BOP Basic Safety Functions

Katrine Harsem Lund

Principal Engineer, Department Manager
Scandpower AS
2011.10.11

Deepwater Horizon

Deepwater Horizon

Agenda
What is a BOP/BOP Stack
Safety Functions for a BOP Stack and Safety Integrity Levels (SIL)

Critical components in BOP control systems and their reliability

What is a BOP?

A blowout preventer
(BOP) is a large,
specialized valve used to
seal, and control oil and gas
wells.

A BOP Stack (Well control

package) is the assembly of
well-control equipment
including preventers,
spools, valves, and nipples
connected to the top of the
wellhead.

Topside/Subsea BOP stacks

Annulus

Drill pipe

Fig: A typical BOP Stack

A BOP Stack consists of multiple components

According to NORSOK D-001 "Drilling Facilities", paragraph 5.10.3, a BOP shall as a

minimum consist of the following:

One (1) annular preventer

One (1) shear ram preventer
Two (2) pipe ram preventers
Minimum one (1) Choke Line outlet
Minimum one (1) Kill Line outlet
One (1) Wellhead coupling or connector
Minimum two manual gate valves
Minimum two remote operated gate valves.

BOP Stacks

Preventer valves

Annular Preventer

Pipe Ram

Shear Ram

How does a Ram valve work?

Safety functions of a BOP Stack

Prevention of blowouts and well leaks

OLF Guideline 070, defines the following functions for the BOP:
1. Seal around drill pipe
2. Seal an open hole
3. Shear drill pipe and seal off well.

Thus the guideline differentiates between two main functionalities and set SIL levels
for:
The annular preventer/pipe ram function (function 1)
The shear ram function (function 2 & 3 combined).

No valves closed

Seal around Drill pipe

Shear drill pipe and seal off well

Setting A SIL Level for the BOP Safety Functions

The BOPs are used for a number of drilling related safety functions
Well intervention
Drilling

A SIL level is only set for the drilling BOP

Based on data from a Scandpower report Blowout and Well Release Frequencies, it
is estimated that the industry is operating with a blowout prevention reliability
somewhere close to SIL 3 on average.

Setting a SIL Level for the BOP Safety Functions

The OLF- guideline discussion concludes with the following:

Setting a SIL 3 level to either function would lead to a significant increase in the
standard for drilling BOPs. The challenge lies mainly in the need for documentation of
the system reliability, Setting a SIL 3 level would most certainly also result in the need
for changing the existing control system. It would also be necessary to include
additional RAMs in standard BOP assemblies.

The required PFD/SIL for the BOP function for each specific well should be calculated
and a tolerable risk level set as part of the process applying for consent of exploration
and development of the wells. As a minimum the SIL for isolation using the
annulus function should be SIL 2 and the minimum SIL for closing the
blind/shear RAM should be SIL 2.

There are MANY components in the BOP control system!

Shuttle valves
Hydraulic Reservoir
Filter
Check valves
Accumulator bottles
Bleed valves
Flow Totalisers
Push-to-hold button
Indicator lights
Hydraulic pumps
Pipe Ram valves
Hydraulic Block valves
Pressure gauges
Drillers Panel
Pressure transmitter

Wedge locks
Gate valves
Kill & Choke valves
Shear Ram valve
Flow transmitter
Pilot valve
Pneumatic Block valve
Pressure regulator
Hydraulic booster pump
Pushbuttons
SEM
PCL
Analogue input/output
SCM
Acoustic Transmitter

Isolation valves
Flow transmitter
Solenoids
Umbilical
Tool pushers panel
SPM valves
Pressure Indicators
Etc.
Etc.

Components in BOP & control system

How to decide which components are critical, and which are for information
only, or not critical?
FMECA with client, including operators/drillers
SIL Workshops with client, including operators/drillers

Accumulator bottles shall store hydraulic pressure to necessary volume and

pressure to enable closing-opening-closing operation of all rams +25% of volume
for one closing operation of each ram - function independent of many failures in
the hydraulic system

Build Reliability Block Diagrams

OLF Guideline 070 used to determine which functions of the BOP that
shall be SIL rated

SIL 2 = 100 %

A
Initiator(s)

Logic

35 %
PFD < 0.0035

15 %
PFD < 0.0015

Final
Element(s)

50 %
PFD < 0.0050

Reliability Block Diagram example topside BOP

Reliability Block Diagram example subsea BOP

Challenges
All the SIFs for the BOP are manually initiated - Human Factors??
Difficult to find relevant reliability data
Generic data
Data from vendors

Redundancy?

Not always possible to use pipe rams or shear the drill pipe!

Not possible to Shear/close pipe ram

Remaining issues/Questions
When is it possible to move the drillpipe up/down if pipe ram/shear
ram cannot close?

Everything is manually initiated - Impact of Human Factor?

The testing of the Shear ram does not include actual cutting of the
pipe. I.e the main function is not really tested Test independent
failures
Should other BOP functions have a SIL rating?

Is all critical components identified and included in the SIL function?

Should other BOP functions have a SIL rating?

References

OLF Guideline 070

NORSOK D-001
NORSOK D-010
Sintef Memo: Barriers to prevent and Limit Pollutants to sea
Sintef Memo: Drill, not Spill
Transocean Deepwater Horizon Investigation report chp. 3.4
BP Deepwater Horizon Investigation report
Sintef Report Reliability of Subsea BOP systems for Deepwater
application, Phase IIDW

For more information, please contact:

Katrine Harsem Lund
Principal Engineer, Department Manager at Kjeller Office
Scandpower AS
T
E
W
w

+47 98 66 08 11
khl@scandpower.com
www.scandpower.com
www.lr.org