser or flow stack
(Schlumberger, 2012) (Goins, W., C., Sheffield, R., 1983)

Blow Out Preventer A structure with a large set of valves and rams placed on the top of
the well that can be closed when the drilling crew have uncontrolled
flow of formation fluids (Subsea1, 2010)

Burst Pressure The differential internal pressure where a joint of casing will fail. It is a
key consideration for well control and contingency operation as well as
an indicator in the well design process (Schlumberger, 2012)

Casing Steel pipe used to protect the wall of the well after drilling to prevent it
from collapsing and prevent the fluid in the rocks to enter the well
bore. (Stoneley, R., 1995)

Caving Rocks fragments that come from the well bore but not necessarily
come from the drill bit cuttings nor drilling fluid flow (Schlumberger,
2012). It could the fragments from the broken weak or impermeable
rock formations.

Completion Assembly of down hole tubulars and equipments required to enable

safe and efficient production from an oil and gas well (Odland, J.,
2010)

Connection Gas A short entry of gas into drilling fluid in the drilling operation during
pipe connection as a result of mud pumping stoppage which allows
gas to enter the wellbore. It is also occur as a result of swabbing
effects from the drill string movement during connection
(Schlumberger, 2012)

Cut set A set of events/components in a system whose occurrence (at the

same time) ensures the system to fail (Rausand, M., Høyland A.,
2004)

Differential Sticking A situation where the drill string is stick into the well bore/bore hole
embedded by mud cake or filter cake and cannot be rotated
(Schlumberger, 2012)

Draw Works A large horizontal hoist carrying cable on the drilling rig used to raise
and lower the drill string (Stoneley, R., 1995)

Drill Bit The tool used to crush or cut rock. It works by scraping or crushing or
both, usually as part of a rotational motion (Schlumberger, 2012)

Drill Break A change in the rate of drilling penetration as a result of drilling into a
different rock formation such as from shale into limestone (Malhotra,
S., M., 2005)

Drill Collars Tube that is used between drill pipe and bit in the drill string to provide
additional weight on the bit and give more pendulum effect to the drill
string (Malhotra, S., M., 2005)

Page | ix
Drill Stem Test A test to determine the productive capacity, pressure and permeability
of a hydrocarbon reservoir (Schlumberger, 2012)

Drill String The steel pipe where the drill bit is attached on the bottom and which
is rotated in the well during drilling. It consists of section(s) with a
length of 30 ft (Stoneley, R., 1995)

Drilling Fluid/Mud A fluid that is used in drilling operation that contains solid
suspensions, mixtures and emulsions of liquid, gases and solids
(Schlumberger, 2012)

Emergency Disconnect A package which enables quick disconnection between marine riser
Package and blow out preventer (BOP) in case of emergency (Subsea1, 2010)

Equivalent Mud Weight specific weight of drilling mud that is exerted to hold the pressure of
the formation fluid in the equivalent value (SPE E&P, 2011)

Flowing Well A well that has enough natural pressure from reservoirs to flow oil
without the aid of pump (Schlumberger, 2012)

Gas-Cut Mud A drilling fluid that is contaminated by gas causing reduction in its
density (Schlumberger, 2012)

Hydrostatic Pressure The pressure exerted by a fluid at rest. It increases along with the
density and depth of the fluid and is expressed in pounds per square
inch (psi) (Malhotra, S., M., 2005)

Kelly The top section of the drill string, square or hexagonal in cross
section. It is used to transmit rotary motion from the rotary table or
kelly bushing to the drillstring, while allowing the drill string to be
lowered or raised during rotation (Schlumberger, 2012)

Kelly Bushing An adapter to connect the rotary table to the kelly (Schlumberger,
2012)

Kick An incoming flow of formation fluid into the wellbore that can be
controlled at surface (Hawker, D., 2001)

Kill Stop the flow of fluid inside the wellbore by circulating higher mud
weight to balance the pressure in the well when influx (kick) occur
(Schlumberger, 2012)

Landing String A tool to facilitates well control during completion and workover
operations (Subsea1, 2010)

Log (Logging) The examination of one or more physical characteristics in or around a

well against the depth or time or both (Schlumberger, 2012)

Lower Marine Riser Package A package that makes a quick disconnection between marine riser
and blow out preventer (BOP) in case of emergency (Subsea1, 2010)

Lower Riser Package A package which enables well control in case of emergency
(Subsea1, 2010)

Marine Riser A pipe connection between drilling platform and Blowout Preventer
(BOP) on the seafloor (Subsea1, 2010)

Minimum cut set A cut set that cannot be reduced without losing its status as a cut set
(Rausand, M., Høyland A., 2004)

Minimum path set A path set that cannot be reduced without losing its status as a path
set (Rausand, M., Høyland A., 2004)

Page | x
Nipple Part of a pipe which have threaded section at both ends with male
threads (Schlumberger, 2012)

Open Hole Parts of a well that are not protected with casing (Schlumberger,
2012)

Path set A set of events/components in a system whose occurrence (at the

same time) ensures the system to function (Rausand, M., Høyland A.,
2004)

Pay/Pay Zone A reservoir or portion of a reservoir which contains economically

producible hydrocarbons (Schlumberger, 2012)

Perforation The path or channel in the final casing or liner that gives
communication into the reservoir formation where hydrocarbon is
produced (Schlumberger, 2012)

Rate of Penetration A rate of how fast the bit drills into formations, usually expressed in
feet or meters per hour or minutes per foot (meter) (Malhotra, S., M.,
2005)

Rotary Table The rotating part of the drill floor that supplies power to rotate the drill
string in a clockwise direction (Schlumberger, 2012)

Shut In Sealing a well to protect against kick by closing BOP and chokes
(Malhotra, S., M., 2005)

Slips A device used to grip and suspend the drill string on the rotary table
(Schlumberger, 2012)

Snubbing The process of placing drill pipe into the well bore by pushing it down
when the BOPs are closed and pressure is contained in the well. The
pushing force is necessary because the pressure inside the wellbore
exerting the pipe upward. It is important because well kill operations
should always be conducted when there is drill pipe inside the well
bore. (Schlumberger, 2012)

Spacing out measurement of average length of drill pipe in the well to prevent the
BOP close on tool joints or drill collar (Well Control School, 2004)

Stand The number of joints of pipe that can be pulled and stood back at one
time by the rig, e.g., double or triples (GEKEngineering, 2010)

Stripping The process of placing drill pipe into the well bore by its own weight
when the BOPs are closed and pressure is contained in the well. It is
important because well kill operations should always be conducted
when there is drill pipe inside the well bore. (Schlumberger, 2012)

Swabbing The situation where drilling fluid tends to follow the drill string as it is
pulled from the hole causing a reduction in well/annulus (Malhotra, S.,
M., 2005)

Thief Zone A formation encountered during drilling into which circulating fluids can
be lost (Schlumberger, 2012). Usually as a result of large open pores
in the formation where sealing mud filter cake cannot be formed
(Westergaard, R., H., 1987).

Transition Zone A zone where the type of flow is changing as a result of gas breakout,
gas expansion, shear or turbulence (SPE E&P, 2011)

Trip Margin An amount of additional mud weight that is used to balance the
reduced mud pressure in the well bore as a result of swabbing effect
when performing tripping out of the hole (Malhotra, S., M., 2005)
Page | xi
Trip Tank A small mud tank with a capacity of 10-15 barrels (1590–2385 liters)
usually with 1 barrel or 0.5 barrel (159 or 79.5 liters) divisions, used to
make sure the required amount of mud when it is displaced by drill
pipe (Malhotra, S., M., 2005)

Tripping Pulling out or replacing the drill string from the hole to change the
inefficient and dulled drill bit (Schlumberger, 2012)

Tool Joint The enlarged and threaded ends of joints of drill pipe used as a pipe
connection (Schlumberger, 2012)

Tool Pusher Supervisor for the drilling contractor to accommodate administration

including materials, spare parts and crew’s quality assurance for
efficient operations (Schlumberger, 2012)

Top Drive A pipe rotation mechanism in the travelling block section used to turns
the drill string. It is suspended from the hook, so the rotary mechanism
is free to travel up and down the derrick (Schlumberger, 2012)

Tubing Hanger Running Tool Tools for installation/retrieval of tubing hanger (Subsea1, 2010)

Underground Blowout An uncontrollable flow of fluids from one formation into another
weaker formation through wellbore. One formation could make a kick
while at the same time another formation is losing circulation (Hawker,
D., 2001)

Weight on Bit The additional weight on a drill bit by adding drill collars to improve
rate of penetration (Malhotra, S., M., 2005)

Wellhead The equipment used to seal and control the flow of fluids from the well
that is attached on the top of the well and act as an interface between
the X-mas tree/tubing hanger and the well. (Odland, J., 2010),
(Subsea1, 2010)

Workover Riser A pipe connection between the drilling platform and the landing string
deployed inside the marine riser to give the availability of circulate
fluid, test production, well control and deployment of wireline tools
(Subsea1, 2010)

Wireline Activities related to logging which employs an electrical cable to lower

tools into the wellbore and to transmit data (Schlumberger, 2012)

X-mas Tree A structure consists of control valves, pressure gauges and chokes
located at the top of a well where the primary function is to control the
flow into or out of the well (Odland, J., 2010)

Page | xii
 ABBREVIATIONS
f feet
g gravity (specific gravity)
m Meter
psi Pounds per Square Inch
AAV Annulus Access Valve
AMF Automatic Mode Function
AP Annular Preventer
BOP Blow Out Preventer
BSEE Bureau of Safety and Environmental Enforcement
DST Drill Stem Test
EDP Emergency Disconnect Package
EMW Equivalent Mud Weight
ETA Event Tree Analysis
FCP Final Circulating Pressure
FMEA Failure Modes, Effect Analysis
FMECA Failure Modes, Effect and Criticality Analysis
FTA Fault Tree Analysis
GOM Gulf of Mexico
HCR Hydraulically Controlled
KT Kick Tolerance
LMRP Lower Marine Riser Package
LOT Leak Off Test
LOP Leak Off Pressure
LPR Lower Pipe Ram
LRP Lower Riser Package (LRP)
MAASP Maximum Allowable Annular Surface Pressure
MPR Middle Pipe Ram
MTTF Mean Time To Failure
MTTR Mean Time To Repair
MW Mud Weight
NCS Norwegian Continental Shelf
OCS Outer Continental Shelf
PLMV Production Lower Master Valve
PMV Production Master Valve
PUMV Production Upper Master Valve
PPG Pounds Per Gallon
PWV Production Wing Valve
P&ID Piping and Instrumentation Diagram
QRA Quantitative Risk Analysis
ROP Rate of Penetration
ROV Remotely Operated Vehicles
Page | xiii
RPN Risk Priority Number
SCR Slow Circulating Rate
SEM Subsea Electronic Module
SG Specific Gravity (gm/cc)
SICP Shut In Casing Pressure
SIDPP Shut In Drill pipe Pressure
THRT Tubing Hanger Running Tool
TVD True Vertical Depth
UPR Upper Pipe Ram
WOB Weight on Bit

Page | xiv
1. INTRODUCTION

1.1 Background
Safety during drilling operations is the most important aspect to be considered.
Procedures, design, specifications and requirements of all aspects of drilling activities are
established to make sure that the operation is safe. All companies and organizations which
participate in drilling operations should perform and implement their activities to valid and
approved standards and regulations. Standards and regulations vary for different geographic
areas, due to many factors such as government policies, level of safety, environmental and
geographical condition, etc. It should also be updated continuously to meet the specific
needs and requirements which are relevant to present situation.

There are many problems that might occur during well drilling operations, particularly
for subsea well drilling where remoteness and access become challenges during operations.
One of the main issues that could result in a catastrophe is the occurrence of kick (influx).
Kick is described as the unwanted influx of formation fluid into a wellbore during drilling
operation as a result of pressure difference in the wellbore. This influx is unwanted because
it can flow into surface and create blowout which can harm people's lives, the environment
and cause property damage. The pressure inside wellbore, which is exerted by drilling fluid
through drill bit, should be higher than the pressure from the formation fluid in order to make
a controllable well drilling. This is known as overbalanced pressure condition. Safety
precaution should be established for procedures and equipments to handle kicks and
blowouts. The blowout preventer (BOP) is one of several barriers in the well to prevent kicks
and blowouts and it is the most important and critical equipment as it becomes the last line of
protection against blowout. The BOP is a structure with a large set of valves and rams placed
on the top of the well that can be closed when the drilling crew have uncontrolled flow of
formation fluid in the wellbore. If the BOP is not working properly during a kick, it will keep the
well open and which can lead to a kick flow to surface and it can become a blowout.

Figure 1.1 Barrier failures in the Deepwater Macondo Accident (BP Investigation Team, 2010)

Page | 1
 Figure 1.1 shows an example of how barrier failures escalated into a disaster at the
Macondo Deepwater Horizon accident on 20 April 2010. In this case the last and very critical
barrier, the blowout preventer, failed causing uncontrolled explosion and fire resulting in
eleven losses of lives, massive oil spill, environmental damage, loss of asset and reputation
as well as the impact on cost. According to the BP Investigation Team (2010) the causes of
the barrier failures were not only from technical problems, but also from other factors such as
human error, management and organizational issues. Some of them are related to the
discrepancies of the standard and requirement for the drilling operation, particularly for BOP
maintenance, procedure and operations. Therefore it is very important to identify and
describe the critical components in a BOP to ensure the functionality of BOP by having the
right components that should be put more focus for maintenance and testing.

1.2 Purpose
The purpose of this thesis is to determine the criticality of components in BOP related
to the redundancies they have for well shut in, stripping, snubbing and BOP testing
operation.

1.3 Content
This thesis describes general activities of drilling and the problems that might occur
such as kicks and blowouts. The blowout preventer (BOP) as the main barriers against kicks
and blowouts is the main focus in the report. Work principles, components and the use of
BOP for different operations are described. The analysis of critical component in a BOP
during drilling operation is discussed. To support the analysis of the criticality, some risk
assessment tools are used such as reliability block diagram, failure mode effect and criticality
analysis (FMECA), criticality matrix, redundancy and effect table. Standards and regulation
regarding to the requirements of BOP are identified to make sure the alignment of the
analysis against them.

To provide a thorough knowledge, this thesis consists of some chapters which are
structured in sequence. Chapter one, gives a background, purposes, content, methodology
and limitation of the thesis. Second chapter presents the general operations of drilling and
how kicks can be evaluated. Kicks and blowouts as part of the problems in drilling operation
are described together with its causes and indications. In order to cope with kicks problems,
basic well control principles are described in chapter three. The equipments needed to
control and eliminate kicks such as BOP stack and BOP control system are described in
chapter four. These equipments are somehow should have redundancy in order to ensure
the availability and reliability of the functions. The minimum redundancy requirements are
described in chapter five including other general requirements for the design of BOP. It refers

Page | 2
to a company policy (Sedco Forex and Schlumberger) and local regulations BSEE for OCS
(e.g., GOM). The use of BOP in drilling operations is described in chapter five. It includes
some procedures for conducting well shut in, stripping, snubbing and testing of BOP. In order
to conduct criticality analysis of blowout preventer, the suggested risk tools is presented and
discussed in chapter seven. It includes reliability block diagram, FMECA, criticality ranking,
criticality matrix, redundancy and effect table as the main discussion. The analysis of
criticality by using the suggested risk tools is presented in chapter eight. Chapter nine
present and discuss the result of criticality analysis of component in BOP as well as a
discussion with regards to the use of BOP in drilling operations. Some conclusion,
recommendation and suggestion for further works are presented in chapter ten. The rest of
the report consists of references and appendices presented in chapter eleven and twelve.

1.4 Methodology
The methodology use in this thesis is an integrated process of guidance from
supervisors, discussion with practitioners, literature study through textbooks and publications
to describe drilling activity in general and to focus on the BOP by defining its function,
principal, components, characteristics and operations. Relevant factors that influence the
criticality of components in a BOP are described and analyzed through the literature study,
aid of supervisor and practitioners. In order to analyze the criticality component of BOP,
some suggested risk tools are presented and discussed. It includes reliability block diagram
(RBD), failure modes, effects and criticality analysis (FMECA), criticality ranking, criticality
matrix, redundancy and effect table. All of these methods are complement to each other to
support the decision of the critical component in a BOP.

1.5 Limitation
This study is intended to analyze the criticality of component (barriers) in a subsea
BOP. It is only focus to the components of BOP in the general stack arrangement and
general control system. The analysis is conducted related to the drilling operations where the
BOP is used as it gives the most contribution for the occurrence of kicks. The discussion and
analysis are to some degree refers to general operations of drilling due to many variations in
applications for drilling technologies, methods, government and company regulation.
Moreover, the analysis is limited to qualitative approach as there is a scarce of quantified
data and the limited amount of time for the works of the report.

Page | 3
2. BASIC WELL DRILLING CONCEPT

2.1 Drilling and Completion

Drilling an oilfield is an elaborate tasks which consists of drillers, complex machineries,
tools and equipments that are use to drill a well up to five to six miles below the ground to
reach hydrocarbon reservoirs as efficiently and as safely as possible. All necessary
equipments are mostly driven from a drilling rig which is use to lower a set of steel string
carrying drill bit to make a hole and to pull it out again (Stoneley, R., 1995). Drill rigs have
their own specifications and equipments needed to perform the drilling, but generally it can
be as shown in the figure 2.1 below.

The drill bit is connected to the

bottom of the drill string where the drill
collars can be attached on it to add
more weight which is necessary to give
more efficient force to break rock
formation. Lowering and raising these
sets of drill pipes are done by means of
draw-works which is connected to the
travelling block. It also used to endure
most of the weight of the drill string(s),
drill bit and drill collar(s). The drillers
should monitor the required weight of
the bit to control the amount of the
added weight applied.

Drill string and drill bit are both

rotated by rotary table where kelly
bushing are attached and connected to
the drill string via kelly. The rotary table
itself is driven by rig motor.

Figure 2.1 The important parts of the drilling rig

(Stoneley, R., 1995)

Alternatively a top drive could be used instead of rotary table. A top drive is a device that
turns the drill string(s) from above where it is suspended from the hook (travelling block), so it
gives free vertical movement while rotating. Kelly and kelly bushing allow connection
between drill strings as the well is drilled deeper while maintaining its flexibility to rotate, raise
and lower the drill string and the drill bit.
Page | 4
 Debris and cuttings of rock during drilling are carried out from the well bore into the
surface by drilling fluid (mud) to be collected, examined and logged. The rock sample gives
information about the formation of rock in the different depths of a well and also to give
indication for the potential hydrocarbon location. Moreover, drilling fluid lubricates and cools
the drill bit, balances the pressurized formation fluid that flow in the well bore and cleans out
the hole. Figure 2.1 shows the flows and circulations of drilling fluid which is pumped from
the mud tank into the kelly through flexible mud hose, down the hole of the drill string until it
reaches and out from drill bit, goes up again to the surface carrying debris through annulus
and vibrating screen to separate debris and cuttings from the mud before it end up in the
mud tank again. The volume in the mud tank and the composition of mud after circulation
could be a good indicator for the integrity of the well.

Protecting the wall of the hole after drilling is important to prevent it from collapsing,
loss of circulation and withstand the hole from the kick. Casing is established in some depth
of the well and the diameters (sizes) are varies according to the depth and formation
characteristics. Generally, the deeper the depth, the less the diameters and sizes are. There
are several concentric casing that would be required in the well such as conductor casing,
surface casing, intermediate casing and production casing. In some depths of the well,
usually where the production casing and production tubing are in place, packer would be
placed in their annulus to make sure it seals completely.

Another kind of protection is blow out preventer (BOP). It is used to close and seal the
well if the drilling crew loss control of formation, also known as kick and blowout. It is
attached on the top of the well and consists of some types of rams that can be used for
different purposes when closing a well in the emergency situation. BOP is very critical to the
safety of the crew, the rig, and the wellbore itself (Subsea1, 2010).

Cementing job is important after casing has been placed in order to prevent the loss of
drilling fluid and to seal the annulus between casing and well bore by filling it with proper
cement so there is no spaces in the annulus. Primary cementing is placed right after the
casing has been run into the hole and if deficiency occurs, then secondary cementing might
be done. Casing and cementing operations are parts of the well completion during drilling
operation. Drilling and completion operations usually are in line as they are acted as
complement to each other to make a good well integrity.

Offshore drilling operations have quite similarities with the onshore drilling as
mentioned above. There are some differences in the equipments used particularly during
completion as it is drilled from the seabed. Marine riser, work over riser, lower marine riser
package (LMRP), lower riser package (LRP), emergency disconnect package (EDP), landing
string and tubing hanger running tool (THRT) might be used. There are many different
systems and approaches that can be used, but the most common systems are landing string

Page | 5
systems for running in marine riser, simplified landing string systems for running in marine
riser, open water systems with workover risers and riserless open water system (Subsea1,
2010).

Figure 2.2 shows the example of

completion by using landing string
systems for running in marine riser.
The number of components can be
listed as follows (Subsea1, 2010) :

1. Surface Flow Tree

2. Rig
3. Marine riser
4. Workover riser
5. LMRP
6. Landing string
7. BOP
8. THRT
9. Tubing hanger & X-mass tree
10. Wellhead
11. Completion/tubing
12. Well
Figure 2.2 Completion by using landing string systems for
running in marine riser (Subsea1, 2010)

The offshore drilling can be

done from fixed structures (e.g.
jacket platform, gravity based
platform, etc) or floating structures
(e.g. semisubmersible platform). To
secure the position of drilling on the
seabed, subsea drilling template
might be used. Blow out preventer
and X-mass tree could be installed
on the platform (surface/dry tree) for
fixed platform or on the sea bed
(subsea/wet tree) for floating
platform where the well head is
attached on the seabed.
Figure 2.3 Surface and Subsea Tree (Odland, J., 2010)
Page | 6
 The tree is installed by replacing (removing) BOP during completion operation when
drilling is finished and the well is ready for production. To start production, perforation is
conducted by making a hole in the casing and formation. The hole in the formation will make
a differential pressure which allows the hydrocarbon to flow from high pressure reservoir into
the lower pressure of well and up to the surface. The flow of the fluid is control by the tree.
The design, installation, operation and maintenance for surface trees are simpler than for wet
tree.
The design of well construction is different from one area to other area, it depends on
the location (depth) of the reservoir, layers of rocks that should be drilled, drilling fluid,
pressure, temperature, integrity, fracture strength, hole stability of the formation, the available
equipment, the economic operation and most importantly the safety of personnel. Here is an
example of typical well construction in the North Sea (Odland, J., 2010), (Serene Energy,
2010):

1. Drill 30” – 36” hole to approximately 120 m below seabed by using sea water as a
drilling fluid. To place the conductor, it can also be done by using piling technique.
2. Set conductor of 30” diameter.
3. Drill 26” surface hole to approximately 500 m by using mud as a drilling fluid.
4. Run and set 20” surface casing.
5. Cement surface casing and wellhead housing is installed on the top of the casing to
provide the weight support of the casings that will be installed after. The BOP is also
installed on the top of the casing to anticipate the possibility of high pressure
formation fluid that might contain in the next drilling phase.
6. Drill 17½ “ intermediate hole to approximately 1800 m.
7. Run and set intermediate casing (13 3/8”).
8. Cement intermediate casing.
9. Drill 12 1/4” hole to top of reservoir. In this dept there would be a possibility of
hydrocarbon presence in the formation and the sample of drill cutting are collected
and examined. The formation in the well is also examined by using wireline technique
to know the porosity of the rocks, shale and sands. Drill stem test can also be
performed here after knowing the possibility of potential hydrocarbon and the
formation fluid that flows in the well.
10. Run and set production casing (9 5/8”)
11. Cement casing.
12. Drill 8 ½” hole.
13. Run, set production tubing (7”) and placed packer in the annulus between production
casing and production tubing
14. Remove BOP and replace with Xmass tree
15. Perforate and production

Page | 7
2.2 Kicks and Blowouts
During drilling operations many problems that can occur such as casing collapse,
casing burst, kick, blow out, leaking tube, gas filled casing, etc. Kick and blow out could
result in the most catastrophe event in the term of costs, assets, environmental damage and
personnel safety when its occurrences and escalations are not handled properly. A kick
should be detected early before it reached surface and become a blow out. The crew who
work with drilling activities should understand the behaviors and characteristics related to the
kick as well as the principles, the causes, the warning signs and the indicators. Drilling and
tripping activities are contributing the most for the kick event to occur. In addition, it is also
very important to comprehend the theories and procedures for well control operations.

The causes of kicks and blowouts are principally a result of pressure difference in the
annulus between the wellbore and the formation. The pressures that are exerted from the
drilling fluid should balance the pressure from the formation fluid. It should be larger than the
pressure of fluid from the formation. However, the drilling fluid pressure could not be larger
than the fracture pressure in the formation which can cause a formation fracture. When
fracture occurs, there will be a diversion flow of drilling fluid (mud) into the fracture area
resulting in a loss of mud circulation which reduces hydrostatic pressure in the annulus
allowing formation fluid to flow up through the annulus and possibly to the surface. Moreover,
the fractured formation allows high pressure fluid to flow inside it and if the formation is weak
the flows could break the weaker formation above and reach the surface on any random
location known as cratered blowout. The blowout will make well control operations become
harder.
Kick is occur when the pressure of drilling fluid
(mud) in the wellbore has less pressure than the
pressure flows in the formation fluid, whether as a
result of the loss of mud circulation or increase
pressure in the deeper formation, making an
unwanted influx of formation fluid into the wellbore. A
blowout (surface blowout) occur when an
uncontrolled kick in the wellbore reaches the surface,
endanger the safety of rig, personnel and
environment. Underground blowout occurs when the
uncontrolled flow of formations is flowing into another
weaker formation.

Figure 2.4 Underground blowouts from a well reach surface (Chu, D., L., 2010)

Page | 8
 Blowout could occur when there are some failures in the equipment, operations caused
by human error and the force of nature such as annular losses, poor cement, casing failure,
swabbing, low density of mud weight, tubing plug failure, well test string failure, gas cut mud,
unexpected high well pressure, trapped gas behind casing, shallow gas, etc (Hauge, S. et
al., 2011).

Drilling from a floating platform gives another challenge when bad weather occurs or
when there is a problem with station keeping. The platform might have to disconnect LMRP
from BOP and the well is shut in. If there is a kick and the well is not stable a blowout might
occur. Ship or platform collision could also become an indirect cause of a blowout. Gas
blowout around the pipe could sink a floater in a relatively shallow water as a result of
decrease buoyancy (Goins, W.,C., Sheffield R., 1983).

The well need to be shut in when there is a kick and surface shut in pressure is
required to add more pressure balance in the bottom hole of the well which gives additional
pressure that are already exerted by drilling fluid (mud hydrostatic). Both pressures (surface
and drilling fluid pressures) should not exceed the maximum fracture pressure in the
formation and there would be a maximum allowable annular surface pressure (MAASP).

Pfrac > Phyd at shoe + Pshut in (MAASP)

Therefore, MAASP = Pfrac – Phyd at shoe

In addition to the maximum annular surface pressure, we also need to know the
maximum pressure that can be exerted by drilling mud without fracturing the formation called
kick tolerance (KT).

KT = [TVDshoe x (Pfrac – MW)] / TVDhole

𝑇𝑉𝐷 𝑠𝑕 𝑜𝑒 × 𝑃𝑓𝑟𝑎𝑐 −𝑀𝑊 𝑖𝑛𝑓𝑙𝑢𝑥 𝑕𝑒𝑖𝑔 𝑕𝑡× 𝑀𝑊−𝑔𝑎𝑠 𝑑𝑒𝑛𝑠𝑖𝑡𝑦

𝐾𝑇 = 𝑇𝑉𝐷 𝑕 𝑜𝑙𝑒
− 𝑇𝑉𝐷 𝑕 𝑜𝑙𝑒

2.2.1 Causes of Kick

Kick occurs when there is underbalanced pressure in the well. The under balance
could occur principally when there is a deviation in the drilling fluid volumes and pressures
that are acted in the well. According to Rig Train (2001), the main causes of kick are failing to
fill the hole properly when tripping, swabbing in a kick while tripping out, insufficient mud
weight, abnormal formation pressure, lost of circulation, shallow gas sands and excessive
drilling rate in gas bearing sands.
a. Deviation in the drilling fluid as a result of:

i. Tripping
Tripping will create additional volume of drilling fluid that need to be filled in the
well replacing the volume of the pulled pipe/string. If the volume of the drilling fluid
Page | 9
 is reduced or not maintained properly, there will be a reduction in the hydrostatic
pressure in the drilling fluid giving the possibility of formation fluid to enter the
wellbore. In this case keeping the hole full when drill string are pulled from the hole
is very important

ii. Fracture formation

Fracture could happen naturally in the formation or when it is not strong enough to
hold the pressure coming from the drilling fluid. It will lead to a deviated drilling fluid
flow from annulus into formation resulting in a loss of mud circulation in the well
and reduces well pressure. The loss of circulation could also happen when the
drilling fluid flow into thief zone. According to Nas (2011), the fracturing of
formation could be the result of excessive in drilling fluid density, surface back
pressure and annular circulating pressure. In addition, pressure surges related to
pipe movement and breaking circulation could also become the source of fracture
formation.

iii. Insufficient mud weight

Principally when the drilling fluid hydrostatic is less than the hydrostatic exerted by
the formation, there will be influx in the wellbore. Insufficient mud weight can be
the result of unexpected penetration fluid from abnormally high pressure zone.
Dilution of mud weight with water, for example in mud tank, could also become the
causes of insufficient mud weight. In addition, mud weight are reduced intentionally
for the underbalanced drilling operation (Rig Train, 2001)

b. Deviation in the hole pressures as a result of:

i. Swabbing and surging

Swabbing is the situation where drilling fluid tends to follow the drill string as it is
pulled from the hole causing a reduction in well/annulus (Malhotra, S., M., 2005).
According to Hawker (2001), swabbing effect could be overcome by having a
slower speed when pulling the pipe and maintain low mud viscosity

ii. Excessive rate of penetration (ROP) during drilling in the gaseous formations could
create the release of gas into the hole and it will give some void in the drilling fluid
resulting in loss of annular pressure. The characteristics of gas can be described
with the relationship between pressure, volume and temperature. Pressure and
volume varies inversely with temperature (PV/T) with the constant value. The
pressure will be higher in the deeper depth and vice versa. From here we can see
that when we have a constant value of PV/T, half pressure (half depth) will result in
double volume and vice versa. In application, gas will have double volume as the
depth is reduced into half. Therefore, the volume of gas in the surface is much

Page | 10
 bigger compare to the volume of gas when it is still in the bottom of the hole.

iii. Underpressured formations could occur when there is a fracture resulting in

diversion of drilling fluid that creates loss of circulation

iv. Overpressured formations occur when the pressure in the formation exceeds the
annular pressure.

v. Shallow gas
In most cases of gas influx, gas is much lighter than the normal drilling mud
hydrostatic causing fast flow of gas up to the surface. The behavior of gas that can
expand as the pressure is reduced resulting in quick migration of gas from the
wellbore into the surface. This situation is very critical to the operator as they must
act quickly and properly to know the sign of influx and the treatment of gas influx.
Furthermore, it is also very dangerous to the integrity of the hole, particularly when
the drilling progress is still in the shallow depth. In the shallow hole, the short
surface casing is placed in a relatively weak formation giving the possibility of
fracture and broaching. It is necessary to divert the flow of gas influx instead of
shut in the well to reduce the risk of formation fracture. In case of gas influx during
drilling from floating platform, the occurrence of fracture on seabed which gives
expanding air bubbles could cause instability to the platform and even could
sinking the platform. The risk for shallow water drilling is higher than drilling in the
deeper water.

Figure 2.5 Loss of stability in shallow gas kick (Rig Train, 2001)

Page | 11
2.2.2 Kick Warning Signs

According to Hawker (2001), there are a number of signs that are potential to become a kick
and can be categorized in three areas such as shown in table 2.1 below.

Table 2.1 Indicators of the occurrence possibility of kicks (Hawker, D., 2001)
Area Indicators
Lost Circulations Zones - Large surge pressures (sign of formation fracture
and loss of circulation)
- Increase in ROP and irregular torque (sign of
fracture formation)
- Reduction in the volume of the returned mud
(indicate loss of fluid into formation)
Transitional Zones - Increase in ROP
- Increase in gas levels
- The occurrence of connection gas
- Hole instability indications such as irregular torque,
drag, etc
- Increase in mud temperature
- Increase in cutting volumes
- Reduce shale density
Sealed Overpressured Bodies - Immediate change in ROP (indicate pressure
differential and high porosity in the formation)

The indication of kicks are varies according to the permeability of the formation and the
pressure exist in the hole. Goins and Sheffield (1983), mentioned some indications of kick in
different pressure and permeable formation.

Table 2.2 Indicators of the occurrence possibility of kicks (Goins, W.,C., Sheffield, R., 1983)
Area Indicators
Very permeable formation underbalanced by mud - Increasing flow rate and pit volume
pressure - Reduction of drill pipe pressure and increasing
pump rate
Very permeable formation slightly underbalanced by - Initially small rate of flow and slow pit level gain
mud pressure - Expansion of gas at surface causing :
- Reduction in bottom hole pressure
- Rapid increase of flow in the bottom
- The occurrence of drilling break
Low permeability formations underbalanced by mud - Slow rate of pit gain level and gas cut mud
pressure
Formation with slightly overbalanced by mud - Increase in pit volume
Pressure - Occurrence of small amount of gas after mud
circulation

Page | 12
2.2.3 Indication of Kicks

1. Indications of kicks while drilling (Hawker, D., 2001):

a. Increase or decrease of pump pressure (pumping rate) gradually or exponentially
b. Increase of mud flow from annulus. The measurement of mud flow can be done with
flow meter
c. Increase in mud pit volumes
d. Contaminated mud marked with the reduced in mud density, change in chloride
content, change in mud pressure and temperature.
e. The appearance of connection gas due to pipe connection or caving signed with the
reduction in pressure and mud hydrostatic
f. Variations in weight on bit (WOB)

2. Indications of kicks while tripping (Hawker, D., 2001).

a. Insufficient volume of drilling fluid in the hole due to swabbing effect or loss of
circulation. It can be balanced by adding some pressures according to the trip margin.
b. The change in a trip tank volume due to swabbing effect
c. Increase of mud volume in a trip tank
d. Mud flowing at surface
e. Increase of mud levels added by caving indicate the possibility of influx
f. Pinched bit shows imbalance pressure in the hole. When the drill pipe or drill bit is
stuck or broken, circulation of mud might not flow properly causing a possibility of
harder well control (Westergaard, R., H., 1987)

3. Indications of kick while pulling out of the hole is quite similar to the indications while
tripping as it has the same operations. In addition, a small flow of mud in the flow line
and the reduction of fluid level during pulling could contribute the indication of kick.

Page | 13
3. BASIC WELL CONTROL PRINCIPLES
When a kick occur, the well need to be closed (shut in) to control the kick. However,
not every situation with kick should be handled through well shut in. There are factors such
as pressure, casing depth and formation strength that need to be considered before
choosing to shut in a well. First consideration is that there would be an increase of pressure
in annular which will give a possibility of formation fracture when a shut in is initiated. The
fracture could cause other problems such as loss of circulation. Moreover, if the casing is set
shallow, it could create fracture until it reaches surface. This phenomenon is also known as
"broaching" which is very dangerous to the safety of personnel and can result in loss of well
and rig. Therefore, according to Goins and Sheffield (1983), a well should only be shut in
when there is an influx of formation fluid and no possibility of broaching to occur. Casing
depth and formation strength should be measured to determine the well shut in possibility.
The reasons to shut in the well are to protect the crew and rig, stop the influx of formation
fluid into the wellbore, allows shut in pressure to be determined and provide opportunity to
organize the kill procedure (Well Control School, 2004, p.5-2)

There are some considerations when performing drilling on a floating platform

regarding to the kick killing procedure (Goins, W.,C., Sheffield R., 1983) :

 The fracture gradient in deep water are less which require additional casing strings
to protect the formation from fracture
 There is a possibility that the floater sink if a gas blowout occur around the string
and in relatively shallow water
 There will be an increase of bottom hole pressure as the effect of long choke lines
from the subsea wellhead to the choke at surface.
 Special procedure should be established to cope with the vessel's motion in order to
perform kick killing

When a kick occur, there are two basic principles that can be used in order to balance
the pressure in the well. First, is to give additional pressure into the well to counter the
pressure from the kick and secondly by adding mud weight so it gives higher hydrostatic that
can balance the formation pressure.

For a drill bit and the circulation of fluid that take place in the bottom of the hole,
principally there are two pressures that are contained in the well during drilling to balance the
pressure in the well. One is the pressure in the drill pipe and one is in the casing (annulus).
U-Tube model is present to illustrate the pressure in the bottom of the hole and further to
measure the required pressure and mud weight that might be needed to balance the
pressure in the well. On the left side of the tube is drill pipe and on the right side is the
annulus (Grace, R., D., 2003).

Page | 14
 SIDPP SICP

Figure 3.1 U-Tube model of the bottom hole pressure (Grace, R., D., 2003)

During shut in process these pressures are called shut in drill pipe pressure (SIDP) and
shut in casing pressure (SICP). The principle is to balance the pressure both in drill pipe and
annulus so there is no influx takes place in both holes. The minimum requirement to balance
the pressure is when bottom hole pressure is equal to mud hydrostatic. In case of kick occur,
bottom hole pressure is equal to the formation kick pressure which shows the highest
pressure in the well for balance situation. SIDP is required when hydrostatic mud in the drill
pipe is less than the pressure exerted by the formation/kick. In the same way SICP is also
required when the hydrostatic mud and hydrostatic of influx is less than the pressure exerted
by the formation/kick. Therefore, in order to balance the pressure in the bottom hole we can
conclude that:
Phyd mud drill pipe + SIDP ≥ P formation / kick

Phyd mud casing/annulus + Phyd mud influx + SICP ≥ P formation / kick

The above method is only useful when the influx is happening in the bottom of the hole.
In case that it happens in other places or any other type of influx with related operation (e.g.
kick in the middle of the well with further migration), then other method would be useful. The
U-tube principal is quite useful in determining the early estimation of influx. The influx volume
is normally assumed to be equal to the increase in a pit volume. The indication of migration
of gas influx during shut in is when SICP never reach the estimate balance condition while it
is still increasing (Hawker, D., 2001).

The required mud weight to counter the pressure of the influx is called kill mud and it is
circulated into the well with an initial slow circulating rate (SCR) to minimize the excess of
pressure in the well. As the heavier mud is replacing the lighter mud, pressure exerted by the
pump into drill string can be reduced. When the kill mud has replaced all the lighter mud, the
pressure should be kept constant and final circulating pressure (FCP) can be reached. These
procedures are often called constant bottom-hole pressure method. In order to make it
practicable the drill pipe should be in the bottom-hole to give the required mud density to kill
Page | 15
the well. If there is no pipe in the hole, the pipe must be placed inside by using either
stripping or snubbing method.

In order to control the well when influx occurred, there would be some procedures
before commencing one of the above methods. Figure 3.2 shows an example of flow chart
for a kick control procedure during drilling, tripping and pulled out of hole (no pipe in BOP).

Page | 16
 Well influx

operation
in progress

Pulled out of
Drilling bit hole, no pipe in
Tripping
on bottom BOP

Install open Close shear

Raise kelly rams
kelly cock

Close kelly Open

Stop pump choke line
cock

Close close
Annular annular
Preventer preventer

Open Open
choke line choke line

close kelly
Collars Yes
choke
in BOP?

install kill Check

assembly surface
and test pressures
No

check Upward No
space out Install kill force acting
assembly & on collars
test greater
than string Drop string,
close 5"
weight? wait then close
pipe rams
check shear rams
space out
land string,
close Yes
posilocks Close 5"
pipe rams
pressure up to
shut in drillpipe
pressure land string,
close
posilocks
open kelly
choke
open kelly
cock

Observe
Well

Withdraw Advice
Muster all crews for
all work standby
information
permits boat

Prepare to
kill well

Figure 3.2 Flow chart of kick control procedure (Schlumberger, 2012)

Page | 17
4. KICK CONTROL EQUIPMENTS
Controlling the flow of a kick is very important to maintain balance pressures in a well so that
drilling operation can be safely performed. In case of uncontrolled flow which turns into
blowout, there should be barriers to stop and mitigate the consequences. Kick control
equipments are required to control and regulate fluid flow in a well and to seal wellbore from
the uncontrolled flow of fluid.

4.1 Blowout Preventer (BOP) Stack

Blowout preventer (BOP) is a structure with a large set of valves and rams placed on the top
of the wellhead that can be closed when drilling crew have uncontrolled flow of formation
fluids (Subsea1, 2010). It is also used to hold erratic pressures of a flow that comes from a
well during drilling. Other purpose is to centre and hang off the drill string in the wellbore
(Hauge, S. et al., 2011). During well killing, BOP also allows the drill pipe to be laid into down
hole while maintaining the sealing of the well. The processes are also known as stripping and
snubbing. Generally, subsea BOP is incorporated with LMRP to enables quick disconnection
between marine riser and BOP in emergency situation. Figure 4.1 shows the main
components in BOP and LMRP.

Figure 4.1 Typical main components in subsea BOP and LMRP (Subsea1, 2010) (Transocean, 2011)

Page | 18
From figure 4.1 (left) the components from number one to ten sequentially are kill line, choke
line, annular BOP, accumulator, shear blind ram, upper pipe ram, middle pipe ram, lower
pipe ram, accumulator and hydraulic line. There are also other components as can be seen
in figure 4.1 (right) such as riser adapter, flex joint, rigid conduit line, wellhead connector,
yellow and blue pod.

Figure 4.2 Example of cutaway view of blowout preventer stack components (Transocean, 2011)

Page | 19
 BOP has different styles, sizes and pressure ratings. Its varieties are depending on the
intended function, hazard expectation and the design of the well. Some type of BOPs can be
designed to close, seal and cut through drill pipe. On a regular basis BOPs are inspected,
tested and refurbished with respect to risk assessment, local practice, well type and legal
requirements in order to ensure the reliability and functionality of a BOP (Subsea1, 2010).

BOP mainly consists of preventer, valves, spools and rams that are positioned on the
top of the wellhead. The arrangement of these items as can be seen in the above pictures
are often called stack. The purposes of the stack are (Hawker, 2001):

 Control the flow of formation fluid by sealing of the well

 Prevent fluid from flowing into surface
 Allow the release of fluids from the well under controlled conditions
 Balance the pressure from formation and prevent further influx by allowing drilling
fluid to be pumped into the well under controlled condition
 Allow the drill string to be moved in and out from the well

The configuration of the stack is depending on the expected operations, redundancy,

flexibility and the trade off between the advantages and disadvantages of each configuration.
The basic typical configurations of the BOP stack from the top to the bottom are bell nipple,
flow line, fill line, annular preventer, blind rams, pipe rams, drilling spools, kill line and choke
flow line (Goins, W.,C., Sheffield, R., 1983).

When kick occurs, the well will be shut in and annular preventer and/or rams will be
closed to stop the influx going further into the surface. The closing and opening of the
preventer and rams are mainly driven by hydraulic fluid that is controlled manually from the
surface (control room) through BOP control system or by the use of ROV (Remotely
Operated Vehicles). Automatic mode function (AMF) or dead man function is an important
part of BOP to close blind shear rams automatically in case of loss of communication
(hydraulic control and power) from the surface. The required mud weight to balance the
pressure from a kick will be circulated into the well through kill line and the flow of fluid in the
well will be circulated through choke flow line into mud pit. Figure 4.3 shows the blowout
preventer stack with preventer closed, pipe rams closed and blind rams closed.

Page | 20
 Figure 4.3 Blowout preventer stack with preventer and rams close (Goins, W.,C.,
Sheffield, R., 1983)

The position of annular preventer is always on the top of the BOP stack. On the other
hand, the stack configuration of ram type (e.g. blind ram above pipe rams, blind ram below
pipe rams, etc) can be varies and there will be some advantages and disadvantages of these
configurations as follows (Hawker, 2001):

 Lower blind rams

When the well is shut in and blind rams in the lower part is closed, it allows other
rams on the upper part of the rams to be repaired or changed, but it has a
consequences where the rest of the string below the blind rams could not be hung
off. The lower blind rams is act as a master valve (Hawker, 2001).

 Upper blind rams

When the blind rams in upper part is closed, the rest of the pipe below the blind
rams can be hung off by pipe rams below. Moreover, it can be replaced by pipe
rams for stripping (ram to ram stripping) to minimize wearing (Hawker, 2001).
Consequentially, it prevents other rams for repair or changed.

Page | 21
 The configurations of blowout preventer
should maximize the advantages and minimize
the disadvantages. One can configure blind ram
on top or in the middle for one size drill pipe. It
allows the pipe to be hung off in the pipe rams
and the circulation can be made through drill
string with proper, ram to ram stripping and
partial utilization of the blind ram as a master
valve to give access for equipment repair
(Goins, W.,C., Sheffield, R., 1983). Figure 4.4
shows the common subsea BOP arrangement.
Stripping and snubbing during well shut in or
well control will make some wear in the sealing
element inside rams or preventer. It requires
replacement and in this case the ease of repair
and access should be taken into consideration
when deciding the configuration of the stack.
Figure 4.4 Typical subsea BOP stack (Rees,
A., Daniel, M., 2011)

Circulation of killing mud and the flow

Kill line
from the formation in the well should be
considered in the well control operation.
The configuration and position of kill line
and choke line also have to be in line
Choke line with the ram configuration to give
access for killing mud, allows equalizing
pressure before opening other rams (in
case of the other functioning ram) and
giving measurement for pressure
monitoring. Figure 4.5 shows the
example of kill and choke lines
configuration for four ram stack.

Figure 4.5 Typical kill and choke lines configuration

(Goins, W.,C., Sheffield, R., 1983)

Page | 22
Components of blowout preventer can be described as follows:

4.1.1 Annular Preventer

The annular preventer is a preventer used to seal and close around the pipe in any sizes
(diameter) and shapes such as drill pipes, kelly, tool joints, drill collars, casing or wire
line. The prime sealing element is reinforced packer consisting of rubber seal with steel
reinforcement segments. Annular preventer allows slow rotation and vertical movement
of the pipe while maintaining the sealing which is useful for snubbing and stripping
process. It becomes the first barrier to close in a BOP stack when controlling and it is
capable to seal on any drill pipe component in the well bore (Hawker, 2001) (Vujasinovic,
A., 1986).
The advantages of having annular preventer as an additional barrier compare to ram
preventer are (Goins, W.,C., Sheffield, R., 1983) :
 Closure can be made on drill collars or casing
 Closure can be made on tool joints or on the kelly
 Closure can be made on any segment of a tapered drill string
 Closure can be made on swab, logging and perforating lines and tools
 Drill pipe can be reciprocated
 Faster well closure is possible because the pipe does not need to be positioned
 The string can be stripped in or out of the hole
 A back up for both blind rams and pipe rams is provided

There are some types of annular preventer that are mostly produced and used in the oil
and gas industry such as Shaffer spherical BOP, Annular Cameron DL, Annular Hydril
GK and Annular Hydril GL. Each of these annular preventer have their own features.

 Shaffer spherical BOP

Shaffer annular is a common type of annular preventer that can seal on almost any
shapes or sizes such as drill pipes, tool joints, drill collars, casing or wire line. It is also
provide positive pressure control for stripping drill pipe into and out of the hole. The
closing of the annular is operated by hydraulic pressure. It has some features such as
(Rig Train, 2001):
- Simple hydraulic system where it only needs two hydraulic connections
- Prolongs preventer life by reducing metal to metal contact by having wear rings
on movable parts
- Suitable for H2S service
- Element can be changed without getting mud and grit into the hydraulic system

Page | 23
Figure 4.6 Sealing element and steel reinforcement segments in an annular preventer
(Vujasinovic, A., 1986)

Figure 4.7 Shaffer spherical BOP (Rig Train, 2001)

Figure 4.8 The closing of Shaffer spherical BOP (Rig Train, 2001)

Page | 24
 Figure 4.8 shows the closing step of Shaffer spherical BOP. Hydraulic fluid is pumped
into the closing chamber and it pushes the sealing element up and closes as it goes
further up (left). The steel reinforcement element support the rubber element in the
sealing element as the well pressure pushes it upward (middle). When there is no pipe
in the annular, the sealing element will continue close until it fully closed (Rig Train,
2001).

 Annular Cameron DL
This type of annular has a different type of sealing element compare to the previous
one, but the main functions are still the same to seal on almost any size of shape
object that will be used in the well bore. It is also has a capacity to strip pipe, close and
seal on open hole. Additional feature allowing the preventer to be split for installation
while pipe is in the hole (Rig Train, 2001).

Figure 4.9 DL Annular Blowout Preventer (Rig Train, 2001)

Figure 4.10 Packing element components and operations (Rig Train, 2001)

Page | 25
 The closing operation is start when a pressure forcing the operating piston and
pusher plate to close upward (see figure 4.10). Packer inserts will rotate inward as
the packer closes and forming support to the top and bottom of the packer.

 Annular Hydril GK
This annular is suitable for onshore installation as well as offshore platform and
subsea installation. The closing is driven by hydraulic pressures which push the
closing chamber to raise the piston and packing unit for sealing (Rig Train, 2001).

Figure 4.11 Annular Hydril GK type (Rig Train, 2001)

 Annular Hydril GL
The annular has additional secondary chamber which provides greater flexibility of
control hook up, reduce closing pressure, minimize the closing and opening volumes
(Rig Train, 2001).

Figure 4.12 Annular Hydril GL type (Rig Train, 2001)

Page | 26
4.1.2 Ram Preventer

Ram is a tool that can be used to seal and close the well in the event of influx from
formation into wellbore. It consists of packer and seal divided in two parts which are
opposing each other and hydraulic pressure pushes the parts in the middle for sealing
purposes (Schlumberger, 2012). The sealing depends on which type of rams, some are
intended to close completely by cutting the drill pipe known as blind/shear rams, other are for
seal which correspond to the diameter of the pipe known as pipe/casing rams. For some
purposes the pipe rams can be used for more than one pipe size and/or more than one pipe
known as variable rams.

Rams are controlled by pistons from both sides which are operated by fluid pressure.
Closing ratio and opening ratio are used to know the ratio of well bore pressure to pressure
required for closure and opening (Goins, W.,C., Sheffield, R., 1983).

i. Pipe/casing rams
Ram type that can close around a pipe. It is specifically use for one size pipe only.

Figure 4.13 Typical pipe/casing rams (Rig Train, 2001)

ii. Blind/shear rams

Blind rams is used to seal a wellbore by cutting through the drill pipe as the rams close
off and seal the well (Transocean, 2011)

Figure 4.14 Typical blind/shear ram (Transocean, 2011)

Page | 27
iii. Variable rams
a. Variable bore rams (VBR) capable of closing around a range of tubing and drill
pipe outside diameters (Transocean, 2011)

Figure 4.15 Typical variable bore rams (Rig Train, 2001) (Transocean, 2011)

b. Flex packer can close around a range of tubing and drill pipe outside diameter by
the use of flexible packer

Figure 4.16 Typical flex packer (Rig Train, 2001)

c. Dual bore flex packer is designed to seal on three different pipe sizes in two
different packer bores (Rig Train, 2001).

Figure 4.17 Typical dual bore flex packer (Rig Train, 2001)

iv. Test rams

It is a variable bore rams (VBRs) which is inverted to seal the pressure from above. It is
useful to reduce the time required to prepare for BOP pressure testing and resume
drilling operations. (Transocean, 2011).

Page | 28
4.1.2.1 Rams Closing Principle

Figure 4.18 Blind shear rams closing (Gröndahl, M., et al., 2010) (Rig Train, 2001)

The closing of rams is controlled by BOP control system which is driven mainly by
hydraulic power. The hydraulic used to close rams are carried out from accumulator into
subsea control pod. It passes through regulator, SPM valve and shuttle valve. The
sequences and functions of this system are described in more detail in BOP control system
chapter.

The closing of blind shear rams start when hydraulic fluid from control pod pass
through shuttle valve and push both pistons inward. The hydraulic fluid from the other side of
the pistons is circulated into another shuttle valve and later into surface. While piston is
moving inward, wedge lock is move behind the piston rod to prevent the piston move
backward. The well is shut completely when both rams are closed and seal the well.

The opening of the rams has the same principle like the closing one. The hydraulic flow
is now pass through the other side of the piston and push it outward. At the same time, the
wedge lock is move to its original position to allow the opening of the rams.

The operating sequence for closing and opening of other type of rams (e.g., variable
bore rams and fixed pipe rams) are also having the same principle like the mentioned one.

Page | 29
4.1.3 Choke Lines and Kill Lines

Choke line is a line that connecting BOP stack to surface through choke manifold. It is
used to circulate the fluid in the wellbore during well control operations. When there is
overpressure in the wellbore, choke lines circulate the flow into surface and reduce the
pressure in the well (Schlumberger, 2011). The flow should pass through choke line, choke
manifold, mud tanks and reserve pit. On floating rig, four or more chokes should be available
on the manifold. Two are usually remotely controlled and the other two are manually
controlled. Master valve should be available next to the wellhead of each flow line and should
not be used during normal operation to prevent unnecessary wearing. It is used to close the
line when flow line is repaired (Goins, W.,C., Sheffield, R., 1983).

Kill line is a high pressure pipe that connecting outlet on the BOP stacks and rig pumps
(Schlumberger, 2011). It is used to pump killing mud into the wellbore when pumping through
drill string is not possible. When drill pipe is pulled out and the well is pressured, then the kill
lines can be used to pump mud into the well. It can be located below blind ram. The working
pressure of kill line should be equal to or greater than BOPs (Goins, W.,C., Sheffield, R.,
1983).

The configuration of rams will determine the position of kill and choke lines. Placing it
below one or more rams allows bleed of fluid and pressure under control. The pressure can
be monitored by passing choke line into choke manifold. Choke manifold is the arrangement
of lines and valves which are connected to the BOP stack to give different flow routes and
capable to stop the flow completely (Hawker, 2001). Subsea BOP that is connected to a
floating platform, have choke and kill lines which are attached to opposite side of the marine
riser. Flexibility of these lines is important to handle movement and heave motion of the
floating platform (Hawker, 2001). Furthermore, the volumetric and frictional effects of these
long choke and kill lines should be taken into consideration for a proper well control operation
(Schlumberger, 2012). The position of the choke and kill line outlets should be arranged so
that circulation for well control can be carried out with the drill string suspended in the BOP
and the shear ram closed. Each of the choke and kill outlets in the BOP stack should be
fitted with two gates arranged in series and installed close to the BOP. One choke outlet
should be located below upper annular in order to handle trapped gas (Norsok D-001, 1998).
There are some requirements regarding to the choke and kill line as follows:
- The manifold should have a pressure capability equal to the rated operation pressure
of the BOP stack (equal to the weakest component) (Hawker, 2001).
- The choke line connecting the manifold to the stack should be as straight as possible
and firmly anchored (Hawker, 2001).
- Alternative flow and flare routes should be available downstream of the choke line in
order to isolate equipment that may need repair (Hawker, 2001)

Page | 30
4.2 Blowout Preventer (BOP) Control System
BOP control system is a critical component in a BOP stack because this is the heart of
a system that drives preventers and rams to close and open with or without using primary rig
power. There are some essential elements of a BOP control system such as accumulator
system, operating fluid, high pressure piping to carry and direct hydraulic fluid, remote unit
for controlling valve with hydraulic unit (Goins, W.,C., Sheffield, R., 1983).

Figure 4.19 BOP control system in Macondo Deepwater Horizon (Gröndahl, M., et al., 2010)

Page | 31
 Accumulator is a device used in a hydraulic system to store energy or, in some
applications, dampen pressure fluctuation (Schlumberger, 2012). It contains pre-charge
nitrogen that is stored in a series of bottles that can supply hydraulic fluid under pressure
which will be required to close preventers (Hawker, 2001). It can be used to provide hydraulic
power to close blind shear rams and other rams when there is no communication of power or
loss of pressure in an emergency situation. In a subsea BOP, the location of accumulator is
under blue and yellow pod (see figure 4.19 with red tubes). There are two types of
accumulator, float type and bladder type. Both types are having the same system consisting
of (Goins, W.,C., Sheffield, R., 1983):
- Accumulator bottles which contains hydraulic operating fluid under compressed nitrogen.
The pre-charge nitrogen usually within the range of 750 psi – 1000 psi and when power
fluid is pumped into the bottles the pressure inside is increasing and resulting in operating
pressure with 1200 psi - 3000 psi (Hawker, 2001)
- High pressure pumps to recharge the accumulator with power fluid. Electric or pneumatic
pumps are usually used to deliver hydraulic fluid under pressure (Hawker, 2001)
- A control manifold to regulate the pressure and direct flows into the correct ram and
preventer. Pneumatic operation is typically used for the mechanism of opening and
closing of preventer, choke, kill lines and to monitor and regulate pressure (Hawker,
2001)
- a reserve tank for storing operating fluid at atmospheric pressure

Activation of control from the

surface on floating/offshore platform to
a subsea control pod can be delivered
by the use of hydraulic system,
electrohydraulic system and multiplexed
(MUX) system with separate hydraulic
line. Control pod is a set of valves and
regulator that are grouped together in
one place. Nowadays, multiplexed
system and electrohydraulic system are
the most common use for subsea BOP
control system as it gives simplicity for
the cost and the size of the lines (hose
bundle) as well as reducing the
operational problems when running and
retrieving large hose bundles.

Figure 4.20 Typical electro hydraulic cable (top left), MUX cable (top right) and hydraulic hose (bottom)
(Goins, W.,C., Sheffield, R., 1983) (Umbilicals, 2009) (Rig Train, 2001)

Page | 32
 The time taken for the hydraulic system to activate BOPs is longer than the other two
systems with electric signal. Therefore, hydraulic system is not recommended for deep water
drilling as it will require more hydraulic fluid, more pressures to be pumped, high pressure
drop and longer activation time to close BOPs.

Instead of supplying hydraulic fluid, hydraulic system also control the activation of the
BOPs through hydraulic control. From figure 4.20 (bottom), we can see that the power fluid is
carried out by supply hose and the control line are transmitted by a pilot hose. On the other
hand, electrohydraulic system uses multiple conductor electric cable for activation control
and supply hydraulic fluid through hydraulic hose (figure 4.20, left). Multiplex system will only
consists of electric cable for variety of controlling purposes and hydraulic fluid is carried out
by a separate line which is connected to subsea control pod.

There should be a minimum of two independent pods to give redundancy and only one
pod is activated at a time. Inside a pod, there are pilot valve for the hydraulic system and
solenoid valve together with pilot valve for the electrohydraulic and MUX system. Pilot valve
will receive hydraulic fluid to regulate and control the flow of power fluid. Before power fluid is
regulated by shuttle valve in electrohydraulic and MUX system, the system will give electric
signal to operate solenoid valve which will directs hydraulic fluid into pilot valve. Power fluid
stored in the accumulator flows pass through the pilot valve to give a regulated power fluid
needed to close and open the rams and preventers. The closing and opening of the BOP are
regulated by means of shuttle valve. In addition, the hydraulic fluid is not only used to
transmit fluid into pod for control on command, but also into accumulator both on surface and
subsea control system for storage.

Figure 4.21 Example of redundancy between pods and stack (Rig Train, 2001)

Page | 33
 Figure 4.21 shows the redundancy of pods to operate the closing and opening of a ram
preventer with one pod activation a time. While one pod is activated to close or open the
ram, the flow of hydraulic fluid of the other pod will be closed by means of shuttle valve. The
flow of the fluid is controlled by pilot valve. Shuttle valve is used to divert the flow from the
active pod and isolate the inactive pod.

In the emergency situation (blowout), there could be two alternatives to close the rams,
manual and automatic. Manual approaches is when operator on the rig activates the
emergency button which will provide signal to control pod to directs fluids from accumulators
into a shuttle valve and drive blind shear ram to cut and seal the well (Gröndahl, M., et al.,
2010). In the automatic mode (AMF), the pod will detect if there is no communication of
power and hydraulic from the surface and will activate accumulator automatically to direct the
pressurized hydraulic fluid into shuttle valve to close blind shear ram and seal the well. In
addition, acoustic system could also be used as a back-up system for emergency plan when
there is no hydraulic and electric communication from the surface. It uses acoustic signal to
activate the system in a pod to close blind shear ram. Manual intervention can be conducted
by the use of ROV (Remotely Operated Vehicle) which activate the system through ROV
intervention panel attached in the BOP stack.

4.2.1 Hydraulic subsea BOP Control System Overview for BOP Function

Hydraulic BOP control system uses hydraulic power to operate the closing and opening
of annular and ram preventer where the initial command is come from electric control panel
in the control room. The systems mainly consists of master electric panel, electric mini panel,
electric power pack with battery back-up, electric power cable, hydraulic power unit (consists
of surface accumulator and central hydraulic control manifold), hydraulic jumper hose bundle,
hose reel, subsea hose bundle, subsea control pod, subsea BOP and subsea accumulator.
Figure 4.22 shows the general arrangement of hydraulic subsea BOP control system.

The signal initiation of hydraulic control system is using electric signal. This signal can
be transmitted from master electric panel or electric mini panel. Independent supply of
electric power can be brought by electric power pack with battery back-up. The electric signal
will trigger solenoid valve to open pilot control valve and pod select valve inside central
hydraulic control manifold to control and direct the hydraulic fluid from surface accumulator
into one of the subsea control pod. This direction of hydraulic flow is important since
hydraulic control system should have two subsea control pods for redundancy purpose. Blue
control pod and yellow control pod are the common name for these two subsea control pods.
The hydraulic flow from hydraulic power unit is forwarded into hydraulic jumper hose bundle,
hose reel, subsea hydraulic hose bundle (umbilical), subsea accumulator and finally subsea
control pod.

Page | 34
 Figure 4.22 General arrangment of hydraulic subsea BOP control system (Rig Train, 2001)

The hydraulic pressure from surface and subsea accumulator usually has 3000 psi.
This pressure will be regulated by mean of subsea regulated valve into the required pressure
to operate rams and annular preventers. The regulated pressure usually contains 1500 psi.

Information of a more detail sequence of control system operation is needed in order to

know which components are required to make the system functioning. The main functions
can be divided into three operations which are close function, block function and open
function. These three operations require the same components and have some differences in
operating the closing and opening of the solenoid valve, pilot control valve and sub plate
mounted (SPM) valve. Figure 4.23-4.25 shows the full schematic for operating sequence of
block, open and close function in subsea BOP control system.
Page | 35
Figure 4.23 Schematic of block function for subsea BOP control system (Rig Train, 2001)

Page | 36
Figure 4.24 Schematic of open function for subsea BOP control system (Rig Train, 2001)

Page | 37
Figure 4.25 Schematic of close function for subsea BOP control system (Rig Train, 2001)

Page | 38
 The close function (figure 4.25) start when the operator press the close panel in the
control panel (master electric panel or electric mini panel). The electric signal is sent to the
associated solenoid valve to open which allows high pressure air to pass and actuate pilot
control valve to be in close position. The actuation of pilot control valve gives access to high
pressure (3000 psi) hydraulic pilot fluid stored in the surface accumulator to flow through
hydraulic jumper hose bundle, hose reel and subsea hydraulic hose bundle into closed sub
plate mounted (SPM) valve inside subsea control pod. There are two SPM valves inside
subsea control pod. One function is to regulate the valve so it allows the flows of power fluid
into the ram and perform the closing/opening function. The other one is to regulate the valve
so that power fluid on the opposite side of the ram can be vented up to the surface.

At the same time, the position of pod selector valve is set to allows and directs the flow
of power fluid (3000 psi) from surface power fluid accumulator into subsea regulator valve
inside one of subsea control pod. Power fluid (3000 psi) from subsea power fluid
accumulator are also directed into this regulator as a backup. The regulator valve reduce the
pressure in the power fluid into 1500 psi in order to operate the BOP function. The regulated
power fluid is pass through shuttle valve into the rams and push it for closing function. The
power fluid in the opposite side of the rams is vented through the open SPM valve and pass
through pilot control valve into mix water tank for fluid treatment. Shuttle valve has a function
to close the flows of power fluid into another control pod (inactive control pod) and allows
them to pass through the designated BOP functions.

Block function is initiated to vent a flow in a pilot control valve in order to detect leakage
in the control system and preventer. The operation sequence is similar with the closing
operation (see figure 4.23). The differences are both solenoid valves are open half way
allowing the pilot control valve to be centered and give access for pilot fluid to be vented into
both SPM valves inside the subsea control pod. The vented pilot fluid makes the SPM valve
to seal against any power fluid to enter into shuttle valve. It makes the power fluid inside
BOP rams become available to be vented back through SPM valves.

The open function operation is similar to close function operation. The differences are
the position of closing and opening of solenoid valve, pilot control valve and SPM valve. All of
the position in the mentioned components are opposite to the closing function. The
schematic of open function can be seen in figure 4.24. The pilot control valve will direct the
the pilot fluid into the opposite SPM valve to allows flow of power fluid into open rams.

In order to simplify the understanding of operation sequences, type of components and

the redundancy they have on subsea BOP control system, the reliability block diagram can
be developed based on the function flow from the schematic operation mentioned above.

Page | 39
4.2.2 Control Fluid Circuit and Subsea Accumulator Recharge

BOP control systems is not only function for the closing and opening of BOP rams and
preventer but also to control the subsea regulators, provide readback pressure, latch/unlatch
the subsea control pods and charge the subsea accumulator (Rig Train, 2001).

Control fluid circuit and subsea accumulator recharge system can be described in the
same schematic flows as shown in figure 4.26 below. The control circuit is mainly driven by
isolator valve and selector valve which are commanded from hydraulic control manifold and
subsea control pod.

Figure 4.26 Schematic flows of control fluid circuit and accumulator recharge system (Rig Train, 2001)

Page | 40
 The recharge operation of subsea accumulator starts from the fluid mixing system and
mixed fluid reservoir for preparing the required hydraulic power fluid for storage. The power
fluid is flowed into surface accumulator by using pump and to subsea accumulator later. In
order to reach subsea accumulator, the fluid flows in two ways. One flow through
accumulator isolation valve (AIV) and pass through accumulator isolator pilot valve (AIPV)
and the other flow pass through pressure switch, flow meter and pod selector valve. The
pressure switch set the required pressure for storing (3000 psi). Flow meter is needed to
measure and read the flow of the fluid. Pod selector valve (PSV) is used to direct the flow
into one of a subsea control pod.
After pass through AIPV and PSV, the fluid is go into one of the subsea control pod by
passing through hydraulic jumper hose bundle, quick disconnect junction box, hose reel and
subsea hydraulic hose bundle (umbilical). From there it can be routed into annular or
preventer for closing/opening purpose by passing through subsea regulated valve, SPM
valve and shuttle valve. In addition, the fluid can directed into shuttle valve directly or pass
through pod mounted accumulator isolation valve (PMAIV) and shuttle valve for accumulator
recharging purposes.

4.2.3 Pilot Fluid Circuit

The control of pilot valves in the subsea pods are performed by using control valve
located in the hydraulic control manifold. BOP stack function can have a system of open or
close function (2 position function) and open and close function (3 position function). This
control can be operated manually from the control manifold or remotely by means of solenoid
valve. The pilot fluid function for 2 position functions have two solenoid valves, while 3
position functions have three solenoid valves. These valves are commanded by electronic
connection via electric panel and are driven by air in order to move the pilot valve. The
schematic operation of this function is generally the same as mentioned in the system
overview of BOP function (chapter 4.2.1). In addition, pressure switch is connected to each
line of the control valve and will transmit signal to the appropriate control panel lamp. Figure
4.27 shows the schematic flows of pilot fluid circuit for 3 position functions.

Page | 41
Figure 4.27 Schematic flows of pilot fluid circuit (Rig Train, 2001)

Page | 42
5. REQUIREMENTS FOR BOP

5.1 Redundancy Requirements for BOP

The critical components and system in a BOP should be made redundant in order to give
functional availability in case of system or component failure during kicks occurrence. The
required redundancies can be determined by the local standard regulations and company
policy based on their best knowledge and expertise to reflect the minimum requirements of
redundancies. According to Sedco Forex (p 192-193, 1999) together with Schlumberger
expertise, the subsea BOP should consists of five BOP rams and two annular preventers in
order to have minimum redundancies requirements.

1. 5 BOP rams:
 3 pipe rams
 1 casing shear rams
 1 blind shear rams
2. 2 annular preventers:
 1 upper annular BOP
 1 lower annular BOP
Figure 5.1 shows the example of preferred stack arrangement for subsea BOP

Figure 5.1 Subsea BOP stack arrangement (Sedco Forex, 1999)

Page | 43
When a tapered drill string is used, the BOP stack should be equipped with one of the
following pipe ram configurations (Sedco Forex, 1999, p.193):

a. 2 sets of pipe rams for the larger size string and 1 set for the smaller size string of
drill pipe
b. 2 sets of pipe rams for the larger size string and one set of variable bore pipe
rams to fit both sizes of drill pipe
c. 2 sets of variable bore pipe rams to fir both sizes of drill pipe
d. 1 set of pipe rams for the larger size string and 1 set of variable bore pipe rams to
fit both sizes of drill pipe
e. 1 set of pipe rams for the larger size string and one set of pipe rams for the
smaller size string and 1 set of variable bore pipe rams to fit both sizes of drill pipe

Another regulation such as from Bureau of Safety and Environmental Enforcement (BSEE),
which formerly known as Mineral Management Service as an American body for energy
regulations maker in the outer continental shelf (OCS), announced their minimum
requirements for a subsea BOP stack as follows (BSEE, 2012):

 1 annular preventer
 2 pipe rams
 1 blind shear ram

According to Norsok D-001, the BOP should have a minimum component consists of the
following:
 1 annular preventer
 1 shear ram preventer
 2 pipe ram preventers
 1 choke line outlet
 1 kill line outlet
 1 wellhead coupling or connector
 2 manual gate valves
 2 remote operated gate valve

Page | 44
5.2 General Requirements for BOP
Overall, the general requirements for a BOP stack and systems must be met and are
describe as follows:
 There must be sufficient casing to provide a firm anchor for the stack (Hawker, 2001)
 It must be able to close off and seal the well completely, with or without string in the
hole (Hawker, 2001)
 It must have a simple and rapid procedure (Hawker, 2001)
 It must have controllable lines through which to bleed off pressure (Hawker, 2001)
 It must provide the ability to circulate fluids through both the string and annulus
(Hawker, 2001)
 There must be the ability to hang or shear pipe, shut in a subsea stack, detach the riser
and abandon the location (Hawker, 2001)
 Subsea stacks cannot be affected by the lateral movement of the riser caused by
currents movement and tidal variations. This achieved through a ball joint connection
(Hawker, 2001)
 BOP must have ROV (Remotely Operated Vehicle) intervention capability equipment.
At a minimum the ROV must be capable of closing one set of pipe rams, closing one
set of blind shear rams, and unlatching the LMRP) (BOEM, 2011)
 BOP must have auto shear and deadman systems (BOEM, 2011)
 BOP system must have an automatic backup to the primary accumulator-charging
system. The power source must be independent of the power source for the primary
accumulator-charging system. The independent power source must be able to close
and hold the closure of all BOP components (BSEE, 2012)
 There must be at least two BOP control stations. One placed on the drilling floor and
the other should be placed in the readily accessible location away from the drilling floor
(BSEE, 2012)
 BOP must have separate side outlet for kill and choke lines. If the stacks does not have
side outlets, drilling spool must be installed with side outlets (BSEE, 2012)
 Remote controlled of subsea choke and kill line valves. Choke lines must be installed
above the bottom ram and kill lines can be installed at the bottom ram (BSEE, 2012)

Annular preventer closing time

- API RP 53 state that surface annular preventers closing times should not exceed 30
seconds for smaller than 18 ¾” and 45 seconds for 18 ¾” and larger
- Subsea annular preventers should not exceed 60 seconds

Ram Preventer closing time

- API RP 53 requirements state that surface rams must close within 30 seconds
- Subsea rams must close within 45 seconds
Page | 45
6. THE USE OF BOP IN DRILLING OPERATION
Principally, the use of BOP is to hold the flow and pressure of reservoir fluid in case of
influx entering the wellbore up to the surface when other barriers inside the well have failed.
It is acting as a last line of protection against kicks and blowouts. In general, the use of BOP
during drilling operations can be divided into four operations, well shut in, stripping, snubbing
and testing BOP. Well shut in is required in the most of the well control methods (e.g., wait
and weight method, driller’s method, concurrent method, etc.) in order to close and seal the
wellbore. Stripping and snubbing can be useful for giving a possibility of access for
circulation of influx and drilling fluid (kill mud). It is important that testing of BOP is performed
to ensure the functionality of system and components in a BOP.

6.1 Shut In
Shut in is a process to seal a well in order to protect it against kicks, by closing BOP
and chokes. There are some situations during drilling operation where the well must be shut
in such as (Well Control School, 2004):

1. Shut in when the pipe is on the bottom

2. Shut in while tripping pipe
3. Shut in when on trip with top drive
4. Shut in while spacing out
5. Shut in on collars
6. Shut in while out of hole
7. Shut in while running casing
8. Shut in while running pipe

From all of the shut in situations mentioned above, principally they are conducted in either of
three ways which are hard shut in, modified shut in and soft shut in. The differences between
them are the sequences of closing and opening of choke line and BOP as shown in table 5.1.
It is important to know that shut in process is the first approach to close the well in order to
protect the crew, stop the flow, gain time and read pressures

Page | 46
 Table 6.1 Shut in procedures (Well Control School, 2004)
Step Hard shut in Modified shut in Soft shut in
1 Open choke line valve on Close designated BOP Open choke line valve on BOP stack
BOP stack
2 Close designated BOP Open choke line valve on Close designated BOP
BOP stack
3 Notify company crew Notify company crew Close choke, follow the pressure in the casing
to ensure it does not exceed the limit or
pressure trapped
4 Read and record SIDPP Read and record SIDPP Notify company crew
and SICP each minute and SICP each minute
5 Read and record SIDPP and SICP each
minute

6.2 Stripping and Snubbing

Stripping and snubbing are the process to put in/out drill pipe in the wellbore in order to
distribute and circulate killing mud into the bottom hole. It is conducted when either preventer
or rams in the BOP is closed to prevent influx travel up to the surface. Stripping use its own
weight to enter the wellbore as the pressure inside is less than the pressure exerted by the
weight of the pipe. Snubbing is performed when the pressure exerted by the pipe is not
enough to enter the wellbore by its own weight. It has to be snub in by exerting additional
pressure using back pressure to force drill pipe enter the wellbore. There are two types of
stripping/snubbing operation:

1.Stripping in/out the hole with annular preventer

2.Stripping in/out the hole with pipe rams

6.2.1 Stripping in the hole with the annular preventer

When stripping in, fluid will have to be released from the hole equal to total cross
section area of pipe. Some steps to perform stripping in the hole with the annular preventer
(Well Control School, 2004):

1. Construct landing nipple and backpressure valve and install open safety valve on
top of pipe
2. Lower pipe into the hole slowly and pass tool joints through preventer carefully (the
preventer are closed according to the diameter of the lowered pipe). At the same
time check annular regulator valve on accumulator to ensure it is working and
regulated pressure to preventer is remaining constant. To keep the bottom hole
pressure constant during the stripping operation, the drilling fluid is circulated
through kill line and choke line

Page | 47
 3. Land the pipe, fill the pipe, install safety valve on the next pipe which will be
stripped into the hole. Remove safety valve from the previous pipe. The new pipe is
connected to the next pipe and repeat step two until the pipe has reached the
bottom

6.2.2 Stripping out of the hole with the annular

When stripping out, fluid will have to be pumped into annulus to keep the hole full. The
safety valve should be open during stripping out to prevent the pipe pulled up (float) by the
pressure inside the well in case of float leak situation. Some steps to perform stripping out of
the hole with the annular preventer (Well Control School, 2004):

1. The annular preventer should be closed according to the diameter of the pipe.
Stripping out can be started by circulating the drilling fluid through kill and choke
line with initial pressure greater than shut in pressure (100 psi difference). Install
safety valve and begin to pulling the pipe slowly
2. While stripping out, check the annular preventer from leaking and the hole must be
ensured to be circulated by drilling fluid in order to keep the constant bottom hole
pressure. Pass the tool joints in the pipe carefully through the preventer. Check
annular regulator
3. Land the pipe on slips. Check drilling fluid displacement and annular pressure.
Break off stand and install safety valve. Repeat the process from step one for the
next stripping out pipe until all the string has been pulled out

6.2.3 Stripping in the hole with pipe rams

Stripping in the hole can be performed with ram to ram stripping technique where it
uses combination of closing and opening (depends on the diameter of pipe) of rams to allow
drill string stripped into the hole. The upper rams should be used to take maximum wear
when stripping the pipe/string. If rams on bottom are used as a master valve or safety valve,
ram to ram stripping should be conducted with four stacks of ram or an annular preventer
with a set of rams stack. Stripping rams must have some distance so that tool joint in the
pipe will not interrupt both rams when they are close. During the stripping process, the safety
valve must always be installed and keep open to prevent float leak situation. Some steps to
perform stripping in the hole with two upper pipe rams and one blind ram at the bottom of the
stack (Well Control School, 2004):

Page | 48
 1. Shut in the well with blind ram. Lower the pipe until the bottom edge of the pipe is
just above the blind ram. Use open safety valve on each stand and keep annulus
pressure constant by circulating drilling fluid through kill and choke line
2. Close the upper stripping ram and pressure up the fluid between closed blind ram
and upper ram until it reached the same pressure in the well by using pump
3. Open blind ram and lower the next tool joints into the stack until it is just above the
upper stripping ram
4. Close the lower stripping ram. Bleed off pressure between the two rams. Open
upper rams
5. Lower the pipe until the tool joint is just below the upper stripping ram
6. Close upper rams and choke, circulate and pressure up the drilling fluid between
rams until it reach the equal pressure in the well by using pump through kill and
choke line
7. Open lower pipe until tool joint is just above upper stripping ram and repeat the
sequences starting from step four until the pipe has reached the bottom

6.2.4 Stripping out of the hole with pipe rams

Most requirements for stripping out of the hole with pipe rams are the same as for
stripping in operation. The upper rams should be used to take maximum wear when stripping
out the pipe/string. The float must be ensured that it can be hold properly and safety valve
should always be opened. Some steps to perform stripping out of the hole with two upper
pipe rams and one blind ram at the bottom of the stack (Well Control School, 2004):

1. Close upper pipe ram (according to the diameter of the pipe). Begin circulating
drilling fluid through kill and choke line until it reach the equal pressure in the well.
Slowly raise the pipe until next lower tool joint is just below upper stripping ram.
Automatic drilling fluid injection should fill the hole as the pipe is pulled out of the
hole
2. When lower tool joint is below upper stripping ram, stop the pipe, close the lower
stripping ram. Shut down the drilling fluid circulation pump and bleed off the
pressure between stripping rams
3. Open upper ram, pull tool joint above the upper ram
4. Close upper stripping ram, circulate the drilling fluid again and pressure up until it
has the same pressure in the well by using pump through choke and kill lines
5. Open the lower stripping ram and repeat the sequence from step one until the pipe
has been pulled out of the hole

Page | 49
6.3 Testing of BOP
BOP testing is very important to be performed to ensure the functionality of system and
components in a BOP. It should resist the maximum pressure they are intended according to
their design specifications. The test includes function test, reaction time test, low and high
pressure tests. Each of these tests should be recorded. Low pressure test should be
performed first by giving pressures between 200 to 300 psi (13.79 bar to 20.69 bar). The high
pressure test should be a little lesser than the maximum expected surface pressure,
minimum burst pressure of the well’s tubing or the rating of the stack. The fluid for conducting
the test must not cause pollution and harm the personnel in case of leak occurs (Well Control
School, 2004). Testing of BOP can be divided into BOP simulation and BOP testing.

6.3.1 BOP Simulation

BOP should be tested by having simulation of drilling operation to reflect the functionality of
BOP in real situation. The simulation usually concerns on the reaction time during operation
such as crew’s reaction time, time of drill, time for closing and opening of rams and
preventer, etc. All of the times taken during simulation are recorded. The simulation
conditions are divided into four categories as follows:

 On bottom drilling
 While tripping drill pipe
 When drill collars are in the blowout preventer
 Out of the hole
Here are some examples of procedure for conducting BOP simulation during drilling
operation based on Goins and Sheffield (1983). In this example, the drilling rotation
mechanism is driven by rotary table instead of top drive. The simulation can be different
depends on the required specification.

6.3.1.1 Condition 1: On bottom drilling

1. Stop rotary, hoist kelly joint above rotary table and shut down the pumps while
picking up. Check for flow
2. Record the time taken and pit level for the above operations into drill report and pit
level chart
3. Open choke flow line while one choke is open
4. Close annular preventer or pipe rams (steps 3 and 4 are done simultaneously)
5. Close variable choke or choke line valve at choke
6. Check all lines and BOP from leakage and record the total time taken

Page | 50
6.3.1.2 Condition 2: Tripping drill pipe

1. Position upper tool joint just above rotary table and set slips
2. Install a full opening valve or inside blowout preventer to close the drill pipe
3. Open choke flow line while one choke is open
4. Close drill pipe rams (annular preventer acceptable)
5. Close variable choke or choke line valve at choke
6. Record the time taken and pit level for the above operations into drill report and pit
level chart
7. Check all lines and BOP from leakage

6.3.1.3 Condition 3: Out of the hole

1. Open choke flow line, keeping one choke line open

2. Close blind rams
3. Close variable choke or choke line at choke
4. Record the time taken and pit level for the above operations into drill report and pit
level chart
5. Check all lines and BOP from leakage

6.3.1.4 Condition 4: Drill collars in preventers

1. Position upper drill collar box at rotary table and set slips
2. Open choke flowline with one choke open
3. Install a full opening valve and close in the drill collar string
4. Close annular preventers
5. Close variable choke or manifold valve at choke
6. Check that all actions have been correctly accomplished. If only one stand of drill
collars remains to be hoisted, the stand should be pulled and the well treated as in
condition 3
7. Record the time taken and pit level for the above operations into drill report and pit
level chart

Page | 51
6.3.2 BOP Testing

The components inside BOP do not always work as intended, sometimes they fail
because of defects from factory, bad design, wear, ageing, etc. Component testing gives
status of its availability and performances. The deviation from its intended function can be
adjusted by doing maintenance including repair and replacement. According to Goins and
Sheffield (1983), there are many likely causes of failure in the BOP components such as
improper equipment design and construction, leakage of seal gaskets and rings caused by
vibration or added loading, wearing in casing, abrasion of lines and fittings by mud flow,
accumulation and deposition of cement, freezing valves, loss of lubricants, partially closed
valves caused by erosion, deterioration of rubber seal, etc. Some considerations when
performing BOP component test are:

 All choke manifolds, choke and kill lines should be flushed out
 Always use clean water for testing the inner system. The use of drilling mud is
not recommended as it will create sealant
 Pipe rams should be closed only where there is pipe in the hole. The closing
on open hole and wrong size of pipe diameter can create ram-packer damage
 Casing head valves should always be open when a casing head plug tester is
used. The opening allows detection of leakage and prevent overpressure
burden inside
 For specific equipment test procedures, always consult manufacturer’s guide
as well as local regulations
 Always perform low pressure test before commencing high pressure test
 The minimum time, required component and pressure required are depends
on the policy, regulations and standard

The testing of components in BOP can be vary depends on their configuration, type and the
number of components being tested. It can be divided into:

 Closing unit pump capability test

 Accumulator closing test
 BOP inspection and test

6.3.2.1 Closing unit pump capability test

Pressure testing on BOP should be conducted after the closing unit test has been
performed. The closing mechanism should be driven by the accumulator instead of main
power unit to ensure the redundancies in power supply in case of emergency situation during
the test. Each well should be tested with BOP closing unit test. The test generally should
include the following steps (Well Control School, 2004):

Page | 52
 1. Position a joint of drill pipe/tubing in the BOP stack
2. Isolate the accumulator from closing unit manifold by closing the necessary valves
3. If the pumps are powered by air, isolate rig air system from the pumps. A separate
closing unit air storage tank or nitrogen bottles should be used to power the pumps
during the test. For two redundancies power supply, both system should be tested
separately
4. Simultaneously turn the control valve for the closing of annular preventer and turn the
control for the opening of hydraulically controlled valve (HCR)
5. By using the power from the pump, the time taken for annular preventer closing and
hydraulically controlled valve opening are recorded. Moreover, the remaining
pressure is also recorded. According API RP 53 (1997), the recommendation time for
this test should less than two minutes
6. Close the hydraulically controlled (HCR) valve and open the annular preventer. Open
the accumulator system to the closing unit, charge the accumulator system to its
proper operating pressure and record the time required to do this

6.3.2.2 Accumulator closing test

Accumulator closing test should be performed on each well before BOP testing is
performed. Some typical procedures are as follows (Well Control School, 2004):

1. Position a joint of drill pipe/tubing in the BOP stack

2. Close power supply to accumulator pumps
3. Record the initial accumulator pressure. Adjust the annular regulator to 1500 psi or
designated pressure
4. Depending on standard, policy or regulations, perform the functions that are required
such as close the annular, pipe ram and the hydraulic choke line valve
5. Record the time required for accumulators to close. Record the final accumulator
pressure. It should not be lower than 200 psi above the pre-charge pressure
6. After preventers have been opened, recharge accumulator system to designed
operating pressure and record time for complete power up

6.3.2.3 BOP inspection and test

Some verification of BOP components is necessary before conducting the test. It

includes verification of wellhead type, wellhead bowl protector, preventer type, drilling spool,
spacer spool, valve types, pump type, rams type, drill pipe/tubing connection type, and all
their working pressure rates. It is also important to verify the placement of rams. Other things
that should be considered for the test are (Well Control School, 2004):

Page | 53
 1. Open casing valve during test, unless pressuring the casing or hole is intended
2. Test pressure should not exceed the manufacturer’s rated working pressure for body
or seals of assembly being tested
3. Test pressure should not exceed the values for collapse and internal yield pressures
tabulated for the appropriate drill pipe/tubing used. Do not exceed tensile strength of
pipe

The main concern for this testing is the capability of BOP components, particularly
accumulator, preventer, rams, chokes line, kill line and valves, to works under the maximum
designated pressure and minimum closing time of BOP. Figure 5.1 and 5.2 shows the
example of performing the BOP testing on some components in the BOP. The explanations
of symbols in the figures are as follows:

Test pressure
Test pressure inlet
Equipment being tested

In the figures, the arrow point may be subjected to components being test

Procedures in performing blind ram

testing (Goins, W., C., Sheffield, R.,
1983):
1. All equipments should be tested at
200-300 psi and then to the rated
working pressure of the weakest
member
2. Install one stand of drill collars
below an appropriate casing-head plug
tester. Land the plug tester and back
off the running joint. Open bore type
plug testers can be provided with a
plug in order to test blind rams with the
drill string removed. Fill the BOP with
water and close the blind shear rams

Figure 6.0.1 Testing blind ram (Goins, W.,C.,

Sheffield, R., 1983)

3. Open casing head valves to prevent casing rupture or formation breakdown if the plug
tester leaks

Page | 54
4. Apply test pressure as illustrated in the figure. This test also applied to other component
than blind ram as indicated by the arrows in the figure

Procedures in performing BOP

components testing (Goins, W., C.,
Sheffield, R., 1983):
* Bottom pipe ram tested by using same
procedure as for top pipe ram
** Annular preventer tested using same
procedure as for pipe rams

1. All equipments in the test should be

tested to rated working pressure of the
weakest member

Figure 6.0.2 Testing pipe rams, annular and all choke and kill manifolds, flowlines and
BOP wing valves (Goins, W.,C., Sheffield, R., 1983)

2. From previous test, open the blind rams and install appropriate test string and screw into
the plug tester. Fill BOP with water and close top pipe ram
3. Apply test pressure down the drill pipe and through a perforated sub or through the pug
tester if it has an integral port
4. The bottom ram can be tested in a similar manner. The test string must fit ram size
5. The annular preventer can also be tested similarly, but do not test to more than 70% of
rated working pressure unless required, or 50% of rated working pressure where
regulations do not specify

Page | 55
7. SUGGESTED RISK ANALYSIS TOOLS FOR BOP CRITICALITY
ASSESSMENT
Risk analysis is the process of identification, definition, analysis and measurement of
problems, hazard, causes, consequences and alternatives in a system to give a risk picture
that will be used for a decision making process through some accepted parameters.
According to Norsok Z-013 (2001), risk analysis is the process of using information to identify
hazards and estimate risk. It covers the analysis of cause and consequence of risk to
personnel, environment and asset.

Typically there are two approaches for risk analysis, qualitative and quantitative risk
analysis. Qualitative risk analysis uses the knowledge of risk from experts through
brainstorming and group discussion to present the simplify risk picture in a descriptive
categories or coarse scale, i.e. high, medium, low, etc, while quantitative risk analysis (QRA)
use the knowledge of risk from model-based risk such as event tree analysis, fault tree
analysis and other tools to represent the risk picture in more detail (Aven, T., 2008, p. 4). The
limitation of information and data in the beginning of a project make brainstorming and group
discussions among experts become a good way to conduct risk picture. Quantitative risk
analysis needs quantified data in order to assess risk in more detail, usually by combining
the judgment from the expert. The risk picture resulted from risk analysis should be
evaluated with regard to risk acceptance criteria and when applicable compared to
alternative. Risk reducing measures is presented and cost benefit analysis can be used as
part of decision making. Figure 8.1 shows the schematic to determine the appropriate risk
analysis approaches.

Qualitative risk
assessment (Q)

Yes
Adequate for
decision making

No

Semi-quantitative risk
assessment (SQ)

Carry out
Yes assessment record
Increase depth of Adequate for
modelling findings and
decision making
recommendations
No

Quantified risk
assessment (QRA)

Yes
Increase depth of Adequate for
modelling decision making

No
Figure 7.1 Step to determine appropriate risk assessment (HSE, 2006)
Page | 56
 There are tools to support the risk analysis process. The use of tools depends on the
intention of the analysis and result. In some risk analysis, criticality and reliability can be the
main focus of the analysis, particularly for the design of components or machineries in the
production and safety systems where functionality is the most prominent aspect to gives the
highest value of production and safety assurance. The needs for robust and redundant
system are determined through this process. Moreover, criticality and reliability analysis are
also used in maintenance area where the assessment of the component’s reliabilities are
very important to determine maintenance plan which is needed to optimize component’s
uptime, reduce component’s downtime and prevent unplanned maintenance.

Engineering system, such as BOP, usually consists of a number of subsystems and

components that interacts with each other to perform some specific function. Critical
components in the system need to be identified and ranked to determine the robustness and
redundancies of the system if one or more components in the system fail. Mainly, the criteria
are chosen from the severity of consequences, occurrence (frequency or probability) of
failure, detection of failure, functionality requirement of the items and redundancy in the
system. Knowing these criteria can help us to determine the proper risk analysis tools to
determine the criticality of components in a system such as reliability block diagram (RBD),
failure modes, effects and criticality analysis (FMECA), risk (criticality) matrix, redundancy
and effect table.

7.1 Reliability Block Diagram (RBD)

Reliability block diagram is used for BOP criticality assessment because it presents
functional flow diagram of how the logical relation of components in the BOP system runs a
BOP function. It ensures that all components that make up a BOP function are presented
which can be useful for failure identification. Identification of component’s failure in the BOP
system is important to find out which components are the most critical to the availability of
the BOP function. It can be achieved by identifying minimal cut set. The components in the
minimal cut set are then considered as the critical components.

In the reliability block diagram, a system can be assumed to consist of n components

and have a state of functioning or failure. We can assign the binary state of component i with
xi and binary state for a system with Φi, (Aven, T., 1992, p.87-88).

1 𝑖𝑓 𝑐𝑜𝑚𝑝𝑜𝑛𝑒𝑛𝑡 𝑖 𝑖𝑠 𝑖𝑛 𝑡𝑕𝑒 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛𝑖𝑛𝑔 𝑠𝑡𝑎𝑡𝑒

𝑥𝑖 =
0 𝑖𝑓 𝑐𝑜𝑚𝑝𝑜𝑛𝑒𝑛𝑡 𝑖 𝑖𝑠 𝑖𝑛 𝑡𝑕𝑒 𝑓𝑎𝑖𝑙𝑢𝑟𝑒 𝑠𝑡𝑎𝑡𝑒
1 𝑖𝑓 𝑡𝑕𝑒 𝑠𝑦𝑠𝑡𝑒𝑚 𝑖𝑠 𝑖𝑛 𝑡𝑕𝑒 𝑓𝑢𝑛𝑐𝑡𝑖𝑜𝑛𝑖𝑛𝑔 𝑠𝑡𝑎𝑡𝑒
𝜙𝑖 =
0 𝑖𝑓 𝑡𝑕𝑒 𝑠𝑦𝑠𝑡𝑒𝑚 𝑖𝑠 𝑖𝑛 𝑡𝑕𝑒 𝑓𝑎𝑖𝑙𝑢𝑟𝑒 𝑠𝑡𝑎𝑡𝑒

Page | 57
The state of a system is determined by the state of components in the system, therefore
structure function Φ(x) is:

𝜙=𝜙 𝑥 , where x = (x1, x2,…, xn)

Basically, the components in a system have two logic structures, series and parallel
structure. There may be series, parallel or combination of both structures. These structures
determine the failure characteristics of a system. In the series structure, the system fails if
one of the components in a system fails. On the other hand, parallel structure will have a
system failure if all of the components in the system fail. Table 8.1 shows the difference
between series and parallel structure and formula to determine the state (function or failure)
of a system.

Table 7.1 figure and formula of series and parallel structure in RBD
Series Structure Parallel Structure

𝑛
𝜙 𝑥 = 1 − 1 − 𝑥1 1 − 𝑥2 ∙∙∙ 1 − 𝑥𝑛
𝜙 𝑥 = 𝑥1 ∙ 𝑥2 ∙ … ∙ 𝑥𝑛 = 𝑥𝑖 𝑛 𝑛
𝑖=1
𝜙 𝑥 =1− 1 − 𝑥𝑖 = 𝑥𝑖
𝑖=1 𝑖=1

Manual Ram
Activation Wedges
Hydraulic Shear Pipe Pipe Ram
System Blade Collar Thickness Seal
Automatic Hydraulic
Activation System

Annular Ram Choke/Kill Choke/Kill Control Chassis Flexible

Preventer Preventer Valve Valve System Connection Joint

Figure 7.2 Example of reliability block diagram of BOP activation (Tumer, I., et al., 2010)

Page | 58
7.2 Failure Modes, Effects and Criticality Analysis (FMECA)

The critical component analyzed in the reliability block diagram is not enough to
present the criticality on BOP system. There could be more than one critical component in a
system and it is quite hard to determine which component that gives significant
consequences to the BOP system by only knowing the failure state of the components. Other
factors related to the occurrence of component’s failure such as failure causes, failure effects
and level of consequences need to be identified to get a broader scope of the component’s
criticality. One of the tools which analyze these factors is failure modes, effects and criticality
analysis (FMECA).

Failure modes, effects and criticality analysis identify all possible failures modes and its
effects that may occur as well as the criticality of each component to know the reliability and
performance of a system. The diagram from RBD is useful to identify components and the
effects of failure modes against other component in the system. This analysis also identifies
the compensation activity or risk reducing measures to prevent the occurrence of
component’s failure and to mitigate the effects of failure in a system.

The main goals of conducting FMECA for BOP system are:

1) Identify failure modes for the subsystem/function of the BOP systems and the resulting
effects of these failure modes on each subsystem or component at a local level and for
the total system/component as a whole

2) Identify how the failure modes can be detected, and describe the possible existing,
provisions and safeguards that prevent the system from failing. If none is available, alert
mode should be defined if hazards are present when the system fails. It shows attention
to increase safety and reduce the probability or consequence which reduces the risk as
well

3) Assess the criticality of the failure modes by estimating the probability and severity, and
then plot it in the criticality matrix

The approach of conducting FMECA can be done in qualitative and quantitative way.
Quantitative method is used when failure rates, failure modes, failure mode ratios and failure
effect probabilities are known which are required to quantify the criticality number of
components. Qualitative method is used when there is no available data for failure rates and
failure modes. The criticality in qualitative method is determined by making some subjective
measurements for ranking the severity and occurrence of the failures (Department of the
Army, 2006). In this report, the analysis is conducting in a qualitative approach as there is
inadequate time and effort to do the quantitative as well as scarcity in the BOP system data.
Discussion, brain storming and using experience from experts is considered a good way to
present the criticality of the BOP components.
Page | 59
 Initiate FMEA or FMECA of an item

Select a component of the item to analyze

Identify failure modes of the selected component

Select the failure mode to analyze

Identify immediate effect and the final effect of the failure mode

Determine severity of the final effect

Identify potential causes of that failure mode

Estimate frequency or probability of occurrence for the failure

mode during the predetermined time period

Do severity and/or No
probability of
occurrence warrant
the need for action?

Yes

Propose mitigation method, corrective actions or compensating

provisions. Identify actions and responsible personnel

Document notes, recommendations, actions and remarks

Are there more of No Are there other No

the component components for
failure modes to analysis?
analyze?

Yes
Yes

Complete FMEA. Determine the next revision date as appropriate

Figure 7.3 Flowchart of FMECA (IEC 60812, 2006)

Page | 60
7.2.1 Failure Modes, Effects and Criticality Analysis (FMECA) Methodology

The construction of FMECA is systematically created in a sheet containing some

parameters. These parameters can vary from one sheet to other sheets, but basically it
contains parameters which describe identification (item number), function (operation state),
failure modes, failure mechanism, effect on other units in the system, effect on system,
corrective measure, failure frequency, failure effect ranking and remarks (Aven, T., 2008,
p.64). The sheet for qualitative and quantitative method may have some distinction in the
parameters. Moreover, a good work flows are also required to conduct a thorough analysis of
FMECA. Failure modes and effect analysis (FMEA) is usually conducted first before
assigning criticality analysis (FMECA).

a. Defining the system clarifies the purpose of the system and gives an initial schematic and
operational detail of the system. Rules and assumptions should be made when
conducting the analysis to give more understanding of the system. Typically, there are
two systems which are mostly defined in the analysis, functional and hardware
(component) systems.

 Functional systems definition usually uses in the early phase of design and
commonly conducted in the top down approach. It will be used to analyze the
effects of a system or subsystems on a specific condition. To do this the analyst
should define and identify each system functions, potential failure modes and
failure causes for each functional output.

 Hardware systems definition commonly outlines the components in the system and
their possible failure mode. It uses bottom up approach to analyze the component’s
failure mode.

b. Reliability block diagram is constructed to give a representation of interrelationship and

interdependencies of functional component in the intended operation of a system. The
interdependencies are illustrated with the functional flow sequence with series and
parallel structure. It also helps the analyst to follow the failure mode and its effect of
component and function.

c. Failure and fault sometimes been interpreted in the same meaning. According to Norsok
Z-008 (2001), failure can be described as the termination of the ability of an item to
perform a required function, while fault can be described as the inability of an item to
perform a required function. Further, failure mode is the observed of failure in a function,
subsystem, or components. It can be identified by studying the output of the various
functions. Failure mode concern depends on the specific component, system,
environment and past history (Department of the Army, 2006). According to Blanche and
Shrivastava (1994), the failure mode can be classified into two categories such as:

Page | 61
 1. Intermittent failures is failures that caused by some problems in the functionality of
components and only happen in a short period of time

2. Extended failure is failures that caused by some problems in the functionality of

components continuously until some parts are repaired. This type of failure can be
classified again into :
 Complete failures is failures that cause complete lack of a required function
 Partial failures is failures that lead to a lack of some function but do not cause a
complete lack of a required function
 Sudden failures is failures that could not be predicted by testing or examination
 Gradual failures is failures that can be predicted by testing or examination
 Catastrophic failures is failures which are sudden and complete
 Degraded failures is failures which are partial and gradual

The application of failures is not only limited to the above categorizations. It sometimes
depends on the application they are applied on such as primary failure, secondary
failure and command failure are introduced. Primary failure is a failure that is cause by
the natural ageing of the component(s). Secondary failure is a failure that is cause by
load or stress that is beyond the limited design of a component. Command failure is a
failure cause by an improper control signal or noise (Rausand, M., Høyland A., 2004,
p.85-86).

Thorough failure mode analysis can be done by examining each component failure
mode and/or output function for the following condition (Department of the Army, 2006):

 Failure to operate at the proper time

 Intermittent operation
 Failure to stop operating at the proper time
 Loss of output
 Degraded output or reduced operational capability

d. Another important parameter in FMECA is failure cause or mechanism. According to IEC

50(191), failure cause is the circumstances during design, manufacture or the use that
have led to a failure. Failure cause can be defined in different aspects such as design
failure, weakness failure, manufacturing failure, ageing failure, misuse failure and
mishandling failure (Rausand, M., Høyland A., 2004, p.87).

e. Failure effect analysis is performed to all relevant components prior to the failure mode
on the system. To simplify the work, the relevant component can be taken from the
reliability block diagram which defines the functional relationship between components in
the system. Normally, there are three types of failure effects in the FMECA:

Page | 62
 - Local effect is the specific effect as an immediate result from the failure mode of
component. Local effects are determined without taking into account existing
provisions and safeguards
- Global effect is the effects that influence other failure mode in the operation and
functionality of other components in a system.
- End effect shows the state of the system whether function or failure. It is determined
after taking all the existing provisions and safeguards into account. It consists of
different categories as follows:

1. System failure which shows that the failed component can make disturbance to
the operation and function of the system
2. Degraded operation which shows that the failed component can influence the
operation of the system but it still can be performed as intended
3. No immediate effect of failed component in the system

f. Prior to the failure of component(s), there should be indicator(s) to detect failure so that
operator can perform the required action in order to prevent system failure or other
sequence that can influence the performance of other component and system as a
whole. Supervisory control and data acquisition (SCADA) is one example of detection
system with visual or audible warning devices and automatic sensing device. If there is
no detection device in the working component, the failure effects should be examine
whether it is affecting the objective of the system or safety. The Indicator can be a normal
indicator, abnormal indicator or incorrect indication. Normal indicator shows a normal
operation condition, abnormal indicator shows that the system or component has failed or
malfunction, incorrect indicator shows an opposite indication status of component or
system from its actual condition/status (e.g., fault indicator while the component/system is
still functioning normally).

The failure detection system or method gives the availability to operator to perform
compensating provisions to prevent and mitigate the effect of a failure in a system. It can
be achieved by adding active or passive compensating provisions such as (Department
of the Army, 2006):

- Redundancies in a system to ensure the operability and allow more safe operation
- Safety devices such as alarm or monitoring systems which gives the indication of
limited parameter in the operation. Monitoring system can be done with regular
testing or regular condition monitoring
- Automatic self compensating devices that can set the required operation parameter
automatically to ensure the performance of the intended component (e.g., automatic
adjustment of variable speed in a pump)
- Manual operator action such as manual turn on/off of a component’s function

Page | 63
g. The assignment of severity (consequences) and probability of occurrence ranking is to
give first overview of the criticality of component in a system. It is derived from generic
data and will be discussed with experts in the workshop.

 Probability (P) is derived from qualitative assessment of the likelihood for the
failure mode to occur, rated from 1 (least likely/frequent) to 5 (most likely/frequent)

 Consequence (C) is derived from qualitative assessment of the consequence or

severity of the failure mode, rated from 1 (least severe) to 5 (the most severe)

 Risk (R) is the risk rank of failure mode rated as low (L), medium (M) and high (H)

The available provisions and safeguards are taken into consideration when assigned
probability and consequence value.

h. Remarks field consists of additional information and recommendation as well as the

responsible party who are in charge for resolving the problem.

7.3 Criticality Ranking and Criticality Matrix

The criticality ranking can be described by showing the failure mode with
consequences and the probability of occurrence. The consequence and probability can be
ranked based on the subjective probability based on the knowledge from experts and
engineering judgment.

Table 7.2 Failure probability rank

Failure probability rank Description

P=1 Could occur, but never heard of in the world (<1/10,000 years)
P=2 Has occurred in the world, but very unlikely (1/10,000 – 1/1000 years)
P=3 Incident has occurred in some operations (1/1000 – 1/100 years)
P=4 Incident has occurred several times in some operators (1/100 – 1/10 years)
P=5 Incident has occurred several times in most operators (1/10 – 1 years)

Table 7.3 Effect severity rank

Effect severity rank Description

C=1 First aid/medical treatment case

C=2 Serious injury
C=3 1-10 fatalities
C=4 10-30 fatalities
C=5 30+ fatalities

Page | 64
 Criticality matrix (risk matrix) is established to show the criticality level and risk
acceptance criteria of failure modes in the BOP components. Normally, there are three levels
of risk in the matrix, low, medium and high (Gudmestad, O.T., 2001). The matrix has
probability and consequence values as their axes where the criticality (risk) value taken from
FMECA can be plotted in the matrix to see the level of criticality of the BOP’s component.
The failure modes within the area of high or intolerable critical (risk) level must be reduced to
the medium region by using risk reducing measures/actions and/or barriers.

High (H) level or Intolerable risk level is considered as the most critical failure mode
for components and indicated by the red area in the risk matrix.

The medium (M) region is also known as ALARP (As Low As is Reasonably
Practicable). This is where the criticality of component should be treated and assessed for
possibility of another risk reducing measure or whether a more detail studies should be
performed (Norsok Z-013, 2001). Intermediate region is indicated by the yellow area in the
matrix.

The low (L) region is considered as a low critical area and indicated by green area in
the matrix.

Probability
P=1 P=2 P=3 P=4 P=5
Incident has Incident has
Could occur, Has occurred Incident has
occurred occurred
but never in the world, occurred in
several times several times
heard of in the but very some
in some in most
world unlikely operations
operations operators
< 1/10,000 1/10,000 – 1/1000 – 1/100 1/100 – 1/10
Description 1/10 – 1 years
years 1/1000 years years years

C=5 30+ fatalities

C=4 10-30 fatalities

C=3 1-10 fatalities

C=2 Serious injury

First
C=1 aid/medical
treatment case

Figure 7.4 Criticality matrix

When consequence and criticality of one or more components are same, the
alternative of the criticality can be reassessed by considering the safety and the objective of
the component’s function. If the most concern in the system is safety or functionality of
component, then area on the top side of the diagonal in the criticality matrix should be put
more emphasize for criticality because high severity is considered more important than high
occurrence.
Page | 65
7.4 Redundancy and Effect Table
Redundancy can be described as a duplicate system or component to serve as a back
up when the other system with the same function has failed. Redundancy should be added in
the system or components that are critical to the safety and functionality. If redundancy is
considered to be unavailable, then robust system or component needs to be employed. If it is
also unavailable, then reaction plan or operation should be created to replace the function of
the failed component. Redundancy and effect table lists all the numbers and types of
redundancies for the specific component that is assumed to be in the total failure in the BOP
system as well as showing the effects of the redundancy given the failure of the component.
It might have the similarity with FMECA, but it is specifically present the redundancy when
total failure of component is considered. The critical component can then be identified from
the component failure effects and the redundancy they have.

7.5 Discussion of the Suggested Risk Analysis Tools for BOP Criticality
Assessment
The suggested risk tools for BOP criticality assessment are reliability block diagram
(RBD), failure modes, effects and criticality analysis (FMECA), criticality matrix, redundancy
and effect table. All these tools are complement to each other to give a better perspective of
criticality in the BOP system.

Reliability block diagram (RBD) is important to shows the functional flow of the
components and their logic relations in the BOP system. The construction of RBD in this
report is based on the hydraulic BOP control system schematic, function flow and P&ID.
Knowing the relations between components, give the ease of reliability identification in the
system. We can assume which component failure that can make a failure of the system
through minimum cut set. The components in the minimum cut set can be considered as the
critical components. In this case, one component is more critical than more than one
component in the minimum cut set. Due to the complexity of BOP control system, the
minimum cut set is only considered for one component that can make a system to fail.

In this RBD analysis, the components are only considered to have binary states
(function or failure). Reliability analysis based on the quantified data of failure rate is not
conducted as there is a lack of source and it requires a lot of time and man work to conduct
quantitative analysis.

Binary state analysis in the RBD is the first overview of criticality in BOP regarding to its
simplicity. However, RBD has lack of information of how the component fails and what
compensating measures can be taken into account to prevent the failure of the component.
Thus, one of the tools to assess that, FMECA, is needed to cope with the issues.

Page | 66
 FMECA is used to describe failure modes, failure causes and safeguards of the
components as well as giving the description of its effects for other component and the
system as a whole. It is also describe the level of failure modes occurrence and the
consequences that might occur. FMECA is considered to be an easy way to assess criticality
in a system.

The method used in FMECA is qualitative analysis by using expert judgment and
discussion among other interest parties. The lack of BOP’s component failure data and less
time consuming make qualitative method is the best approach for the criticality analysis. The
failure modes in the analysis are based on the best knowledge of experts and are presented
only for the most important for the BOP function. The level of occurrences and
consequences of failure modes are plotted into the criticality matrix by considering the
safeguards to see the critical level of the component.

Regarding to the ease of using qualitative FMECA analysis, there are some
considerations to take into account. FMECA does not include the relations between
components in the system and assume that other components are function perfectly. It might
give a wrong conclusion given the system fails as a result of components failure sequences
in the system. Furthermore, the assignment of consequence value is based on individual
component which might give inaccurate value of criticality of the system as a whole.

Despite of the issues, qualitative FMECA is a simple tool that can systematically
analyze the critical component in a system to provide a preliminary reliable overview of
critical components in a BOP system given that the data is rare. Table 8.4 shows the pros
and cons of FMECA.

Table 7.4 Pros and Cons of FMECA

Pros Cons
FMECA is a systematic analysis and reliable FMECA is not suitable for multiple failures as it
method to evaluate the performance and criticality assumes only one failure occur at a time and
of component and system as a whole (Rausand, other components are working perfectly
M., 2005) (Rausand, M., 2005)
Simple concept and application allow that can be The process of constructing FMECA may be
easily learned (Rausand, M., 2005) tedious, time consuming and expensive
(Rausand, M., 2005)
Complex system can be evaluated easily FMECA is not suitable for analyzing system with
(Rausand, M., 2005) some redundancies (Aven, T., 2008, p.69)
FMECA can be used as a good basis for more FMECA put more emphasizes on technical
comprehensive quantitative analysis (Aven, T., failures and sometimes ignore the human failure
2008, p.69) contribution (Aven, T., 2008, p.69)

Page | 67
 The FMECA sheet for BOP system produced in this report are refers to the FMECA
workshop done by some interest company who own and operate the BOP control system
such as Statoil, NOV, Fabricom as well as from consultancy company, Scandpower.

The FMECA workshop is done by having discussion and brainstorming between

experts from different expertise related to the operation of BOP. It involves field operator
engineer, drilling engineer, technician (maintenance and inspection of BOP), BOP risk
consultant and BOP project manager. The step in conducting the FMECA is the same as the
flow shown in figure 7.3. The item identification, failure modes, failure causes, failure effects,
detection, compensating provisions (safeguards), consequences, probability, risk value and
additional information are discussed thoroughly among experts. The information of these
parameters is taken from the specific P&ID (piping and instrument diagram) of the related
item/component and the experience from experts through discussion among them.

The FMECA is performed by dividing the relevant BOP systems into subsystems or
main components and looking at the functions, these subsystems and main components
needed to perform in order for the BOP systems to work as intended. Then it is assessed in
the FMECA meeting how these functions could fail (the failure modes) and the effects of
these failures, as well as the criticality rated as a combination of the probability and
consequence of the failure modes which are based on the knowledge from the meeting.

The FMECA facilitator makes a preliminary breakdown of the BOP systems and a
proposal for potential generic failure modes. The proposed division of the BOP systems and
the generic failure modes is presented at the start of the FMECA meeting. The final divisions
of the BOP system into main components and subsystems, and the potential failure modes
for these are then modified and agreed by brainstorming with the FMECA participants during
the meeting. Moreover, for each of the subsystems, the scoring of probability and
consequence of the failure modes are also discussed and agreed between participants.
These values are then plotted into the criticality matrix.

The effect severity rank (scale) is related to personnel injuries or fatalities due to a
failure. The consequence has been divided into five categories according to the severity. The
effect consequence scale is available during the FMECA workshop and is determined based
on the subjective prediction from experts through discussion in the meeting.

The criticality matrix and the rank of failure mode occurrence probability are derived
and proposed by risk consultant company, Scandpower, based on their expertise and related
discipline. The cause probability or frequency related to failures was determined using
engineering judgment. The assessment of probability of each FMECA items is based on
experiences with the different parties in the company and from the joint experience of the
participators, and engineering judgments.

Page | 68
 Some failure modes in this report are not discussed in the workshop and thus the
assessment of some occurrence probabilities and consequences in this report are based on
the Sintef report by Holand, P., (2007) and case study report of Deepwater Horizon risk
assessment by Tumer, I., et al., (2010). Sintef report gives failure data occurrence
probabilities (failure rates) for some BOP component’s failure modes. Failure mode rate (λ) is
taken by dividing 1 with MTTF (Mean Time To Failure).

1
𝜆=
𝑀𝑇𝑇𝐹

In this analysis the effects of consequences are only focus on the personnel injury or
fatalities due to a component failure. It is considered as the most critical element for safety.
Potential loss of money due to delays/material damage, environment damage and loss of
reputation might not be discussed directly.

There are some failure modes that might not really influence the functionality of a
component. In this case, the analysis of criticality should also be based on the assumption if
one component is totally not functioning and analyze its effect to other component in the
system. The number of redundancy based on the back up component/system and alternative
operations are documented in the redundancy and effect table. The information of effect and
redundancy can be taken from FMECA. Through this table, we can see which component
that has high effect (consequence) with less/no redundancy to be the critical component.

The purpose of using redundancy and effect table together with FMECA is to give
different views of criticality based on their failure modes. The results of both methods are
compared and final critical component in the BOP system can be presented.

Page | 69
8. ANALYSIS OF CRITICALITY COMPONENT IN BOP

The analysis of BOP components in this report is based on some parameters and
assumptions as follows:
 The components analyzed are hydraulic BOP control system, BOP stack, choke
valve, kill valve, connector (LMRP and wellhead) and general component inside
rams and preventer
 The analysis is based on the simple schematic and/or simple P&ID of the BOP
control system
 Some analysis in FMECA is taken from the BOP control system workshop done
by some interest companies
 The analysis use subsea BOP stack arrangement typically similar as shown in
figure 5.1 consisting of:
o 1 Annular preventer:
o 4 rams:
 1 blind shear ram
 1 variable bore ram
 1 middle pipe ram
 1 lower pipe ram
o 2 pairs of choke and kill lines with standard valves configuration

Page | 70
8.1 Reliability Block Diagram
8.1.1 Reliability Block Diagram for Close Function of Subsea BOP control System

Figure 8.1 Reliability block diagram for BOP rams close function
Legends of BOP rams close function block diagram
MEP : Master Electric Panel PSV : Pod Selector Valve AC : Air Control
EMP : Electric Mini Panel HR Y/B : Hose Reel Yellow/Blue MC : Mechanical Control
EPC : Electric Power Cable SHHB Y/B : Subsea Hydraulic Hose Bundle Yellow/Blue PiF : Pilot Fluid
EPBB : Electric Power Pack with Battery Back-up SPFA : Subsea Power Fluid Accumulator PoF : Power Fluid
SoV : Solenoid Valve SRV Y/B : Subsea Regulated Valve Yellow/Blue RF : Regulated Fluid
AO : Air Operator SPMV Y/B : Sub Plate Mounted Valve Yellow/Blue VF : Vent Fluid
PiFA : Pilot Fluid Accumulator SV : Solenoid Valve
PCV : Pilot Control Valve MWT : Mix Water Tank
PoFA : Power Fluid Accumulator EC : Electric Control

Page | 71
The reliability block diagram above based on the schematic flow figure 4.22 and 4.25. The
opening and blocking function of the subsea BOP control system have the same reliability
block diagram as the closing one. There are only some differences in the operations of some
components as shown in table 8.1 below.

Table 8.1 Operation modes of components for different BOP functions

Position of Operation
Component
Close Function Open Function Block Function
Solenoid Valve (SoV)
Open Close ½ open
Pilot Control Valve
(PCV) Close Open ½ open

Sub Plate Mounted

Valve (SPMV) Close Open ½ open

BOP rams/annular
preventer Close Open ½ open

Critical components based on the minimum cut set (one component):

 Solenoid valve (SoV)
 Air operator (AO)
 Pilot control valve (PCV)
 Pod selector valve (PSV)
 Rams or annular preventer
 Shuttle valve
 Surface fluid accumulator (pilot and power fluid is in one accumulator)
 Subsea fluid accumulator

Page | 72
8.1.2 Reliability Block Diagram for Control Fluid Circuit and Subsea Accumulator Recharge System

Figure 8.2 Reliability block diagram for control fluid circuit and subsea accumulator recharge system

Page | 73
Legends of BOP control fluid circuit and accumulator recharge system block diagram

FMS : Fluid Mixing System

MFR : Mixed Fluid Reservoir
SuFA : Surface Fluid Accumulator
AIV : Accumulator Isolation Valve
AIPV : Accumulator Isolation Pilot Valve
PSV : Pod Selector Valve
HJHB Y/B : Hydraulic Jumper Hose Bundle Yellow/Blue
QDJB Y/B : Quick Disconnect Junction Box Yellow/Blue
HR Y/B : Hose Reel Yellow/Blue
SHHB Y/B : Subsea Hydraulic Hose Bundle Yellow/Blue
PMAIV Y/B : Pod Mounted Accumulator Isolation Valve Yellow/Blue
SRV Y/B : Subsea Regulated Valve Yellow/Blue
SPMV Y/B : Sub Plate Mounted Valve Yellow/Blue
SV : Shuttle Valve
SMAIV : Stack Mounted Accumulator Isolation Valve
SFA : Subsea Fluid Accumulator
MF : Mixed Fluid
PF : Power Fluid
RF : Regulated Fluid

The diagram based on figure 4.26. It has critical components based on minimum cut set (one
component) as follows:
 Fluid mixing system (FMS)
 Mixed fluid reservoir (MFR)
 Pump
 Surface fluid accumulator
 Shuttle valve (SV) annular
 Annular preventer
 Shuttle valve (SV) rams
 Rams preventer
 Shuttle valve (SV) accumulator
 Stack mounted accumulator isolation valve (SMAIV)
 Subsea fluid accumulator

Page | 74
8.1.3 Reliability Block Diagram for Annular Preventer

Figure 8.3 Reliability block diagram for annular preventer close and open function

Legends of annular preventer function flow block diagram

SV : Shuttle Valve
CHC : Closing Hydraulic Connection
OHC : Opening Hydraulic Connection
CC : Closing Chamber
OC : Opening Chamber
P : Piston
SE : Sealing Element
LW : Locking Wegde

The diagram based on figure 4.7. All of the components in the diagram, except locking
wedge, are critical.

8.1.4 Reliability Block Diagram for Ram Preventer

Figure 8.4 Reliability block diagram for ram preventer

Legends of ram preventer function flow block diagram

SV : Shuttle Valve
PR : Piston Rod and blade
WL : Wedge Lock

The diagram based on figure 4.18. All of the components in the diagram plus shear ram
housing, except wedge lock, are critical.

Page | 75
8.2 Failure Modes, Effects and Criticality Analysis (FMECA)
8.2.1 System Breakdown

The BOP system is broken down into components based on the information from
reliability block diagram and additional component taken from the FMECA workshop that are
significant for the BOP functionality. Failure mode of each component are identified and
given a unique identifying number. More than one component may have the same failure
modes, but it can has different effects depends on the type of component. Main component
and its corresponding failure mode can be seen in table 8.2 below.

Table 8.2 Lists of components and the corresponding failure modes

ID No. Item/Functional Identification Failure Description
mode(s)
Node 1: Hydraulic BOP control system
1.1 Accumulator bottles F-1.1.1 Burst bladder
F-1.1.2 Leakage through nitrogen "fill"- system (valve)
F-1.1.3 Lack of stored accumulation pressure, reduced
capacity,
F-1.1.4 Lack of stored accumulation pressure, reduced
capacity,
1.2 Hydraulic line from HPU to BOP F-1.2.1 Leakage, bursting, plugged line
1.3 Solenoids to valves F-1.3.1 Fail to move
1.4 Pilot valve (air) F-1.4.1 Not operating
1.5 Subsea regulated valve F-1.5.1 Regulator stuck in position
F-1.5.2 Fail to open/close
1.6 Shuttle valve (rams and annular preventer) F-1.6.1 Not able to change position
1.7 Fluid reservoir F-1.7.1 Rupture of reservoir
F-1.7.2 Contamination of hydraulic fluid
F-1.7.3 Too low volumetric capacity of reservoir (1200
gal. reservoir)
1.8 Pressure regulator (hydraulic manifold) F-1.8.1 Regulator stuck in position
F-1.8.2 Fail to open
F-1.8.3 Fail to close
F-1.8.4 Seal failure / washout failure
1.9 Flow meter, instrumentation on HPU, F-1.9.1 Failure of pressure transmitter, loss of signal
pressure transmitter
F-1.9.2 Failure of pressure transmitter, wrong signal
F-1.9.3 Failure of flow transmitter, loss of signal
F-1.9.4 Failure of flow transmitter, wrong signal
1.10 Pump in hydraulic manifold F-1.10.1 Pump does not start, pump not running when
intended to run
F-1.10.2 Pump does not start, pump not running when
intended to run
F-1.10.3 Pump does not stop
F-1.10.4 Pump running but not building up pressure, or
giving enough flow
F-1.10.5 Vibration
F-1.10.6 Pump runs when not intended to run
1.11 Air pressure switch for pumps F-1.11.1 Switch is not switching when intended to
F-1.11.2 Switch is not closing when intended to
1.12 Strainer upstream pumps F-1.12.1 Clogging of strainer
1.13 Filter downstream pumps F-1.13.1 Clogging of filter
F-1.13.2 No filtering effect
F-1.13.3 Bursting filter/filter collapse
1.14 Hose upstream strainers F-1.14.1 Ingress of air into hydraulic system gives potential
small vacuum/ under pressure on the pump
suction side when pump is stroking
1.15 Level transmitter in reservoir F-1.15.1 Fails to read correct level (i.e. reading low level
when level are not low)
F-1.15.2 Fails to read correct level (i.e. not reading an
actual low level)
1.16 Pressure safety valve (PSV)s F-1.16.1 Open when not suppose to open (manifold)
1.17 Pilot control valve/panel valve F-1.17.1 Fails to move
F-1.17.2 Wash out
1.18 Flange and gasket F-1.18.1 Leakage

Page | 76
1.19 Master electric panel and electric mini panel F-1.19.1 Fail to give electric signal for some intended
valves and BOP function
1.20 Electric power pack with battery back up F-1.20.1 Fail to give electric power for BOP panel
command initiation
1.21 Electric power cable F-1.21.1 Not able to distribute electric signal
1.22 Air operator F-1.22.1 Fail to regulate
1.23 Pod selector valve F-1.23.1 Fail to move (change position)
1.24 Sub plate mounted (SPM) valves F-1.24.1 Fail to close
F-1.24.2 Fail to open
F-1.24.3 Fail between positions (not completely closed nor
opened)
1.25 Fluid mixing system F-1.25.1 Fail to make the required hydraulic fluid
1.26 Accumulator isolator valve (inside HPU) F-1.26.1 Fail to open/close
1.27 Accumulator isolator pilot valve (inside control F-1.27.1 Fail to open/close
manifold)
1.28 Pod mounted accumulator isolation valve F-1.28.1 Fail to open/close
1.29 Stack mounted accumulator isolation valve F-1.29.1 Fail to open/close

1.30 Batteries inside subsea pod F-1.30.1 No voltage

Node 2: BOP stack
2.1 Fixed pipe ram F-2.1.1 Not able to close
F-2.1.2 Not able to open
F-2.1.3 Not able to seal around tubular
F-2.1.4 Degradation of packers over time
F-2.1.5 External leakage (bonnet/door seal or other
external leakage path)
F-2.1.6 Internal leakage (leakage through a close ram)
2.2 Variable bore ram F-2.2.1 Not able to seal around tubular
F-2.2.2 Not able to close
F-2.2.3 Unable to hold the hang-off weight
F-2.2.4 Degradation of packers over time or high
temperature
F-2.2.5 Not able to open
2.3 Blind shear ram F-2.3.1 Unable to cut string, thus unable to seal of
wellbore
F-2.3.2 Not able to close
Not able to perform complete shut off and seal the
annulus
F-2.3.3 Degradation of packers over time
F-2.3.4 Not able to open
2.4 Annular BOP F-2.4.1 Not able to seal around tubular
F-2.4.2 Not able to open to full or within 30 minutes (API)
F-2.4.3 Degradation of elements over time
2.5 Automatic subsea ram locks F-2.5.1 Unable to lock
F-2.5.2 Unable to open
Node 3: Choke valve, kill valve and connector
3.1 Choke and kill valve F-3.1.1 External leakage (leakage to environment in main
valve or valve connectors)
F-3.1.2 Internal leakage (leakage through a closed valve)
F-3.1.3 Failed to open
F-3.1.4 Failed to close
3.2 Hydraulic connector F-3.2.1 External leakage
F-3.2.2 Failed to unlock
Node 4: Component inside rams and preventer
4.1 Blind/shear ram seal (sealing element) F-4.1.1 Deformed, worn, stiff, eroded
4.2 Piston on both sides F-4.2.1 Galling, seizure, misalignment, pitting
4.3 Wedge on both sides F-4.3.1 Galling, seizure, misalignment, impact failure
4.4. Blade on both sides F-4.4.1 Impact failure, brittle failure, pitting, dulling
4.5 Shear ram housing F-4.5.1 Deformation, cracking, erosion
4.6 Annular preventer rubber housing F-4.6.1 Deformation, worn, stiff, eroded parts
4.7 Annular sealing element (rubber seal and F-4.7.1 Deformed, worn, stiff, eroded
steel reinforcement segments)
4.8 Annular piston F-4.8.1 Galling, seizure, misalignment, pitting
4.9 Annular locking wedge F-4.9.1 Galling, seizure, misalignment, impact failure

8.2.2 FMECA Sheet

The analysis of FMECA sheet can be seen in appendices 12.1.

Page | 77
8.2.3 Criticality Ranking and Criticality Matrix

Probability
P=1 P=2 P=3 P=4 P=5
Incident has Incident has
Could occur, Has occurred Incident has
occurred occurred
but never in the world, occurred in
several times several times
heard of in the but very some
in some in most
world unlikely operations
operations operators
< 1/10,000 1/10,000 – 1/1000 – 1/100 1/100 – 1/10
Description 1/10 – 1 years
years 1/1000 years years years

C=5 30+ fatalities F-1.6.1

C=4 10-30 fatalities

F-1.8.3, F-4.4.1,
C=3 1-10 fatalities F-4.5.1
F-4.2.1 F-2.3.1, F-4.6.1

C=2 Serious injury F-4.1.1, F-4.7.1 F-3.2.2, F-4.8.1 F-1.2.1, F-1.18.1

F-1.1.2, F-1.1.3,
F-1.1.4, F-1.7.3,
F-1.9.1, F-1.9.2,
F-1.9.3, F-1.9.4,
F-1.10.2, F- F-1.3.1, F-1.5.1,
1.10.3, F-1.10.4, F-1.7.2, F-1.8.1,
F-1.10.5, F- F-1.8.4, F-1.10.1,
1.11.1, F-1.11.2, F-1.10.6, F-
F-1.12.1, F- 1.15.1, F-1.15.2,
1.13.1, F-1.13.2, F-1.16.1, F-
First F-1.1.1, F-1.4.1, F-1.13.3, F- 1.17.1, F-1.17.2,
F-1.5.2, F-1.8.2, 1.14.1, F-1.19.1, F-1.24.1, F-
C=1 aid/medical F-2.1.5, F-3.1.3, F-1.20.1, F- 1.24.2, F-1.24.3,
F-1.7.1
treatment case F-3.1.4 1.21.1, F-1.22.1, F-1.26.1, F-
F-1.23.1, F- 1.27.1, F-1.28.1,
1.25.1, F-1.30.1, F-1.29.1, F-2.1.1,
F-2.1.2, F-2.1.3, F-2.1.4, F-2.2.1,
F-2.1.6, F-2.2.3, F-2.2.2, F-2.2.4,
F-2.2.5, F-2.3.2, F-2.3.3, F-2.4.1,
F-2.3.4, F-2.4.2, F-2.4.3
F-2.5.1, F-2.5.2,
F-3.1.1, F-3.1.2,
F-3.2.1, F-4.3.1,
F-4.9.1

Figure 8.5 Criticality matrix for BOP control system failure modes

We can see that the critical failure modes are in the medium region of the matrix. The most
critical failure modes can be sorted from the highest consequences and probabilities of
occurrence as follows:

Table 8.3 Prioritization of BOP component criticality from criticality matrix

Priority Component Failure mode Description
1 Shuttle valve (rams and annular F-1.6.1 Not able to change position
preventer
2 Blind shear ram F-2.3.1 Unable to cut string, thus
unable to seal of wellbore
Annular preventer rubber housing F-4.6.1 Deformation, worn, stiff,
eroded parts
3 Piston on both sides F-4.2.1 Galling, seizure,
misalignment, pitting
4 Hydraulic line from HPU to BOP F-1.2.1 Leakage, bursting, plugged
line
Flange and gasket F-1.18.1 leakage
5 Fluid reservoir F-1.7.1 Rupture of reservoir

Page | 78
8.3 Redundancy and Effect Table
Table 8.4 Redundancy and effect table of subsea BOP

How many Possibility to Effect other

Redundant(Yes redundancy(ies)
No System/Function component's functions after Redundant equipment
/No)
redundancy
Local Global Total
Hydraulic BOP control system
1.1 Accumulator bottles Y 3 0 3 Not significant (redundancy) - Some number of accumulator (25% over capacity + 3 extra bottles)
1.2 Hydraulic line from HPU to BOP Y 1 0 1 Not significant (redundancy) - Line for yellow and blue pod
1.3 Solenoids to valves Y 0 1 1 Not significant (redundancy) - manual override and manual initiation of pilot control valve
1.4 pilot valve (air) Y 0 2 2 Not significant (redundancy) - Closing sub plate mounted on the shear ram via the panel

- Manual override by closing sub plate mounted on the shear ram

subsea regulated valve (rams and Y 2 1 3 Not significant (redundancy)
1.5 preventer) - subsea regulated valve on other pod
- Can be operated manually
- each rams and annular has separate regulator
1.6 shuttle valve (pipe rams, VBR and - each rams and annular has separate shuttle valve for operations
Y 0 1 1
a annular preventer) trough other rams or preventer.

- The corresponding blind shear

ram cannot be operated. Thus
N 0 0 0
1.6 effecting the operation of well
b Shuttle valve (blind shear rams) shut in
According to FMEA sheet, there
is no failure mode that gives a
1.7 fluid reservoir N/A 0 0 0 failure for a component (e.g., N/A
contamination, rupture, low
volume)

pressure regulator (hydraulic

Y 2 1 3 Not significant (redundancy)
1.8 manifold) - Can be operated manually
- Bypass the regulator via high pressure bypass directly to the ram
valves
- Global: separate regulator on rams and annular preventer

Page | 79
 Not significant (still possible to (this is just the instrumentation, reading devices, etc. which are not
flow meter, intrumentation, N 0 0 0 directly influence the functionality of the BOP function, but could be a
perform BOP functions)
1.9 pressure transmitter problem for well control operations)
Y 2 1 3 Not significant (redundancy)
1.10 pump in hydraulic manifold - redundant pump
- emergency pump (in case all powers are lost)
- accumulator banks
Y 1 1 2 Not significant (redundancy)
1.11 air pressure switch for pumps - electric driven pumps as primary pumping system
- accumulator banks
Y 0 2 2 Not significant (redundancy)
1.12 strainer upstream pumps - Redundancy of pump
- accumulator banks
Y 2 2 4 Not significant (redundancy)
1.13 filter downstream pumps - Redundant filters
- Bypass of filter
- Redundant pump
- Accumulator banks
Y 1 1 2 Not significant (redundancy)
1.14 hose upstream strainers - Redundant strainer
- Redundant pump

Not significant (still possible to (it is a level reading of fluid in reservoir which does not directly
level transmitter in reservoir N 0 0 0 influence the functionality of the BOP function, but could be a problem
1.15 perform BOP functions)
for well control operations)
- The accumulator will not have
enough hydraulic fluid pressure
pressure safety valve (PSV)s N 0 0 0
1.16 for BOP functions (failure to
close allows fluid to leakage)

Y 0 1 1 Not significant (redundancy)

1.17 pilot control valve/panel valve - Manual operation/override of valves
- for the worst case, it can drain
all hydraulic fluid in the
flange and gasket N 0 0 0 accumulator (there will be
1.18
alarm for a leakage) and could
effect the BOP functions
master electric panel and electric Y 1 0 1 Not significant (redundancy)
1.19 mini panel - Redundant electric panel (mini panel)

Page | 80
 electric power pack with battery Y 1 0 1 Not significant (redundancy)
1.20 back up - Redundant main power from main generator
Y 0 1 1 Not significant (redundancy)
1.21 electric power cable - Manual override of valve or other command
Y 0 1 1 Not significant (redundancy)
1.22 air operator - Manual intervention of solenoid and pilot control valve
Y 0 1 1 Not significant (redundancy)
1.23 pod selector valve - Manual intervention of pod selector valve
sub plate mounted (SPM) valves Y 1 2 3 Not significant (redundancy)
1.24 (rams and preventer) - Redundant SPM from other pod
- Manual override (possible to manually operate BOP functions)
- Redundancy from other rams or annular preventer
According to FMEA sheet, there
is no failure mode that gives a
fluid mixing system N 0 0 0 failure for a component (e.g.,
1.25
fail to make the required
hydraulic fluid)
accumulator isolator valve (inside
Y 0 1 1 Not significant (redundancy)
1.26 HPU) - redundancy by having flow through other valve
accumulator isolator pilot valve - Redundancy by having pod selector vavle to regulate the hydrauic
Y 0 1 1 Not significant (redundancy)
1.27 (inside control manifold) flow into subsea accumulator
pod mounted accumulator isolation Y 0 1 1 Not significant (redundancy)
1.28 valve - Redundancy by having the flow through other valve
stack mounted accumulator Y 0 1 1 Not significant (redundancy)
1.29 isolation valve - Redundancy by having the flow through other valve
Y 1 1 2 Not significant (redundancy)
1.30 batteries inside both pods - Redundancy by having batteries from other pod

- Redundancy of initiating blind shear ram function by using accoustic

system
BOP stack
2.1 fixed pipe rams Y 1 2 3 Not significant (redundancy) - Redundancy by having variable bore rams
- Redundancy by having blind shear ram
- Redundancy by having annular preventer
2.2 variable bore rams Y 1 2 3 Not significant (redundancy) - Redundancy by having pipe rams
- Redundancy by having blind shear ram
- Redundancy by having annular preventer

Page | 81
 Y 0 1 1 Not significant (redundancy) - Redundancy by having annular preventer (possible to close annular
2.3 blind shear ram on empty hole up to 10,000 psi in combination with the choke system)
2.4 annular BOP Y 0 1 1 Not significant (redundancy) - Redundancy by having shear ram and/or pipe ram

Y 0 1 1 Not significant (redundancy)

2.5 automatic subsea ram locks - Redundancy by having hydraulic pressure in the closing chamber
Choke valve, kill valve and connector

Y 1 0 1 Not significant (redundancy)

3.1 choke and kill valve - Redundancy by flowing the flow through other choke and kill valve
3.2 hydraulic connector Y 1 1 2 Not significant (redundancy) - Redundancy of secondary connection unlatch
- Redundancy of unlatch from LMRP or wellhead
Component inside rams and preventer
blind/shear ram seal (sealing Y 0 1 1 Not significant (redundancy)
4.1 element) - redundancy by having other rams and/or annular preventer to close
Y 0 1 1 Not significant (redundancy)
4.2 piston on both sides (shear ram) - redundancy by having other rams and/or annular preventer to close
- Redundancy by having hydraulic fluid to secure the linier mechanical
Y 0 1 1 Not significant (redundancy)
4.3 wedge on both sides (shear ram) energy on piston
- Redundancy by having other rams and annular preventer to seal the
Y 0 1 1 Not significant (redundancy)
4.4 blade on both sides (shear ram) well

Y 0 1 1 Not significant (redundancy)

4.5 shear ram housing (shear ram) - Redundancy by having sealing device such as blind ram and pipe ram

Y 0 1 1 Not significant (redundancy)

4.6 annular preventer rubber housing - Redundancy by having sealing device such as blind ram and pipe ram
4.7 annular sealilng element Y 0 1 1 Not significant (redundancy) - Redundancy by having other rams close
4.8 annular piston Y 0 1 1 Not significant (redundancy) - Redundancy by having other rams close
- Redundancy by having hydraulic fluid to secure the linier mechanical
Y 0 1 1 Not significant (redundancy)
4.9 annular locking wedge energy on piston

Page | 82
The component inside variable bore rams and pipe rams have more or less the same type of
component inside blind shear ram. The difference is only in the rams parts.

Based on table 8.5, the critical components can be seen with the green mark having neither
redundancy/back-up with the same component (local), nor other different types of
components or actions/operations (global). Some components listed in the table are having
no redundancy, but it is not significant to the failure of the BOP function.

Table 8.5 Summary of critical component from redundancy and effect table
ID no. Failure of the critical components Redundancy Effects
1.6 Shuttle valve (blind shear ram) No The corresponding blind shear ram cannot be
operated. Thus effecting the operation of well shut
in
1.16 Pressure safety valve (PSV)s No The accumulator will not have enough hydraulic
fluid pressure for BOP functions (failure to close
allows fluid to leakage)
1.18 Flange and gasket No For the worst case, it can drain all hydraulic fluid in
the accumulator (there will be alarm for a leakage)
and could effects the BOP functions

Page | 83
9. DISCUSSION

9.1 Result of Criticality Analysis

Different risk tools give different result for the critical components in the BOP as can be
seen in the summarized Table 9.1. The highest numbers of critical components are found in
the reliability block diagram follows by FMECA and redundancy table respectively.

In table 9.1, some assumptions are made for some components related to their similar
functionality. Surface and subsea fluid accumulator are both considered as bottle
accumulator. All shuttle valves for different functions (e.g., rams, annular preventer and
accumulator) are assumed to be the same. Closing hydraulic connection, opening hydraulic
connection, closing chamber and opening chamber of annular preventer are some
components inside annular preventer rubber housing.

Table 9.1 List of critical components based on the used risk tools
ID No. List of critical components based on each risk tools
Reliability Block Diagram FMECA & Criticality Matrix Redundancy and effect table
1.1 Accumulator bottles
1.2 Hydraulic line from HPU to BOP
(4)
1.3 Solenoid valve
1.6 Shuttle valve Shuttle valve (1) Shuttle valve
1.7 Fluid reservoir Fluid reservoir (5)
1.10 Pump
1.16 Pressure safety valve (PSV)s
1.17 Pilot control valve
1.18 Flange and gasket (4) Flange and gasket
1.22 Air operator
1.23 Pod selector valve
1.25 Fluid mixing system
1.29 Stack mounted
accumulator isolation valve
2.1 Fixed pipe ram
2.2 Variable bore ram
2.3 Blind shear ram Blind shear ram (2)
2.4 Annular preventer
4.1 Blind/shear ram seal
4.2 Ram piston on both sides Ram piston on both sides (3)
4.4 Ram Blade on both sides
4.5 Shear ram housing
4.6 Annular preventer rubber Annular preventer rubber housing
housing (2)
4.7 Annular sealing element
4.8 Annular piston

Page | 84
 The critical components of BOP found in reliability block diagram are only based on
every single minimum cut set. It is analyzed without considering the effect of compensating
provisions (safeguard) and no information is used to analyze how the failure mechanism of
the component failure. In order to assess which components are critical with respect to the
functionality of BOP system and fatality as parameters, FMECA and redundancy table can
be used. Both FMECA and redundancy table are complement to each other to determine the
final critical component of BOP.

FMECA and redundancy table might present the similar method. The basic
assessment between these two methods is from the failure modes being analyzed. FMECA
method analyzes failure modes where every relevant and significant possibility for the
deterioration of the component function is assessed and then ranked according to their
critical levels (e.g., low, medium, high). While redundancy table only consider the failure
mode when component is in the total failure state.

FMECA presents shuttle valve for ram and annular function as the most critical
component in the BOP, followed by blind shear ram, annular preventer (rubber housing), ram
piston, hydraulic line from HPU to BOP, flange, gasket and fluid reservoir respectively. This
criticality rank is based on the level of fatality and the occurrence probability which are in the
medium area (no failure mode in high are) of the criticality matrix. In this assessment, every
critical component on the topside/surface can be neglected since problems occurring on the
surface are consider more accessible for detection, testing, inspection, maintenance and
repair. Moreover, dual redundancies component can also be considered as not critical since
they have a back-up system to compromise with one failure for the same function of
component since FMECA consider one component failure at a time and others are function
perfectly. Based on this premises, fluid reservoir and hydraulic line from HPU to BOP can be
excluded as critical component.

In the FMECA, annular preventer (rubber housing) and blind shear ram become the
second most critical component. In this case, we can prioritize annular preventer (rubber
housing) into the last priority for criticality since it has redundancy component such as blind
shear ram, variable bore ram and pipe ram to replace the function of annular preventer.
Although annular preventer rubber housing has redundancies, it can still be considered as
critical component. It is because annular preventer has an important role in the BOP function
as a first device to be activated during well shut in to seal the well which is very important to
prevent the influx reach surface. Moreover, it is also more practicable to conduct stripping or
snubbing operation through annular preventer than through ram to ram stripping method.

Page | 85
 Redundancy and effect table presents four critical components which are shuttle valve,
pressure safety valve (PSV), flange and gasket. There is no criticality rank in this table since
all the components are analyzed based on the redundancy and back-up operation they might
have to compensate the failure of the component.

Pressure safety valve is a component which does not have direct impact with regard to
BOP function. In the analysis, the pressure safety valve is used to release pressure of
hydraulic fluid only when overpressure occurs in the accumulator. Furthermore, criticality
matrix shows low consequences of fatality and tolerable occurrence probability. Thus,
pressure safety valve can be excluded as a critical component.

Overall, shuttle valve for ram and annular function is the most critical component in
BOP. It is used to shuttles hydraulic fluid from the control pod to annular preventer and rams
preventer. There is no other way and no other redundancy for the hydraulic fluid to enter
annular or ram without shuttle valve. Moreover, the annular and preventer are function only
by means of hydraulic fluid. No manual intervention can be initiated to operate annular and
ram. The failure of shuttle valve means no annular or ram function.

Each preventer and ram have their own shuttle valve. In this case the most important
shuttle valve is for the blind shear ram function. Other shuttle valves such as for pipe rams
and variable bore rams functions have advantage to substitute their function to shuttle the
hydraulic which drive the rams to seal the well. Shuttle valve in annular preventer could also
substitute the function of every rams including blind shear ram for shut in operation.
However, annular preventer is not design to seal the well in case of emergency, only blind
shear ram has the capability to completely shut off the well. The maximum pressure that
annular preventer can hold usually less than the maximum pressure that blind shear ram can
hold. Moreover, in case of drifting floating platform due to bad weather, the drill string need to
be cut off and LMRP disconnection is initiated. If the string cannot be cut, it can endanger the
personnel on platform. Therefore, the shuttle valve for blind shear ram function and the blind
shear ram itself are the most critical component in the BOP.

Leakage is the main problem for flange and gasket. In the subsea accumulator
connector or other pipe connection, the leakage problem usually never make sudden
catastrophe. Usually the problem is only a small leakage and seepage of fluid. The drainage
of hydraulic fluid in the accumulator or drilling fluid in the pipe connection can be detected
with alarm to prevent bigger leakage. However, in case of large leaks and operator does not
have time to react, then it could be a catastrophe. Thus, flange and gasket become the next
critical component in the BOP.

Page | 86
9.2 BOP Criticality Component With Regards to the Use of BOP for Well
Shut-in, Stripping, Snubbing and BOP Testing
In the drilling operation, BOP has several roles such as well shut in, stripping, snubbing
and BOP testing. In author opinion, the most important operation is well shut in. Shut in the
well is needed when kicks occur to prevent influx into the surface by sealing the well either
with annular or ram preventer. Shut in process is the first approach to close the well to
protect the crew, stop the flow and pressure reading. The operations of well shut in is just
simply close the ram/preventer and operate the choke and kill valve for pressure reading.
Special attention should be taken for shut in when the drill string/pipe/casing/collar/tool joint
are in the ram position. Drill string or pipe can be cut by means of blind ram, but drill casing,
tool joint and drill collar are too thick for blind ram. The position of drill collar and tool joint
should be maintained in the ram, so only the pipe section that should be in the position of the
ram.

In this case, the critical component of BOP mentioned before such as shuttle valve for
blind shear ram function, blind shear ram and annular preventer are very critical to the
successful closing of the well. If these components fail during shut in, it can create very
catastrophe fatality and damage to the platform as well as environment.

Well shut in usually follows by stripping or snubbing operations (depends on the hole
pressure) in order to gives killing fluid access into the bottom hole of the well. The killing fluid
in the bottom hole is necessary to perform the well control based on constant bottom-hole
method. Since the stripping or snubbing is perform after well shut in, then it is necessary for
the critical component, shuttle valve (blind shear ram) and blind shear ram/annular preventer,
to maintain its functionality. If the critical component fails after well shut in, the ram or annular
preventer can still have the locking wedge as a safety device to prevent the rams or sealing
element move backward. In this case, it only cause delay in the operation of stripping or
snubbing. Otherwise, kill line can be used to direct killing fluid into the well without having to
put drill string into the bottom hole of the well.

BOP testing is part of the precautionary action to know the condition and performance
of the BOP system. During this test, the performance of the critical component can be tested
and ascertained. In this operation, the critical component might not be critical as it has many
safety measure and procedure to handle with the expected raising problems.

Page | 87
10. CONCLUSIONS
Safety of drilling operation, particularly during the event of kicks, can be improved by
having more component redundancy or back-up operation in the subsea blowout preventer
(BOP). It is important for well shut in, stripping, snubbing and BOP testing operation. The
redundancy is particularly required for the critical components in the BOP as it has been
analyzed in this report. The critical components of BOP can be summarized and prioritized
as follows:
1. Shuttle valve for blind shear ram (e.g., for closing function)
2. Blind shear ram, additional critical components inside shear ram:
 Ram piston
3. Flange and gasket (in the BOP stack)
4. Annular preventer (rubber housing)

In the event of kick and well shut in is initiated, the above critical component is very
critical to the safety of personnel. Stripping and snubbing operation also require the critical
components to be function properly. It might not be a big problem if the critical components
are fail when the shut in has been initiated since it is only causing the delay of the operation.
Alternatively, well control can be done by regulating kill fluid directly into the hole through kill
line. During BOP testing operation, the critical components might not be critical if it fail as
there are many safety measure and procedure for safety.

10.1 Recommendation
If possible the design of rams and annular preventer are equipped with two shuttle
valves for each preventer. It might not common for the BOP design nowadays. There is a
need for additional shuttle valve for each annular and ram preventer as this is the most
critical equipment for operation of closing BOP (well shut in). Shuttle valve should also be
more robust against fire and explosion to ensure its functionality in case of blowouts.

The design of BOP should consider two blind shear rams in the stack to give more
availability for well shut in operation. Annular preventer should have the same maximum rate
pressure such as in the blind shear ram so it can act like blind shear ram when blind shear
ram is unavailable due to failure.

Page | 88
10.2 Suggestion for further works
The works conducted in this report is the analysis of criticality based on qualitative
approach. The scarce of data and the amount of time required to finish the report making
qualitative analysis become a good approach for the analysis. Literature study and experts
judgment with experience are the dominant sources for the analysis. There could be a
hidden or mislead information during the analysis, study, discussion and brainstorming
session. Hence, thorough quantitative analysis of criticality and reliability of BOP component
in more detail is necessary for further works to give a better insight of criticality in the BOP
component. Moreover, the consequences for loss of asset and environment damage should
also be analyzed in more detail in the further work.

The work done in this report is mainly for hydraulic BOP system. Further analysis on
electrohydraulic, multiplex system, ram intervention and acoustic intervention can also be
conducted.

Page | 89
11. REFERENCES
1. Aadnøy, B., S., 1999. Modern Well Design. Rotterdam: A.A. Balkema

2. Aven, T., 1992. Reliability and Risk Analysis. New York: Elsevier Science

3. Aven, T., 2008. Risk Analysis Assessing Uncertainties beyond Expected Values and Probabilities.
Chicester: John Wiley & Sons Ltd.

4. AIChE, 1985. Guidelines for Hazard Evaluation Procedures. New York: American Institute of
Chemical Engineers, Center for Chemical Process Safety

5. API RP 53, 1997. Recommended Practice for Blowout Prevention Equipment Systems for Drilling
Wells Third Edition. Washington: American Petroleum Institute

6. Bai, Y., Bai, Q., 2005. Subsea Pipelines and Risers. Oxford: Elsevier Inc.

7. Blanche, K.M., Shrivastava, A.B., 1994. Defining Failure of Manufacturing Machinery and
Equipment. In proceeding from the Annual Reliability and Maintainability Symposium, 1994: 69-75

8. BOEM (The Bureau of Ocean Energy Management, Regulation and Enforcement), 2011. The
Drilling Safety Rule: An Interim Final Rule to Enhance Safety Measures for Energy Development
on the Outer Continental Shelf (OCS). [online] Available at:
<http://www.doi.gov/news/pressreleases/loader.cfm?csModule=security/getfile&PageID=45792>
[Accessed 2 May 2012]

9. BP Investigation Team, 2010. Deepwater Horizon Accident Investigation Report. [online].

Available at:
<http://www.bp.com/liveassets/bp_internet/globalbp/globalbp_uk_english/incident_response/STA
GING/local_assets/downloads_pdfs/Deepwater_Horizon_Accident_Investigation_Report.pdf
[Accessed 29 March 2012]

10. BSEE (Bureau of Safety and Environmental Enforcement), 2012. Blowout Preventer (BOP)
System Requirements. [online] Available at: <http://ecfr.gpoaccess.gov/cgi/t/text/text-
idx?c=ecfr;sid=753e09fcc56267ea591458d1f43bba2c;rgn=div7;view=text;node=30%3A2.0.1.2.2.4
.68;idno=30;cc=ecfr> [Accessed 2 May 2012]

11. Chu, D., L., 2010. Plausible Oil Spill Scenario: Underground Blowout and Mudflow. [online]
Available at: <http://www.econmatters.com/2010/07/plausible-oil-spill-scenario.html>
[Accessed 14 March 2012]

12. Department of the Army, 2006. TM 5-698-4, Failure Modes, Effects and Criticality Analysis
(FMECA) for Command, Control, Communication, Computer, Intelligence, Surveillance and
Reconnaissance (C4ISR) Facilities. [online] Available at:
<http://armypubs.army.mil/eng/DR_pubs/DR_a/pdf/tm5_698_4.pdf> [Accessed 16 April 2012]

13. DNV RP-H101, 2003. Risk Management in Marine - and Subsea Operations. [online] Available at:
<http://exchange.dnv.com/publishing/codes/download.asp?url=2003-01/rp-h101.pdf>

14. Eslinger, E., Ure, D. and Kutlay, S., 2004. Risk Management and Analysis of Driving Hazard Using
Bow Tie Model. [online] Available at:
<http://www.onepetro.org/mslib/app/pdfpurchase.do?itemChronicleId=090147628005d5c0&itemS
ocietyCode=SPE> [Accessed 17 April 2012]

15. Goins, W.,C., Sheffield, R., 1983. Blowout Prevention: Practical Drilling Technology Volume 1.
Houston: Gulf Publishing Company

16. Grace, R., D., 2003. Blowout and Well Control Handbook. Burlington: Gulf Professional Publishing

17. Gudmestad, O.T., 2001. Risk Assessment Tools for Use during fabrication of Offshore Structures
th
and in Marine Operations Projects. 20 International Conference on Offshore Mechanics and
Arctic Engineering. Rio de Janeiro, Brazil 3-8 June 2001. Brazil: OMAE

Page | 90
18. Gröndahl, M., et al., 2010. Investigating the Cause of the Deepwater Horizon Blowout. [online]
Available at: <http://www.nytimes.com/interactive/2010/06/21/us/20100621-bop.html> [Accessed
27 march 2012]

19. GEKEngineering, 2010. 5000 Oilfield Terms: A Glossary of Petroleum Engineering Terms,
Abbreviations and Acronyms. [online] Available at:
<http://gekengineering.com/Downloads/Free_Downloads/Glossary_of_Petroleum_Engineering_Te
rms_25_August_2010.pdf> [Accessed 30 April 2012]

20. Hauge, S., et al., 2011. Barriers to Prevent and Limit Acute Releases to Sea: Environmental Risk
Acceptance Criteria and Requirements to Safety System. Trondheim: Sintef

21. Hawker, D., 2001. Blow Out Preventer & Well Control (Version 2.1). Stavanger: Datalog

22. Holand, P., 2007. Sintef Report: Reliability of Subsea BOP systems for Deepwater Application,
Phase II DW Unrestricted Version. [online] Available at:
<http://www.boemre.gov/tarprojects/319/319aa.pdf> [Accessed 17 April 2012]

23. Holand, P., Skalle, P. 2001. Sintef Report: Deepwater Kicks and BOP Performance Unrestricted
Version. [online] Available at:
<http://www.boemre.gov/tarprojects/383/383%20AB%20Final%20report%20Deepwater%20Kicks
%20and%20BOP%20Performance.pdf> [Accessed 17 April 2012]

24. HSE, 2006. Guidance on Risk Assessment for Offshore Installations. [online] Available at:
<http://www.hse.gov.uk/offshore/sheet32006.pdf> [Accessed 30 May 2012]

25. IEC 50(191). 1990. International Electrotechnical Vocabulary (IEV) – Chapter 191 – Dependability
and Quality of Service. International Electrotechnical Commision, Geneva.

26. IEC 60812, 2006. Analysis Techniques for System Reliability – Procedure for Failure Mode and
Effects Analysis (FMEA). International Electrotechnical Commision, Geneva.

27. Malhotra, S.,M., 2005. Handbook of Drilling Technology Terms & Phrases. India: Technology
Publications

28. Nas, S., 2011. Kick Detection and Well Control in a Closed Wellbore. [online] Available at :
<http://www.onepetro.org/mslib/app/pdfpurchase.do?itemChronicleId=090147628022a0ee&itemS
ocietyCode=SPE> [Accessed 7 April 2012]

29. Norsok D-001, 1998. Drilling Facilities. [online] Available at:

<http://www.standard.no/PageFiles/1318/D-001.pdf> [Accessed 3 April 2012]

30. Norsok D-010, 2004. Well Integrity in Drilling and Well Operations. [online] Available at:
<http://www.standard.no/pagefiles/1315/d-010r3.pdf> [Accessed 3 April 2012]

31. Norsok Z-008, 2001. Criticality Analysis for Maintenance Purposes. [online] Available at:
<http://www.standard.no/PageFiles/961/Z-008.pdf> [Accessed 20 April 2012]

32. Norsok Z-013, 2001. Risk and Emergency Preparedness Analysis. [online] Available at:
<http://www.standard.no/PageFiles/955/Z-013.pdf> [Accessed 30 May 2012]

33. Odland, J., 2010. MOK 120 Offshore Field Development Compendium and Lectures. Stavanger:
University of Stavanger

34. Oil States, 2012. Drilling Risers. [online] Available at: <http://www.oilstates.com/fw/main/Drilling-
Risers-471.html> [Accessed 28 March 2012]

35. Perez, R., 1993. Using Fault Trees to Determine the Root Cause of Rotating Equipment Failures.
Texas: Texas A&M University.

36. Rausand, M., 2005. Chapter 3 System Analysis Failure Modes, Effects, and Criticality Analysis.
[online] Available at: <http://www.ntnu.no/ross/slides/fmeca.pdf> [Accessed 20 April 2012]

Page | 91
37. Rausand, M., Høyland A., 2004. System Reliability Theory: Models, Statistical Methods and
nd
Applications 2 Edition. New Jersey: John Wiley & Sons, Inc.

38. Radoil, 2009. Loc-Torus Wellhead Connector. [online] Available at:

<http://www.radoil.com/docs/Wellhead-Connector-LOC-Torus.pdf> [Accessed 28 March 2012]

39. Rees, A., Daniel, M., 2011. Blowout Preventer Stack and Control System. [online] Available at:
<http://www.energyclaims.net/assets/BOP-and-control-system.pdf> [Accessed 3 April 2012]

40. Rig Train, 2001. Drilling and Well Services Training. Aberdeen: TDI

41. Risk Support, 2005. Risk Analysis of Modules Installation onto Visund FPU, Final Report 2005.
London: Risk Support

42. Scandpower, 2011a. FMECA of BOP Hydraulic Control System at Statfjord B and C. Kjeller:
Scandpower

43. Scandpower, 2011b. FMECA of BOP Systems. Kjeller: Scandpower

44. Schlumberger, 2012. Oilfield Glossary. [online]Available at: <http://www.glossary.oilfield.slb.com/>

[Accessed 5 March 2012]

45. Sedco Forex, 1999. Well Control Manual. HQS-PO-OPT-01. Schlumberger

46. Serene Energy, 2010. Drilling. [online] Availbel at: <http://www.sereneenergy.org/Drilling.php>

[Accessed 10 March 2012]

47. Subsea1, 2010. Subsea Facility Overview. [online] Available at: <http://subsea1.com>
[Accessed 8 March 2012]

48. SPE E&P, 2011. SPE E&P Glossary. [online] Available at:
<http://www.spe.org/glossary/wiki/doku.php> [Accessed 14 March 2012]

49. Stoneley, R., 1995. An Introduction to Petroleum Exploration for Non-Geologists. New York:
Oxford University Press Inc.

50. Transocean, 2011. Macondo Well Incident Transocean Investigation Report Volume 1. [online]
Available at: <http://www.deepwater.com/_filelib/FileCabinet/pdfs/00_TRANSOCEAN_Vol_1.pdf>
[Accessed 21 March 2012]

51. Tumer, I., et al., 2010. ME 515 DP7: Final Case Study Report Deepwater Horizon Risk
Assessment. [online] Available at: <http://michaelkoopmans.com/DH_risk_assessment.pdf>
[Accessed 18 April 2012]

52. Umbilicals, 2009. BOP Mux Cables. [online] Available at:

<http://www.umbilicals.com/PDF/111220092250e5e1bc12.pdf> [Accessed 28 March 2012]

53. Vujasinovic, A., 1986. How Blowout Preventer Work. [Online] Available at:
<http://www.onepetro.org/mslib/app/pdfpurchase.do?itemChronicleId=0901476280075cbd&itemS
ocietyCode=SPE> [Accessed 25 March 2012]

54. Well Control School, 2004. Guide to Blowout Prevention. Louisiana: Well Control School.

55. Westergaard, R., H., 1987. All About Blowout. Oslo: BK Grafisk.

Page | 92
 12. APPENDICES

12.1 FMECA sheet

Table 12.1 FMECA of hydraulic BOP system
ID Item/functional Operational Failure Failure Cause(s) Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Local Global method provisions (1- (1- (L,M, and recommendation party
(safeguards) 5) 5) H)
1.1 Accumulator Used for all F-1.1.1 Wear due to ageing Gas in the Some Maintenance Redundancy 1 3 L Evaluate to add
Bottles operational Burst system reduced and with regards to strainer upstream
modes, shall be bladder Human error when (increased capacity inspection number of pressure regulating
Function: available at all refilling the bottles motive force procedures. bottles (25% valve in the shear
Store energy times behind the fluid Worst case: overcapacity + boost system
(hydraulic fluid) Potential for damage during possibility of When 3 extra bottles)
to bladder from hydraulic particles from draining Check the
Valve in the bottom return to burst bladder the system; if Routine for calculations for precharge
of the bottle, when reservoir). to pressure the pressure control of pressure on
the bladder expands regulating decreases charge pressure the accumulator
downwards during Reduced valve in the below the in place bottles
depressurization of accuracy of hydraulic charging
the bottles. the flow meter system pressure, it is Competence of Evaluate having one burst
an indication operators when disk for the entire
Affected BOP functions of a burst refilling the accumulator bank. Take into
bladder will will still be bladder in accumulator consideration that this may
not function upheld due to the bottle bottles. The reduce the number of leak
overcapacity rack. bottles are rated points compared to having
for 5000 psi one bursting disk for each
bottle.
Function testing
of BOP Update P&ID to
functions every reflect the chosen solution
week

F-1.1.2 Poor quality of valve Affected No Audible if a Maintenance 1 2 L

Leakage accumulator consequence big leakage. procedures
through mechanical damage has reduced due to (leak check
nitrogen capacity/does safeguards When each time the
"fill"- not function draining valve is
system BOP functions the system; if operated)
(valve) will still be the pressure Redundancy
upheld due to decreases with regards to
overcapacity below the number of
charging bottles (25%
pressure, it is overcapacity +
an indication 3 extra bottles)
of a burst Function testing
bladder in of BOP
the bottle functions every
rack. week

Page | 93
ID Item/functional Operational Failure Failure Cause(s) Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Local Global method provisions (1- (1- (L,M, and recommendation party
(safeguards) 5) 5) H)
F-1.1.3 Rupture of Affected Dampening Nitrogen Maintenance 1 2 L When bringing a Enginee
Lack of bladder, leaks accumulator(s) effects blown back procedures. rack of accumulator ring
stored will have to reservoir, bottles back into
accumulation reduced causing Redundancy gives operation, there will be
pressure, capacity foaming loss of one bottle will 3000 psi on one side of the
reduced not effect other. isolation valve (towards the
capacity, rest of the hydraulic
Bladders are system), and no pressure on
changed out every the other side of the valve.
five years A sudden opening of the
isolation valve could cause
The gauges on the damage to the valve itself. It
accumulator banks should be considered
are included in the to include a balancing
maintenance program. line/tubing with a needle
API valve between each rack of
RP 53, section accumulators in order to
12.5.3g gives minimize the potential for
requirements with damage to the isolation
regards to the valve due to sudden
pressure gauges. pressure
Accumulator
pressure gauges
are currently
checked for
calibration yearly

Optional:
There are currently
provisions in the
design for using
nitrogen as a pressure
source for operating
the BOP.
This is not taken
into consideration
in the risk ranking
F-1.1.4 Leak on gas side Affected Dampening Measurement Maintenance 1 2 L Ensure that maintenance Mainten
Lack of of bladder, failure accumulator(s) effects of bladder procedures. and inspection procedures ance
stored in nitrogen fill valve will have include snooping of the
accumulation assembly reduced Redundancy gives nitrogen fill valves. It is also
pressure, capacity loss of one bottle will a possibility to use soapy
reduced not effect other water to detect leaks (via
capacity, bubbling) every time the
Testing. valve are operated

Page | 94
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.2 Hydraulic line from Used for all F-1.2.1 Mechanical Spillage Worst case: Visual Support in accordance 2 3 M Ensure that layout and
HPU to BOP operational Leakage, failure. (water, glycol, Drain all with regulations and design ensures access to
(Jumper hose line, modes, shall be bursting, Corrosion. hydraulic fluid) hydraulic fluid Low level and standards. the valves etc. that need
subsea hose available at all plugged line Fatigue to in the bottle low pressure maintenance.
bundle, choke and times External forces environment. racks alarms Use environmentally Ensure that grating
kill line) Insufficient or (normally the friendly hydraulic fluid. or similar is in place
incorrect support, Potential for alarms will Excessive / available to prevent
Function: vibration. personnel ensure that running of the Fittings are stainless climbing on pipes
Route of hydraulic Climbing on the injury this does not pumps steel, reducing
fluid from HPU to pipes. happen, corrosion issues Verify the design
BOP Mechanical failure except for specification concerning
in fittings, very large Hoses are fire piping to the accumulator
gaskets, etc leaks where resistant and placed in banks. Take into
the operator a restricted area consideration that a break or
does not have leak from a common
time to react) Hoses are equipped hydraulic pipe could
with whip-checks increase the potential for
Potential loss draining all hydraulic fluid
of individual Short pipe stretches. from the accumulator banks,
BOP functions compared to separate
Operators piping.
Potential loss (competence)
of the normally have Ensure that all valves in the
complete time to react main hydraulic lines are
surface volume and isolate a equipped with a car seal
of hydraulic leak system, and ensure that
fluid through procedures and routines
burst hose Function testing of incorporate this.
BOP functions every
week. Ensure that inspection (and
documentation) of hoses
Maintenance and pipes are included in
and inspection the maintenance and
procedures inspection programs.

Redundant BOP Review the required

functions and change-out intervals for the
hydraulic line for both hoses, including
each pod maintenance procedures.

Ensure that
hoses and connected
pipes are properly tagged, in
order to prevent
misunderstandings when
reattaching hoses after
maintenance

Page | 95
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
Ensure that the hose are
manufactured in accordance
with relevant standards,
and that there are no weak
links in the fire protection of
the hose

Ensure that a scenario with

rupture of a hose and a
rapid loss of hydraulic fluid
surface volume is included
in the operator training, in
order to ensure that correct
actions are being taken to
isolate the leak source in an
emergency situation.

After implementation of
these recommendations, the
probability of the failure
mode may be reduced from
3 to 2, and the risk thus
becomes L (Low)

1.3 Solenoids to Used for all F-1.3.1 Burnt/broken coil Affected No Loop Manual override and 1 3 L The solenoid is attached on Mainten
valves operational Fail to move Wire break solenoid consequence monitoring of manual initiation of the central hydraulic control ance
modes, shall be Dust cannot be due to solenoid pilot control valve manifold
Function: available at all Contamination operated from safeguards through the
Controlling the times Stuck (too high the panels, (still possible PLC, raising Maintenance and Consider to include a test of
opening and closing friction) and thus to operate the an alarm inspection procedures the high/low override
of valves and rams Electrical failure corresponding BOP functions function
Loss of air pilot control manually from Flow meter Function testing of
Type: Mechanical failure valve cannot the BOP and pressure BOP functions every
Solenoid valves to Obstruction be activated control unit transmitter week. Function testing
valves and rams (13 from panel room) monitoring of the sheer boost
off) system every new well
Visual, when
function is
activated

Indicator light
for valve
position on
the remote
panels

Page | 96
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.4 Pilot Valve (air) Shall be F-1.4.1 No credible failure None No Visual Redundancy, i.e., it is 1 1 L Since no credible failure
available at all Not operating causes found consequence possible to close the causes were identified, the
Functions: times for well due to sub plate mounted probability and
Close shuttle valve control safeguards (SPM) valve on the consequence of the failure
to the hydraulic operations shear ram via the mode was considered low
manifold panels

Manual override (it is

possible to manually
close the sub plate
mounted (SPM) valve
on the shear ram)

Maintenance and
inspection procedures

Function testing of the

hydraulic system for
every new well

1.5 Subsea Regulated Used for all F-1.5.1 Loss of air Cannot No Visual Can be operated 1 3 L Confirm if the regulator can
Valve operational Regulator pressure, operate the consequence manually (to be be operated manually (hand
modes, shall be stuck in error in air regulator from due to Pressure verified) wheel, etc). update P&ID
Functions: available at all position solenoid, the panels safeguards gauges accordingly
Regulating pressure times corrosion, Upper and lower pipe
of hydraulic fluid to solenoid valve ram are on a separate
the annulus and failure, electric line, and have a
rams system failure separate pressure
regulator, and may
therefore still be
operated

Maintenance and
inspection procedures

Used often, thus

corrosion is not a
problem

Built in pressure relief

valve in annulus
system, relieving back
into reservoir, will
prevent pressures
above 1500 psi in
downstream annulus
system

Page | 97
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-1.5.2 Broken spring Fail to open: Fail to open Visual. Upper and lower pipe 1 1 L Check whether the pressure
Fail to No gives no ram are on a separate regulator fails open or
open/close consequence consequence Pressure line, and have a closed (confirm failure
(all equipment due to transmitters separate pressure modes) – if it fails close it
is rated for safeguards regulator, and may can be evaluated whether
3000 psi) therefore still be the bypass should be
Fail to close operated included. Vendor should
Fail to close: gives loss of all provide information about
No pressure to equipment Function testing of failure rates. Thus
downstream functions BOP functions every probability may be changed
equipment downstream week
except the
sheer boost
and the
annular (other
main hydraulic
lines)
1.6 Shuttle Valve (rams Shall be F-1.6.1 Wear on slide, Shuttle valve Loss of Visual when Function testing of the 5 1 M The shuttle valve is deemed
and annular available at all Not able to causing jam, cannot move redundancy shuttle valve control pod for every to be critical for safety, and
preventer) times for well change corrosion (shuttle with regards to should move. new well thus needs to be better
control position valve is exposed) shear ram Indicator light documented
Function: operations functions on shear ram
Shuttles hydraulic functions Vendor should document
fluid from the control Worst case: how the valve functions in a
pod to the shear ram Delayed or no situation with equal pressure
and preventer shearing on both sides (e.g., in a
situation with 3000 psi
pressure on the normal
system, and the sheer boost
system needs to be
initiated).

The probability for having

the same pressure on both
sides is low, as the pressure
in the manifold system is
normally down to 1500 psi

Evaluation of test frequency

and documentation of
reliability of valve can
decrease the overall risk
level. It should be evaluated
if the sheer boost system
should be included in
weekly function test. Take
into consideration the
increased wear on the pipe
and valve system if 3000 psi
is routed through every
week

Page | 98
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.7 Fluid Reservoir Used for all F-1.7.1 Too small or Leakage of No Alarm from Vent is designed to 1 4 M Check calculations
operational Rupture of clogged vent on hydraulic fluid consequence the level take full blow down (dimension of the vent), to
Function: modes, shall be reservoir hydraulic due to transmitter from bottle rack ensure that the vent line has
Open tank (with lid) available at all reservoir safeguards (leakage) sufficient capacity to prevent
storage for hydraulic times (still possible Accumulator banks over pressurization of the
fluid. Closed to operate the Visual store enough reservoir in case of a full
hydraulic circuit (all BOP functions) hydraulic power to blow down from bottle rack.
returns to tank) ensure operation of Also take into consideration
BOP the potential for larger
motive force in case of a
nitrogen leak

Probability was rated as 4,

but when calculations have
been confirmed and if they
show that the vent is big
enough then the probability
may be reduced, and thus
the risk

F-1.7.2 Failure in lining Hydraulic fluid Clogging of Sampling of Strainers on suction 1 3 L The Y strainers on the Mainten
Contaminatio giving rise to quality is suction hydraulic side of hydraulic suction side of the electrical ance
n of hydraulic contaminants in inadequte strainers fluid. pumps will remove pumps may have too large
fluid hydraulic fluid upstream Sampling is large particles. Place mesh size to protect the
entry of dirt and hydraulic done on a filters downstream the pumps adequately. Too fine
other pumps. Fine regular basis pumps, after the filters may cause cavitation.
contaminants to particles may (monthly or accumulators The mesh size of the filters
reservoir through pass through every three should be considered taking
breathers and increase months) as The filters will be this into consideration
wear on pump part of the monitored during
maintenance regular maintenance To prevent layering of water, Enginee
procedures in order to detect if glycol and chemicals, ring
there are any particles circulation in the reservoir
in the hydraulic fluid should be considered. A
filter could be installed in
such a circulation system in
order to facilitate cleaning
and improve quality of the
hydraulic fluid. It is
recommended to circulate
three times the reservoir
volume each eight hours

Page | 99
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-1.7.3 Reservoir volume Tank will be Potential for Level switch Environmental friendly 1 2 L The calculations should be
Too low too small, too low emptied, or spills of detects low hydraulic fluid. Low reviewed and the need for a
volumetric level in reservoir, reservoir may hydraulic fluid level, gives level alarm. day tank should be
capacity of too high volume overflow if to the alarm and Maintenance / considered
reservoir in reservoir there are more environment trips pumps. inspection routines
(1200 gal. stored energy Sight glass is
reservoir) (hydraulic fluid) the detection
in the system method for
and too high level
accumulators in reservoir
that the
capacity of the
reservoir
1.8 Pressure Regulator Used for all F-1.8.1 Loss of air Cannot No Visual Can be operated 1 3 L Confirm if the regulator can
(hydraulic operational Regulator pressure, error in operate the consequence (manifold manually. Regulator be operated manually
manifold) modes, shall be stuck in air solenoid, regulator from due to pressure system could be
available at all position corrosion, failure the panels safeguards does not bypassed
Functions: times in solenoid change when
Regulating the valves, electrical you are trying Maintenance and
pressure of the failure to regulate) inspection procedures
hydraulic fluid to the
manifold Used often, thus
corrosion is not a
problem
F-1.8.2 Broken spring Fail to open: Fail to open: Visual Annular preventer is 1 1 L Check whether the pressure
Fail to open No no on a separate line, regulator fails open or
consequence consequence Pressure thus may still be closed (confirm failure
(all equipment due to transmitters operated modes) – if it fails close it
is rated for safeguard can be evaluated whether
3000 psi) the bypass should be
Function testing of included. Vendor should
BOP functions every provide information about
F-1.8.3 Fail to close: Fail to close: week 3 1 L failure rates. Thus
Fail to close no pressure to Lose all probability may be changed
downstream equipment
equipment functions
downstream

Page | 100
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-1.8.4 Contaminated Leak of No global Visual Spare regulator 1 3 L
Seal failure / hydraulic fluid hydraulic fluids effects due to Noise available on the rig.
washout due to seal safeguards Pumps will be Leak rate will be
failure washout allowing for starting smaller that pump
BOP functions frequently capacity, allowing for
to be upheld the BOP function to
be upheld even in
case of a leak. This
means that leaks does
not need to be
repaired in critical
situations. It is also
possible to bypass the
regulator via the high
pressure bypass, and
route 3000 psi
hydraulic fluid directly
to the ram valves

Maintenance program

Filter
1.9 Flow meter, Used for all F-1.9.1 Mechanical Loss of No global Visual, check Maintenance and 1 2 L
instrumentation on operational Failure of failure, pressure effect, still of manifold inspection procedures
HPU, pressure modes, shall be pressure mechanical reading from possible to pressure low
transmitter available at all transmitter, damage, affected perform BOP pressure Yearly calibration
times loss of signal electrical failure transmitter function alarm check
Functions: inspection
Provide information Daily check of
about the status functionality
(pressure and flow) F-1.9.2 Electric failure, False pressure No global Visual, check Maintenance and 1 2 L When running casing, Operati
of the hydraulic Failure of clogging of reading effect, still of manifold inspection procedures ensure that cross checks of on
system pressure transmitter possible to pressure low pressures are made in order
transmitter, perform BOP pressure Yearly calibration to ensure that a false low
wrong signal functions alarm check pressure reading would not
inspection lead to damage of the
Daily check of casing. Check that this is
functionality stated in the operational
procedures

Evaluate to amend the daily Operati

check list to include cross ons &
referencing of pressure mainten
measurements from the ance
different gauges

Page | 101
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-1.9.3 Mechanical Loss of flow No global Visual, Maintenance and 1 2 L Include in the maintenance mainten
Failure of failure, reading effect, still inspection on inspection procedures procedure that the flow ance
flow mechanical possible to BOP meter is cross checked and
transmitter, damage, perform BOP pressure Functional cross calculated against the time
loss of signal electrical failure functions changes, checks every 4 weeks for closing in depletion tests,
pumps are and the pressure before and
running after, and the pump running
time
F-1.9.4 Mechanical failure False flow No global Visual, Maintenance and 1 2 L
Failure of reading effect still inspection on inspection procedures
flow possible to BOP
transmitter, perform BOP pressure Functional cross
wrong signal functions changes, checks every 4 weeks
pumps are
running
1.10 Pump in hydraulic Used for all F-1.10.1 Broken Affected pump No PLC registers 100% redundancy 1 3 L The duty and standby pump Enginee
manifold operational Pump does transmission belt, does not run consequence if a pump with regards to pump will be switched by the PLC, ring
modes, shall be not start, electrical errors, due to does not run capacity in hydraulic to prevent increased wear in
Functions: available at all pump not mechanical safeguards manifold. If all power one of the pumps compared
Providing flow and times running when errors, pressure (still possible Alarms are lost, one of the to the other
pressure in the intended to switch controlling to operate the pumps will run on
hydraulic system run pump not BOP functions) Visual emergency power The bleed valve from the
working, damage pulse dampener on the
to chain drive Visual Accumulator banks pressure side of the pumps
readout on is currently a ball valve.
pressure Maintenance and Consider to replace the ball
switch inspection valve with a needle valve to
procedures. A check facilitate regulation of air
of the chain drive is purging from the system
part of the planned
maintenance
procedures
F-1.10.2 Poor quality Affected pump No global Visual A check of this is a 1 2 L
Pump does linings in will not run effect. System part of the planned
not start, electrical motor will still operate Visual maintenance
pump not as intended readout on
running when due to pressure Redundant pump
intended to redundancy switch system, accumulators
run
F-1.10.3 Electrical failure, Increased No Redundant PSVs prevent over 1 2 L Check max design pressure
Pump does MCC failure, wear of pump consequence PTs pressurization on the of the pumps, and confirm if
not stop signal failure due to programmed system the pumps may over
safeguards to start/stop Redundant pressure pressurize the system.
(PSV) the pumps transmitters Confirm with vendor what
High max design pressure is and
pressure Maintenance and evaluate against set and
alarm inspection procedures design pressure in system

Excessive
running alarm

Page | 102
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-1.10.4 Broken piston Affected pump No Excessive Accumulator banks 1 2 L There are one primary and
Pump shaft, wear and cannot build up consequence running alarm one secondary pump. This
running but tear in pump, pressure due to (observe Maintenance and is not switched around
not building blocked strainer, safeguards. stable low inspection procedures during normal operation.
up pressure, low level in No or reduced System will still pressure over This was deemed good as
or giving reservoir, leaking flow trough operate as a long time) Redundant pump the pumps are mainly
enough flow piston packers, affected pump intended due system in hydraulic needed when the BOP is
other leaks, to redundancy manifold used, and in that case, both
damage to pumps will be used. I.e.,
downstream there will not be increased
check valve wear and tear on the
primary pump compared to
the secondary

F-1.10.5 Positive Failure of No global Noise, visual Inspection. 1 2 L

Vibration displacement pump effect due to Pulsation dampener
pumps. adequate as safeguard against
Misalignment of pulsation pulses from PD
drive chain dampener pumps

F-1.10.6 Electrical failure, High pressure No global Pump Pressure relief valves 1 3 L
Pump runs failure in pressure in the system, effect due to running light
when not switch controlling over pressure relief on drillers Redundant pump
intended to the pump pressurization valves and and auxiliary system
run redundant panel.
system Visual Maintenance
procedures,
competence of drillers

1.11 Air pressure switch Used for all F-1.11.1 Mechanical failure No air supply No global Pressure Electrical driven 1 2 L
for pumps operational Switch is not in the switch itself to pump, pump effect. indication in pumps as primary
modes, shall be switching will not start Pressure will the hydraulic pumping system.
Functions: available at all when be maintained system. Low Accumulators.
Supply air to air times intended to in order to pressure Maintenance
driven pumps allow for alarms procedures cover the
operation of functionality of the
BOP whole pump system,
including the switch
F-1.11.2 Mechanical failure High pressure No global Visual (it will Pressure relief valves. 1 2 L
Switch is not in the switch in the system, effect due to be noticed Maintenance
closing when itself, dirt/particles over pressure relief when the procedures,
intended to pressurization valves and pressure competence of drillers
redundant relief valves
system lifts).
Pressure
gauges

Page | 103
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.12 Strainer upstream Used for all F-1.12.1 Contamination of Cavitation of No Excessive Acid resistant 1 2 L Verify that inspection of
pumps operational Clogging of hydraulic fluid pump (loss of consequence running alarm strainers filters and strainers is
modes, shall be strainer redundancy) due to (will alert included in the maintenance
Functions: available at all safeguards operator 100& redundancy with manual and procedures
Removing particles times Reduced (still possible before the regards to pump
to prevent damage capacity to operate the pump breaks) capacity in hydraulic Verify that isolation valves is
to pump through BOP functions) manifold available for maintenance
strainer, lower Physical purpose
NPSH for inspection Redundant strainer
pump and pump system

Accumulator banks

Maintenance and
inspection procedures
1.13 Filter downstream Used for all F-1.13.1 Contamination of Clogged filter, No Clogging Bypass of filters is 1 2 L The set points of dP alarms
pumps operational Clogging of hydraulic fluid erratic consequence indicator possible should be evaluated in order
modes, shall be filter operation of due to (gree/yellow/ to prevent unnecessary
Functions: available at all the pumps, safeguards red) Redundant pump alarms.
Filtering hydraulic times increased wear system and filters
fluid and removing Consider to measure the
impurities / Maintenance and condition of the filters via dP
contamination inspection procedures measurement over the filter
in order to minimize the
Accumulator banks need for change of filters on
a regular basis

F-1.13.2 Burst filter A burst filter No Pump Maintenance and 1 2 L

No filtering Wrong installation may cause a consequence running, low inspection procedures
effect of filter (human leak, and in due to level alarm
error) worst case safeguards on reservoir Competence of
empty the (first low, operators
accumulators then low-low
and hydraulic and stop). Accumulator banks
reservoir.
Visual.
Particles not
being filtered Wrong
out of the installation of
system. the filters will
Potential for be detected
clogging of visually when
downstream starting the
system system

Page | 104
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-1.13.3 High differential Damaged filter No global Clogging Redundant filters. 1 2 L Consider to measure the
Bursting pressure over the effect due to indicator Filters are exchanged condition of the filters via dP
filter/filter filter caused by redundancy internally in when needed through measurement over the filter
collapse clogging of the each filter normal maintenance. in order to minimize the
filter need for change of filters on
Safety factor built into a regular basis
filter element with
regards to structural
integrity/strength

1.14 Hose Upstream Used for all F-1.14.1 Deterioration of Pump damage, No global Visual, noise Maintenance 1 2 L
Strainers operational Ingress of air clamps for reduced effect. System procedures,
modes, shall be into hydraulic connection of operational will still operate inspection
available at all system gives hose or the hose capacity as intended
times potential itself due to Redundant strainer
small redundancy and pump system
vacuum/
under
pressure on
the pump
suction side
when pump
is stroking
1.15 Level transmitter in Used for all F-1.15.1 Damaged wire, Unnecessary No global Audio and Air pumps will start 1 3 L Ensure that testing mainten
reservoir operational Fails to read electric failure trip of electrical effect visual alarm when electric pumps incorporates a physical ance
modes, shall be correct level pumps on drillers are shut down. verification of the level
Functions: available at all (i.e. reading and auxiliary switch function
give low level alarm times low level panels. Accumulators will
and trip pumps at when level Low pressure maintain pressure in
low level in reservoir are not low) alarm in system. Maintenance
accumulators procedures (testing of
switch)
F-1.15.2 Level switch hung Dry running of No global Low pressure Accumulators will 1 3 L Ensure that testing
Fails to read up electrical effect alarm in maintain pressure in incorporates a physical
correct level pumps, accumulators system verification of the level
(i.e. not damage to switch function
reading an pumps Running Alarm, pumps will not
actual low pumps be damaged
level) indication on immediately, so there
panels (light) is time to react.
Competence of the
drillers.

Page | 105
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.16 Pressure safety Used for all F-1.16.1 Corrosion Affected PSV Will empty the Inspection, Excessive running 1 3 L If the PSV opens when not
valve (PSV)s operational Open when will lift when accumulators. visual alarm intended to, the accumulator
modes, shall be not suppose Human error not intended to All BOP Yearly control of PSVs banks may be emptied back
Functions: available at all to open (installation error) functions will Pressure Maintenance and into the hydraulic reservoir
Pressure reduction times (manifold) be unavailable transmitter inspection procedures
to prevent over Wrong set point will indicate
pressurization of the falling Competence of
equipment pressure operators
PSVs is made of
Excessive corrosion resistant
running alarm material

1.17 Pilot Control Used for all F-1.17.1 Loss of air from Affected 4 way No global Visual Manual operation / 1 3 L Consider to include greasing
Valve/Panel Valve operational Fails to move solenoid valve, valve does not effects due to monitoring of override of valves. of the 4 way valves in the
modes, shall be mechanical work, safeguards flow meter maintenance program
Functions: available at all failure, stuck (too corresponding and pressure Maintenance and
Controlling the times high friction), BOP function transmitter. inspection procedures
opening and closing obstruction, (depending on
of valves and rams corrosion which 4 way Indicator light
valve that fails) for valve
Type: will be lost position on
Panel valve the remote
panels
F-1.17.2 Contaminated Leak of No global Visual, noise. Maintenance and 1 3 L
Wash out hydraulic fluid hydraulic fluid effects due to inspection procedures
due to seal safeguards Pumps will be
washout allowing for starting Filters
BOP functions frequently.
to be upheld
Leak will be
back to
reservoir
1.18 Flange and Gasket Used for all F-1.18.1 Poor quality of Spillage (water Worst case: Visual Certificate for each 2 3 M Evaluate to include a torque
operational Leakage gaskets. Wrong and glycol) drain all flange after installation check in maintenance
Function: modes, shall be torque applied hydraulic fluid Low level and programs (e.g., on a 5 years
Connection and seal available at all when fastening in the bottle low pressure Pipe support respects basis)
between pipe and times bolts (too little racks (normally alarms the current standards
valves torque or the alarms will and requirements
skewed). ensure that Excessive
Insufficient or this does not running of the Short pipe stretches
wrong support, happen, pumps
vibration except for very Standard, proven
large leaks gaskets will be used
Human error where the
(wrong operator does Piping, flanges and
installation) not have time gaskets will comply
to react) with TR2000
Misalignment
Maintenance and
inspection procedures

Page | 106
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.19 Master Electric Used for all F-1.19.1 Failed electric No initiation of No global Visual, Testing, 1 2 L
Panel and Electric operational Fail to give power cable, valve or BOP effect due to Feedback
Mini Panel modes, shall be electric human error function safeguard from the Redundancy by
available at all signal for when switching hydraulic having master electric
Function: times some panel system and mini panel for
Initiate electric intended initiation of command
command for BOP valves and Flow meter,
function, valves, flow BOP function pressure
of hydraulic. gauges (to
see if the
electric signal
has been
sent)

1.20 Electric Power Used for all F-1.20.1 Obsolete battery, Not significant No global Indicator light Redundancy by 1 2 L
Pack with Battery operational Fail to give failed electric effect effect due to having generator as a
Back Up modes, shall be electric power cable safeguard main power
available at all power for
Function: times BOP panel Testing and
Independent supply command maintenance
of electric power into initiation
manifold

1.21 Electric Power Used for all F-1.21.1 Worn cables, Unable to Worst case Visual Regular visual check 1 2 L
Cable operational Not able to short circuit, no initiate scenario: to see if cables are
modes, shall be distribute signal sent from solenoid valve No command Feedback worn, scratch, etc.
Function: available at all electric electric panel, and other can be initiated from the
Provide flow of times signal cables are cut function of from the hydraulic Manual override of
electric command valves control panel system valve or other
from control panel command
into manifold Flow meter,
pressure
gauges (to
see if the
electric signal
has been
sent)

Page | 107
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.22 Air Operator Used for all F-1.22.1 Air leakage, worn Pilot control No pilot Visual, noise Manual intervention 1 2 L
operational Fail to parts of air valve cannot hydraulic fluid
Function: modes, shall be regulate operator, be operated can be
Allow the opening available at all corrosion, not regulated into
and closing of pilot times enough air subsea pod for
control valve by pressure, failure BOP function
using air as a media of solenoid valve

1.23 Pod Selector Valve Shall be F-1.23.1 Loss of air from Routing failure In case of Indicator light Regularly scheduled 1 2 L Manual intervention with
available at all Fail to move solenoid valve, of hydraulic failure in one for valve testing, maintenance ROV requires longer
Function: times for well (change mechanical fluid into the of the subsea position and inspection response time. It could be
Select one of the control position) failure, stuck (too intended pods, the the last effort for BOP
subsea pods to be operations high friction), subsea pod hydraulic fluid Visual Manual intervention intervention when other
flowed by hydraulic obstruction, cannot be monitoring of electric and hydraulic
power fluid for BOP corrosion routed into flow meter system for BOP function has
function. There are another and pressure failed.
two subsea pods for subsea pod. It transmitter
redundancy and only gives no BOP
one pod should only function
be flowed at a time causing high
probability of
blowout
1.24 Sub Plate Mounted Shall be F-1.24.1 Hydraulic Affected sub No Indicator light Regularly scheduled 1 3 L
(SPM) Valves available at all Fail to close leakage, plate mounted consequence for valve testing, maintenance
times for well worn/degrade (SPM) valve due to position and inspection
Function: control parts in the valve will not close safeguards
Direct the power operations causing leakage, (still possible Visual Redundancy by
hydraulic fluid either corrosion, stuck, to operate the monitoring of operating other SPM
to close ram or open mechanical SPM from flow meter valve trough other
ram by closing and failure, loss of other pods) and pressure pods
opening its valve instrumented air, transmitter
broken solenoid, Manual override
loss of signal Alarms (possible to manually
operate BOP
Not enough pilot functions)
hydraulic fluid
pressure Function testing of
BOP functions every
week

Page | 108
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-1.24.2 Hydraulic Not able to No Indicator light Regularly scheduled 1 3 L
Fail to open leakage, circulate the consequence for valve testing, maintenance
worn/degrade hydraulic fluid due to position and inspection
parts in the valve properly safeguards
causing leakage, causing not (still possible Visual Redundancy by
corrosion, stuck, proper to operate the monitoring of operating other SPM
mechanical ram/annular SPM from flow meter valve trough other
failure, loss of function (not other pods) and pressure pods
instrumented air, significant transmitter
broken solenoid, effect, just Manual override
loss of signal cause delay) Alarms (possible to manually
operate BOP
Over pressure in functions)
the pilot hydraulic
fluid Function testing of
BOP functions every
week
F-1.24.3 Contaminated Affected sub No Visual (flow Manual override 1 3 L
Fail between hydraulic fluid, plate mounted consequence meter) (possible to manually
positions (not mechanical fail in (SPM) valve due to operate BOP
completely actuator, wear will not close safeguards Pressure functions)
closed nor or open (still possible transmitter
opened) completely to operate the Maintenance and
BOP functions Indication inspection procedures
manually from lights on
the BOP panels In some cases there is
control unit redundancy from
room) Alarms other rams/preventer
for closing

Function testing of
BOP functions every
week
1.25 Fluid Mixing Used for all F-1.25.1 Inadequate Might need Improper Pump stroke Quality control of 1 2 L
System operational Fail to make mixture, human more powerful opening/closin reading hydraulic fluid from
mode, shall be the required error, leakage pump to g of SPM valve fluid mixing system
Function: available at all hydraulic transfer into
Mixing the fluids to times fluid accumulator Improper
become hydraulic opening/closin
fluid needed for BOP Might g of rams or
operation deteriorate preventer
accumulator

Page | 109
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.26 Accumulator Used for all F-1.26.1 Corrosion, Fail to open: No Flow meter Regular testing and 1 3 L
Isolator Valve operational Failed to mechanical failure Unable to flow consequence and pressure maintenance
(inside HPU) mode, shall be open/close the hydraulic due to transmitter
available at all flow from the redundancy monitoring Redundancy by
Function: times valve having the flow
Isolate hydraulic through other valve
fluid from Fail to close:
accumulator The flow can
still be stop
with isolator
pilot valve or
hose reel
1.27 Accumulator Used for all F-1.27.1 Stuck, Fail to No Flow meter Regularly testing and 1 3 L
Isolator Pilot Valve operational Failed to mechanical open/open: consequences and pressure maintenance
(inside control mode, shall be open/close failure, corrosion, No due to transmitter
manifold) available at all no pilot supply consequence safeguard monitoring Redundancy by
times (the flow can having pod selector
Function: be directed Indicator light valve to regulate the
Regulate and control from other for valve hydraulic flow into
the flow of fluid valve) position subsea accumulator
through isolator
valve into subsea
pod

1.28 Pod mounted Used for all F-1.28.1 Corrosion, Fail to open: No Flow meter Regular testing and 1 3 L
accumulator operational Failed to mechanical failure Unable to flow consequence and pressure maintenance
isolation valve mode, shall be open/close the hydraulic due to transmitter
available at all flow from the redundancy monitoring Redundancy by
Functions: times valve having the flow
Isolate hydraulic through other valve
fluid in the pod Fail to close:
The flow can
still be stop
with other
accumulator
isolator valve
1.29 Stack mounted Used for all F-1.29.1 Corrosion, Fail to open: No Flow meter Regular testing and 1 3 L
accumulator operational Failed to mechanical failure Unable to flow consequence and pressure maintenance
isolation valve mode, shall be open/close the hydraulic due to transmitter
available at all flow from the redundancy monitoring Redundancy by
Function: times valve having the flow
Isolate hydraulic through other valve
fluid in the stack Fail to close:
accumulator The flow can
still be stop
with other
accumulator
isolator valve

Page | 110
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
1.30 Batteries inside Shall be F-1.30.1 Obsolete battery, Solenoid valve In case of After Regularly scheduled 1 2 L
subsea pod available at all No voltage corrosion, thermal inside subsea emergency emergency testing, maintenance
times for well variations not function well shut in, situation (no and inspection
Functions: control the AMF will electricity and
Give electric power operations not activate hydraulic Redundancy by
and signal into blind shear communicatio having batteries from
subsea solenoid ram to n), where other pod
valve to activate the function, there is no
emergency BOP causing a high sign of influx Redundancy of
functions. Usually probability of sealed by the initiating blind shear
the batteries will blowout into BOP ram function by
function surface. having BOP acoustic
automatically by intervention system
means of PLC when Reduce effect
there is no due to
communication redundancy
(electric and
hydraulic) from the
surface

Page | 111
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
2.1 Fixed Pipe Rams Shall be F-2.1.1 Mechanical Affected ram No global Flow meter, Regularly scheduled 1 3 L
available at all Not able to failure, hydraulic not able to effect, due to pressure testing, maintenance
Function: times for well close failure operate redundancy gauges and inspection
Protecting topside control and
from uncontrolled operations safeguards Feedback Function test every
pressure from the from the week
well hydraulic
system Redundancy

Visual Competence of
indication on personnel
BOP
Pressure testing
Increase in
trip tank
volume
F-2.1.2 Mechanical Affected ram No global Flow meter, Regularly scheduled 1 2 L
Not able to failure, hydraulic not able to effect, due to pressure testing, maintenance
open failure, human operated redundancy gauges and inspection
error and
safeguards Feedback Function test every
from the week
hydraulic
system Redundancy

Visual Competence of
indication on personnel
BOP
Pressure testing
F-2.1.3 Wrong ram with During well Unwanted Potential for Testing, regularly 1 2 L Verify that pressure testing mainten
Not able to regards to tubular control amounts of increase in scheduled testing, according to ance
seal around diameter/geometr situations, fluids or gas trip tank maintenance and recommendations from
tubular y unable to seal influx into the volume. inspection. manufacturer and
off the well, wellbore, and Function test every regulations
Worn parts (e.g., leading to well also possibility Unstable week
seals and fluid leaking for influx to shut-in
packers), closing through surface for the pressures More than one fixed
pressure not amount of time ram available.
maintained, not it takes from Variable ram available
correct space-out trying to close
the first ram Competence of
until the next personnel
one is closed
Pressure testing

Page | 112
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-2.1.4 High temperature Not able to Elastomers Visual Pressure testing every 1 3 L Evaluate to keep a log of the Mainten
Degradation seal around may have to indication on two weeks. temperature readouts on all ance &
of packers tubular be exchanged BOP. Function tests every temperature sensors operatio
over time Visual week ns
inspection of Evaluate if the ram packers Enginee
the weep When temperature and seals should be ring &
0
hole on the reach 180 F, pumping exchanged after they have operatio
rod seal. rate will be reduced in been exposed to ns
Increase in order to allow fluids to temperature above their
trip tank cool before reaching maximum continuous design
volume the surface temperature, regardless of
their state as an extra
Temperature gauges safeguard
in the systems.
Spares of the Evaluate to update operatio
elastomers are kept operation procedures to ns
on the rig take into consideration the
HPHT drilling

F-2.1.5 Loosen bonnet Fluid leakage In the worst Visual, Regularly scheduled 1 1 L
External bolts, to environment case: Reduction in testing, maintenance
leakage Loosen ram Influx can hydraulic and inspection
(bonnet/door housing flange, deteriorate the pressure
seal or other Worn parts (seal, seal and bolt Pressure testing
external packers, etc) causing
leakage massive Competence of
path) environment personnel
spill

F-2.1.6 Worn part (seal, Some influx In the worst Visual Regularly scheduled 1 2 L
Internal packers, etc, into wellbore case: indication on testing, maintenance
leakage Influx can BOP and inspection
(leakage deteriorate
through a seal and Flow meter, Pressure testing
close ram) packers pressure
causing failure gauges Competence of
in ram personnel
function. It Reduction in
allows influx to kill mud Redundancy by
reach surface pressure having annular
and endanger preventer
personnel

Page | 113
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
2.2 Variable Bore Shall be F-2.2.1 Worn parts (e.g., During well Possibility for Potential for Testing, regularly 1 3 L
Rams available at all Not able to seals and control influx to increase in scheduled testing,
times for well seal around packers), closing situations, surface for the trip tank maintenance and
Functions: control tubular pressure not unable to seal amount of time volume. inspection.
Protecting topside operations maintained off the well, it takes from Unstable Function test every
from uncontrolled leading to well trying to close shut-in week
pressure from the fluid leaking the variable pressures Competence of
well through ram until the personnel
next one
(annular Pressure testing
preventer or
shear ram) is Annular preventer
closed available, depending
on pressure.

Shear ram available

F-2.2.2 Mechanical Affected ram No global Flow meter, Testing, regularly 1 3 L

Not able to failure, hydraulic not able to effect due to pressure scheduled testing,
close failure operate redundancy gauges, maintenance and
and feedback inspection.
safeguards from the Function test every
hydraulic week
system. Competence of
Visual personnel
indication on Redundancy
BOP.
Increase in Pressure testing
trip tank
volume

F-2.2.3 Mechanical failure Not able to No global Visual, string Possibility for hanging 1 2 L
Unable to hang off, effect, due to movement off the fixed rams.
hold the potential for safeguards Known hang-off
hang-off dropped string weight.
weight Competence to
operate within
tolerance limits.
Maintenance and
inspections

Page | 114
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-2.2.4 High temperature Not able to Elastomers Visual. Pressure testing every 1 3 L Review operational
Degradation seal around may have to Indication on two weeks procedures to take into
of packers tubular be exchanged BOP. Visual Function tests every consideration dropping of
over time or inspection of week string and tubular which is
high the weep outside the shearing
temperature hole on the When temperature capacity and subsequent
0
rod seal. reaches 180 F, closing of shear rams
Increase in pumping rate will be
trip tank reduced in order to Check the regulations and
volume allow fluids to cool legislations to see if it is
before reaching the allowed to run casing or
surface tubular that cannot be
sheared
Temperature gauges
in the system. A risk assessment should
Spares of the be performed before
elastomers are kept executing this kind of
on the rig. operations

After implementation of
these recommendations, the
probability of risk of the
failure mode may be
After well F-2.2.5 Mechanical Affected ram No global Flow meter, Testing, regularly 1 2 L
control Not able to failure, hydraulic not able to effect due to pressure scheduled testing,
situations and open failure, human operate redundancy gauges, maintenance and
pressure tests error and feedback inspection.
safeguards from the Function test every
hydraulic week
system. Competence of
Visual personnel
indication on Redundancy
BOP
Pressure testing

Page | 115
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
2.3 Blind Shear Ram Shall be F-2.3.1 Hydraulic failure, No shearing Potential for Visual, Maintenance and 3 3 M Review operational Operati
available at all Unable to cut mechanical need to drop datasheets, inspections procedures to take into ons
Functions: times for well string, thus failure, human string or known ram consideration dropping of
Cutting drill string, control unable to error (including tubular before specifications Pressure testing string and tubular which is
pipe/tubular and operations seal of incorrect space closing shear outside the shearing
protecting topside wellbore out) too high ram Hang off in centre capacity and subsequent
from uncontrolled wellbore closing of shear rams
pressure from the pressure. Redundancy (annular
well up to 10000psi, Check the regulations and Operati
Pipe not in the variable ram) legislations to see if it is ons
centre position allowed to run casing or
Check of datasheets tubular that cannot be
Potential for for tubular against sheared
tubular known ram
dimensions specifications A risk assessment should Operati
outside the shear be performed before ons
ram specifications executing this kind of
operations

After implementation of
these recommendations, the
probability of risk of the
failure mode may be
reduced

F-2.3.2 Mechanical Affected ram No global Flow meter, Testing, regularly 1 2 L

Not able to failure, hydraulic not able to effect, due to pressure scheduled testing,
close failure operate safeguard gauges, maintenance and
feedback inspection.
Not able to from the Function test every
perform hydraulic week
complete system.
shut off and Visual Competence
seal the indication on personnel
annulus BOP.
Increase in Pressure testing
trip tank
volume Possible to close
annular on empty hole
up to 10000 psi in
combination with the
choke system

Page | 116
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-2.3.3 High temperature Not able to Elastomers Visual Pressure testing every 1 3 L Evaluate to keep a log of the
Degradation seal off the may have to indication on two weeks temperature readouts on all
of packers wellbore be exchanged BOP. Visual Function tests every temperature sensors
over time inspection of week
the weep Evaluate if the ram packers
hole on the When temperature and seals should be
0
rod seal. reaches 180 F, exchanged after they have
Increase in pumping rate will be been exposed to
trip tank reduced in order to temperature above their
volume allow fluids to cool maximum continuous design
before reaching the temperature, regardless of
surface their state as an extra
safeguard
Temperature gauges
in the system. Evaluate to update
Spares of the operation procedures to
elastomers are kept take into consideration the
on the rig. HPHT drilling
Possible to close
annular on empty hole After implementation of
these recommendations, the
probability of the failure
mode may be reduced

After a well F-2.3.4 Mechanical Affected ram No global Flow meter, Testing, regularly 1 2 L
control situation Not able to failure, hydraulic not able to effect, due to pressure scheduled testing,
or pressure test open failure, human operate redundancy gauges, maintenance and
error and feedback inspection.
safeguards from the Function test every
hydraulic week.
system, Redundancy.
visual Competence of
indication on personnel.
BOP Pressure testing

2.4 Annular BOP Shall be F-2.4.1 Worn parts, During well Possibility for Potential for Testing, regularly 1 3 L
available at all Not able to closing pressure control influx to increase in scheduled testing,
Functions: times for well seal around not maintained situations, surface for the trip tank maintenance and
Protecting topside control tubular unable to seal amount of time volume. inspection.
from uncontrolled operations off the well, it takes from Unstable Function test every
pressure from the leading to well trying to close shut-in week
well fluid leaking the annular pressures Competence of
until the other personnel
rams with Pressure testing
suitable size or Shear ram and
shear ram is potentially other rams
closed available

Page | 117
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
F-2.4.2 Mechanical Annular not No global Flow meter, Testing, regularly 1 2 L
Not able to failure, hydraulic able to operate effect, due to pressure schedule testing,
open to full failure, human redundancy gauges, maintenance and
or within 30 error. Worn and feedback inspection.
minutes elements safeguards from the Function test every
(API) hydraulic week
system Competence of
personnel

F-2.4.3 High temperature Not able to Elements may Increase in Pressure testing every 1 3 L
Degradation or mud type (e.g. seal around have to be trip tank two weeks.
of elements OBM), extensive tubular exchanged volume. Function tests every
over time use (including Unstable shut week
stripping) in pressures When temperature
reaches 1800F,
pumping rate will be
reduced in order to
allow fluids to cool
before reaching the
surface
Temperature gauges
in the system.
Spares of the
elements are kept on
the rig.

Correct choice of
element type
2.5 Automatic Subsea Shall be F-2.5.1 Rusted, bended, Unable to lock No global Visual Testing and 1 2 L Update the operational
Ram Locks available at all Unable to mechanical rams in closed effects due to maintenance procedure to ensure that
times for well lock damage, human position safeguards testing is done according to
Functions: control error Hydraulic pressure in API 53, and including the
Locking the ram in operations the closing chamber locks in the test when
closed position energizing the rams

F-2.5.2 Rusted, bended, Unable to Unable to Visual Testing and 1 2 L Update the operational
Unable to mechanical unlock rams, proceed with maintenance procedure to ensure that
open damage and thus open operation, testing is done according to
them delays API 53, and including the
locks in the test when
energizing the rams

Page | 118
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
3.1 Choke ad Kill Valve Shall be F-3.1.1 Worn or degraded Leakage in the The worst Visual Regularly scheduled 1 2 L
available at all External parts (ring gasket connection case: inspection testing, maintenance
Function: times for well leakage and flange) between the If leakage with SSTV and inspection
Regulate the flow of control (leakage to inner valve and occurs in the (Subsea test
kill fluid and influx operations environment Over pressure the BOP body lower inner Valve) and Pressure testing
in main valve valve below ROV
or valve Human error Leakage in the LPR, the Regulate the flow
connectors) (improper valve connection BOP will leak if Pressure through other
connection between two attempting to gauges redundant choke and
installation) valves close in a well kill valve is possible
kick

F-3.1.2 Worn or degraded Leakage No global Visual Redundancy in the 1 2 L

Internal parts of valves through a effect, due to inspection choke and kill valve
leakage (seat, gate, etc) closed valve redundancy (have more than one
(leakage and Pressure lines)
through a Over pressured safeguards gauges
closed valve) Flushed and greased
Human error the valves
(improper valve
connection Pressure testing
installation)
Regularly schedule
testing, maintenance
and inspection

F-3.1.3 Plugged line, Kill fluid and No global Visual BOP test (pressure 1 1 L
Failed to Failure valve influx flow effect, due to inspection test)
open cannot be redundancy
regulated and Pressure Flushed and greased
through the safeguards gauges the valves
valve
Redundancy

F-3.1.4 Plugged line, Kill fluid and No global Visual BOP test (pressure 1 1 L
Failed to Failure valve influx flow effect, due to inspection test)
close redundancy
and Pressure Flushed and greased
safeguards gauges the valves

Redundancy

Page | 119
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
3.2 Hydraulic Used for all F-3.2.1 Leakage in Leakage of Delays in well Visual Redundancy by BOP 1 2 L
connector operational External wellhead gasket, drilling fluid control inspection during well control
modes, shall be leakage Damage seal into operations operation
Function: available at all ring, over environment
Connect BOP with times pressure during drilling BOP testing
LMRP and wellhead operation
Regularly schedule
testing, maintenance
and inspection

F-3.2.2 Failure in Damage to Major fatalities No hydraulic BOP testing 2 2 L

Failed to wellhead wellhead damages to response
unlock connector, failure connector subsea riser Redundancy of
in LMRP during drift off. and very costly Well secondary unlatch to
connector, rig downtime abandonment unlatch the stack
Connector stuck, when drift off, operation
hydraulic system kick (influx) Redundancy of
failure and black out unlatching the
happen at the connection during bad
same time, weather for floating
especially in vessel by unlatch
the floating DP LMRP or wellhead
vessel. connector
Possibility of
major leakage Dumped the
if not handle accumulator fluid
properly through the connector
to flush
Leakage of hydrates/debris that
fluid into can cause clog or plug
environment
Redundancy of BOP
function when kick
occur

Page | 120
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
4.1 Blind /shear ram Shall be F-4.1.1 Chemical Kick influx flow The Pressure Schedule testing and 2 1 L The shearing of drill pipe
seal (sealing available at all Deformed, corrosion, not contained deterioration of gauge maintenance during drilling and when kick
element) times for well worn, stiff, mechanical seal during reading occur is necessary when
control eroded elastic/plastic kick influx Redundancy by pipe ram and annular
Function: operations deformation might escalate Volume of having other rams preventer could not hold the
Seal the ram from the leakage. mud pit and/or annular pressure generated during
influx The small preventer close the influx. In this case the
leakage of kick (might be well need to be shut
influx could general, it is completely by using shear
create influx not only ram
liquid splash showing the
out of the ram failure of ram
like water jet seal
that can erode
the blade and
string being cut
4.2 Piston on both Shall be F-4.2.1 Corrosion, Shear ram not In the worst Pressure Schedule testing and 3 2 M Other type of ram (pipe ram)
sides available at all Galling, thermal variation operational case, Influx gauge maintenance and annular preventer are
times for well seizure, might escalate reading designed to hold the influx
Function: control misalignment and escape Redundancy by but not intended to shut off
Convert hydraulic operations , pitting into surface Volume of having other rams the well completely. The
pressure to mud pit and/or annular well needs blind shear ram
mechanical energy preventer close to complete shut off.
(might be
general, it is
not only
showing the
failure of
piston)

4.3 Wedge on both Shall be F-4.3.1 Thermal variation Oil contained No global Pressure Scheduled testing and 1 2 L
sides available at all Galling, in combination temporarily effect, due to gauge maintenance
times for well seizure, with excess force redundancy reading
Function: control misalignment and Redundancy by
Secure linier operations , impact safeguards having hydraulic fluid
mechanical energy failure to secure the linier
on piston mechanical energy on
piston
4.4 Blade on both Shall be F-4.4.1 Excess force, Shear ram not In the worst Pressure Scheduled testing and 3 1 L Other type of ram (pipe ram)
sides available at all Impact corrosion, thermal effective, fails case, influx gauge maintenance and annular preventer are
times for well failure, brittle fatigue to cut pipe might enter the reading designed to hold the influx
Function: control failure, riser up to the Redundancy by but not intended to shut off
Shear or cut the operations pitting, surface Volume of having other rams and the well completely. The
string and/or casing dulling endanger mud pit annular preventer to well needs blind shear ram
personnel live (might be seal the well to complete shut off.
general, it is
not only
showing the
failure of
piston)

Page | 121
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
4.5 Shear ram housing Shall be F-4.5.1 Excess pressure, Hydraulic fluid Failure on Visual Scheduled testing and 3 1 L
available at all Deformation, thermal variation, not contained, rams function maintenance
Function: times for well cracking, corrosion, fatigue leakage of (unable to Hydraulic
Guiding piston and control erosion hydraulic fluid close and seal pressure Redundancy by
the flow of hydraulic operations the well) reading having sealing device
fluid such as blind ram and
pipe ram

4.6 Annular preventer Shall be F-4.6.1 Excess pressure, Hydrocarbon Failure on Visual Scheduled testing and 3 3 M
rubber housing available at all Deformation, thermal variation, influx not annular maintenance
times for well worn, stiff, corrosion, fatigue contained, leak prevention Hydraulic
Function: control eroded parts function pressure Redundancy by
Guiding sealing operations (unable to reading having sealing device
element (rubber) to close and seal such as blind ram and
seal around the the well) pipe ram
tubular
4.7 Annular sealing Shall be F-4.7.1 Chemical Kick influx flow The Pressure Schedule testing and 2 1 L The shearing of drill pipe
element (rubber available at all Deformed, corrosion, not contained deterioration of gauge maintenance during drilling and when kick
seal and steel times for well worn, stiff, mechanical seal during reading occur is necessary when
reinforcement control eroded elastic/plastic kick influx Redundancy by pipe ram and annular
segments) operations deformation might escalate Volume of having other rams preventer could not hold the
the leakage. mud pit close pressure generated during
Function: The small the influx. In this case the
Seal the well by leakage of kick (might be well need to be shut
pushing the sealing influx could general, it is completely by using shear
element upward create influx not only ram
through piston liquid splash showing the
out of the ram failure of ram
like water jet seal
that can erode
the sealing
element and
drill string
being clamped
4.8 Annular Piston Shall be F-4.8.1 Corrosion, Annular In the worst Pressure Schedule testing and 2 2 L Other type of ram (pipe ram)
available at all Galling, thermal variation preventer not case, Influx gauge maintenance and annular preventer are
Function: times for well seizure, operational might escalate reading designed to hold the influx
Convert hydraulic control misalignment and escape Redundancy by but not intended to shut off
pressure to operations , pitting into surface Volume of having other rams the well completely. The
mechanical energy mud pit close well needs blind shear ram
to pushed the to complete shut off.
sealing element (might be
upward for sealing general, it is
purpose not only
showing the
failure of
piston)

Page | 122
ID Item/functional Operational Failure Failure Failure effect(s) Detection Compensating C P Risk Dwg. Additional Information Resp.
no. identification mode mode(s) Cause(s) method provisions (1- (1- (L,M, and recommendation party
Local Global (safeguards) 5) 5) H)
4.9 Annular locking Shall be F-4.9.1 Thermal variation Oil contained No global Pressure Scheduled testing and 1 2 L
wedge available at all Galling, in combination temporarily effect, due to gauge maintenance
times for well seizure, with excess force redundancy reading
Function: control misalignment and Redundancy by
Secure linier operations , impact safeguards having hydraulic fluid
mechanical energy failure to secure the linier
on piston mechanical energy on
piston

Page | 123
12.2 Well Barrier elements in drilling operation
Well barriers are layers of one or several dependent well barrier elements which
prevents fluids to flow unintentionally from one formation to other formation or to surface.
Well barriers element is a dependent object to prevent flow from one side to the other side of
itself. According to Norsok D-010 (2004), there are four conditions where well barriers
element should be established in the drilling operations as follows:
- Drilling, coring and tripping with shearable drill string
- Running non shearable drill string
- Running non shearable casing
- Through tubing drilling and coring

Figure 12.1 Well barrier schematic for running non-shearable drill string (left) and drilling, coring and
tripping with shearable drill string (right) (Norsok D-010, 2004)

Page | 124
Figure 12.2 Well barrier schematic for running non-shearable casing (left) and drilling through tubing
drilling and coring (right) (Norsok D-010, 2004)

According to the figures above, there are some basic well barrier elements during
drilling operation such as fluid column, casing cement, casing, wellhead, high pressure riser,
drilling BOP, drill string, stab-in safety valve, casing float valve, production tree, annulus
access line and tubing hanger (Norsok D-010, 2004). The well barriers elements are
generally accepted and required when doing some operations where BOP is used such as
when well shut in, stripping, snubbing and BOP testing.

Page | 125
12.2.1 Fluid column

Fluid column is the fluid located in the wellbore which is used to balance the pressure
in the wellbore by exerting hydrostatic pressure that will prevent influx (kicks) entering
wellbore. It is important that the hydrostatic pressure of fluid column do not exceed the
formation fracture pressure (Norsok D-010, 2004). Fluid column can be represented by
drilling fluid which can be oil, oil-based fluids (oil in water, water in oil emulsions), gas-based
mud and water-based mud. There are eight basic functions of drilling fluids as follows (Well
Control School, 2004):

1. Transportation of cuttings to surface

2. Suspension of cuttings when circulation is stopped
3. Control of annular pressure and delivery of hydraulic energy
4. Lubrication and cooling of the drilling assembly
5. Provision of wall support
6. Suspension of drilling assembly and casing
7. Provision of a suitable medium for wireline logging

12.2.2 Casing cement

Casing cement is application of liquid slurry of cement and water to be placed inside or
outside casing. There are three types of cementing which are primary cement, secondary
cement and squeeze cement. Primary cement is the first cementing process into the well.
Secondary cement is used to isolate producing formation, seal off water, repair casing leak,
etc. Squeeze cementing is forcing cement into the wells to fill channels in the primary
cementing (Well Control School, 2004)

The placement of cement should be in the annulus between concentric casing string or
the casing/liner and the formation. Cement is used to provide continuous, permanent and
impermeable hydraulic seal along hole in the casing annulus or between casing strings in
order to prevent flow of formation fluids, resist pressures from above or below, and support
casing or liner string structurally (Norsok D-010, 2004).

12.2.3 Casing

Casing is element consist of casing/liner and/or tubing in case tubing is used for
through tubing drilling and completion operations. The purpose is to provide a physical
barrier to uncontrolled flow of formation fluid or injected fluid between the bore and casing
(Norsok D-010, 2004).

Page | 126
  Conductor pipe
Conductor pipe is established to prevent the hole from
caving in at the surface and endangering the drilling rig
foundation (Odland, J., 2010). It is cemented to prevent
drilling fluids circulating outside the casing that can
cause surface erosion (Schlumberger, 2012). The
unconsolidated layers below seabed/surface will be
isolated and it support template, marine riser on floating
rigs, mud line suspension/riser system on jack up rigs,
surface casing and wellhead (Aadnøy, B., S., 1999).

Figure 12.3 Casings inside wellbore (Schlumberger, 2012)

 Surface casing
Surface casing provides protection from freshwater formations and prevents shale,
sand and gravel to fall into the hole (Odland, J., 2010). Blow out preventer can be
anchored to surface casing and support deeper casing strings (Schlumberger, 2012). It
is also isolates weak formations to sufficiently form formation integrity where proper
control of abnormal pressure from the formations below can be assured. Furthermore,
the isolation will prevent the influx of potential shallow gas zone to establish integrity for
further drilling (Aadnøy, B., S., 1999).

 Intermediate casing
Like any other basic casing function, Intermediate casing is cemented to prevent loss
of circulation in the well by isolating the formation (Schlumberger, 2012). It also isolates
all formations up to the surface casing to allow the safe and efficient drilling for the next
holes sections through the pay zone. Moreover, intermediate casing gives sufficient
well integrity for drilling the pay zone or any abnormally pressurized zones (Aadnøy, B.,
S., 1999).

 Production casing
The last casing which is production casing is used to prevent oil moving to thief zones
and avoid sloughing of formations causing a reduction in productivity (Schlumberger,
2012). In addition to isolating the productive zones, it maintains well integrity during
production and work over periods as well as allows further drilling into deeper hole if
needed (Aadnøy, B., S., 1999).

Page | 127
12.2.4 Wellhead

According to Norsok D-010 (2004), wellhead is an element consists of the wellhead

body with annulus access ports and valves, seals and casing/tubing hangers with seal
assemblies. It is used to provide mechanical support for the suspending casing and tubing
strings and for hook up of risers of BOP or production tree and to prevent flow from the bore
and annuli to formation or the environment.

12.2.5 Riser (High Pressure Riser)

Riser is a tubular that connects drilling BOP (subsea BOP) into surface rig. It is act as
an extension of the drilling BOP on platforms where the wellheads is positioned at different
levels and thus prevent flow from the bore to the environment (Norsok D-010, 2004). It
includes connectors and seals connecting the drilling BOP to the wellhead.

12.2.6 Drilling BOP

BOP is a tool that acting as a last line of protection against kicks and blowouts. It
consists of rams and preventers that can be closed and seal the well in case of influx
occurrence inside the well. The elements that construct drilling BOP are consists of wellhead
connector, BOP, kill/choke line and valves. According to Norsok D-010 (2004), the function of
these constructions is to allow wellhead connector to prevent flow from the bore to the
environment and to provide a mechanical connection between drilling BOP and wellhead.

12.2.7 Drill String

Drill string is an extension of tubular pipe/column connecting drill collar and drill bit from
the surface with attached tool joints that transmits fluid and rotational power as part of the
drilling tools. The purpose of the drill string as well barrier element is to prevent flow of
formation fluid from wellbore into external environment. It should be designed to resists
against abrasive environment, fatigue and buckle as it will be used continuously as a rotating
tools to drill a well.

12.2.8 Stab in safety valve

Stab in safety valve is a valve that is connected to the work string when the well begins
to flow when running or retrieving the string. It gives protection against tubing plug or
backpressure valve pressure during snubbing operation (Schlumberger, 2012). This element
consists of housing with a bore and a ball valve. Stab in safety valve is used to allow
mounting and closure at the top of any free tubular joint sitting in the rotary table.

Page | 128
12.2.9 Casing float valves

Casing float valves is a valve used to prevent flow of fluids from the wellbore up the
casing/liner during installation of casing/liner and to allow for circulating the well. The fluid
should be pumped down into the casing/liner while at the same time prevent the flow back in
the opposite direction. It consists of a tubular body with pin and box threads and internal one-
way valve (Norsok D-010, 2004).

12.2.10 Production tree

Tree or x-mas tree is a structure consists of control valves, pressure gauges and
chokes located at the top of a well where the primary function is to control the flow into or out
of the well (Odland, J., 2010). According to the location of installation, production tree can be
divided into two types, subsea and surface production tree. Subsea production tree or wet x-
mas tree is located on the top of the subsea wellhead. It has some elements consist of
housing bores that are fitted with production and annulus master. It has some functions as
follows (Norsok D-010, 2004):

- Provides a flow conduit for hydrocarbons from wellbore into surface by having the
ability to adjust the flow by opening or closing the valve and/or PMV (production
master valve).
- Provides monitoring and pressure adjustment of the annulus as well as provide
vertical tool access through the swab valve(s) (Norsok D-010, 2004).

Surface production tree is located on the surface platform and has the same function
as subsea production tree with additional function to gives access point where kill fluid can
be pumped into the wellbore.

12.2.11 Annulus access line and valve (AAV)

Annulus access line and valve is a line and valve which allows monitoring of pressure
and flow in the annulus below the tubing hanger. It consists of wellhead housing and an
isolation valve.

12.2.12 Tubing hanger

Tubing hanger is acting as an interface between the tubing from the well and the x-mas
tree. It directs the flow from the well to the x-mas tree and provide interface possibilities for
downhole electrical and hydraulic lines from the x-mas tree (Subsea1, 2010). According to
Norsok D-010 (2004), tubing hanger consists of body, seals and bore which may have a
tubing hanger plug profile. It has some functions to support the weight of the tubing, prevent
flow from the bore and to the annulus, provides sealing in annulus space between tubing and
wellhead and provides a stab-in connection point for bore communication with the tree.

Page | 129
12.2.13 Diverters

Diverter is a low pressure system to direct well flow away from rig. It is installed to
provide safety when there is a flow of shallow gas (Hawker, 2001). It is designed to divert low
pressure gas which comes from a pressurized gas zone during drilling in case of incapability
of casing shoe to hold shut in pressure. Massive flows of gas and sand can quickly destroy a
diverter (Rig Train, 2001). Flex/ball joint between BOP stack and the rig is installed to deal
with the relative motion of the floating platform.
Two diverter lines are usually
installed to direct gas into starboard
side and portside of the platform. In
the event of a kick, one or both lines
will be opened and the annulus will be
closed. Minimum one vent must be
open before closing annulus to prevent
gas accumulating in the pipe. The gas
can be directed away from the rig until
the pressure is reduced.

Figure 12.4 Flow of diverted gas (left) and schematic of typical

installation for floating drilling platform (right) (Rig Train,
2010) (Hawker, 2001)

12.2.14 Drilling Spools

Drilling spool is a spool which connecting the kill lines and choke lines to the BOPs.
When BOPs are closed, the fluid flows through the choke line and injection of drilling fluid is
through the kill line.
- Minimum drilling spool specifications include one or two side outlets no smaller than
two inches nominal diameter
- A vertical bore at least equal to the maximum inner diameter of the innermost casing
(if the spool is to pass slips, hangers, or test tools, the bore should at least equal the
inside diameter of the top casing head).

12.2.15 Relief Lines

The relief line is a large line to relieve well pressure when BOP is closed and when
there is back pressure that is resulting from the flow in the smaller choke lines which can
endanger the well.

Page | 130
12.2.16 Rotating Preventer (Rotating Head/Stripper)

Rotating preventer is a tool located in the top of the BOP stack which is use to seal the
annular space where it has a capability to prevent the well from blowing out and allowing
underbalanced drilling. The most used application for rotating preventer is for underbalanced
drilling.

Underbalanced drilling is a drilling of a well where the drilling fluid has less hydrostatic
pressure than the formation pressure while maintaining the bottom hole pressure by using
rotating preventer features to release and control the pressure. This method is the opposite
of the conventional drilling where the drilling fluid should have higher pressure than formation
pressure to prevent any influx (kick) to become a blowout. The advantages of using
underbalanced drilling methods are:

 Loss of circulation/mud is reduce as the pressure in the well is less than the pressure
in the formation, preventing it from cracking or fracturing the formation in the borehole
which can cause the flow to loss in the crack.

 It allows hydrocarbon production while drilling. During drilling operation, drill bit will
pass through some layer of formation and has lower hydrostatic pressure than
formation allowing hydrocarbon that could be trapped in some drilled layers to be
flown into the surface.

For subsea use, the rotating preventer are mounted on top of the standard BOP stack and
act as a rotating flow diverter. It allows rotation and vertical movement of the drill string
during drilling while in the same time it seals around and rotates with the pipe or kelly
(Hawker, 2001).

Figure 12.5 haffer rotating head and stripper (Goins, W.,C., Sheffield, R., 1983)

Page | 131
12.2.17 Flex Joints

A flexible joint is a connector between riser and BOP stack which allows some degree
of movement to handle the movement of a floating rig. It gives capability to allow riser system
to rotate with minimum bending moment. The design of flex joints should consider the
maximum accepted rotation, fatigue ranges, tensions of the riser when it is in the hang off
mode and the effects of that tension (Bai, Y., Bai, Q., 2005, p. 444). Figure 4.21 shows some
type of flex joints. The tendon system inside the flex joint gives possibility to accept some
movement.

Figure 12.6 Some type of flex joint (Oil States, 2012)

12.2.18 Wellhead Connector

Wellhead connector is a connector between BOP stack and well head. It consists of
parts (figure 4.22) that should be designed for the specific purpose of expected pressures
and weight of the stack.

Figure 12.7 Wellhead connector and its connection sequence (Radoil, 2009)
Page | 132
12.3 Pressures Acted in the Well
1. formation related pressures that consists of:
a. Overburden pressure is the pressure as a result of accumulated deposit in the
sediments as a function of rock matrix and pore fluid (Hawker, D., 2001)
b. Formation pressure is the pressure exerted from the fluid in the pores of rocks
(Hawker, D., 2001)
c. Fracture pressure/gradient is the maximum pressures that the formation can
withstand without collapsing (Hawker, D., 2001)

Figure 12.8 Pressures acted in a wellbore (Hawker, D., 2001)

2. Wellbore balancing pressures that consists of :

a. Mud hydrostatic pressure is the static pressure exerted by the weight of a vertical
column of mud at a given depth. This is the pressure of drilling fluid (mud) to
balance the fluid pressure from formation at static or when there is no drilling
activity. When drilling activity take place there would be a frictional pressures loss
causing an increase or decrease in the balancing pressures (Hawker, D., 2001).

Phyd mud = MW x TVD x g

Where: Phyd mud : Mud hydrostatic pressure

Unit : PSI = PPG x ft x 0.052
PSI = SG x ft x 0.433
KPa = kg/m3 x m x 0.00981

b. Equivalent circulating density is the increase of frictional pressure in annulus as a

result of mud circulation activity which gives an increase in the annular pressure
(Hawker, D., 2001).

Page | 133
 c. Surge pressure is the increase of frictional pressure in annulus as a result of
vertical movement of running drill string in the hole which gives an increase of
annular pressure. Excessive surge pressure can damage formation and create
fracture allowing drilling fluid to enter the formation and create loss of mud
circulation which will decrease the annulus pressure (Hawker, D., 2001).

d. Swab pressure is the loss of frictional pressure as a result of lifting pipe activity
out from hole which gives a decrease in the annular pressure. Swab can occur
from the slow pull out of drill string that makes drilling fluid to have an effect of
being attached to the pipe and dragged up. Other case would be by rapid pull out
movement of drill string that makes drilling fluid to replace the emptied volume left
by the pipe. Both scenarios would reduce annular pressure (Hawker, D., 2001).

Figure 12.9 Relationship between depth and pressure for different pressures acting in a wellbore
(Hawker, D., 2001)

The conclusions can be seen in the figure 2.6. The mud hydrostatic should be larger than the
formation pressure to prevent a kick. On the other hand, the increase of annular pressure as
an effect of mud circulation and drill string vertical movement should still be below the
fracture pressure to prevent formation collapse and damage. The reduced annular pressure
caused by swabbing should be handled to keep it above the formation pressure.

In order to know the required fracture pressure, a leak off test (LOT) needs to be
performed. The test is carried out after casing or cementing activity related to the next drilling
in the deeper depth. There are two principles in conducting this test. Firstly, cement integrity
test is performs to know the strength of the cement in order to withstand from the high
flowing pressures. Secondly, fracture pressure test is conducted after cement integrity test
has proven acceptable. It is conducted in order to know the maximum value of fracture
pressure in the formation, where the mud is allows to be pumped for the next drilling
operation without causing fracture. It is done by letting the formation fracture under a given
pressure from mud in a control manner. The result of this fracture pressure test also known
Page | 134
as leak of pressure (LOP). There are some factors that determine the fracture pressure such
as rock type, in situ stresses, weakness (fractures, faults), condition on the borehole,
relationship between wellbore geometry and formation orientation and mud characteristics
(Hawker, D., 2001).

Pfracture = Phyd mud at shoe + LOP

Pfracture (EMW) = MW + LOP/(TVD shoe x g)

Page | 135
12.4 Basic Well Control Methods
There are three methods to control a well when influx occurred by using constant bottom-
hole pressure method such as:
1. Wait and weight method
Shut in the well, prepare the required killing mud (mud weight) and when it is ready, it
will be used to circulate out the kick (Goins, W.,C., Sheffield, R., 1983, p.27).
2. Driller’s method
The lighter mud in the well is circulated out from the hole and the well is shut in. During
this circulation the required mud is calculated and built. The killing mud will be
circulated to kill the well once it is ready (Hawker, D., 2001, p.62)
3. Concurrent method
The circulation of mud is conducting directly and the weights are added up until it
reaches the required killing mud weight to kill the well (Hawker, D., 2001, p.64).

In some situations where constant bottom-hole pressure could not be applied, there are other
methods that can be used to control a well such as:
1. Volumetric method
This method is used when the above methods are not possible due to the position (e.g.
out of hole, twisted off, etc.) and the pressure (less than required) of the drill string. The
plugged bit nozzle also allows volumetric method to be used. The principal is to
maintain the pressure in the bottom hole by allowing drilling fluid to escape from
annulus. The volume of the escape fluid is measured. When the influx goes up into
surface, its volume will expand and SICP should be increased to maintain the pressure
(Hawker, D., 2001, p.65)

2. Killing diverted blowout

This method is used when pipe is still set in the shallow depth and a kick occur. As a
result there is not enough back pressure that can be used at the surface. In this case a
BOP is used to divert the well fluid out of the rig. It requires maximum rate of pumping
to provide mud fluid in the well (Goins, W.,C., Sheffield, R., 1983, p.28).

3. Low choke pressure method

This method is used when a kick occur and there is a concern that the casing pressure
will not sufficient enough to maintain its strength. It is important to prevent broaching.
When a kick occurs, the bottom-hole pressure is kept constant by circulating back
pressure in a higher rate than normal killing rate. Meanwhile, the choke holds its
maximum allowable pressure to circulate these flows when the mud density is increase
to balance the well. The back pressure gives higher annular friction pressure and
increase mud-gas ratio which in turn increase bottom hole pressure used to prevent
gas influx (Goins, W.,C., Sheffield, R., 1983, p.29).

Page | 136
4. Top kill
The temporary well control when gas influx has reached surface or when the drill pipe
is quite far from bottom-hole where constant bottom-hole pressure method could not be
applied to control a well. It is conducted by pumping mud and bleeding gas into the well
(Goins, W.,C., Sheffield, R., 1983, p.30).

5. Bull heading
Well control method by pumping the kick back into formation. It uses when there is a
concern of surface pressure that can exceed the strength limit of casing such as when
string plugs, pipe is out of the hole or when there is a possibility of hazardous fluid
(Goins, W.,C., Sheffield, R., 1983, p.30). It is also used when there is an influx of
formation fluid into the wellbore during well control operation, contamination of toxic
gas such as hydrogen sulfide and in normal operation like for example borehole
collapse (Schlumberger, 2012). Bull heading method is quite risky method to kill a well
as the operator has no control on the flow of the pumped fluid. It can flow into weak
formation and create broaching.

Page | 137