SPE/IADC 163531

BOP Performance - Developments and Consequences in a Post-Macondo

World
Jeffry P. Sattler, WEST Engineering Services

Copyright 2013, SPE/IADC Drilling Conference and Exhibition

This paper was prepared for presentation at the SPE/IADC Drilling Conference and Exhibition held in Amsterdam, The Netherlands, 5–7 March 2013.

This paper was selected for presentation by an SPE/IADC program committee following review of information contained in an abstract submitted by the author(s). Contents of the paper have
not been reviewed by the Society of Petroleum Engineers or the International Association of Drilling Contractors and are subject to correction by the author(s). The material does not
necessarily reflect any position of the Society of Petroleum Engineers or the International Association of Drilling Contractors, its officers, or members. Electronic reproduction, distribution, or
storage of any part of this paper without the written consent of the Society of Petroleum Engineers or the International Association of Drilling Contractors is prohibited. Permission to
reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not be copied. The abstract must contain conspicuous acknowledgment of SPE/IADC copyright.

Abstract
BOP equipment and systems have predictably changed as a result of the Macondo incident. While these changes have been
driven by regulatory impetus, additional progress has also occurred as a result of risk and financial pressures. The
combination of these drivers has resulted in noticeable progress to date, and is expected to continue to generate
improvements at an increasing pace in the near term. Thus far, advances in processes and procedures represent the most
significant category, but ongoing work on the equipment, which takes longer to engineer, test, and implement, will also result
in much improved reliability for this critical safety system.

Introduction
The Macondo disaster and other recent environmental incidents have resulted in a new emphasis on the performance and
reliability of BOP (Blowout Preventer) equipment and systems, most specifically in the US Gulf of Mexico (GOM), but also
in other drilling regions. With the resultant increase in industry scrutiny and regulatory requirements, this new emphasis has
led to many improvements. This paper will describe the practical effects of these changes from an independent, third-party
verifier’s perspective, including perceived benefits and identified but unintended consequences, together with some possible
unintended consequences for the future. Considerable progress has been made in some areas, while other areas still have
significant unresolved issues.
Although the materials presented reflect the author’s experience on offshore floating drilling rigs, some of the contents
are applicable to other types of offshore rigs as well as land rigs.

Background
BOP equipment and systems have long been understood as one of the most safety critical of all rig equipment. Although not
the primary tool in a driller’s well control tool chest, they are correctly understood as one of the last line of defenses,
particularly the shear rams. Additionally, they have also been the single largest root cause of non-productive time. The
recent Macondo event in the US GOM highlighted both of these elements.
As a result, these systems have been appropriately targeted by regulatory as well as industry standardization efforts. Both
have resulted in improvements. On the other hand, there is a clear distinction between the minimum requirements defined by
such requirements and the desire to implement best practices, with the recognition that these practices are highly dependent
upon the specific conditions of an individual well. In the offshore environment utilizing floating drilling rigs, it is rare, if not
impossible, to find a rig that only meets minimum industry standards relative to BOP (ram and annular) count. This is a
result of business requirements negotiated between rig owners and their customers, balancing original capital investment with
reduced risk of availability of BOPs and the need to pull the BOP to maintain agreed upon functionality.
When rigs moved to water depths over about 4000 ft, system complexity took a step change forward with the introduction
of electric signal transmission. This has helped accelerate the move to more sophisticated systems and controls throughout
the rig. While a definite benefit, the industry has suffered significant growing pains with these more complex controls.

Regulatory Developments
The most significant regulatory activity since Macondo has clearly been in the US. In the days after this disaster, the
industry, led by the API (American Petroleum Institute), convened a series of meetings with the intention of identifying best
practices and recommending them to the regulators. In the area of BOP equipment, these efforts were followed up with a
2 SPE/IADC 163531

formal re-write of API RP (Recommended Practice) 53 “Recommended Practices for Blowout Prevention Equipment
Systems for Drilling Wells”. The resulting document, API S (Standard) 53 “Blowout Prevention Equipment Systems for
Drilling Wells”, was completed unusually quickly and will be released soon if not already by the time of this conference.
This was essentially a complete re-write. More than normal emphasis was placed on the use of the words “shall” and
“should” in the requirements. The API class of document “Standard” versus “Recommended Practice” was adopted so as to
provide additional strength to the requirements articulated.
New regulations have mandated two main equipment-related verification requirements:
1. Well compatibility, and
2. Shearing of drill pipe.
It is anticipated that additional requirements will include:
1. BOP certification (initially mandated but invalidated by the judicial process),
2. Increased equipment monitoring, and
3. Specific maintenance requirements.
The the BOP certification originally mandated was invalidated by a US Federal Court because of the nature of the
regulatory process. There is a class of documents called NTLs (Notices to Lessees) whose function is to clarify existing
laws. The BOP certification was mandated by the issuance of a NTL. Insofar as they were new requirements, the court
correctly invalidated them. Each of these requirements, along with other operating and maintenance requirements, must be
integrated by a comprehensive SEMS (Safety and Environmental Management System) program.
Some operators and drilling contractors now consider the new US regulatory requirements to be the most stringent and
thus to represent current industry best practices. This perspective, combined with other factors, has inspired them to work
towards compliance with these standards in their operations across the globe. Additionally, several countries have included
these requirements for operations in their jurisdictions. At this time, they are limited to those with limited offshore drilling
experience.
One result of these new requirements has been the identification of unknown deficiencies and increased visibility of
known weaknesses. Specifically, in situ testing subsea has necessitated changes in components and circuits. While some of
the testing had been completed on surface or with portions of the test simulated, flaws in these testing protocols were
identified, resulting in important changes.

Best Practices
As often happens, the increased scrutiny has led to the identification of problems with equipment that had gone unrecognized,
at least formally. In some cases, best practices have been developed in response, while in other cases, additional work is
required.

Issues
The following is a list that, in the opinion of the author, constitutes some of the major issues of interest regarding BOP
systems
 Management of change
 Redundancy
 Hydraulic control system leaks
 Reliability
 Advanced maintenance systems and philosophies
 Holistic integrity of systems

Management of change
One concern that has arisen is the condition of the BOP system currently compared to when it was originally
commissioned. One result of this concern is an increased, more robust emphasis on management of change. Long gone (at
least for rigs operating in US waters) is the day that a single person can effect changes on BOPs or their control systems in
isolation. This has another, less obvious, result in that equipment drawings are often more accurate than in times past.
Although some say it causes unnecessary delays, management of change has and will continue to reduce the number and
severity of unforeseen additional risks. It will also improve the ability of rigs to access external resources to assist in problem
resolution.

Redundancy
One often repeated question is “What is redundancy?” and the related, expanded question of “What is enough
redundancy?” The first is often asked during the evaluation of component failures to evaluate the additional risks associated
with continuing operations without pulling the BOP or LMRP (Lower Marine Riser Package). The second is more frequently
asked as part of a design analysis.
Each manufacturer has taken a slightly different approach to design redundancy. Additionally, some contractors have
specified and installed additional, non-standard features. One internet definition of redundant is:
SPE/IADC 163531 3

“Engineering: (of a device, circuit, computer system, etc.) having excess or duplicate parts that can
continue to perform in the event of malfunction of some of the parts.”
The degree to which redundancy is implemented most likely is related to the vendor’s perception of a component’s frequency
of failure, as well as the consequence of that failure. The word “Perception” was intentionally used, insofar as component
reliability statistics are currently mostly empirical. This will be explored in more detail in the reliability section below.
As an example, consider the electronics part of the BOP control system. Simplistically, the system includes the input
panel, control processors, signal transmission subsea, subsea control processors, and solenoid valves. While vendors
commonly have redundancy with input panels, control processors, and signal transmission, each differ in their application of
redundancy in the remaining systems.
More markedly in the months immediately following Macondo, the expectation was that the BOP or LMRP must be
pulled when any component failed. If the failed component was redundant, discussions then ensued about the need for the
redundancy relative to the increased risk. For example, if a system has two independent SEMs (Subsea Electronic Modules),
does the failure of one require repair prior to continuing drilling operation? Because some manufacturers have but a single
SEM, a good case can be made to continue operation.
As time has passed, a more reasoned rationale has been applied to the question of redundancy. This is not only warranted
but necessary, because failure to do so might result in a reduction in installed redundancy to reduce the statistical likelihood
of a stack pull. For instance, in the SEM example above, the likelihood of SEM failure with two SEMs per pod is twice that
of a single pod. Therefore, if one had to pull the LMRP upon failure of one SEM, the value of a second one is negative from
both a capital and operational perspective. If this operating philosophy prevailed, over time one might expect the
unintendended consequence of a move towards a single SEM.
Considering redundancy from a design basis, the high cost of retrieving subsea BOPs motivates rig owners to spend
additional capital up front, to reduce lost revenues when failures occur. In addition to higher capital cost, owners are also left
with more complex systems which result in more complicated troubleshooting , higher maintenance costs, and higher spare
parts inventory. Historically, these expenses are balanced by the designer and owner. As noted above, the balance will be
impacted by currently accepted operating philosophy regarding operation with failed component(s).
Another consideration is redundant BSRs (Blind Shear Rams). While this topic may at first seem unworthy of detailed
discussion, a thorough review is recommended of the controls for the redundant ram. For example, with one shear ram,
typical installations include BSR closure with
 Normal manual (single function) operation
 EDS (Emergency Disconnect Sequence) operation
 Automatic operation
 Deadman
 Autoshear
Issues you will want to clarify include understanding which system(s) can operate the redundant BSR, and whether they are
same or parallel systems?

Hydraulic control system leaks

Hydraulic control systems leak. Higher pressure control systems leak more than lower pressure ones. Every time a leak
is observed, the obvious question is “Is it bad enough to warrant repair?”
Best operating practices have historically applied the most rigorous standards to testing when the BOP is on the surface.
In fact, API RP 53 states that “no visible leak” is one criteria of a successful pressure test. The consensus view is that more
rigorous testing on the surface will lead to fewer consequential leaks when subsea.
There is a need for the industry to define what is an acceptable leak. The extreme position is that any leak where the
pumping system can maintain design system pressure doesn’t require repair. A more reasoned position considers the
minimum level needed for emergency systems to operate absent hydraulic energy from the rig. At this time, there is much
dialogue about acceptable leak rates, but there is no known, organized effort to define a minimum industry standard.

Reliability
For the most part, parties in the industry feel comfortable about their ability to control a well based on annular and ram
redundancy. On the other hand, costs associated with pulling a stack or LMRP in deep water have increased the focus on
reliability. The biggest hindrance to systematic advances in reliability is the absence of consistent and dependable data.
Historically, maintenance procedures and frequencies were developed based on senior staff’s experience rather than a
more rigorous scientific approach. Additionally, subsea engineers’ workload and pace are frenetic when the BOP is on the
beams, so as to minimize between well time or avoid becoming critical path activities. Accordingly, analysis was not
commonly done on the parts replaced to evaluate current replacement frequency. Maintenance systems and/or their improper
use often do not lend themselves to unplanned maintenance analysis. Improvements in the systematic capture and analysis of
data will allow the identification of the most likely productive areas of focus and thus the quickest improvement in reliability.
Some drilling contractors have the ability to generate adequate data based on their fleet size. However, even with good
data, the speed at which components are improved seems too slow to many.
4 SPE/IADC 163531

For subsea systems, there is significant incentive to utilize OEM (Original Equipment Manufacturer) parts. This helps
ensure compatibility and minimizes system integrity discussions. API RP 53 also specifically recommends using OEM or
equal supplied parts. However, there are no guidelines on what qualifies a part as “equal.” This practice reduces motivation
for non-OEM suppliers to develop competing offerings. One might even suggest the financial incentive for an OEM to
develop an improved component is negative when strictly calculated from only a business perspective. The cost to design,
fabricate, test, and evaluate the new component is not trivial when correctly executed. If this will replace the older part,
making it and the manufacturer’s inventory obsolete, combined with the need to change it less often, pure economics
suggests maintaining the status quo.
The results of a recent joint industry project on BOP reliability show considerable improvements in reliability over the
past decade. As a result, some have come to believe that failures are so infrequent as to be classified as random, and thus
more attention should be paid to mitigating failures.
This line of thought has resulted in several rigs installing spare circuits that can replace those that fail using a combination
of flying leads and pre-defined software. Similar to spare pilot lines in straight hydraulic control systems, this allows in-
service replacement and thus minimal downtime.
Eight operators currently support an industry-wide database for subsea production equipment, as well as other limited
equipment. Known by its acronym OREDA, a database similar to this would help identify components with the highest
failure rates.

Advanced maintenance systems and philosophies

Maintenance systems are an obvious critical tool for improving reliability. Substantial gains have been made in this area,
having moved from a repair-on-failure philosophy to the most common calendar-based maintenance philosophy. Progress is
being made on several fronts with more advanced systems.
RCM (Reliability Centered Maintenance) may become more widely applied once reliability data is improved. FMECA
(Failure Mode Effects and Criticality Analysis) risk assessments, a key component for RCM systems, have been completed
on many systems. However, their use has been primarily for the design review process. There has been little or no use of
FMECA in the development of maintenance systems.
Performance-based maintenance, often used in other industries, considers real-time measurement of performance
variables versus direct maintenance activities. Some are applying this maintenance philosophy by specifying component
changes based on the number of cycles of operation. Considerable advances in reliability, efficiency, and cost effectiveness
can be expected as expertise available in other industries is applied to the drilling machinery and systems.

Holistic integrity of systems

The dramatic increase in electronic control systems in the past decade has brought significant advances in capabilities
along with a new set of problems. In particular, the integration of systems has sometimes resulted in unforeseen
compatibility issues. This has been experienced primarily with systems from different vendors, although it has also been
seen with systems from different departments within a vendor. Even though BOP control systems are normally delivered by
the same manufacturer that delivers the big iron, the need for information exchange to other systems has introduced
problems. Increased awareness of the need to consider systems holistically by all parties has resulted in the identification and
resolution of some of these issues, and this can be expected to continue to improve with time.

Conclusion
Overall BOP performance, on the increase over the prior decade, is at the threshold of a new and significant upsurge based on
the scrutiny resulting from the Macondo event, increased risk sensitivity within the industry and continued high rig rates.
Considerable progress has been made in areas such as maintenance systems and management of change. In other areas, such
as redundancy and equipment reliability, significant issues still exist. Regardless, incremental changes in each of the
procedural and hardware areas identified have a compounding effect, and can be expected to increase the rate of progress in
the coming years.