Blow Out Preventer BOP FMECA

BLOWOUT PREVENTER (BOP)
FAILURE MODE EFFECT CRITICALITY ANALYSIS (FMECA)-3

FOR
THE BUREAU OF SAFETY AND ENVIRONMENTAL ENFORCEMENT
2650788-DFMECA-3-D2
2650788-DFMECA-3-D2
4
3
2650788-DFMECA-3-D2
2650788-DFMECA-3-D2
Report No.
Revision
Final Report
Issued to BSEE as Draft
Issued to industry participants
(IPs) as Draft for comments
Issued as Draft for internal
review and comments
Purpose of Revision
6/28/2013
3/25/2013
3/7/2013
2/20/2013
Date
June 2013
This work was performed by American Bureau of Shipping and ABSG Consulting Inc. for the Bureau of
Safety and Environmental Enforcement (BSEE) under the terms of BSEE contract number M11PC00027.
THIS PAGE INTENTIONALLY LEFT BLANK
ii
LIST OF CONTRIBUTORS:
ABS Consulting
Randal Montgomery
Darshan Lakhani
ABS
Harish Patel
David Cherbonnier
Bibek Das
iii
SUMMARY
As part of the Blowout Preventer (BOP) Maintenance and Inspection for Deepwater Operations study
(Bureau of Safety and Environmental Enforcement [BSEE] contract number M11PC00027),
American Bureau of Shipping (ABS) and ABSG Consulting Inc. (ABS Consulting) performed a
Failure Mode, Effect, and Criticality Analysis (FMECA) on specific BOP subsystems and
equipment. There were three FMECAs performed with three different teams of operator, drilling
contractor and original equipment manufacturer. This is the draft report of the FMECA conducted
with team-3 and represents the study deliverable associated with Task 6.2.2.1 as outlined in the
contract.
This report presents the objective and scope of the FMECA study, FMECA methodology, FMECA
worksheets and discusses major findings of the two workshops (Functional-level and Equipmentlevel) that were conducted on a Class VIII BOP (6R,2A) and a Class VI BOP (4R,2A) configuration.
Summary of Objective and Scope
The objectives of the FMECA analysis were to:
(1) identify the causes and effects of loss of BOP system functionality,
(2) identify the causes and effects of individual equipment failures,
(3) establish the relationship between a specific equipment failure and a loss of system
functionality,
(4) identify the current protection and monitoring/indication methods associated with the system
and equipment failures,
(5) identify and align the current maintenance, inspection, and test (MIT) practices and their
associated frequencies with each functional failure and the associated equipment failures, and
(6) identify the critical failures by using criticality- or risk-ranking methods.
The BOP system, sub-systems and components within the scope of this study are presented in
Appendix E of this report.
Summary of FMECA Approach
The FMECA was conducted in two phases, first a functional-level and then an equipment-level
FMECA. The functional-level (top-down) FMECA was conducted to identify the failures that could
degrade the BOP system functions. The equipment-level (bottom-up) FMECA was conducted to
identify the impact of major equipment and component failures on the BOP system performance by
evaluating equipment-level failure modes, identifying specific equipment-level causes, identifying
the safeguards to prevent or detect the failure modes, and ranking the failure modes risks. In
addition, the equipment-level FMECA was used to identify MIT activities associated with
equipment-level failure modes and specific equipment failures.
iv
The team identified the eight BOP functions in American Petroleum Institute (API) 53 Standard,
Section 7.1.3. During the workshop a few more functions were either added or broken down into
additional functions based on different operating conditions/logic. In total 13 BOP functions/systems
and their 56 associated functional failures were studied in the functional-level FMECA. Appendix A
presents the Functional-FMECA Worksheets.
For the equipment-level FMECA, the team identified and evaluated 3 major BOP subsystems
(surface control, subsea control and stack) and 50 major associated equipment categories. The list of
equipment is presented in the report. The definition of the sub-systems and equipment are presented
in Appendix E.
In order to establish the criticality of each equipment-level failure mode, the team used a Risk
Priority Number (RPN) scoring methodology based on severity, occurrence, and detection. The
definition of severity, occurrence and detection are presented in the report. Appendix B presents the
equipment-level FMECA Worksheets.
Summary of Assessment
Solenoid Valve Fluid End - Subsea

Control
Tubing and piping - Subsea Control
SPM Valve - Single acting - Subsea
Control
Rigid Conduit - Surface Control & Rigid
Conduit Manifold Valve Subsea Control
Remote hydraulic regulator (HKR) &
manual hydraulic regulators (MKR), Pilot
operated check Valve (POCV) - Subsea
Control
Top 25%
Double-acting SPM (Subsea PlateMounted) Valves - Subsea Control

Shuttle Valves
Choke & Kill Lines and Valves
Annular
Pipe Ram
Top 15%
Top 10%
Based on the criticality ranking, the following equipment and their failure modes were identified as
the top 25% of the critical items contributing to the BOPs potential functional failure:
The Double-acting SPM Valves were assessed as one of the top 10% of equipment whose failure
could potentially have a severe effect. This is owing to the fact that these valves are used in the
autoshear, where failure can lead to worst case consequences. The team assessed the double-acting
SPM valves to have mechanical damage (as a dormant failure not leading to leaks) every five years
to once in every ten years caused by damage to the piston rod, poppet, cage, seal plate or piston
housing or seal wear. Due to the nature of the Autoshear Hydraulic Circuit, such damage can only be
detected when the BOP is pulled for inspections. However, it is to be noted that these valves are
rebuilt or rotated every 18 months. The high RPN rating is also due to the occurrence of external and
internal leaks caused by seal wear and other mechanical damage discussed above. Such leak events
are assessed to occur once every two years. A high frequency of rebuilding the valves and a high
frequency of wear leading to leaks call for a detailed look at the maintenance practices followed
during the overhaul. It is also to be noted that a comparative assessment with the failure data
collected from the drilling contractor and the original equipment manufacturer (OEM) did not show
any failures of the double-acting SPM valves discussed above. Hence, this item will be discussed
with the IPs to verify the assessment results.
The Shuttle Valve external leaks were assessed as one of the top 10% of critical equipment failures.
Shuttle valves are evaluated as a single point of failure and depending on the function, the valve
failure may lead to worst case consequences. The team assessed external leaks caused by seal leaks,
fittings or O-ring leaks to occur less than twice a year to at least once every year. It is also to be noted
that these leaks will not be detected until the function is fired. A review of maintenance practices
shows that these valves are rebuilt or rotated every 18 months and checked for tightness of fittings on
every trip. A comparative assessment with the failure data collected from the drilling contractor and
the OEM did not show high failure occurrences. This could be attributed to the limited amount of
available failure data collected owing to the unavailable historical records reported during the data
collection phase. However, in the case of such uncertainties, the judgment based on the experience of
the team members from the operator, drilling contractor and OEM should be relied upon during the
assessment.
The inability to operate the Choke and Kill lines and valves when needed while closed on the drill
pipe or on an open hole by rams, or to circulate the wellbore, were assessed to be in the top 25% of
the criticality rankings. Such failures were attributed to mechanical failure of these gate valves owing
to spring failure, damage to the piston/operator cylinder, damage to the gate/seat, damage to the tail
rod, damage to the grease plate which prevents the gate from moving, or failure of connections and
bolts possibly due to over-torqueing during a recheck of the bolt torque. Such failures were assessed
by the team to occur less than twice a year to at least once every year. A review of the MIT practices
showed that the gate and seat are replaced every 18 months. The valves undergo an overhaul
schedule every three years and a hydraulic chamber test every year. It is to be noted that these valves
are cycled or function tested every shift (12 hours), which makes the failure detectability fairly high.
It is also to be noted that multiple choke and kill valves are available, depending on the ram that is
being functioned. Hence the team lowered the failure occurrence ranking by giving credit for the
redundancy. A comparative assessment with the failure data collected from the drilling contractor
vi
and the OEM did show occurrences of gate valve failures during surface tests, and some significant
downtime associated with its repair when such failures occurred during operation. The failure data
also showed external leaks from choke and kill lines being detected during surface tests.
The preliminary FMECA results show the Annular to be in the top 25% of the critical equipment
list. The possibility of mechanical damage to the annular body was assessed as once every 2 to 5
years. Such damages caused either by cutting/milling debris in the wellbore fluid, or wear of the
sealing element due to normal operation, or any corrosion or erosion issues specific to the well bore
chemical or sea-water environment, will only be detected during visual inspection of the body and
elements at the end of well. Such wear or damages, if kept unchecked, and other seal leaks (like
adapter seal, piston inner & outer seals, bonnet seal) will lead to external leak events. The annulars
are overhauled every five years. A comparative assessment with the failure data collected from the
drilling contractor and the OEM did show a couple of occurrences of annular upper element failures
with significant downtime associated with its repair.
The Pipe Ram was also assessed as one of the top 25% of the critical equipment, owing to the
severity of the failure of the functions associated with their operation. The failure of the poppet,
damage to the piston rod/cylinder/lock, ram housing, damage to the door lock/hinges/bolts, and worn
ram packers were assessed to have the likelihood of occurrence of once every 2 to 5 years. The
review of MIT practices showed that the ram doors are overhauled every 3 years and the body every
5 years. Additionally the ram doors are opened and an internal inspection is performed with changing
the rubber elements on every trip. In addition to that, the locks and the ram cavity are inspected every
year. The door hinges are greased between wells. Apart from weekly functional and bi-weekly
pressure tests, wellbore pressure tests are performed every month to detect leaks. However, a
comparative assessment with the failure data collected from the drilling contractor and the OEM
showed that external leaks associated with the pipe rams were found only during tests on surface.
The external leaks caused by damage to the ball/ball seat or O-ring and tubing failure of the Solenoid
valve fluid end, leaks caused by failure of the seals and elements of single-acting SPM valves and
associated tubing and piping in the subsea hydraulic fluid lines, and plugging due to external debris
and Teflon tape, place these equipment items in the top 15% of the criticality list. The solenoid valve
fluid end and single-acting SPM valves have a rebuild or rotation period of 18 months. The external
leaks can be detected either by surface/subsea flow meter indication or by remotely operated vehicle
(ROV) visual monitoring during the weekly functional tests or during operation. A comparative
assessment with the failure data collected from the drilling contractor and the OEM showed several
occurrences of external leaks in SPM valves and tubing, mostly during tests on surface. One
occurrence of a tubing leak on one pod during operation led to a significant downtime event.
Owing to the mechanical damage and subsequent failure, the HKR and MKR regulators, and the
Pilot operated check valves (POCVs) were assessed as one of the top 25% of critical equipment.
These equipment items are rebuilt or rotated every 18 months, and tested on the surface before
deployment. The external leaks in the Rigid Conduit (Surface Control) and Rigid Conduit
vii
Manifold Valve (Subsea Control) were also categorized under the top 25% of critical equipment
failures. A comparative assessment with the failure data collected from the drilling contractor and the
OEM did not show high failure occurrences. This can also be attributed to the limited amount of
failure data collected owing to the unavailable historical records reported during the data collection
phase. However, in the case of such uncertainties, the judgment based on the experience of the team
members from the operator, drilling contractor and OEM should be relied upon during the
assessment.
The RPN results are presented to reflect the criticality of the functions that were assessed during the
FMECA. Table 3-3 lists the top 25% of effects/functional failures with the highest average RPN for
all of the equipment failures associated with that functional failure. Another way is to calculate the
number of occurrences of each equipment level failure linked to a functional failure as presented in
Table 3-4. However, the reader is advised that tables 3-3 and 3-4, and the method of the average RPN
score depend on the categorization of functions, categorization of equipment and the level of detailed
analysis, and results may slightly differ for different studies. It is suggested that the reader should
review the system and equipment breakdown for this particular study before assessing Tables 3-3 &
3-4.
The FMECA will also support the RAM modeling as appropriate. Specifically, the FMECA may be
used to provide operational and maintenance information, as well as, identification of dominant BOP
failures and protections.
This preliminary FMECA analysis and assessment report is submitted for review by the IPs. The
final report may bear the modifications suggested during the review process.
viii
TABLE OF CONTENTS
Section
Page
SUMMARY ......................................................................................................................................... iv
LIST OF TABLES .............................................................................................................................. xi
LIST OF FIGURES ............................................................................................................................ xi
LIST OF ACRONYMS ....................................................................................................................xiii
1.0
INTRODUCTION .................................................................................................................... 1
1.1
Objectives ............................................................................................................................... 1
1.2
Analysis Scope........................................................................................................................ 1
1.3
FMECA Team Members and Workshop Schedule ................................................................ 4
1.4
Report Organization................................................................................................................ 5
2.0
ANALYSIS METHODOLOGY .............................................................................................. 7
2.1
Analysis Approach.................................................................................................................. 7
2.2.1
Functional Level (Top-Down) FMECA .......................................................................... 9
2.2.2
Equipment Level (Bottom-Up) FMECA ........................................................................ 12
2.2.3
Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking) ...... 14
3.0
FMECA RESULTS & ASSESSMENT ................................................................................ 19
4.0
CONCLUSION ....................................................................................................................... 47
5.0
REFERENCES ....................................................................................................................... 49
Appendix A Functional-Level FMECA Worksheets ................................................................. A-1

Appendix B Equipment-Level FMECA Worksheets ................................................................. B-1
Appendix C Equipment Criticality Sorted by RPN ................................................................... C-1
Appendix D Functional Failure Sorted by Average RPN ......................................................... D-1
Appendix E BOP Sub-System and Equipment Definitions ....... E-1
ix
LIST OF TABLES
Table
1-2
1-3
2-1
2-2
2-3
2-4
2-5
3-1
3-2
3-3
3-4
3-5
Description
Page
IP FMECA Team Members....................................................................................................... 5
ABS and ABS Consulting FMECA Team Members ................................................................ 5
Functions and Functional Failures........................................................................................... 10
General Equipment Failure Modes ......................................................................................... 12
Severity Ratings....................................................................................................................... 15
Occurrence Ratings ........................................................................................................................ 16
Detection Ratings .................................................................................................................... 17
Functional Failure Ranking ..................................................................................................... 19
Failure Modes with Highest RPN Sorted by RPN ............................................................... 27
Failure Modes with S = 10, O 3, and D 5 ......................................................................... 32
Functional Failures with Highest Average RPN ..................................................................... 36
Functional Failures with Greatest Occurrences Due to Equipment Failures........................... 43
LIST OF FIGURES
Figure
Description
Page
2-1
General FMECA Approach ....................................................................................................... 8
2-2
Functional-Level FMECA Procedure...................................................................................... 10
2-3
Equipment-Level FMECA Procedures.................................................................................... 13
xi
xii
LIST OF ACRONYMS
ABS
ABS Consulting
API
BOP
BSEE
C&K
CCSV
DDV
EDS
ERA
FMECA
HKR
HPU
IP
LMRP
MIT
MKR
MUX
OEM
ROV
RPN
SEM
SPM
UPS
American Bureau of Shipping

ABSG Consulting Inc.
American Petroleum Institute
Blowout Preventer
Bureau of Safety and Environmental Enforcement
Choke and Kill
Compensated Chamber Solenoid Valve
Direct Drive Valve (solenoid valve)
Emergency Disconnect System
Electronic Riser Angle
Failure Mode, Effect, and Criticality Analysis
Remote Hydraulic Regulator
Hydraulic Power Unit
Industry Participant
Lower Marine-Riser Package
Maintenance, Inspection, and Test
Manual Hydraulic Regulator
Multiplex
Original Equipment Manufacturer
Remote Operated Vehicle
Risk Priority Number
Subsea Electronic Module
Subsea Plate-Mounted (valve)
Uninterrupted Power Source
xiii
xiv
1.0 INTRODUCTION
As part of the Blowout Preventer (BOP) Maintenance and Inspection for Deepwater Operations study
(Bureau of Safety and Environmental Enforcement [BSEE] contract number M11PC00027),
American Bureau of Shipping (ABS) and ABSG Consulting Inc. (ABS Consulting) performed
Failure Mode, Effect, and Criticality Analysis (FMECA) on specific BOP subsystems and
equipment. There were three FMECAs performed with three different teams of operator, drilling
contractor and original equipment manufacturer. This is the draft report of the FMECA conducted
with team-3 and represents the study deliverable associated with Task 6.2.2.1 as outlined in the
contract.
This report presents the objective and scope of the FMECA study, FMECA methodology, FMECA
worksheets and discusses major findings of the two workshops (Functional-level and Equipmentlevel) that were conducted on Class VIII BOP (6R, 2A) and Class VI BOP (4R, 2A) configurations.
1.1
OBJECTIVES
The objectives of the FMECA analysis were to:

(1) dentify the causes and effects of loss of BOP system functionality,
(2) identify the causes and effects of individual equipment failure,
(3) establish the relationship between a specific equipment failure and a loss of system
functionality,
(4) identify the current protection and monitoring/indication methods associated with the system
and equipment failures,
(5) identify and align the current maintenance, inspection, and test (MIT) practices and their
associated frequencies with each functional failure and the associated equipment failures,
and
(6) identify the critical failures by using criticality- or risk-ranking methods.
1.2
ANALYSIS SCOPE
The scope of this effort was the analysis of a selected BOP and associated equipment that meets the
following criteria:
Operation Location Gulf of Mexico (majority of the operation and maintenance to be from
the Gulf of Mexico)
Operating Depth 5,000 Feet and Deeper
BOP Configurations:
o Class VI BOP, five ram configuration and single annular or a four ram and dual annular
o Class VII BOP, five ram configuration and dual annular or a six ram and single annular
o Class VIII BOP, six ram configuration and dual annular (ram configurations can consist
of a combination of blind/shear ram, non-sealing casing ram and pipe ram preventers)
Since the drilling contractor and the operator were operating rigs in Gulf of Mexico using both Class
VIII BOP (6R, 2A) and Class VI BOP (4R, 2A) configurations from the same original equipment
manufacturer (OEM), ABS decided to include both configurations in the analysis. As pointed out by
the OEM, apart from the obvious difference in the stack configuration, the BOP multiplex control
system for the rig BOPs had a few differences including the type of solenoid valve and the voting
logic/redundancy of programmed logic controllers. The analysis included the compilation of
information from the industry participatns (IPs), followed by the review and analysis of the selected
BOPs and associated control systems used by the drilling contractor.
Figure 1-1. Class VI BOP Configuration Used in

Study
Figure 1-2. Class VIII BOP Configuration Used in

Study
The team identified eight BOP functions in American Petroleum Institute (API) 53 Standard, Section
7.1.3. During the workshop a few more functions were either added or broken down into additional
functions based on different operating conditions/logic. For example, the FMECA team determined
that the shear the drill pipe and seal the wellbore function needed to be broken down into three
functions based on different operating condition/logic. In total 13 BOP functions/system and their
56 associated functional failures were studied in the functional-level FMECA.
The following 13 BOP functions/system were studied in the functional-level FMECA:
1.
2.
3.
4.
5.
6.
7.
Close and seal on the drill pipe and allow circulation on demand
Close and seal on open hole and allow volumetric well control operations on demand
Strip the drill string using the annular BOP(s)
Hang-off the drill pipe on a ram BOP and control the wellbore
Controlled operation Shear the drill pipe and seal the wellbore
Emergency Operation Auto-Shear Shear the drill pipe and seal the wellbore
Emergency Operation Emergency Disconnect System (EDS) Shear the drill pipe and seal
the wellbore
8.
9.
10.
11.
12.
13.
Disconnect the lower marine-riser package (LMRP) from BOP stack

Circulate the well after drill pipe disconnect
Circulate across the BOP stack to remove trapped gas
Connect BOP and LMRP at landing (not included API 53)
Secondary Acoustic (not included API 53)
Secondary remotely operated vehicle (ROV) (not included API 53)
Note: Item 12 and 13 are not functional failures, but they were evaluated during the functional-level
FMECA as the team considered these systems as a vital contributor for safe operation of the BOP
stack and drilling rig. Since these were considered as standalone systems and not analyzed in the
equipment-level FMECA, there are no links between these items and the equipment-level FMECA.
For the equipment-level FMECA, the team identified and evaluated 3 major BOP subsystems
(surface control, subsea control and BOP stack (LMRP & lower stack)) and 50 major associated
equipment categories. The list of equipment is presented below (the numbering system followed in
the FMECA Worksheets has been retained).
Subsystem 1: Surface Control System
1. Surface Control: Power & multiplex (MUX) Electrical
1.1. Power Uninterrupted Power Source (UPS)
1.2. CCU
1.3. Driller Control Panel/RMP/SEP
1.4. MUX Reel
1.5. Slip Ring
1.6. MUX Communication Fiber Optic Ring
1.7. Hydraulic Power Unit (HPU) Panel
1.8. MUX Cable/Connector
2. Surface Control: Hydraulic
2.1. Glycol and Soluble Oil Tank
2.2. Filter & Glycol and Soluble Oil Pump
2.3. MRU and Level Switches
2.4. Mixing Pump
2.5. HPU Pump & Suction Strainer
2.6. High Pressure Discharge Filter
2.7. Rigid Conduit
2.8. Hotline
2.9. Surface Accumulators
Subsystem 2: Subsea Control System
3. Subsea Control: MUX Electrical
3.1. Subsea Electronic Module (SEM)
3.2. Solenoid Valve

3.3. Well bore P/T Probe
3.4. Electronic Riser Angle (ERA)
3.5. LMRP P/T Probe
4. Subsea Control: Hydraulic
4.1. Subsea Plate-Mounted (SPM) Manifold
4.2. Compensated Chamber and Depth Compensated Bladder
4.3. HKR Regulator
4.4. SPM Valve Single Acting
4.5. SPM Valve Double Acting
4.6. Pilot Operated Check Valve (POCV)
4.7. Tubing and Piping
4.8. Compensated Chamber Solenoid Valve (CCSV)/Direct Drive Valve (DDV) (solenoid
valve) Fluid End
4.9. Manual Hydraulic Regulator (MKR)
4.10. Subsea Accumulator (POD)
4.11. Subsea Accumulator (LMRP)
4.12. Pilot Manifold and Pilot Filter
4.13. Inlet/Supply Manifold and Supply Filter
4.14. Rigid Conduit Manifold
4.15. Gripper Assembly
Subsystem 3: Stack
5. BOP Stack
5.1. Annular
5.2. Blind Shear Ram
5.3. Pipe Ram
5.4. Casing Shear Ram
5.5. Choke & Kill Lines & Valves
5.6. Choke & Kill Hose
5.7. LMRP Connectors
5.8. Well Head Connectors
5.9. Spools (not applicable for the stacks studied)
5.10. Shuttle Valve
5.11. Clamps for Choke & Kill Hot Connection
5.12. Function hose
5.13. Accumulator DCB/Autoshear
For the major equipment boundaries included in the study, refer to the definitions presented in
Appendix E of this report. The referenced manuals and drawings are presented in Section 5 of this
report.
1.3
FMECA TEAM MEMBERS AND WORKSHOP SCHEDULE
The FMECA workshop team members included personnel from three IPs, ABS, and
ABS Consulting. The IPs participating included one or more representatives from an OEM, a drilling
contractor, and an operator. These individuals provided knowledge of the design, engineering,
operation, and maintenance of the BOP being evaluated. Table 1-2 lists the functional positions for
the IP personnel who participated in this study.
Table 1-2: IP FMECA Team Members

IP Organization
Position/Expertise
BOP OEM
Engineering Director
Project Manager
Manager Pressure Control
Electrical Supervisor Pressure Control
Engineering Consultant Pressure Control
Drilling Contractor
Manager Subsea systems
Operator
Well Delivery Manager
Drilling Supervisor
ABS personnel provided knowledge of the overall BOP operations and class society and regulatory
requirements applicable to BOP design and operation. Table 1-3 lists the ABS and ABS Consulting
personnel who participated in this study.
Table 1-3: ABS and ABS Consulting FMECA Team Members
Name
Organization
Title
Bibek Das
ABS
Senior Engineer II (Risk &
Reliability), Corporate
Technology
Darshan Lakhani
ABS Consulting
Lead Engineer
Harish Patel
ABS
Manager, Corporate
Technology - Drilling and
Process
Study Role
Workshop Chair
Study Scribe
Project Manager
To prepare for the FMECA studies, ABS and ABS Consulting held a FMECA kickoff meeting with
the IPs on August 14 and 15, 2012. The purpose of the kickoff meeting was to discuss the FMECA
approach and the analysis scope for all participants to have the same level of understanding of the
FMECA procedures.
The functional-level FMECA workshop was conducted during full-day sessions held on
September 18 through 20, 2012. The equipment-level FMECA workshop was conducted during fullday sessions held on October 1 through 5, 2012.
1.4
REPORT ORGANIZATION
Section 1 of this report has provided the objectives, scope, FMECA team composition and workshop
schedules. Section 2 of this report provides an overview of the methodology used to analyze the
BOPs selected functions and equipment to determine the critical failure modes and their effects.
Section 3 discusses the results of the effort. Section 4 provides the concluding remarks. Section 5
presents the referenced documents and drawings used during the FMECA study. Appendices A & B
present the functional-level FMECA and the equipment-level FMECA worksheets respectively.
Appendices C & D present criticality rankings for equipment and functional failures respectively.
Appendix E presents the BOP sub-system and equipment definitions.
2.0 ANALYSIS METHODOLOGY

In order to evaluate BOP MIT practices, reduce the risk of failures and improve the reliability of
BOP performance, it is essential to identify the BOPs critical failure modes and their effects.
Therefore, ABS and ABS Consulting selected and employed both functional- and equipment-level
FMECA methodologies to evaluate BOP functions and identify specific subsystem and equipment
failures of interest as outlined in Section 1.2, Analysis Scope.
This analysis methodology was chosen because it provided a means to establish a relationship among
(1) BOP system functions, (2) BOP system equipment failures, and (3) BOP system MIT practices
by:
Identifying the potential effects resulting from deviations to BOP system functions (i.e.,
functional failures) and equipment-level failure modes causing the BOP system functional
failures
Identifying the potential functional failures resulting from BOP system equipment failure
modes and specific equipment failures causing the BOP system equipment failure modes
Linking specific equipment failures to BOP system functional failures
Identifying the safeguards (i.e., inspection, tests, protection/redundancy and maintenance)
currently provided for preventing specific equipment failures resulting in BOP system
functional failures and the associated potential end effects
Identifying and aligning MIT activities associated with specific equipment-level and failure
mode
Risk-ranking the equipment-level failure modes.
2.1
ANALYSIS APPROACH
A FMECA is an inductive reasoning approach that (1) considers how the functional failures of each
system function or the failure modes of each component could result in system performance
problems and (2) helps evaluate safeguards that are in place (including engineered protections &
monitoring systems, human actions, and maintenance activities) to prevent, detect or mitigate such
problems. The main focus of a FMECA is to establish the cause-and-effect relationship between
potential equipment failures, functional failures, and the end effect of those failures, and to evaluate
the criticality of the postulated functional failure/failure mode.
Figure 2-1 represents the general FMECA methodology used in evaluating the BOP system.
Specifically, this study employed both functional- and equipment-level FMECA approaches (see
Step 3) with the explicit purpose of transitioning the functional-level FMECA to a more detailed
level to better ensure the alignment of MIT activities with specific equipment failures and link the
specific equipment failures with their potential impact of BOP performance via functional failures.
This FMECA approach is very similar to the approach employed in many classical reliabilitycentered maintenance approaches, which have the overall objective of determining the optimal
maintenance strategy for preserving system functionality via detection and prevention of equipment
failures.
Figure 2-1. General FMECA Approach
2.2
ANALYSIS PROCEDURES
This section summarizes the procedures and specific tools used in performing the functional- and
equipment-level FMEAs. In addition, the risk priority number approach that was used to risk rank the
functional failure effects & equipment failure mode pairs is provided. More explanation on the
ranking method is given in section 2.2.3.
In preparation for the FMECA, ABS engineers identified potential functional failures and equipmentlevel failure modes to help guide the analysis team. Functional- and equipment-level FMECA
sessions were held with BOP subject matter experts from the OEM, drilling contractor, and operator.
ABS facilitated and documented the analysis using ABS Consultings Enterprise LEADER software
tool.
2.2.1
Functional Level (Top-Down) FMECA
The functional-level FMECA was performed by analyzing each function and its associated functional
failures. The functional-level FMECA process is illustrated in Figure 2-2. In executing this
procedure, the following operating modes were applied:
Normal Drilling
Kick Control
Emergency Operation (e.g., disconnect)
Riding the Storm
In addition, the following are consequences of interest for identifying end effects of interest during
the functional-level FMECA:
Safety Effects
Inability to control well or maintain well integrity
Potential release of hydrocarbon to the atmosphere resulting in potential fire, Explosion,

and/or exposure to toxic materials causing injury or worse
Environmental Effects
Inability to control well or maintain well integrity
Potential release of hydrocarbons to the environment resulting in a minor, significant,

(<1,000 bbl.), (1,000 to 10,000 bbl.), or large (>10,000 bbl.) spill/atmospheric release
Significant Downtime
Failures requiring pulling of the LMRP or BOP Stack
Downtime exceeding 5 days
In evaluating potential end effects, the team evaluated the severities based on worst-case end effects
assuming that available safeguards do not prevent or mitigate the end effects. Therefore, the end
effects represent the potential severity and conservatively overstate the expected consequences.
Figure 2-2. Functional-Level FMECA Procedure

During the functional-level FMECA, the analysis team evaluated these 13 BOP functions/systems
and their 56 associated functional failures. Each function and its associated functional failures were
evaluated in detail by identifying (1) the potential end effects resulting from the functional failure,
(2) equipment-level causes and failure modes potentially resulting in the functional failure, and (3)
safeguards used to prevent or detect the potential functional failure and its associated equipmentlevel causes. The equipment-level causes and failure modes were then studied in detail during the
equipment-level FMECA workshop.
Secondary systems (functions 12 & 13 below) were evaluated in a similar manner but were not
assessed in the equipment-level FMECA. Appendix A presents the Functional-FMECA Worksheets.
Table 2-1: Functions and Functional Failures
No.
Function
Functional Failure Modes
Failure to close on drill pipe through annular(s)
1
Close and seal on the drill
pipe and allow circulation
Failure to close on drill pipe through pipe rams
on demand
Failure to seal or partial seal on drill pipe through
annular(s)
Failure to seal or partial seal on drill pipe through
pipe rams
Unintentional closing / opening
Failure to open/close fail-safe valves to seal
Close too slowly
Loss of containment
10
Table 2-1: Functions and Functional Failures (contd)

No.
Function
2
Close and seal on open hole Failure to close on open hole through blind-shear
rams
and allow volumetric well
control operations on
demand
Failure to open/close fail-safe valves
Close too slowly
Loss of containment
3
Strip the drill string using
Failure to close annular
the annular BOP(s)
Failure to maintain stripping pressure
Failure to seal
4
Hang-off the drill pipe on a Failure of hang-off ram to close
ram BOP and control the
Failure to maintain closing pressure
wellbore
Failure to maintain locking
5
Controlled Operation-Shear Failure to close
the drill pipe and seal the
Failure to shear the drill pipe
wellbore
Failure to seal the wellbore
Close too slowly
Loss of containment
6
Emergency Operation-Auto Failure to arm
shear- Shear the drill pipe
Failure to close
and seal the wellbore
Close too slowly
Loss of containment
Failure to close
7
Emergency OperationEDS- Shear the drill pipe
and seal the wellbore
Close too slowly
Loss of containment
Failure to disconnect the LMRP
8
Disconnect LMRP/BOP
Failure to disconnect the LMRP/BOP
Unintentional disconnect of the LMRP/BOP
9
Circulate the well after drill Failure to circulate
pipe disconnect
Failure to circulate at desired flow rate
Failure to seal wellbore after drill pipe disconnect
Loss of containment
10
Circulate across the BOP
Failure to circulate
stack to remove trapped gas Failure to circulate at desired flow rate
Loss of containment
11
Table 2-1: Functions and Functional Failures (contd)

No.
Function
11
Connect BOP and LMRP at Inadequate BOP connection
landing
Inadequate LMRP connection
12
Secondary Acoustic
Failure to disarm
Failure to arm
13
Secondary ROV
Failure to perform ROV intervention
2.2.2
Equipment Level (Bottom-Up) FMECA
The equipment-level FMECA was performed by analyzing each major piece of equipment with its
associated components using equipment-level failure modes. The major equipment items were
identified in the functional-level FMECA as critical equipment whose failure contributed to the
failure of the function. Figure 2-3 outlines the equipment-level FMECA process. To evaluate each
equipment item, a list of the general failure modes was developed during the FMECA kick-off
meeting and is provided in Table 2-2. During the equipment-level FMECA, the analysis team
modified these general equipment failure modes to describe the means in which each major
component can fail.
Table 2-2: General Equipment Failure Modes
Mechanical Failures
Electrical/Electronics Failure
External leak/rupture
Loss of or degraded power
Internal leak
Fails with no output signal/no

communication
Plugged
Fails with low or high output signal
Mechanical failure (e.g., fracture, galling, fatigue)
Erratic output
Corrosion/erosion
Fails to respond to input
Loss of function (general)
Short
Wear/Mechanical Damage
Loss of function (general)

Processing error (e.g. calculation error,
sequence error)
12
Figure 2-3. Equipment-Level FMECA Procedures

During the equipment-level FMECA workshop, the analysis team evaluated each major equipment
item by first identifying potential equipment-level failure modes and then postulating on specific
equipment failure causes resulting in each failure mode. The team then identified the potential effects
resulting from each failure mode. The effects were then identified and classified into various BOP
functional failures. Based on this classification the equipment-level failure modes were linked to the
corresponding BOP functional failure. Once these links were established, the team identified any
safeguards that are currently in place to detect, prevent or mitigate the failure mode. Appendix B
presents the equipment-level FMECA Worksheets.
13
2.2.3
Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking)
To provide a consistent means to evaluate the relative criticality of the BOP subsystem and
equipment failures and to help judge the adequacy of MIT activities performed to prevent and detect
the failures, a Risk Priority Number (RPN) ranking scheme based the following factors was
employed:
Frequency of Failure of the Equipment Failure Mode

Level of Redundancy to Prevent Specific Failure from Resulting in Complete Loss of Safety
Critical Functions
Ability to Detect and Prevent the Failure Mode via system monitoring and MIT practices
Severity of the End Effect for each BOP Functional Failure
A RPN ranking for each functional failure associated with an equipment-level failure mode was
based on the product of the following three independent factors:
Severity Rating This rating assesses the severity of worst-case end effect for a given
functional failure. (Note: The functional failure end effects documented in the functionallevel FMECA were used to determine this rating assuming no redundancies are present.). The
severity was rated for potential hazard to personnel on the rig, potential environmental
impact, and potential downtime.
Occurrence Rating This rating assesses the likelihood of the failure mode resulting in the
functional failure and its stated end effect. Such an assessment is made by evaluating the
causes listed for the failure mode. The presence of redundant components and systems is
explicitly considered in this rating.
Detection Rating This rating assesses the likelihood of the current applicable MIT activities
and system monitoring techniques to detect the failure mode before it results in the functional
failure.
The severity, occurrence, and detection ratings are provided in Tables 2-3 through 2-5, respectively.
These ratings were then used to calculate a single RPN ranking for each functional failure effect &
equipment failure mode pair (i.e., RPN ranking for each functional failure associated with an
equipment-level failure mode) using the following equation:
RPN = Severity Rating X Occurrence Rating X Detection Rating
The individual RPN rankings provide a relative ranking of the risk associated with a given functional
failure effect-equipment failure mode pair. Thereby, providing a means to identify the most critical
equipment-level failure modes in overall BOP performance, as well as identifying the more critical
failure modes associated with a specific BOP functional failure.
14
Table 2-3: Severity Ratings

Severity Rank
Significance
Does not affect BOP
functionality; no
1
impact on safety and
environment.
Does not affect BOP
functionality but
2
needs to be corrected;
no impact on safety
and environment.
Partial loss of BOP
3
function; no loss of
well control.
Partial loss of BOP
function; no loss of
4
well control.
Personnel
No impact
Environment
Down Time
No impact
No downtime, repair can
be done while drilling
continues.
No impact
No impact
No impact
No impact
No downtime, repair can

be done at next
opportunity, drilling
continues.
Downtime of less than a

shift, stop drilling,
intervene and repair.
No impact No impact
Downtime between a
shift and 24 hours, stop
drilling, intervene and
repair.
Partial loss of BOP
No impact No impact
Downtime between 1 and
primary function if
7 days - stop drilling,
not corrected
intervene and repair
immediately.
(surface only).
Partial loss of BOP
Minor
Minor
Downtime between 8 and
primary function if
Injury; no
external
21 days - stop drilling,
not corrected
recordable subsea leak
intervene and repair
immediately.
lost time
(e.g., choke & (surface only).
kill [C&K]
connector
leak)
Loss of BOP primary Minor
Significant
Pulling LMRP only.
function.
Injury;
external
some lost subsea leak
time.
(e.g., major
connector
leak)
Loss of BOP primary Serious
<1000 BBL
Pulling LMRP/BOP
function.
Injury;
stack.
significant
lost time.
Loss of BOP primary Single
>1000BBL
Shut down of operations;
function.
Fatality;
drilling stopped and
multiple
major regulatory
serious
implications; changes to
injuries.
drilling schedule > 3
months.
15
Table 2-3: Severity Ratings (contd)

Severity Rank
Significance
Loss of BOP primary
function.
10
Personnel
Multiple
fatalities
and
injuries.
Table 2-4: Occurrence Ratings

Occurrence
Frequency/Rig Yr.
Ratings
10
>50+ events/ rig yr.
<50 events /rig yr. to 10 events /rig
9
yr.
8
<10 events /rig yr. to 4 events /rig yr.
7
<4 events /rig yr. to 2 events /yr.
6
<2 events /rig yr. to 1 event/yr.
<1 event /rig yr. to 1 event every 2 rig
5
years
<1 event every 2 rig years to 1 event
4
every 5 rig years
3
every 10 rig years
2
every 100 rig years
<1 event every 100 rig years
1
16
Environment
>10,000BBL
and severe
environmental
damage over a
large area.
Down Time
Shut down of
operations; drilling
stopped and major
regulatory implications;
total loss of asset.
Occurrence
Once a week or more often
Less than once a week to once a month
Less than once a month to once a quarter
Less than once a quarter to twice a year
Less than twice a year to once a year
Less than once a year to once every 2
years
Less than once every 2 years to once
every 5 years
Less than once every 5 years to once
every 10 years
Less than once every 10 years to 10%
chance every 10 years of operation
Less than 1% chance every 10 years of
operation
Table 2-5: Detection Ratings

Detection
Detection
Rating
Almost Certain
1
2
3
4
5
6
7-8
9
10
Likelihood of Detection
Very high probability of detection (>90% probability of

detection) by design controls (redundant or independent selfdiagnostic capability, independent alarms) will certainly detect
failures
Very High
High probability of detection (50 to 90% of detection) by
design controls (single device self-diagnostic capability, single
alarms, visual monitoring, leak monitoring, loss of fluid etc.)
will certainly detect failures
High
Probability of detection via weekly on-stream tests/inspections
will provide immediate detection of the failure
Moderately high
Probability of detection via monthly on-stream tests/inspections
will provide immediate detection of the failure
Moderate
Probability of detection via quarterly on-stream
tests/inspections will provide immediate detection of the failure
Low
Can only be detected during routine inspections/tests while the
BOP is pulled from the well
Very Low
Can only be detected during major PMs while the BOP is
pulled from the well
Remote
Can only be detected and/or corrected during major overhaul or
rebuilding-type activities
Absolute Uncertainty Currently no design controls or maintenance techniques in
place
17
18
3.0 FMECA RESULTS & ASSESSMENT

This section summarizes the results of the FMECA analysisspecifically, the results of the
functional-level and equipment-level FMECAs which are provided in tabular format in
Appendices A and B, respectively. These appendices also include a description of the FMECA table
information.
The functional failures were ranked during the FMECA Workshop and the results are presented in
Table 3-1. The worst case ranking among the three groups was chosen as the severity ranking for
RPN calculations.
Table 3-1: Functional Failure Ranking
Severity
Function
1- Close and seal on the drill pipe and allow
circulation, on demand
No.:
Failure to close on drill pipe through
1.1.1
annular(s)
Failure to Provide Control Signal to Annular
1
or C&K Valves When Demanded
Failure to Supply Hydraulic Fluid &
Pressure to Annular & C&K Valves When
Demanded
2
3
Failure to Close Annular on Demand
4
Inability to Operate C&K Valves as Needed
5
Failure to open annular on demand
No.:
Failure to close on drill pipe through pipe
1.1.2
rams
Failure to Provide Control Signal to Pipe
1
Ram or C&K Valves When Demanded
Failure to Supply Hydraulic Fluid &
Pressure to Pipe Ram or C&K Valves When
Demanded
2
3
Failure to Close Pipe Ram on Demand
4
Failure to Open Pipe Ram on Demand (as
5
part of well control process)
No.:
Failure to seal or partial seal on drill pipe
1.1.3
through annular(s)
1
Failure of Annular to Seal on Demand
Failure to Maintain Adequate Sealing
2
Pressure on Annular ( high and low)
3
Partial seal - C&K Valves leaking
19
Personnel
Environment
Down
Time
8
1
1
8
8
1
8
8
8
10
10
10
10
10
10
10
1
1
10
10
1
10
10
8
8
8
8
8
8
8
Table 3-1: Functional Failure Ranking (contd)

Severity
Function
No.:
1.1.4
Failure to seal or partial seal on drill pipe

through pipe rams
1
Failure of Pipe Ram to Seal on Demand
2
Pressure on Pipe Ram
3
Partial seal - C&K Valves leaking
No.:
1.1.5A
1
2
No.:
1.1.5B
1
2
No.:
1.1.6
Unintentional closing / opening - Annulars

Unintentional Closing
Unintentional Opening
Unintentional closing / opening -Pipe Rams

Failure to open / close Spring assisted valves
to seal
Failure to Actuate Under Failsafe
1
Conditions - NOT APPLICABLE
Failure to Adequately Seal Under Failsafe
2
Conditions-NOT APPLICABLE
No.:
1.1.7
Personnel
Environment
Down
Time
10
10
10
10
10
10
10
10
1
8
1
8
8
8
8
10
1
10
8
10
Closes too slowly - Annular

Actuates Too Slowly on Demand
Closes too slowly - Pipe Ram

10
10
10
1
1
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
No.:
1.1.7
No.:
1.1.8
Loss of containment
1
External Leak
2
Rupture
2- Close and seal on open hole and allow volumetric
well control operations, on demand
No.:
Failure to close on open hole through blind
1.2.1
shear ram
Failure to Provide Control Signal to blind
1
shear ram or C&K Valves When Demanded
Failure to Supply Hydraulic Fluid & Pressure
to blind shear ram or C&K Valves When
Demanded
2
3
Failure to Close blind shear ram on Demand
Failure of blind shear ram to Seal on
4
Demand
20

Severity
Function

Pressure on Blind shear ram ( high and low)
Unintentional closing / opening - Blind shear
ram
Failure to open / close Spring assisted valves
to seal
Failure to Actuate Under Failsafe Conditions
- NOT APPLICABLE
Failure to Adequately Seal Under Failsafe
Conditions-NOT APPLICABLE
Closes too slowly

5
6
No.:
1.2.2
1
2
No.:
1.2.3
1
No.:
1.2.4
Personnel
Environment
10
10
Down
Time
10
10
10
10
10
10
10
10
10
1
1
10
10
10
10
1
1
1
1
8
8
No.:
1.2.5
Loss of containment
1
External Leak
2
Rupture
3- Strip the drill string using the annular BOP(s)
No.:
1.3.1
Failure to close annulars
Failure to Provide Control Signal to
1
Annulars When Demanded
2
to Annulars
Failure to Close Annulars on Drill String on
3
Demand
No.:
1.3.2
Failure to maintain stripping pressure
Failure to Maintain Hydraulic Fluid &
1
Pressure to Annulars ( low and high pressure)
No.:
1.3.3
Failure to seal /lubrication
1
Failure of Annular to Seal on Demand
2
Pressure on Annular ( high and low)
21

Severity
Function
4- Hang-off the drill pipe on a ram BOP and control
the wellbore
No.:
1.4.1
Failure of hang-off ram to close
Failure to Provide Control Signal to Hang-off
1
Ram When Demanded
2
to Hang-off Ram
3
Failure to Close Hang off Ram on Demand
No.:
1.4.2
Failure to maintain closing pressure
Failure to Maintain Closing Pressure on
1
Hang-off Ram
No.:
1.4.3
Failure to maintain locking
1
Failure to Engage Lock on Hang-off Ram
No.:
Failure of hang-off ram to close in
1.4.4
preparation to Disconnect
Failure to Provide Control Signal to Hang-off
1
Ram in preparation to Disconnect
to Hang-off Ram in preparation to
Disconnect
2
Failure to Close Hang off Ram in
3
preparation to Disconnect
5- Normal operation - Shear the drill pipe and seal
the wellbore
No.:
1.5.1
Failure to close
Failure to Provide Control Signal to Shear
1
Ram When Demanded
2
to Shear Ram
No.:
1.5.2
1
Failure to Shear Pipe
No.:
1.5.3
1
Failure of Shear Ram to Seal On Demand
Failure to Maintain Sealing Pressure on
2
Shear Ram ( failure to maintain seal)
22
Personnel
Environment
Down
Time
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10

Severity
Function
No.:
1.5.4
Personnel
Environment
Down
Time
1
2

8
10
1
10
8
10
Closes too slowly

10
10
10
1
1
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
10
1
1
10
10
10
10
No.:
1.5.5
No.:
1.5.6
Loss of containment
1
External Leak
2
Rupture
6- Emergency Operation - Auto-Shear - Shear the
drill pipe and seal the wellbore
No.:
1.6.1
Failure to Arm
1
Failure to Provide Control Signal
No.:
1.6.2
Failure to close
1
to Shear Ram
No.:
1.6.3
1
to Shear Ram
2
No.:
1.6.4
1
2
Shear Ram
No.:
1.6.5
1
Unintentional Opening - NOT
2
APPLICABLE
No.:
1.6.6
Closes too slowly
1
No.:
1.6.7
Loss of containment
1
External Leak
2
Rupture
23

Severity
Function
7- Emergency Operation - EDS - Disconnect and/or
Shear the drill pipe and seal the wellbore
No.:
1.7.1
Failure to close and/or disconnect
Failure to Provide Control Signal to Riser
1
connector when Demanded
2
to Riser connector
3
No.:
1.7.2
1
No.:
1.7.3
1
2
Shear Ram
No.:
1.7.4
1
2
No.:
1.7.5
Closes too slowly
1
No.:
1.7.6
Loss of containment
1
External Leak
2
Rupture
8- Disconnect the LMRP from the BOP stack
No.:
Failure to disconnect the LMRP from BOP
1.8.1
stack
Failure to Provide Disconnect Signal
1
(automatically or manually)
Failure of LMRP / BOP Connector to
2
Disengage
3
Failure of Hydraulic Fluid to Disconnect
4
Moves too slowly to disconnect
No.:
1.8.2
Unintentional disconnect of the LMRP
1
Spurious Disconnect Signal
2
Unintentional Manual Disconnect Signal
24
Personnel
Environment
Down
Time
10
10
10
10
10
10
1
1
10
10
10
10
10
10
1
1
10
10
10
10
1
1
1
1
8
8
10
10

Severity
Function
9- Circulate the well after drill pipe disconnect
No.:
1.9.1
Failure to circulate/seal the wellbore
Failure to Provide Control Signal (to open) to
1
C&K Valves when Demanded
2
to C&K Valves
3
No.:
1.9.2
Failure to circulate at desired flow rate
Degraded Flow Pressure / Restricted Flow
1
Path
No.:
Failure to open / close fail-spring assist
1.9.3
valves to seal
1
Failure to close/partial close
No.:
Failure to seal wellbore after drill pipe
1.9.4
disconnect
Failure to Provide Control Signal to C&K
1
Valves when Demanded
2
to C&K Valves
3
No.:
1.9.5
Loss of containment
1
External Leak
2
Rupture
10- Circulate across the BOP stack to remove
trapped gas
No.:
1.10.1 Failure to circulate
Failure to Provide Control Signal to C&K
1
Valves when Demanded
2
to C&K Valves
3
No.:
1.10.2 Failure to circulate at desired flow rate
Degraded Flow Pressure / Restricted Flow
1
Path
No.:
Failure to open / close spring assist valves to
1.10.3 seal
1
Failure to close/partial close
25
Personnel
Environment
Down
Time
1
1
10
10
10
10

Severity
Function
No.:
1.10.4 Loss of containment
1
External Leak
2
Rupture
11- Connect BOP and LMRP at Landing
No.:
1.11.1 Inadequate BOP Connection
Failure of Wellhead Connector to Properly
1
Lock and Seal
2
Failure of Connector Integrity
Failure of Connector Integrity (during
3
operation)
No.:
1.11.2 Inadequate LMRP Connection
Failure of LMRP Connector to Properly
1
Lock and Seal
2
Failure of Connector Integrity
Failure of Connector Integrity (during
3
operation)
12- Secondary - Acoustic
No.:
1.12.1 Failure to disarm
1
Failure to provide Acoustic signal to disarm
No.:
1.12.2 Failure to arm
1
Failure to provide Acoustic signal to arm
13- Secondary - ROV
No.:
1.13.1 ROV Intervention
Failure to perform ROV intervention of
Riser connector/BOP stack function
Primary and secondary riser connector
1
unlock
2
Riser Connector gasket release
3
all stabs retract
4
Shear ram close
5
pipe ram close
stack connector primary and secondary
6
unlock
7
stack connector gasket release
8
stack connector gasket lock
26
Personnel
Environment
Down
Time
1
1
10
10
10
10
1
10
1
10
8
10
1
10
1
10
7
10
Not assessed in Equipment-level

FMECA RPN
1
1
1
2
Not assessed in Equipment-level
FMECA RPN
1
1
1
1
1
1
1
10
1
1
7
7
10
8
9
1
1
1
1
8
2

Severity
Function
9
10
11
12
Personnel
Environment
1
1
1
1
1
1
1
1
stack connector glycol injection

Visual inspection and monitoring
Shear Ram open
Pipe ram open
Down
Time
9
5
6
6
Table 3-2 shows the top 25% of equipment-level failure modes. These are considered to be the most
critical failure modes. RPN scores from the FMECA range from 1300, with the top 25% ranging
from 90300. Appendix C provides the complete table for these equipment-level failure modes based
on the RPN rankings. Note: The equipment/sub-system may be repeated in the table below for
different failure modes and functional failures.
Table 3-2: Failure Modes with Highest RPN Sorted by RPN
Equipment/
Subsystem
SPM Valve Double acting Subsea Control:
Hydraulic
Choke & Kill
Lines & Valves
- BOP Stack
Hydraulic
Choke & Kill
Lines & Valves
- BOP Stack
Pipe Ram BOP Stack
Pipe Ram BOP Stack
Annulars - BOP
Stack
Choke & Kill
Lines & Valves
- BOP Stack
Severity
(S)
Occurrence
(O)
Detection
(D)
RPN
(SxOxD)
# of Effects
(Functional
Failures)
External
Leak
10
300
Mechanical
Failure
270
Internal
Leak
10
240
240
10
200
10
200
192
192
Failure
Mode
Mechanical
Failure
External
Leak/
Rupture
Mechanical
Failure
Mechanical
Damage
Internal
Leak
27
Table 3-2: Failure Modes with Highest RPN Sorted by RPN (contd)
Equipment/
Subsystem
Failure
Mode

Hydraulic
Shuttle Valve BOP Stack
Mechani
cal
Damage/
Wear
External
Leak
External
Annulars - BOP
Leak/
Stack
Rupture
Mechani
Annulars - BOP
cal
Stack
Failure
Shuttle Valve External
BOP Stack
Leak
External
Tubing and piping Leak/
- Subsea Control: Mechani
cal
Hydraulic
Failure
CCSV/DDV
Fluid End Plugged
Subsea Control:
Hydraulic
External
Tubing and
Leak/
piping - Subsea
Mechani
Control:
cal
Hydraulic
Failure
CCSV/DDV
Fluid End Plugged
Subsea Control:
Hydraulic
External
Annulars - BOP
Leak/
Stack
Rupture
Mechani
Annulars - BOP
cal
Stack
Failure
Rigid Conduit Surface Control:
Hydraulic
Mechani
cal
Failure
Severity
(S)
Occurrence
(O)
Detection
(D)
RPN
(SxOxD)
# of Effects
(Functional
Failures)
10
180
10
180
160
160
154
10
150
17
10
150
13
135
135
128
128
10
120
13
28
Equipment/
Subsystem
Failure
Mode
Severity
(S)
Occurrence
(O)
Detection
(D)
RPN
(SxOxD)
# of Effects
(Functional
Failures)
SPM Valve Single acting Subsea Control:

Hydraulic
External
Leak
10
120
17

Hydraulic
Mechani
cal
Failure/
Wear
10
120
13
Pilot operated
check Valve
(POCV) - Subsea
Control:
Hydraulic
External
Leak
10
120
Pilot operated
check Valve
(POCV) - Subsea
Control:
Hydraulic
Mechani
cal
Failure
10
120
Tubing and
piping - Subsea
Control:
Hydraulic
External
Leak/
Mechani
cal
Failure
120
10
Plugged
120
10
External
Leak
10
120
17
Mechani
cal
Failure/
Wear
10
120
13
Mechani
cal
Failure
108
CCSV/DDV
Fluid End Subsea Control:
Hydraulic
CCSV/DDV
Hydraulic
Rigid Conduit
Manifold - SPM
valves - Subsea
Control:
Hydraulic
Hydraulic
29
Failure
Mode
Severity
(S)
Occurrence
(O)
Detection
(D)
RPN
(SxOxD)
# of Effects
(Functional
Failures)
External
Leak
108
Mechani
cal
Failure/
Wear
108
External
Leak
108
108
108
108
105
Plugged
105
External
Leak
10
100
17
External
Leak
10
100
17
HKR Regulator Subsea Control:

Hydraulic
Mechani
cal
Failure/
Wear
10
100
13
MKR Regulator Subsea Control:

Hydraulic
External
Leak
10
100
17
Equipment/
Subsystem
Hydraulic
Hydraulic
CCSV/DDV Fluid
End - Subsea
Control: Hydraulic
Rigid Conduit
Manifold - SPM
valves - Subsea
Control: Hydraulic
Choke & Kill
Lines & Valves BOP Stack
Choke & Kill
Tubing and piping
- Subsea Control:
Hydraulic
CCSV/DDV Fluid
End - Subsea
Control: Hydraulic
Hydraulic
Hydraulic
Mechani
cal
Failure/
Wear
External
Leak/
Rupture
Loss of
function
(general)
External
Leak/
Mechani
cal
Failure
30
Equipment/
Subsystem
Hydraulic
Hydraulic
Rigid Conduit
Manifold - SPM
valves - Subsea
Control:
Hydraulic
Hydraulic
Hydraulic
Hydraulic
CCSV/DDV
Hydraulic
Rigid Conduit
Manifold - SPM
valves - Subsea
Control:
Hydraulic
Choke & Kill
Hydraulic
Hydraulic
Severity
(S)
Occurrence
(O)
Detection
(D)
RPN
(SxOxD)
# of Effects
(Functional
Failures)
10
100
13
10
100
External
Leak
10
100
17
Mechani
cal
Failure
96
10
External
Leak
96
10
Mechani
cal
Failure/
Wear
96
External
Leak
96
10
Mechani
cal
Failure/
Wear
96
10
External
Leak/
Rupture
96
External
Leak
90
Mechani
cal
Failure/
Wear
90
Failure
Mode
Mechani
cal
Failure/
Wear
Loss of
Function
(4th gen)
31
Equipment/
Subsystem
Failure
Mode
Severity
(S)
Occurrence
(O)
Detection
(D)
RPN
(SxOxD)
# of Effects
(Functional
Failures)

Hydraulic
External
Leak
90

Hydraulic
Mechani
cal
Failure/
Wear
90
Rigid Conduit
Manifold - SPM
valves - Subsea
Control:
Hydraulic
External
Leak
90
Table 3-3 shows the equipment failure modes with a severity ranking of 10, an occurrence ranking
greater than or equal to 3 and a detection ranking greater than or equal to 5. These are the equipment
failures that occur most frequently and could result in the highest severity and are the hardest to
detect.
Table 3-3: Failure Modes with S = 10, O 3, and D 5
Equipment/
Subsystem
Hydraulic
Hydraulic
Hydraulic
Failure
Mode
# of Effects
Severity Occurrence Detection
RPN
(Functional
(S)
(O)
(D)
(SxOxD)
Failures)
External
Leak
10
300
Internal
Leak
10
240
Mechanical
Failure/Wear
10
180
32
Based on the criticality ranking, the following equipment and their failure modes were identified as
the top 25% of the critical items contributing to the BOPs potential functional failure:
Double-acting SPM Valves Subsea Control

Shuttle Valves
Annular
Pipe Ram
Solenoid Valve Fluid End - Subsea Control
SPM Valve - Single acting - Subsea Control
Rigid Conduit - Surface Control & Rigid Conduit Manifold Valve Subsea Control
HKR & MKR Regulators, Pilot operated check Valve (POCV) - Subsea Control
The Double-acting SPM Valves were assessed as one of the top 10% of equipment whose failure
could potentially have a severe effect. This is owing to the fact that these valves are used in the
autoshear application, where failure can lead to the worst case consequences. The team assessed the
double-acting SPM valves to have mechanical damage (as a dormant failure not leading to leaks)
every five years to once in every ten years caused by damage to the piston rod, poppet, cage, seal
plate or piston housing or seal wear. Such damage can only be detected when the BOP is pulled for
inspections. However, it is to be noted that these valves are rebuilt or rotated every 18 months. The
high RPN rating is also due to the occurrence of external and internal leaks caused by seal wear and
other mechanical damage discussed above. Such leak events are assessed to occur once every two
years. A high frequency of rebuilding the valves and a high frequency of wear leading to leaks call
for a detailed look at the maintenance practices followed during the overhaul. It is also to be noted
that a comparative assessment with the failure data collected from the drilling contractor and the
OEM did not show any failures of the double-acting SPM valves discussed above. Hence, this item
will be discussed with the IPs to verify the assessment results.
The Shuttle Valve external leaks were assessed as one of the top 10% of critical equipment failures.
Shuttle valves are evaluated as a single point of failure and depending on the function, the valve
failure may lead to worst consequences. The team assessed external leaks caused by seal leaks,
fittings or O-ring leaks to occur less than twice a year to at least once every year. It is also to be noted
that these leaks will not be detected until the function is fired. A review of maintenance practices
shows that these valves are rebuilt or rotated every 18 months and checked for tightness of fittings on
every trip. A comparative assessment with the failure data collected from the drilling contractor and
the OEM did not show high failure occurrences. This could be attributed to the limited amount of
available failure data collected owing to the unavailable historical records reported during the data
collection phase. However, in the case of such uncertainties, the judgment based on the experience of
the team members from the operator, drilling contractor and OEM should be relied upon during the
assessment.
33
The inability to operate the choke and kill lines and valves when needed while closed on the drill
pipe or on an open hole by rams, or to circulate the wellbore, were assessed to be in the top 25% of
the criticality rankings. Such failures were attributed to mechanical failure of these gate valves owing
to spring failure, damage to the piston/operator cylinder, damage to the gate/seat, damage to the tail
rod, damage to the grease plate which prevents gate from moving, or failure of connections and bolts.
Such failures were assessed by the team to occur less than twice a year to at least once every year. A
review of the MIT practices showed that the gate and seat are replaced every 18 months. The valves
undergo an overhaul schedule every three years and a hydraulic chamber test every year. It is also to
be noted that multiple choke and kill valves are available, depending on the ram that is being
functioned. Hence the team lowered the failure occurrence ranking by giving credit for the
redundancy. A comparative assessment with the failure data collected from the drilling contractor
and the OEM did show occurrences of gate valve failures during surface tests, and some significant
downtime associated with their repair when such failures occurred during operation. The failure data
also showed external leaks from choke and kill lines being detected during surface tests.
The preliminary FMECA results show the annular to be in the top 25% of the critical equipment list.
The possibility of mechanical damage to the annular body was assessed as once every 2 to 5 years.
Such damages caused either by cutting/milling debris in the wellbore fluid, or wear of the sealing
element due to normal operation, or any corrosion or erosion issues specific to the well bore chemical
or sea-water environment, will only be detected during visual inspection of the elements at the end of
well. Such wear or damages, if kept unchecked, and other seal leaks (like adapter seal, piston inner &
outer seals, bonnet seal) will lead to external leak events. The annulars are overhauled every five
years. A comparative assessment with the failure data collected from the drilling contractor and the
OEM did show a couple of occurrences of annular upper element failures with significant downtime
associated with its repair.
The pipe ram was also assessed as one of the top 25% of the critical equipment, owing to the severity
of the failure of the functions associated with their operation. The failure of the poppet, damage to
the piston rod/cylinder/lock, ram housing, damage to the door lock/hinges/bolts, and worn ram
packers were assessed to have the likelihood of occurrence of once every 2 to 5 years. The review of
MIT practices showed that the ram doors are overhauled every 3 years and the body every 5 years. In
addition to that, the locks and the ram cavity are inspected every year. The door hinges are greased
between wells. Apart from weekly functional and bi-weekly pressure tests, wellbore pressure tests
are performed every month to detect leaks. However, a comparative assessment with the failure data
collected from the drilling contractor and the OEM showed that external leaks associated with the
pipe rams were found only during tests on surface.
The external leaks caused by damage to the ball/ball seat or O-ring and tubing failure of Solenoid
valve fluid end, leaks caused by failure of the seals and elements of single-acting SPM valves and
associated tubing and piping in the subsea hydraulic fluid lines, place these equipment items in the
top 15% of the criticality list. The solenoid valve fluid end and single-acting SPM valves have a
rebuild or rotation period of 18 months. The external leaks can be detected either by surface/subsea
34
flow meter indication, by ROV visual monitoring during the weekly functional tests or during
operation. A comparative assessment with the failure data collected from the drilling contractor and
the OEM showed several occurrences of external leaks in SPM valves and tubing, mostly during tests
while on surface. One occurrence of a tubing leak on one pod during operation led to a significant
downtime event.
Owing to the mechanical damage and subsequent failure, the HKR and MKR regulators, and the
Pilot operated check valves (POCVs) were assessed as one of the top 25% of critical equipment.
These equipment items are rebuilt or rotated every 18 months. The external leaks in the Rigid
Conduit (Surface Control) and Rigid Conduit Manifold Valve (Subsea Control) were also
categorized under the top 25% of critical equipment failures. A comparative assessment with the
failure data collected from the drilling contractor and the OEM did not show high failure
occurrences. This can also be attributed to the limited amount of failure data collected owing to the
unavailable historical records reported during the data collection phase. However, in the case of such
uncertainties, the judgment based on the experience of the team members from the operator, drilling
contractor and OEM should be relied upon during the assessment.
The RPN results are presented to reflect the criticality of the functions that were assessed during the
FMECA. Table 3-4 lists the top 25% of effects/functional failures with the highest average RPN for
all of the equipment failures associated with that functional failure. The complete table is provided in
Appendix C. Another way of evaluating the data is to calculate the number of occurrences of each
equipment level failure linked to a functional failure as presented in Table 3-5. The complete table is
provided in Appendix D.
However, the reader is advised that Tables 3-3 and 3-4, and the method of the average RPN score
depend on the categorization of functions, categorization of equipment and the level of detailed
analysis, and results may slightly differ for different studies. It is suggested that the reader should
review the system and equipment breakdown for this particular study before assessing tables 3-3 &
3-4.
35
Table 3-4: Functional Failures with Highest Average RPN

Effects
Failure of Pipe Ram to Seal on Demand - Failure to
seal or partial seal on drill pipe through pipe rams Close and seal on the drill pipe and allow circulation,
on demand (linked to 1.1.4.1)
Failure to Maintain Adequate Sealing Pressure on
Pipe Ram - Failure to seal or partial seal on drill pipe
through pipe rams - Close and seal on the drill pipe
and allow circulation, on demand (linked to 1.1.4.2)
Partial seal - C&K Valves leaking - Failure to seal or
partial seal on drill pipe through annular(s) - Close
and seal on the drill pipe and allow circulation, on
demand (linked to 1.1.3.3)
Partial seal - C&K Valves leaking - Failure to seal or
partial seal on drill pipe through pipe rams - Close
and seal on the drill pipe and allow circulation, on
Failure to Close Annulars on Drill String on Demand
- Failure to close annulars - Strip the drill string using
the annular BOP(s) (linked to 1.3.1.3)
Inability to Operate C&K Valves as Needed - Failure
to circulate/seal the wellbore - Circulate the well after
drill pipe disconnect (linked to 1.9.1.3)
Failure to Close Annular on Demand - Failure to
close on drill pipe through annular(s) - Close and seal
on the drill pipe and allow circulation, on demand
(linked to 1.1.1.3)
to seal wellbore after drill pipe disconnect - Circulate
the well after drill pipe disconnect (linked to 1.9.4.3)
to close on drill pipe through pipe rams - Close and
seal on the drill pipe and allow circulation, on
to close on open hole through blind shear ram - Close
and seal on open hole and allow volumetric well
control operations, on demand (linked to 1.2.1.6)
Degraded Flow Pressure / Restricted Flow Path Failure to circulate at desired flow rate - Circulate
across the BOP stack to remove trapped gas (linked
to 1.10.2.1)
36
# of
Occurrence
Cumulative
FF RPN
Average
FF RPN
400
200
400
200
192
192
192
192
320
160
450
150
448
149
432
144
416
139
416
139
400
133
Table 3-4: Functional Failures with Highest Average RPN (contd)

Effects
# of
Occurrence
Cumulative
FF RPN
Average
FF RPN

to circulate - Circulate across the BOP stack to
remove trapped gas (linked to 1.10.1.3)
to close on drill pipe through annular(s) - Close and
seal on the drill pipe and allow circulation, on
Degraded Flow Pressure / Restricted Flow Path Failure to circulate at desired flow rate - Circulate the
well after drill pipe disconnect (linked to 1.9.2.1)
Failure of Annular to Seal on Demand - Failure to
seal or partial seal on drill pipe through annular(s) Close and seal on the drill pipe and allow circulation,
on demand (linked to 1.1.3.1)
Annular ( high and low) - Failure to seal or partial
seal on drill pipe through annular(s) - Close and seal
(linked to 1.1.3.2)
Failure to Supply Hydraulic Fluid & Pressure to
Shear Ram - Failure to close - Emergency Operation Auto-Shear - Shear the drill pipe and seal the
wellbore (linked to 1.6.2.1)
External Leak - Loss of containment - Close and seal
(linked to 1.1.8.1)
External Leak - Loss of containment - Close and seal
on open hole and allow volumetric well control
operations, on demand (linked to 1.2.5.1)
External Leak - Loss of containment - Emergency
Operation - EDS - Disconnect and/or Shear the drill
pipe and seal the wellbore (linked to 1.7.6.1)
External Leak - Loss of containment - Normal
operation - Shear the drill pipe and seal the wellbore
(linked to 1.5.6.1)
Failure to Supply Hydraulic Fluid & Pressure to Pipe
Ram or C&K Valves When Demanded - Failure to
close on drill pipe through pipe rams - Close and seal
(linked to 1.1.2.2)
400
133
516
129
504
126
832
119
832
119
41
3330
85
18
1486
83
19
1526
80
17
1240
73
17
1240
73
33
2260
73
37

Effects
Shear Ram - Failure to shear the drill pipe Emergency Operation - Auto-Shear - Shear the drill
Failure to close/partial close - Failure to open / close
fail-spring assist valves - Circulate the well after drill
pipe disconnect (linked to 1.9.3.1)
Shear Ram - Failure to close - Normal operation Shear the drill pipe and seal the wellbore (linked to
1.5.1.2)
Actuates Too Slowly on Demand - Closes too slowly
- Close and seal on open hole and allow volumetric
well control operations, on demand (linked to 1.2.4.1)
- Emergency Operation - EDS - Disconnect and/or
Shear the drill pipe and seal the wellbore (linked to
1.7.5.1)
- Normal operation - Shear the drill pipe and seal the
Hang-off Ram - Failure of hang-off ram to close Hang-off the drill pipe on a ram BOP and control the
Hang-off Ram in preparation to Disconnect - Failure
of hang-off ram to close- Hang-off the drill pipe on a
ram BOP in preparation to Disconnect (linked to
1.4.4.2)
External Leak - Loss of containment - Normal
operation - Shear the drill pipe and seal the wellbore
(linked to 1.5.6.1)
Ram or C&K Valves When Demanded - Failure to
(linked to 1.1.2.2)
Shear Ram - Failure to close and/or disconnect Emergency Operation - EDS - Disconnect and/or
1.7.1.2)
38
# of
Occurrence
Cumulative
FF RPN
Average
FF RPN
33
2260
73
33
2199
71
32
2120
71
31
2020
70
31
2020
70
31
2020
70
31
2020
70
31
2020
70
17
1240
73
33
2260
73
31
2020
70

Effects
- Emergency Operation - Auto-Shear - Shear the drill
Failure of Annular to Seal on Demand - Failure to
seal /lubrication - Strip the drill string using the
annular BOP(s) (linked to 1.3.3.1)
Failure to Supply Hydraulic Fluid & Pressure to C&K
Valves - Failure to circulate/seal the wellbore Circulate the well after drill pipe disconnect (linked to
1.9.1.2)
Valves - Failure to seal wellbore after drill pipe
disconnect - Circulate the well after drill pipe
disconnect (linked to 1.9.4.2)
Failure of Shear Ram to Seal On Demand - Failure to
seal the wellbore - Emergency Operation - AutoShear - Shear the drill pipe and seal the wellbore
(linked to 1.6.4.1)
seal the wellbore - Emergency Operation - EDS Disconnect and/or Shear the drill pipe and seal the
seal the wellbore - Normal operation - Shear the drill
Failure to Close Pipe Ram on Demand - Failure to
(linked to 1.1.2.3)
Failure to Maintain Sealing Pressure on Shear Ram Failure to seal the wellbore - Emergency Operation Auto-Shear - Shear the drill pipe and seal the
Failure to Maintain Sealing Pressure on Shear Ram Failure to seal the wellbore - Emergency Operation EDS - Disconnect and/or Shear the drill pipe and seal
the wellbore (linked to 1.7.3.2)
Failure to Maintain Sealing Pressure on Shear Ram Failure to seal the wellbore - Normal operation Shear the drill pipe and seal the wellbore (linked to
1.5.3.2)
39
# of
Occurrence
Cumulative
FF RPN
Average
FF RPN
35
2210
67
34
2134
67
33
2037
66
33
2037
66
180
60
60
60
60
60
180
60
180
60
60
60
60
60

Effects
Valves - Failure to circulate - Circulate across the
BOP stack to remove trapped gas (linked to 1.10.1.2)
Annular ( high and low) - Failure to seal /lubrication Strip the drill string using the annular BOP(s) (linked
to 1.3.3.2)
Failure of Hydraulic Fluid to Disconnect - Failure to
disconnect the LMRP from BOP stack - Disconnect
the LMRP from the BOP stack (linked to 1.8.1.3)
Failure to Maintain Hydraulic Fluid & Pressure to
Annulars ( low and high pressure) - Failure to
maintain stripping pressure - Strip the drill string
using the annular BOP(s) (linked to 1.3.2.1)
Annulars - Failure to close annulars - Strip the drill
string using the annular BOP(s) (linked to 1.3.1.2)
Moves too slowly to disconnect - Failure to
disconnect the LMRP from BOP stack - Disconnect
the LMRP from the BOP stack (linked to 1.8.1.4)
Annular & C&K Valves When Demanded - Failure to
close on drill pipe through annular(s) - Close and seal
(linked to 1.1.1.2)
- Close and seal on the drill pipe and allow
circulation, on demand (linked to 1.1.7.1)
Failure to Shear Pipe - Failure to shear the drill pipe Emergency Operation - Auto-Shear - Shear the drill
Failure of Wellhead Connector to Properly Lock and
Seal - Inadequate BOP Connection - Connect BOP
and LMRP at Landing (linked to 1.11.1.1)
Failure of Blind Shear Ram to Seal on Demand Failure to close on open hole through blind shear ram
Failure to Close Blind Shear Ram on Demand Failure to close on open hole through blind shear ram
40
# of
Occurrence
Cumulative
FF RPN
Average
FF RPN
33
1824
59
29
1516
56
31
1622
56
31
1622
56
31
1622
56
31
1622
56
32
1638
55
33
1686
54
270
54
34
1718
54
100
50
100
50

Effects
Failure of LMRP Connector to Properly Lock and
Seal - Inadequate LMRP Connection - Connect BOP
and LMRP at Landing (linked to 1.11.2.1)
Failure to Shear Pipe - Failure to shear the drill pipe Emergency Operation - EDS - Disconnect and/or
1.7.2.1)
Failure to Shear Pipe - Failure to shear the drill pipe Normal operation - Shear the drill pipe and seal the
Failure of Connector Integrity - Inadequate LMRP
Connection - Connect BOP and LMRP at Landing
(linked to 1.11.2.2)
fail-spring assist valves - Circulate across the BOP
stack to remove trapped gas (linked to 1.10.3.1)
External Leak - Loss of containment - Emergency
Operation - Auto-Shear - Shear the drill pipe and seal
Failure of Connector Integrity - Inadequate BOP
Connection - Connect BOP and LMRP at Landing
(linked to 1.11.1.2)
Failure of LMRP / BOP Connector to Disengage Failure to disconnect the LMRP from BOP stack Disconnect the LMRP from the BOP stack (linked to
1.8.1.2)
Failure to Provide Control Signal to C&K Valves
when Demanded - Failure to circulate/seal the
wellbore - Circulate the well after drill pipe
Failure to Provide Control Signal to Hang-off Ram in
preparation to Disconnect - Failure of hang-off ram to
close - Hang-off the drill pipe on a ram BOP in
preparation to Disconnect (linked to 1.4.4.1)
Failure to Provide Control Signal to Hang-off Ram
When Demanded - Failure of hang-off ram to close Hang-off the drill pipe on a ram BOP and control the
Failure to Provide Control Signal to Pipe Ram or
C&K Valves When Demanded - Failure to close on
drill pipe through pipe rams - Close and seal on the
drill pipe and allow circulation, on demand (linked to
1.1.2.1)
41
# of
Occurrence
Cumulative
FF RPN
Average
FF RPN
34
1472
46
220
44
220
44
77
39
106
35
100
33
96
32
58
19
29
540
19
28
480
17
28
480
17
28
480
17

Effects
Failure to Provide Control Signal to Shear Ram When
Demanded - Failure to close - Normal operation Shear the drill pipe and seal the wellbore (linked to
1.5.1.1)
Failure to Provide Control Signal to Shear Ram when
Demanded - Failure to close and/or disconnect Emergency Operation - EDS - Disconnect and/or
1.7.1.1)
Failure to Provide Control Signal - Failure to Arm Emergency Operation - Auto-Shear - Shear the drill
Failure to Provide Control Signal to Annulars When
Demanded - Failure to close annulars - Strip the drill
when Demanded - Failure to seal wellbore after drill
pipe disconnect - Circulate the well after drill pipe
Failure to Provide Control Signal to Annular or C&K
Valves When Demanded - Failure to close on drill
pipe through annular(s) - Close and seal on the drill
pipe and allow circulation, on demand (linked to
1.1.1.1)
when Demanded - Failure to circulate - Circulate
across the BOP stack to remove trapped gas (linked to
1.10.1.1)
Failure to Provide Disconnect Signal (automatically
or manually) - Failure to disconnect the LMRP from
BOP stack - Disconnect the LMRP from the BOP
stack (linked to 1.8.1.1)
Failure to Open Pipe Ram on Demand (as part of well
control process) - Failure to close on drill pipe
through pipe rams - Close and seal on the drill pipe
and allow circulation, on demand (linked to 1.1.2.5)
Failure to Close Hang off Ram on Demand - Failure
of hang-off ram to close - Hang-off the drill pipe on a
ram BOP and control the wellbore (linked to 1.4.1.3)
42
# of
Occurrence
Cumulative
FF RPN
Average
FF RPN
28
480
17
28
480
17
29
444
15
28
414
15
29
405
14
28
386
14
28
384
14
28
384
14
40
13
12

Effects
Failure to Close Hang off Ram on Demand in
Failure to Engage Lock on Hang-off Ram - Failure to
maintain locking - Hang-off the drill pipe on a ram
BOP and control the wellbore (linked to 1.4.3.1)
Failure to Maintain Closing Pressure on Hang-off
Ram - Failure to maintain closing pressure - Hang-off
the drill pipe on a ram BOP and control the wellbore
(linked to 1.4.2.1)
# of
Occurrence
Cumulative
FF RPN
Average
FF RPN
12
Table 3-5: Functional Failures with Greatest Occurrences Due to Equipment Failures
# of
Cumulative Average
Occurrences
FF RPN
FF RPN
Effect
Failure to Supply Hydraulic Fluid & Pressure to Shear
Ram - Failure to close - Emergency Operation - AutoShear - Shear the drill pipe and seal the wellbore (linked
to 1.6.2.1)
Actuates Too Slowly on Demand - Closes too slowly Emergency Operation - Auto-Shear - Shear the drill pipe
and seal the wellbore (linked to 1.6.6.1)
Failure of Annular to Seal on Demand - Failure to seal/
lubrication - Strip the drill string using the annular
BOP(s) (linked to 1.3.3.1)
Failure of Wellhead Connector to Properly Lock and
Seal - Inadequate BOP Connection - Connect BOP and
LMRP at Landing (linked to 1.11.1.1)
Failure of LMRP Connector to Properly Lock and Seal Inadequate LMRP Connection - Connect BOP and
LMRP at Landing (linked to 1.11.2.1)
Ram or C&K Valves When Demanded - Failure to close
on drill pipe through pipe rams - Close and seal on the
drill pipe and allow circulation, on demand (linked to
1.1.2.2)
43
41
3330
85
35
2210
67
34
2134
67
34
1718
54
34
1472
46
33
2260
73
Table 3-5: Functional Failures with Greatest Occurrences Due to Equipment Failures (contd)
# of
Cumulative Average
Occurrences
FF RPN
FF RPN
Effect
Ram - Failure to shear the drill pipe - Emergency
Operation - Auto-Shear - Shear the drill pipe and seal
fail-spring assist valves - Circulate the well after drill
pipe disconnect (linked to 1.9.3.1)
Valves - Failure to circulate/seal the wellbore - Circulate
the well after drill pipe disconnect (linked to 1.9.1.2)
Valves - Failure to seal wellbore after drill pipe
disconnect - Circulate the well after drill pipe disconnect
(linked to 1.9.4.2)
Valves - Failure to circulate - Circulate across the BOP
stack to remove trapped gas (linked to 1.10.1.2)
Actuates Too Slowly on Demand - Closes too slowly Close and seal on the drill pipe and allow circulation, on
Ram - Failure to close - Normal operation - Shear the
drill pipe and seal the wellbore (linked to 1.5.1.2)
Failure to Supply Hydraulic Fluid & Pressure to Annular
& C&K Valves When Demanded - Failure to close on
drill pipe through annular(s) - Close and seal on the drill
pipe and allow circulation, on demand (linked to 1.1.1.2)
Actuates Too Slowly on Demand - Closes too slowly Close and seal on open hole and allow volumetric well
control operations, on demand (linked to 1.2.4.1)
Actuates Too Slowly on Demand - Closes too slowly Emergency Operation - EDS - Disconnect and/or Shear
the drill pipe and seal the wellbore (linked to 1.7.5.1)
Actuates Too Slowly on Demand - Closes too slowly Normal operation - Shear the drill pipe and seal the
Failure to Supply Hydraulic Fluid & Pressure to Hangoff Ram - Failure of hang-off ram to close - Hang-off
the drill pipe on a ram BOP and control the wellbore
(linked to 1.4.1.2)
44
33
2260
73
33
2199
71
33
2037
66
33
2037
66
33
1824
59
33
1686
54
32
2120
71
32
1638
55
31
2020
70
31
2020
70
31
2020
70
31
2020
70
Table 3-5: Functional Failures with Greatest Occurrences Due to Equipment Failures (contd)
# of
Cumulative Average
Effect
Occurrences
FF RPN
FF RPN
Failure to Supply Hydraulic Fluid & Pressure to Hangoff Ram in preparation to Disconnect - Failure of hang31
2020
70
off ram to close- Hang-off the drill pipe on a ram BOP
in preparation to Disconnect (linked to 1.4.4.2)
Ram - Failure to close and/or disconnect - Emergency
31
2020
70
Operation - EDS - Disconnect and/or Shear the drill pipe
Failure of Hydraulic Fluid to Disconnect - Failure to
disconnect the LMRP from BOP stack - Disconnect the
31
1622
56
LMRP from the BOP stack (linked to 1.8.1.3)
Failure to Maintain Hydraulic Fluid & Pressure to
Annulars ( low and high pressure) - Failure to maintain
31
1622
56
stripping pressure - Strip the drill string using the
annular BOP(s) (linked to 1.3.2.1)
Annulars - Failure to close annulars - Strip the drill
31
1622
56
Moves too slowly to disconnect - Failure to disconnect
the LMRP from BOP stack - Disconnect the LMRP
31
1622
56
from the BOP stack (linked to 1.8.1.4)
Annular ( high and low) - Failure to seal /lubrication 29
1516
56
Strip the drill string using the annular BOP(s) (linked to
1.3.3.2)
Failure to Provide Control Signal to C&K Valves when
Demanded - Failure to circulate/seal the wellbore 29
540
19
Circulate the well after drill pipe disconnect (linked to
1.9.1.1)
Failure to Provide Control Signal - Failure to Arm Emergency Operation - Auto-Shear - Shear the drill pipe
29
444
15
Failure to Provide Control Signal to C&K Valves when
Demanded - Failure to seal wellbore after drill pipe
29
405
14
disconnect - Circulate the well after drill pipe disconnect
(linked to 1.9.4.1)
Failure to Provide Control Signal to Hang-off Ram in
28
480
17
45
46
4.0 CONCLUSION
Solenoid Valve Fluid End - Subsea

Control
SPM Valve - Single acting - Subsea
Control
Rigid Conduit - Surface Control & Rigid
Conduit Manifold Valve Subsea Control
HKR & MKR Regulators, Pilot operated
check Valve (POCV) - Subsea Control
Figure 4-1. Equipment RPN range

47
Top 25%
Top 15%
Top 10%
The initial assessment showed that based on the criticality ranking, the following equipment and their
failure modes were identified as the top 25% of the critical items contributing to the BOPs potential
functional failure:
Double-acting SPM Valves - Subsea
Control
Shuttle Valves
Annular
Pipe Ram
Figure 4-1 shows the top equipment RPN ranking range, median (separated by purple and green
lines) and inter-quartile distribution. The top 10% of equipment by RPN, as discussed, are Doubleacting SPM Valves, Shuttle Valves, Choke & Kill Lines and Valves, Annular and Pipe Ram.
Figure 4-2 shows the top failure modes and their RPN range. The top failure modes were external
and internal leaks, mechanical damage & failure and plugging.
Figure 4-2. Equipment Failure Modes RPN range

The MIT data and the failure data provided by the drilling contractor and the OEM were reviewed
against the FMECA results. The findings are presented in Section 3 of this report.
This preliminary FMECA analysis and assessment report is submitted for review by the IPs. The
final report may bear the modifications suggested during the review process.
48
5.0
REFERENCES
API 53 Standard
Drillers Well Control Manual
OEM Equipment Drawings, P&IDs, PFDs
Driller/OEM Equipment Operation and Maintenance Manuals
Drillers Failure data
Driller MIT data
OEM Failure data
49
50

Blow Out Preventer BOP FMECA

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Blow Out Preventer BOP FMECA

Загружено:

Авторское право:

Доступные форматы

BLOWOUT PREVENTER (BOP)

FAILURE MODE EFFECT CRITICALITY ANALYSIS (FMECA)-3

THIS PAGE INTENTIONALLY LEFT BLANK

Solenoid Valve Fluid End - Subsea

Double-acting SPM (Subsea PlateMounted) Valves - Subsea Control

FMECA Team Members and Workshop Schedule ................................................................ 4

ANALYSIS METHODOLOGY .............................................................................................. 7

Functional Level (Top-Down) FMECA .......................................................................... 9

Equipment Level (Bottom-Up) FMECA ........................................................................ 12

Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking) ...... 14

FMECA RESULTS & ASSESSMENT ................................................................................ 19

Appendix A Functional-Level FMECA Worksheets ................................................................. A-1

THIS PAGE INTENTIONALLY LEFT BLANK

THIS PAGE INTENTIONALLY LEFT BLANK

American Bureau of Shipping

THIS PAGE INTENTIONALLY LEFT BLANK

The objectives of the FMECA analysis were to:

Figure 1-1. Class VI BOP Configuration Used in

Figure 1-2. Class VIII BOP Configuration Used in

Disconnect the lower marine-riser package (LMRP) from BOP stack

3.2. Solenoid Valve

FMECA TEAM MEMBERS AND WORKSHOP SCHEDULE

Table 1-2: IP FMECA Team Members

2.0 ANALYSIS METHODOLOGY

Figure 2-1. General FMECA Approach

Functional Level (Top-Down) FMECA

Emergency Operation (e.g., disconnect)

Riding the Storm

Inability to control well or maintain well integrity

Potential release of hydrocarbon to the atmosphere resulting in potential fire, Explosion,

Inability to control well or maintain well integrity

Potential release of hydrocarbons to the environment resulting in a minor, significant,

Failures requiring pulling of the LMRP or BOP Stack

Downtime exceeding 5 days

Figure 2-2. Functional-Level FMECA Procedure

Table 2-1: Functions and Functional Failures (contd)

Table 2-1: Functions and Functional Failures (contd)

Equipment Level (Bottom-Up) FMECA

Loss of or degraded power

Fails with no output signal/no

Fails with low or high output signal

Mechanical failure (e.g., fracture, galling, fatigue)

Fails to respond to input

Loss of function (general)

Loss of function (general)

Figure 2-3. Equipment-Level FMECA Procedures

Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking)

Frequency of Failure of the Equipment Failure Mode

Table 2-3: Severity Ratings

No downtime, repair can

Downtime of less than a

Table 2-3: Severity Ratings (contd)

Table 2-4: Occurrence Ratings

Table 2-5: Detection Ratings

Very high probability of detection (>90% probability of

THIS PAGE INTENTIONALLY LEFT BLANK

3.0 FMECA RESULTS & ASSESSMENT

Table 3-1: Functional Failure Ranking (contd)

Failure to seal or partial seal on drill pipe

Unintentional closing / opening - Annulars

Unintentional closing / opening -Pipe Rams

Closes too slowly - Annular

Closes too slowly - Pipe Ram

Table 3-1: Functional Failure Ranking (contd)