blow out preventer bop fmeca

BLOWOUT PREVENTER (BOP) FAILURE MODE EFFECT CRITICALITY ANALYSIS (FMECA)-3

FOR THE BUREAU OF SAFETY AND ENVIRONMENTAL ENFORCEMENT

2650788-DFMECA-3-D2 4 Final Report 6/28/2013 2650788-DFMECA-3-D2 3 Issued to BSEE as Draft 3/25/2013

2650788-DFMECA-3-D2 2 Issued to industry participants (IPs) as Draft for comments 3/7/2013

2650788-DFMECA-3-D2 1 Issued as Draft for internal review and comments 2/20/2013

Report No. Revision Purpose of Revision Date

June 2013

This work was performed by American Bureau of Shipping and ABSG Consulting Inc. for the Bureau of Safety and Environmental Enforcement (BSEE) under the terms of BSEE contract number M11PC00027.

ii

THIS PAGE INTENTIONALLY LEFT BLANK

iii

LIST OF CONTRIBUTORS: ABS Consulting

Randal Montgomery Darshan Lakhani

ABS

Harish Patel David Cherbonnier Bibek Das

iv

SUMMARY

As part of the Blowout Preventer (BOP) Maintenance and Inspection for Deepwater Operations study (Bureau of Safety and Environmental Enforcement [BSEE] contract number M11PC00027), American Bureau of Shipping (ABS) and ABSG Consulting Inc. (ABS Consulting) performed a Failure Mode, Effect, and Criticality Analysis (FMECA) on specific BOP subsystems and equipment. There were three FMECAs performed with three different teams of operator, drilling contractor and original equipment manufacturer. This is the draft report of the FMECA conducted with team-3 and represents the study deliverable associated with Task 6.2.2.1 as outlined in the contract. This report presents the objective and scope of the FMECA study, FMECA methodology, FMECA worksheets and discusses major findings of the two workshops (Functional-level and Equipment-level) that were conducted on a Class VIII BOP (6R,2A) and a Class VI BOP (4R,2A) configuration. Summary of Objective and Scope The objectives of the FMECA analysis were to:

(1) identify the causes and effects of loss of BOP system functionality, (2) identify the causes and effects of individual equipment failures, (3) establish the relationship between a specific equipment failure and a loss of system

functionality, (4) identify the current protection and monitoring/indication methods associated with the system

and equipment failures, (5) identify and align the current maintenance, inspection, and test (MIT) practices and their

associated frequencies with each functional failure and the associated equipment failures, and (6) identify the critical failures by using criticality- or risk-ranking methods.

The BOP system, sub-systems and components within the scope of this study are presented in Appendix E of this report. Summary of FMECA Approach The FMECA was conducted in two phases, first a functional-level and then an equipment-level FMECA. The functional-level (top-down) FMECA was conducted to identify the failures that could degrade the BOP system functions. The equipment-level (bottom-up) FMECA was conducted to identify the impact of major equipment and component failures on the BOP system performance by evaluating equipment-level failure modes, identifying specific equipment-level causes, identifying the safeguards to prevent or detect the failure modes, and ranking the failure modes risks. In addition, the equipment-level FMECA was used to identify MIT activities associated with equipment-level failure modes and specific equipment failures.

v

The team identified the eight BOP functions in American Petroleum Institute (API) 53 Standard, Section 7.1.3. During the workshop a few more functions were either added or broken down into additional functions based on different operating conditions/logic. In total 13 BOP functions/systems and their 56 associated functional failures were studied in the functional-level FMECA. Appendix A presents the Functional-FMECA Worksheets. For the equipment-level FMECA, the team identified and evaluated 3 major BOP subsystems (surface control, subsea control and stack) and 50 major associated equipment categories. The list of equipment is presented in the report. The definition of the sub-systems and equipment are presented in Appendix E. In order to establish the criticality of each equipment-level failure mode, the team used a Risk Priority Number (RPN) scoring methodology based on severity, occurrence, and detection. The definition of severity, occurrence and detection are presented in the report. Appendix B presents the equipment-level FMECA Worksheets. Summary of Assessment Based on the criticality ranking, the following equipment and their failure modes were identified as the top 25% of the critical items contributing to the BOPs potential functional failure:

Double-acting SPM (Subsea Plate-Mounted) Valves - Subsea Control

Shuttle Valves Choke & Kill Lines and Valves Annular Pipe Ram

Solenoid Valve Fluid End - Subsea

Control Tubing and piping - Subsea Control SPM Valve - Single acting - Subsea

Control

Rigid Conduit - Surface Control & Rigid Conduit Manifold Valve Subsea Control

Remote hydraulic regulator (HKR) & manual hydraulic regulators (MKR), Pilot operated check Valve (POCV) - Subsea Control

Top

10%

Top

15%

Top

25%

vi

The Double-acting SPM Valves were assessed as one of the top 10% of equipment whose failure could potentially have a severe effect. This is owing to the fact that these valves are used in the autoshear, where failure can lead to worst case consequences. The team assessed the double-acting SPM valves to have mechanical damage (as a dormant failure not leading to leaks) every five years to once in every ten years caused by damage to the piston rod, poppet, cage, seal plate or piston housing or seal wear. Due to the nature of the Autoshear Hydraulic Circuit, such damage can only be detected when the BOP is pulled for inspections. However, it is to be noted that these valves are rebuilt or rotated every 18 months. The high RPN rating is also due to the occurrence of external and internal leaks caused by seal wear and other mechanical damage discussed above. Such leak events are assessed to occur once every two years. A high frequency of rebuilding the valves and a high frequency of wear leading to leaks call for a detailed look at the maintenance practices followed during the overhaul. It is also to be noted that a comparative assessment with the failure data collected from the drilling contractor and the original equipment manufacturer (OEM) did not show any failures of the double-acting SPM valves discussed above. Hence, this item will be discussed with the IPs to verify the assessment results. The Shuttle Valve external leaks were assessed as one of the top 10% of critical equipment failures. Shuttle valves are evaluated as a single point of failure and depending on the function, the valve failure may lead to worst case consequences. The team assessed external leaks caused by seal leaks, fittings or O-ring leaks to occur less than twice a year to at least once every year. It is also to be noted that these leaks will not be detected until the function is fired. A review of maintenance practices shows that these valves are rebuilt or rotated every 18 months and checked for tightness of fittings on every trip. A comparative assessment with the failure data collected from the drilling contractor and the OEM did not show high failure occurrences. This could be attributed to the limited amount of available failure data collected owing to the unavailable historical records reported during the data collection phase. However, in the case of such uncertainties, the judgment based on the experience of the team members from the operator, drilling contractor and OEM should be relied upon during the assessment. The inability to operate the Choke and Kill lines and valves when needed while closed on the drill pipe or on an open hole by rams, or to circulate the wellbore, were assessed to be in the top 25% of the criticality rankings. Such failures were attributed to mechanical failure of these gate valves owing to spring failure, damage to the piston/operator cylinder, damage to the gate/seat, damage to the tail rod, damage to the grease plate which prevents the gate from moving, or failure of connections and bolts possibly due to over-torqueing during a recheck of the bolt torque. Such failures were assessed by the team to occur less than twice a year to at least once every year. A review of the MIT practices showed that the gate and seat are replaced every 18 months. The valves undergo an overhaul schedule every three years and a hydraulic chamber test every year. It is to be noted that these valves are cycled or function tested every shift (12 hours), which makes the failure detectability fairly high. It is also to be noted that multiple choke and kill valves are available, depending on the ram that is being functioned. Hence the team lowered the failure occurrence ranking by giving credit for the redundancy. A comparative assessment with the failure data collected from the drilling contractor

vii

and the OEM did show occurrences of gate valve failures during surface tests, and some significant downtime associated with its repair when such failures occurred during operation. The failure data also showed external leaks from choke and kill lines being detected during surface tests. The preliminary FMECA results show the Annular to be in the top 25% of the critical equipment list. The possibility of mechanical damage to the annular body was assessed as once every 2 to 5 years. Such damages caused either by cutting/milling debris in the wellbore fluid, or wear of the sealing element due to normal operation, or any corrosion or erosion issues specific to the well bore chemical or sea-water environment, will only be detected during visual inspection of the body and elements at the end of well. Such wear or damages, if kept unchecked, and other seal leaks (like adapter seal, piston inner & outer seals, bonnet seal) will lead to external leak events. The annulars are overhauled every five years. A comparative assessment with the failure data collected from the drilling contractor and the OEM did show a couple of occurrences of annular upper element failures with significant downtime associated with its repair. The Pipe Ram was also assessed as one of the top 25% of the critical equipment, owing to the severity of the failure of the functions associated with their operation. The failure of the poppet, damage to the piston rod/cylinder/lock, ram housing, damage to the door lock/hinges/bolts, and worn ram packers were assessed to have the likelihood of occurrence of once every 2 to 5 years. The review of MIT practices showed that the ram doors are overhauled every 3 years and the body every 5 years. Additionally the ram doors are opened and an internal inspection is performed with changing the rubber elements on every trip. In addition to that, the locks and the ram cavity are inspected every year. The door hinges are greased between wells. Apart from weekly functional and bi-weekly pressure tests, wellbore pressure tests are performed every month to detect leaks. However, a comparative assessment with the failure data collected from the drilling contractor and the OEM showed that external leaks associated with the pipe rams were found only during tests on surface. The external leaks caused by damage to the ball/ball seat or O-ring and tubing failure of the Solenoid valve fluid end, leaks caused by failure of the seals and elements of single-acting SPM valves and associated tubing and piping in the subsea hydraulic fluid lines, and plugging due to external debris and Teflon tape, place these equipment items in the top 15% of the criticality list. The solenoid valve fluid end and single-acting SPM valves have a rebuild or rotation period of 18 months. The external leaks can be detected either by surface/subsea flow meter indication or by remotely operated vehicle (ROV) visual monitoring during the weekly functional tests or during operation. A comparative assessment with the failure data collected from the drilling contractor and the OEM showed several occurrences of external leaks in SPM valves and tubing, mostly during tests on surface. One occurrence of a tubing leak on one pod during operation led to a significant downtime event. Owing to the mechanical damage and subsequent failure, the HKR and MKR regulators, and the Pilot operated check valves (POCVs) were assessed as one of the top 25% of critical equipment. These equipment items are rebuilt or rotated every 18 months, and tested on the surface before deployment. The external leaks in the Rigid Conduit (Surface Control) and Rigid Conduit

viii

Manifold Valve (Subsea Control) were also categorized under the top 25% of critical equipment failures. A comparative assessment with the failure data collected from the drilling contractor and the OEM did not show high failure occurrences. This can also be attributed to the limited amount of failure data collected owing to the unavailable historical records reported during the data collection phase. However, in the case of such uncertainties, the judgment based on the experience of the team members from the operator, drilling contractor and OEM should be relied upon during the assessment. The RPN results are presented to reflect the criticality of the functions that were assessed during the FMECA. Table 3-3 lists the top 25% of effects/functional failures with the highest average RPN for all of the equipment failures associated with that functional failure. Another way is to calculate the number of occurrences of each equipment level failure linked to a functional failure as presented in Table 3-4. However, the reader is advised that tables 3-3 and 3-4, and the method of the average RPN score depend on the categorization of functions, categorization of equipment and the level of detailed analysis, and results may slightly differ for different studies. It is suggested that the reader should review the system and equipment breakdown for this particular study before assessing Tables 3-3 & 3-4. The FMECA will also support the RAM modeling as appropriate. Specifically, the FMECA may be used to provide operational and maintenance information, as well as, identification of dominant BOP failures and protections. This preliminary FMECA analysis and assessment report is submitted for review by the IPs. The final report may bear the modifications suggested during the review process.

ix

TABLE OF CONTENTS Section Page

SUMMARY ......................................................................................................................................... ivLIST OF TABLES .............................................................................................................................. xiLIST OF FIGURES ............................................................................................................................ xiLIST OF ACRONYMS ....................................................................................................................xiii1.0 INTRODUCTION .................................................................................................................... 1

1.1 Objectives ............................................................................................................................... 11.2 Analysis Scope........................................................................................................................ 11.3 FMECA Team Members and Workshop Schedule ................................................................ 41.4 Report Organization ................................................................................................................ 5

2.0 ANALYSIS METHODOLOGY .............................................................................................. 72.1 Analysis Approach .................................................................................................................. 7

2.2.1 Functional Level (Top-Down) FMECA .......................................................................... 92.2.2 Equipment Level (Bottom-Up) FMECA ........................................................................ 122.2.3 Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking) ...... 14

3.0 FMECA RESULTS & ASSESSMENT ................................................................................ 194.0 CONCLUSION ....................................................................................................................... 475.0 REFERENCES ....................................................................................................................... 49Appendix A Functional-Level FMECA Worksheets ................................................................. A-1

Appendix B Equipment-Level FMECA Worksheets ................................................................. B-1

Appendix C Equipment Criticality Sorted by RPN ................................................................... C-1

Appendix D Functional Failure Sorted by Average RPN ......................................................... D-1

Appendix E BOP Sub-System and Equipment Definitions ....... E-1

x


xi

LIST OF TABLES

Table Description Page 1-2 IP FMECA Team Members ....................................................................................................... 5 1-3 ABS and ABS Consulting FMECA Team Members ................................................................ 5 2-1 Functions and Functional Failures ........................................................................................... 10 2-2 General Equipment Failure Modes ......................................................................................... 12 2-3 Severity Ratings....................................................................................................................... 15 2-4 Occurrence Ratings ........................................................................................................................ 16 2-5 Detection Ratings .................................................................................................................... 17 3-1 Functional Failure Ranking ..................................................................................................... 19 3-2 Failure Modes with Highest RPN Sorted by RPN ............................................................... 27 3-3 Failure Modes with S = 10, O 3, and D 5 ......................................................................... 32 3-4 Functional Failures with Highest Average RPN ..................................................................... 36 3-5 Functional Failures with Greatest Occurrences Due to Equipment Failures ........................... 43

LIST OF FIGURES

Figure Description Page 2-1 General FMECA Approach ....................................................................................................... 8 2-2 Functional-Level FMECA Procedure ...................................................................................... 10 2-3 Equipment-Level FMECA Procedures .................................................................................... 13

xii


xiii

LIST OF ACRONYMS

ABS American Bureau of Shipping ABS Consulting ABSG Consulting Inc. API American Petroleum Institute BOP Blowout Preventer BSEE Bureau of Safety and Environmental Enforcement C&K Choke and Kill CCSV Compensated Chamber Solenoid Valve DDV Direct Drive Valve (solenoid valve) EDS Emergency Disconnect System ERA Electronic Riser Angle FMECA Failure Mode, Effect, and Criticality Analysis HKR Remote Hydraulic Regulator HPU Hydraulic Power Unit IP Industry Participant LMRP Lower Marine-Riser Package MIT Maintenance, Inspection, and Test MKR Manual Hydraulic Regulator MUX Multiplex OEM Original Equipment Manufacturer ROV Remote Operated Vehicle RPN Risk Priority Number SEM Subsea Electronic Module SPM Subsea Plate-Mounted (valve) UPS Uninterrupted Power Source

xiv


1

1.0 INTRODUCTION

As part of the Blowout Preventer (BOP) Maintenance and Inspection for Deepwater Operations study (Bureau of Safety and Environmental Enforcement [BSEE] contract number M11PC00027), American Bureau of Shipping (ABS) and ABSG Consulting Inc. (ABS Consulting) performed Failure Mode, Effect, and Criticality Analysis (FMECA) on specific BOP subsystems and equipment. There were three FMECAs performed with three different teams of operator, drilling contractor and original equipment manufacturer. This is the draft report of the FMECA conducted with team-3 and represents the study deliverable associated with Task 6.2.2.1 as outlined in the contract. This report presents the objective and scope of the FMECA study, FMECA methodology, FMECA worksheets and discusses major findings of the two workshops (Functional-level and Equipment-level) that were conducted on Class VIII BOP (6R, 2A) and Class VI BOP (4R, 2A) configurations.

1.1 OBJECTIVES

The objectives of the FMECA analysis were to: (1) dentify the causes and effects of loss of BOP system functionality, (2) identify the causes and effects of individual equipment failure, (3) establish the relationship between a specific equipment failure and a loss of system

functionality, (4) identify the current protection and monitoring/indication methods associated with the system

and equipment failures, (5) identify and align the current maintenance, inspection, and test (MIT) practices and their

associated frequencies with each functional failure and the associated equipment failures, and

(6) identify the critical failures by using criticality- or risk-ranking methods.

1.2 ANALYSIS SCOPE

The scope of this effort was the analysis of a selected BOP and associated equipment that meets the following criteria:

Operation Location Gulf of Mexico (majority of the operation and maintenance to be from the Gulf of Mexico)

Operating Depth 5,000 Feet and Deeper BOP Configurations:

o Class VI BOP, five ram configuration and single annular or a four ram and dual annular o Class VII BOP, five ram configuration and dual annular or a six ram and single annular o Class VIII BOP, six ram configuration and dual annular (ram configurations can consist

of a combination of blind/shear ram, non-sealing casing ram and pipe ram preventers)

2

Since the drilling contractor and the operator were operating rigs in Gulf of Mexico using both Class VIII BOP (6R, 2A) and Class VI BOP (4R, 2A) configurations from the same original equipment manufacturer (OEM), ABS decided to include both configurations in the analysis. As pointed out by the OEM, apart from the obvious difference in the stack configuration, the BOP multiplex control system for the rig BOPs had a few differences including the type of solenoid valve and the voting logic/redundancy of programmed logic controllers. The analysis included the compilation of information from the industry participatns (IPs), followed by the review and analysis of the selected BOPs and associated control systems used by the drilling contractor.

Figure 1-1. Class VI BOP Configuration Used in

Study Figure 1-2. Class VIII BOP Configuration Used in

Study

The team identified eight BOP functions in American Petroleum Institute (API) 53 Standard, Section 7.1.3. During the workshop a few more functions were either added or broken down into additional functions based on different operating conditions/logic. For example, the FMECA team determined that the shear the drill pipe and seal the wellbore function needed to be broken down into three functions based on different operating condition/logic. In total 13 BOP functions/system and their 56 associated functional failures were studied in the functional-level FMECA. The following 13 BOP functions/system were studied in the functional-level FMECA:

1. Close and seal on the drill pipe and allow circulation on demand 2. Close and seal on open hole and allow volumetric well control operations on demand 3. Strip the drill string using the annular BOP(s) 4. Hang-off the drill pipe on a ram BOP and control the wellbore 5. Controlled operation Shear the drill pipe and seal the wellbore 6. Emergency Operation Auto-Shear Shear the drill pipe and seal the wellbore 7. Emergency Operation Emergency Disconnect System (EDS) Shear the drill pipe and seal

the wellbore

3

8. Disconnect the lower marine-riser package (LMRP) from BOP stack 9. Circulate the well after drill pipe disconnect 10. Circulate across the BOP stack to remove trapped gas 11. Connect BOP and LMRP at landing (not included API 53) 12. Secondary Acoustic (not included API 53) 13. Secondary remotely operated vehicle (ROV) (not included API 53)

Note: Item 12 and 13 are not functional failures, but they were evaluated during the functional-level FMECA as the team considered these systems as a vital contributor for safe operation of the BOP stack and drilling rig. Since these were considered as standalone systems and not analyzed in the equipment-level FMECA, there are no links between these items and the equipment-level FMECA. For the equipment-level FMECA, the team identified and evaluated 3 major BOP subsystems (surface control, subsea control and BOP stack (LMRP & lower stack)) and 50 major associated equipment categories. The list of equipment is presented below (the numbering system followed in the FMECA Worksheets has been retained). Subsystem 1: Surface Control System

1. Surface Control: Power & multiplex (MUX) Electrical 1.1. Power Uninterrupted Power Source (UPS) 1.2. CCU 1.3. Driller Control Panel/RMP/SEP 1.4. MUX Reel 1.5. Slip Ring 1.6. MUX Communication Fiber Optic Ring 1.7. Hydraulic Power Unit (HPU) Panel 1.8. MUX Cable/Connector

2. Surface Control: Hydraulic 2.1. Glycol and Soluble Oil Tank 2.2. Filter & Glycol and Soluble Oil Pump 2.3. MRU and Level Switches 2.4. Mixing Pump 2.5. HPU Pump & Suction Strainer 2.6. High Pressure Discharge Filter 2.7. Rigid Conduit 2.8. Hotline 2.9. Surface Accumulators

Subsystem 2: Subsea Control System

3. Subsea Control: MUX Electrical 3.1. Subsea Electronic Module (SEM)

4

3.2. Solenoid Valve 3.3. Well bore P/T Probe 3.4. Electronic Riser Angle (ERA) 3.5. LMRP P/T Probe

4. Subsea Control: Hydraulic 4.1. Subsea Plate-Mounted (SPM) Manifold 4.2. Compensated Chamber and Depth Compensated Bladder 4.3. HKR Regulator 4.4. SPM Valve Single Acting 4.5. SPM Valve Double Acting 4.6. Pilot Operated Check Valve (POCV) 4.7. Tubing and Piping 4.8. Compensated Chamber Solenoid Valve (CCSV)/Direct Drive Valve (DDV) (solenoid

valve) Fluid End 4.9. Manual Hydraulic Regulator (MKR) 4.10. Subsea Accumulator (POD) 4.11. Subsea Accumulator (LMRP) 4.12. Pilot Manifold and Pilot Filter 4.13. Inlet/Supply Manifold and Supply Filter 4.14. Rigid Conduit Manifold 4.15. Gripper Assembly

Subsystem 3: Stack

5. BOP Stack 5.1. Annular 5.2. Blind Shear Ram 5.3. Pipe Ram 5.4. Casing Shear Ram 5.5. Choke & Kill Lines & Valves 5.6. Choke & Kill Hose 5.7. LMRP Connectors 5.8. Well Head Connectors 5.9. Spools (not applicable for the stacks studied) 5.10. Shuttle Valve 5.11. Clamps for Choke & Kill Hot Connection 5.12. Function hose 5.13. Accumulator DCB/Autoshear

For the major equipment boundaries included in the study, refer to the definitions presented in Appendix E of this report. The referenced manuals and drawings are presented in Section 5 of this report.

1.3 FMECA TEAM MEMBERS AND WORKSHOP SCHEDULE

The FMECA workshop team members included personnel from three IPs, ABS, and ABS Consulting. The IPs participating included one or more representatives from an OEM, a drilling contractor, and an operator. These individuals provided knowledge of the design, engineering,

5

operation, and maintenance of the BOP being evaluated. Table 1-2 lists the functional positions for the IP personnel who participated in this study.

Table 1-2: IP FMECA Team Members

IP Organization Position/Expertise BOP OEM Engineering Director

Project Manager Manager Pressure Control Electrical Supervisor Pressure Control Engineering Consultant Pressure Control

Drilling Contractor Manager Subsea systems Operator Well Delivery Manager

Drilling Supervisor

ABS personnel provided knowledge of the overall BOP operations and class society and regulatory requirements applicable to BOP design and operation. Table 1-3 lists the ABS and ABS Consulting personnel who participated in this study. Table 1-3: ABS and ABS Consulting FMECA Team Members

Name Organization Title Study Role Bibek Das ABS Senior Engineer II (Risk &

Reliability), Corporate Technology

Workshop Chair

Darshan Lakhani ABS Consulting Lead Engineer Study Scribe Harish Patel ABS Manager, Corporate

Technology - Drilling and Process

Project Manager

To prepare for the FMECA studies, ABS and ABS Consulting held a FMECA kickoff meeting with the IPs on August 14 and 15, 2012. The purpose of the kickoff meeting was to discuss the FMECA approach and the analysis scope for all participants to have the same level of understanding of the FMECA procedures. The functional-level FMECA workshop was conducted during full-day sessions held on September 18 through 20, 2012. The equipment-level FMECA workshop was conducted during full-day sessions held on October 1 through 5, 2012.

1.4 REPORT ORGANIZATION

Section 1 of this report has provided the objectives, scope, FMECA team composition and workshop schedules. Section 2 of this report provides an overview of the methodology used to analyze the BOPs selected functions and equipment to determine the critical failure modes and their effects. Section 3 discusses the results of the effort. Section 4 provides the concluding remarks. Section 5 presents the referenced documents and drawings used during the FMECA study. Appendices A & B

6

present the functional-level FMECA and the equipment-level FMECA worksheets respectively. Appendices C & D present criticality rankings for equipment and functional failures respectively. Appendix E presents the BOP sub-system and equipment definitions.

7

2.0 ANALYSIS METHODOLOGY

In order to evaluate BOP MIT practices, reduce the risk of failures and improve the reliability of BOP performance, it is essential to identify the BOPs critical failure modes and their effects. Therefore, ABS and ABS Consulting selected and employed both functional- and equipment-level FMECA methodologies to evaluate BOP functions and identify specific subsystem and equipment failures of interest as outlined in Section 1.2, Analysis Scope. This analysis methodology was chosen because it provided a means to establish a relationship among (1) BOP system functions, (2) BOP system equipment failures, and (3) BOP system MIT practices by:

Identifying the potential effects resulting from deviations to BOP system functions (i.e., functional failures) and equipment-level failure modes causing the BOP system functional failures

Identifying the potential functional failures resulting from BOP system equipment failure modes and specific equipment failures causing the BOP system equipment failure modes

Linking specific equipment failures to BOP system functional failures Identifying the safeguards (i.e., inspection, tests, protection/redundancy and maintenance)

currently provided for preventing specific equipment failures resulting in BOP system functional failures and the associated potential end effects

Identifying and aligning MIT activities associated with specific equipment-level and failure mode

Risk-ranking the equipment-level failure modes. 2.1 ANALYSIS APPROACH

A FMECA is an inductive reasoning approach that (1) considers how the functional failures of each system function or the failure modes of each component could result in system performance problems and (2) helps evaluate safeguards that are in place (including engineered protections & monitoring systems, human actions, and maintenance activities) to prevent, detect or mitigate such problems. The main focus of a FMECA is to establish the cause-and-effect relationship between potential equipment failures, functional failures, and the end effect of those failures, and to evaluate the criticality of the postulated functional failure/failure mode. Figure 2-1 represents the general FMECA methodology used in evaluating the BOP system. Specifically, this study employed both functional- and equipment-level FMECA approaches (see Step 3) with the explicit purpose of transitioning the functional-level FMECA to a more detailed level to better ensure the alignment of MIT activities with specific equipment failures and link the specific equipment failures with their potential impact of BOP performance via functional failures. This FMECA approach is very similar to the approach employed in many classical reliability-centered maintenance approaches, which have the overall objective of determining the optimal maintenance strategy for preserving system functionality via detection and prevention of equipment failures.

8

Figure 2-1. General FMECA Approach

9

2.2 ANALYSIS PROCEDURES

This section summarizes the procedures and specific tools used in performing the functional- and equipment-level FMEAs. In addition, the risk priority number approach that was used to risk rank the functional failure effects & equipment failure mode pairs is provided. More explanation on the ranking method is given in section 2.2.3. In preparation for the FMECA, ABS engineers identified potential functional failures and equipment-level failure modes to help guide the analysis team. Functional- and equipment-level FMECA sessions were held with BOP subject matter experts from the OEM, drilling contractor, and operator. ABS facilitated and documented the analysis using ABS Consultings Enterprise LEADER software tool.

2.2.1 Functional Level (Top-Down) FMECA

The functional-level FMECA was performed by analyzing each function and its associated functional failures. The functional-level FMECA process is illustrated in Figure 2-2. In executing this procedure, the following operating modes were applied:

Normal Drilling Kick Control Emergency Operation (e.g., disconnect) Riding the Storm

In addition, the following are consequences of interest for identifying end effects of interest during the functional-level FMECA:

Safety Effects Inability to control well or maintain well integrity Potential release of hydrocarbon to the atmosphere resulting in potential fire, Explosion,

and/or exposure to toxic materials causing injury or worse Environmental Effects

Inability to control well or maintain well integrity Potential release of hydrocarbons to the environment resulting in a minor, significant,

(10,000 bbl.) spill/atmospheric release Significant Downtime

Failures requiring pulling of the LMRP or BOP Stack Downtime exceeding 5 days

In evaluating potential end effects, the team evaluated the severities based on worst-case end effects assuming that available safeguards do not prevent or mitigate the end effects. Therefore, the end effects represent the potential severity and conservatively overstate the expected consequences.

10

Figure 2-2. Functional-Level FMECA Procedure

During the functional-level FMECA, the analysis team evaluated these 13 BOP functions/systems and their 56 associated functional failures. Each function and its associated functional failures were evaluated in detail by identifying (1) the potential end effects resulting from the functional failure, (2) equipment-level causes and failure modes potentially resulting in the functional failure, and (3) safeguards used to prevent or detect the potential functional failure and its associated equipment-level causes. The equipment-level causes and failure modes were then studied in detail during the equipment-level FMECA workshop. Secondary systems (functions 12 & 13 below) were evaluated in a similar manner but were not assessed in the equipment-level FMECA. Appendix A presents the Functional-FMECA Worksheets. Table 2-1: Functions and Functional Failures

No. Function Functional Failure Modes 1 Close and seal on the drill

pipe and allow circulation on demand

Failure to close on drill pipe through annular(s) Failure to close on drill pipe through pipe rams Failure to seal or partial seal on drill pipe through annular(s) Failure to seal or partial seal on drill pipe through pipe rams Unintentional closing / opening Failure to open/close fail-safe valves to seal Close too slowly Loss of containment

11

Table 2-1: Functions and Functional Failures (contd) No. Function Functional Failure Modes 2 Close and seal on open hole

and allow volumetric well control operations on demand

Failure to close on open hole through blind-shear rams Unintentional closing / opening Failure to open/close fail-safe valves Close too slowly Loss of containment

3 Strip the drill string using the annular BOP(s)

Failure to close annular Failure to maintain stripping pressure Failure to seal

4 Hang-off the drill pipe on a ram BOP and control the wellbore

Failure of hang-off ram to close Failure to maintain closing pressure Failure to maintain locking

5 Controlled Operation-Shear the drill pipe and seal the wellbore

Failure to close Failure to shear the drill pipe Failure to seal the wellbore Unintentional closing / opening Close too slowly Loss of containment

6 Emergency Operation-Auto shear- Shear the drill pipe and seal the wellbore

Failure to arm Failure to close Failure to shear the drill pipe Failure to seal the wellbore Unintentional closing / opening Close too slowly Loss of containment

7 Emergency Operation-EDS- Shear the drill pipe and seal the wellbore

Failure to close Failure to shear the drill pipe Failure to seal the wellbore Unintentional closing / opening Close too slowly Loss of containment Failure to disconnect the LMRP

8 Disconnect LMRP/BOP Failure to disconnect the LMRP/BOP Unintentional disconnect of the LMRP/BOP

9 Circulate the well after drill pipe disconnect

Failure to circulate Failure to circulate at desired flow rate Failure to open/close fail-safe valves Failure to seal wellbore after drill pipe disconnect Loss of containment

10 Circulate across the BOP stack to remove trapped gas

Failure to circulate Failure to circulate at desired flow rate Failure to open/close fail-safe valves Loss of containment

12

Table 2-1: Functions and Functional Failures (contd) No. Function Functional Failure Modes 11 Connect BOP and LMRP at

landing Inadequate BOP connection Inadequate LMRP connection

12 Secondary Acoustic Failure to disarm Failure to arm

13 Secondary ROV Failure to perform ROV intervention

2.2.2 Equipment Level (Bottom-Up) FMECA

The equipment-level FMECA was performed by analyzing each major piece of equipment with its associated components using equipment-level failure modes. The major equipment items were identified in the functional-level FMECA as critical equipment whose failure contributed to the failure of the function. Figure 2-3 outlines the equipment-level FMECA process. To evaluate each equipment item, a list of the general failure modes was developed during the FMECA kick-off meeting and is provided in Table 2-2. During the equipment-level FMECA, the analysis team modified these general equipment failure modes to describe the means in which each major component can fail. Table 2-2: General Equipment Failure Modes

Mechanical Failures Electrical/Electronics Failure

External leak/rupture Loss of or degraded power

Internal leak Fails with no output signal/no communication

Plugged Fails with low or high output signal

Mechanical failure (e.g., fracture, galling, fatigue) Erratic output

Corrosion/erosion Fails to respond to input

Loss of function (general) Short

Wear/Mechanical Damage Loss of function (general)

Processing error (e.g. calculation error, sequence error)

13

Figure 2-3. Equipment-Level FMECA Procedures

During the equipment-level FMECA workshop, the analysis team evaluated each major equipment item by first identifying potential equipment-level failure modes and then postulating on specific equipment failure causes resulting in each failure mode. The team then identified the potential effects resulting from each failure mode. The effects were then identified and classified into various BOP functional failures. Based on this classification the equipment-level failure modes were linked to the corresponding BOP functional failure. Once these links were established, the team identified any safeguards that are currently in place to detect, prevent or mitigate the failure mode. Appendix B presents the equipment-level FMECA Worksheets.

14

2.2.3 Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking)

To provide a consistent means to evaluate the relative criticality of the BOP subsystem and equipment failures and to help judge the adequacy of MIT activities performed to prevent and detect the failures, a Risk Priority Number (RPN) ranking scheme based the following factors was employed:

Frequency of Failure of the Equipment Failure Mode Level of Redundancy to Prevent Specific Failure from Resulting in Complete Loss of Safety

Critical Functions Ability to Detect and Prevent the Failure Mode via system monitoring and MIT practices Severity of the End Effect for each BOP Functional Failure

A RPN ranking for each functional failure associated with an equipment-level failure mode was based on the product of the following three independent factors:

Severity Rating This rating assesses the severity of worst-case end effect for a given functional failure. (Note: The functional failure end effects documented in the functional-level FMECA were used to determine this rating assuming no redundancies are present.). The severity was rated for potential hazard to personnel on the rig, potential environmental impact, and potential downtime.

Occurrence Rating This rating assesses the likelihood of the failure mode resulting in the functional failure and its stated end effect. Such an assessment is made by evaluating the causes listed for the failure mode. The presence of redundant components and systems is explicitly considered in this rating.

Detection Rating This rating assesses the likelihood of the current applicable MIT activities and system monitoring techniques to detect the failure mode before it results in the functional failure.

The severity, occurrence, and detection ratings are provided in Tables 2-3 through 2-5, respectively. These ratings were then used to calculate a single RPN ranking for each functional failure effect & equipment failure mode pair (i.e., RPN ranking for each functional failure associated with an equipment-level failure mode) using the following equation:

RPN = Severity Rating X Occurrence Rating X Detection Rating

The individual RPN rankings provide a relative ranking of the risk associated with a given functional failure effect-equipment failure mode pair. Thereby, providing a means to identify the most critical equipment-level failure modes in overall BOP performance, as well as identifying the more critical failure modes associated with a specific BOP functional failure.

15

Table 2-3: Severity Ratings Severity Rank Significance Personnel Environment Down Time

1

Does not affect BOP functionality; no impact on safety and environment.

No impact No impact No downtime, repair can be done while drilling continues.

2

Does not affect BOP functionality but needs to be corrected; no impact on safety and environment.

No impact No impact No downtime, repair can be done at next opportunity, drilling continues.

3 Partial loss of BOP function; no loss of well control.

No impact No impact Downtime of less than a shift, stop drilling, intervene and repair.

4

Partial loss of BOP function; no loss of well control.

No impact No impact Downtime between a shift and 24 hours, stop drilling, intervene and repair.

5

Partial loss of BOP primary function if not corrected immediately.

No impact No impact Downtime between 1 and 7 days - stop drilling, intervene and repair (surface only).

6

Partial loss of BOP primary function if not corrected immediately.

Minor Injury; no recordable lost time

Minor external subsea leak (e.g., choke & kill [C&K] connector leak)

Downtime between 8 and 21 days - stop drilling, intervene and repair (surface only).

7

Loss of BOP primary function.

Minor Injury; some lost time.

Significant external subsea leak (e.g., major connector leak)

Pulling LMRP only.

8


Serious Injury; significant lost time.

1000BBL Shut down of operations; drilling stopped and major regulatory implications; changes to drilling schedule > 3 months.

16

Table 2-3: Severity Ratings (contd) Severity Rank Significance Personnel Environment Down Time

10


Multiple fatalities and injuries.

>10,000BBL and severe environmental damage over a large area.

Shut down of operations; drilling stopped and major regulatory implications; total loss of asset.

Table 2-4: Occurrence Ratings

Occurrence Ratings Frequency/Rig Yr. Occurrence

10 >50+ events/ rig yr. Once a week or more often

9

17

Table 2-5: Detection Ratings Detection

Rating Detection Likelihood of Detection

1

Almost Certain Very high probability of detection (>90% probability of detection) by design controls (redundant or independent self-diagnostic capability, independent alarms) will certainly detect failures

2

Very High High probability of detection (50 to 90% of detection) by design controls (single device self-diagnostic capability, single alarms, visual monitoring, leak monitoring, loss of fluid etc.) will certainly detect failures

3 High Probability of detection via weekly on-stream tests/inspections will provide immediate detection of the failure

4 Moderately high Probability of detection via monthly on-stream tests/inspections will provide immediate detection of the failure

5 Moderate Probability of detection via quarterly on-stream tests/inspections will provide immediate detection of the failure

6 Low Can only be detected during routine inspections/tests while the BOP is pulled from the well

7-8 Very Low Can only be detected during major PMs while the BOP is pulled from the well

9 Remote Can only be detected and/or corrected during major overhaul or rebuilding-type activities

10 Absolute Uncertainty Currently no design controls or maintenance techniques in place

18


19

3.0 FMECA RESULTS & ASSESSMENT

This section summarizes the results of the FMECA analysisspecifically, the results of the functional-level and equipment-level FMECAs which are provided in tabular format in Appendices A and B, respectively. These appendices also include a description of the FMECA table information. The functional failures were ranked during the FMECA Workshop and the results are presented in Table 3-1. The worst case ranking among the three groups was chosen as the severity ranking for RPN calculations. Table 3-1: Functional Failure Ranking

Function Severity

Personnel Environment Down Time 1- Close and seal on the drill pipe and allow circulation, on demand

No.: 1.1.1

Failure to close on drill pipe through annular(s)

1 Failure to Provide Control Signal to Annular or C&K Valves When Demanded

8 8 8

2

Failure to Supply Hydraulic Fluid & Pressure to Annular & C&K Valves When Demanded

8 8 8

3 Failure to Close Annular on Demand 8 8 8 4 Inability to Operate C&K Valves as Needed 1 8 8 5 Failure to open annular on demand 1 1 8

No.: 1.1.2

Failure to close on drill pipe through pipe rams

1 Failure to Provide Control Signal to Pipe Ram or C&K Valves When Demanded

10 10 10

2

Failure to Supply Hydraulic Fluid & Pressure to Pipe Ram or C&K Valves When Demanded

10 10 10

3 Failure to Close Pipe Ram on Demand 10 10 10 4 Inability to Operate C&K Valves as Needed 1 10 10

5 Failure to Open Pipe Ram on Demand (as part of well control process)

1 1 8

No.: 1.1.3

Failure to seal or partial seal on drill pipe through annular(s)

1 Failure of Annular to Seal on Demand 8 8 8

2 Failure to Maintain Adequate Sealing Pressure on Annular ( high and low)

8 8 8

3 Partial seal - C&K Valves leaking 1 8 8

20

Table 3-1: Functional Failure Ranking (contd)

Function Severity

Personnel Environment Down Time No.: 1.1.4

Failure to seal or partial seal on drill pipe through pipe rams

1 Failure of Pipe Ram to Seal on Demand 10 10 10

2 Failure to Maintain Adequate Sealing Pressure on Pipe Ram

10 10 10

3 Partial seal - C&K Valves leaking 1 10 10 No.: 1.1.5A Unintentional closing / opening - Annulars

1 Unintentional Closing 1 1 8 2 Unintentional Opening 8 8 8

No.: 1.1.5B Unintentional closing / opening -Pipe Rams


No.: 1.1.6

Failure to open / close Spring assisted valves to seal

1 Failure to Actuate Under Failsafe Conditions - NOT APPLICABLE

2 Failure to Adequately Seal Under Failsafe Conditions-NOT APPLICABLE

No.: 1.1.7 Closes too slowly - Annular

1 Actuates Too Slowly on Demand 1 8 8 No.: 1.1.7 Closes too slowly - Pipe Ram

1 Actuates Too Slowly on Demand 10 10 10 No.: 1.1.8 Loss of containment

1 External Leak 1 10 10 2 Rupture 1 10 10

2- Close and seal on open hole and allow volumetric well control operations, on demand

No.: 1.2.1

Failure to close on open hole through blind shear ram

1 Failure to Provide Control Signal to blind shear ram or C&K Valves When Demanded

10 10 10

2

Failure to Supply Hydraulic Fluid & Pressure to blind shear ram or C&K Valves When Demanded

10 10 10

3 Failure to Close blind shear ram on Demand 10 10 10

4 Failure of blind shear ram to Seal on Demand

10 10 10

21


Function Severity

Personnel Environment Down Time

5 Failure to Maintain Adequate Sealing Pressure on Blind shear ram ( high and low)

10 10 10

6 Inability to Operate C&K Valves as Needed 8 10 10 No.: 1.2.2

Unintentional closing / opening - Blind shear ram

1 Unintentional Closing 2 Unintentional Opening 10 10 10

No.: 1.2.3

Failure to open / close Spring assisted valves to seal

1 Failure to Actuate Under Failsafe Conditions - NOT APPLICABLE

2 Failure to Adequately Seal Under Failsafe Conditions-NOT APPLICABLE

No.: 1.2.4 Closes too slowly



3- Strip the drill string using the annular BOP(s) No.: 1.3.1 Failure to close annulars

1 Failure to Provide Control Signal to Annulars When Demanded

1 1 8

2 Failure to Supply Hydraulic Fluid & Pressure to Annulars

1 1 8

3 Failure to Close Annulars on Drill String on Demand

1 1 8

No.: 1.3.2 Failure to maintain stripping pressure

1 Failure to Maintain Hydraulic Fluid & Pressure to Annulars ( low and high pressure)

1 1 8

No.: 1.3.3 Failure to seal /lubrication

1 Failure of Annular to Seal on Demand 1 1 8

2 Failure to Maintain Adequate Sealing Pressure on Annular ( high and low)

1 1 8

22


Function Severity

Personnel Environment Down Time 4- Hang-off the drill pipe on a ram BOP and control the wellbore

No.: 1.4.1 Failure of hang-off ram to close

1 Failure to Provide Control Signal to Hang-off Ram When Demanded

10 10 10

2 Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram

10 10 10

3 Failure to Close Hang off Ram on Demand 10 10 10 No.: 1.4.2 Failure to maintain closing pressure

1 Failure to Maintain Closing Pressure on Hang-off Ram

1 1 1

No.: 1.4.3 Failure to maintain locking

1 Failure to Engage Lock on Hang-off Ram 10 10 10 No.: 1.4.4

Failure of hang-off ram to close in preparation to Disconnect

1 Failure to Provide Control Signal to Hang-off Ram in preparation to Disconnect

1 1 8

2

Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram in preparation to Disconnect

1 1 8

3 Failure to Close Hang off Ram in preparation to Disconnect

1 1 8

5- Normal operation - Shear the drill pipe and seal the wellbore

No.: 1.5.1 Failure to close

1 Failure to Provide Control Signal to Shear Ram When Demanded

10 10 10

2 Failure to Supply Hydraulic Fluid & Pressure to Shear Ram

10 10 10

No.: 1.5.2 Failure to shear the drill pipe

1 Failure to Shear Pipe 10 10 10 No.: 1.5.3 Failure to seal the wellbore

1 Failure of Shear Ram to Seal On Demand 10 10 10

2 Failure to Maintain Sealing Pressure on Shear Ram ( failure to maintain seal)

10 10 10

23


Function Severity

Personnel Environment Down Time No.: 1.5.4 Unintentional closing / opening





6- Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore

No.: 1.6.1 Failure to Arm

1 Failure to Provide Control Signal 1 1 8 No.: 1.6.2 Failure to close


10 10 10

No.: 1.6.3 Failure to shear the drill pipe


10 10 10



2 Failure to Maintain Sealing Pressure on Shear Ram

10 10 10

No.: 1.6.5 Unintentional closing / opening

1 Unintentional Closing 8 1 8

2 Unintentional Opening - NOT APPLICABLE




24


Function Severity

Personnel Environment Down Time 7- Emergency Operation - EDS - Disconnect and/or Shear the drill pipe and seal the wellbore

No.: 1.7.1 Failure to close and/or disconnect

1 Failure to Provide Control Signal to Riser connector when Demanded

9 10 10

2 Failure to Supply Hydraulic Fluid & Pressure to Riser connector

9 10 10

3 Unintentional Closing 8 9 8 No.: 1.7.2 Failure to shear the drill pipe



2 Failure to Maintain Sealing Pressure on Shear Ram

1 10 10

No.: 1.7.4 Unintentional closing / opening

1 Unintentional Closing 8 9 8 2 Unintentional Opening




8- Disconnect the LMRP from the BOP stack No.: 1.8.1

Failure to disconnect the LMRP from BOP stack

1 Failure to Provide Disconnect Signal (automatically or manually)

1 1 8

2 Failure of LMRP / BOP Connector to Disengage

1 1 8

3 Failure of Hydraulic Fluid to Disconnect 1 1 8 4 Moves too slowly to disconnect 1 1 8

No.: 1.8.2 Unintentional disconnect of the LMRP

1 Spurious Disconnect Signal 9 10 10 2 Unintentional Manual Disconnect Signal

25


Function Severity

Personnel Environment Down Time 9- Circulate the well after drill pipe disconnect No.: 1.9.1 Failure to circulate/seal the wellbore

1 Failure to Provide Control Signal (to open) to C&K Valves when Demanded

1 1 9

2 Failure to Supply Hydraulic Fluid & Pressure to C&K Valves

1 1 9

3 Inability to Operate C&K Valves as Needed 1 1 9 No.: 1.9.2 Failure to circulate at desired flow rate

1 Degraded Flow Pressure / Restricted Flow Path

1 1 9

No.: 1.9.3

Failure to open / close fail-spring assist valves to seal

1 Failure to close/partial close 1 8 9 No.: 1.9.4

Failure to seal wellbore after drill pipe disconnect

1 Failure to Provide Control Signal to C&K Valves when Demanded

1 8 9


1 8 9

3 Inability to Operate C&K Valves as Needed 1 8 9 No.: 1.9.5 Loss of containment


10- Circulate across the BOP stack to remove trapped gas

No.: 1.10.1 Failure to circulate

1 Failure to Provide Control Signal to C&K Valves when Demanded

1 8 8


1 8 8

3 Inability to Operate C&K Valves as Needed 1 8 8 No.: 1.10.2 Failure to circulate at desired flow rate

1 Degraded Flow Pressure / Restricted Flow Path

1 1 8

No.: 1.10.3

Failure to open / close spring assist valves to seal

1 Failure to close/partial close 1 1 8

26


Function Severity

Personnel Environment Down Time No.: 1.10.4 Loss of containment


11- Connect BOP and LMRP at Landing No.: 1.11.1 Inadequate BOP Connection

1 Failure of Wellhead Connector to Properly Lock and Seal

1 1 8

2 Failure of Connector Integrity 1 1 8

3 Failure of Connector Integrity (during operation)

10 10 10

No.: 1.11.2 Inadequate LMRP Connection

1 Failure of LMRP Connector to Properly Lock and Seal

1 1 7

2 Failure of Connector Integrity 1 1 7

3 Failure of Connector Integrity (during operation)

10 10 10

12- Secondary - Acoustic Not assessed in Equipment-level

FMECA RPN No.: 1.12.1 Failure to disarm

1 Failure to provide Acoustic signal to disarm 1 1 3 No.: 1.12.2 Failure to arm

1 Failure to provide Acoustic signal to arm 1 1 2

13- Secondary - ROV Not assessed in Equipment-level

FMECA RPN No.: 1.13.1 ROV Intervention

Failure to perform ROV intervention of Riser connector/BOP stack function

1 Primary and secondary riser connector unlock

1 1 8

2 Riser Connector gasket release 1 1 7 3 all stabs retract 1 1 7 4 Shear ram close 1 10 10 5 pipe ram close 1 1 8

6 stack connector primary and secondary unlock

1 1 9

7 stack connector gasket release 1 1 8 8 stack connector gasket lock 1 1 2

27


Function Severity

Personnel Environment Down Time 9 stack connector glycol injection 1 1 9

10 Visual inspection and monitoring 1 1 5 11 Shear Ram open 1 1 6 12 Pipe ram open 1 1 6

Table 3-2 shows the top 25% of equipment-level failure modes. These are considered to be the most critical failure modes. RPN scores from the FMECA range from 1300, with the top 25% ranging from 90300. Appendix C provides the complete table for these equipment-level failure modes based on the RPN rankings. Note: The equipment/sub-system may be repeated in the table below for different failure modes and functional failures. Table 3-2: Failure Modes with Highest RPN Sorted by RPN

Equipment/ Subsystem

Failure Mode

Severity (S)

Occurrence (O)

Detection (D)

RPN (SxOxD)

# of Effects (Functional

Failures) SPM Valve - Double acting - Subsea Control: Hydraulic

External Leak 10 5 6 300 1

Choke & Kill Lines & Valves - BOP Stack

Mechani-cal Failure

9 5 6 270 4

SPM Valve - Double acting - Subsea Control: Hydraulic

Internal Leak 10 4 6 240 1


Mechani-cal Failure

8 5 6 240 5

Pipe Ram - BOP Stack

External Leak/ Rupture

10 5 4 200 2

Pipe Ram - BOP Stack

Mechani-cal Failure

10 5 4 200 2

Annulars - BOP Stack

Mechani-cal Damage

8 4 6 192 4



28

Table 3-2: Failure Modes with Highest RPN Sorted by RPN (contd)


Failure Mode

Severity (S)

Occurrence (O)

Detection (D)

RPN (SxOxD)



Mechanical Damage/Wear

10 3 6 180 1

Shuttle Valve - BOP Stack




8 5 4 160 6


Mechanical Failure

8 5 4 160 4

Shuttle Valve - BOP Stack


Tubing and piping - Subsea Control: Hydraulic

External Leak/ Mechanical Failure

10 5 3 150 17

CCSV/DDV Fluid End - Subsea Control: Hydraulic

Plugged 10 5 3 150 13



9 5 3 135 3


Plugged 9 5 3 135 3



8 4 4 128 1


Mechanical Failure

8 4 4 128 1

Rigid Conduit - Surface Control: Hydraulic

Mechanical Failure

10 4 3 120 13

29



Failure Mode

Severity (S)

Occurrence (O)

Detection (D)

RPN (SxOxD)


Failures) SPM Valve - Single acting - Subsea Control: Hydraulic


SPM Valve - Single acting - Subsea Control: Hydraulic

Mechanical Failure/Wear

10 6 2 120 13

Pilot operated check Valve (POCV) - Subsea Control: Hydraulic


Pilot operated check Valve (POCV) - Subsea Control: Hydraulic

Mechanical Failure

10 2 6 120 1



8 5 3 120 10


Plugged 8 5 3 120 10


External Leak

10 6 2 120 17

Rigid Conduit Manifold - SPM valves - Subsea Control: Hydraulic


10 6 2 120 13


Mechanical Failure

9 4 3 108 3

30



Failure Mode

Severity (S)

Occurrence (O)

Detection (D)

RPN (SxOxD)


Failures) SPM Valve - Single acting - Subsea Control: Hydraulic




9 6 2 108 3





9 6 2 108 3



9 6 2 108 4


Loss of function (general)

9 4 3 108 3



7 5 3 105 1


Plugged 7 5 3 105 1

HKR Regulator - Subsea Control: Hydraulic






10 5 2 100 13

MKR Regulator - Subsea Control: Hydraulic


31



Failure Mode

Severity (S)

Occurrence (O)

Detection (D)

RPN (SxOxD)


Failures)



10 5 2 100 13


Loss of Function (4th gen)

10 5 2 100 1




Mechanical Failure

8 4 3 96 10





8 6 2 96 9





8 6 2 96 10



8 6 2 96 7





9 5 2 90 3

32



Failure Mode

Severity (S)

Occurrence (O)

Detection (D)

RPN (SxOxD)


Failures) MKR Regulator - Subsea Control: Hydraulic




9 5 2 90 3



Table 3-3 shows the equipment failure modes with a severity ranking of 10, an occurrence ranking greater than or equal to 3 and a detection ranking greater than or equal to 5. These are the equipment failures that occur most frequently and could result in the highest severity and are the hardest to detect. Table 3-3: Failure Modes with S = 10, O 3, and D 5


Failure Mode

Severity (S)

Occurrence (O)

Detection (D)

RPN (SxOxD)







Mechanical Failure/Wear 10 3 6 180 1

33

Based on the criticality ranking, the following equipment and their failure modes were identified as the top 25% of the critical items contributing to the BOPs potential functional failure:

Double-acting SPM Valves Subsea Control Shuttle Valves Choke & Kill Lines and Valves Annular Pipe Ram Solenoid Valve Fluid End - Subsea Control Tubing and piping - Subsea Control SPM Valve - Single acting - Subsea Control Rigid Conduit - Surface Control & Rigid Conduit Manifold Valve Subsea Control HKR & MKR Regulators, Pilot operated check Valve (POCV) - Subsea Control

The Double-acting SPM Valves were assessed as one of the top 10% of equipment whose failure could potentially have a severe effect. This is owing to the fact that these valves are used in the autoshear application, where failure can lead to the worst case consequences. The team assessed the double-acting SPM valves to have mechanical damage (as a dormant failure not leading to leaks) every five years to once in every ten years caused by damage to the piston rod, poppet, cage, seal plate or piston housing or seal wear. Such damage can only be detected when the BOP is pulled for inspections. However, it is to be noted that these valves are rebuilt or rotated every 18 months. The high RPN rating is also due to the occurrence of external and internal leaks caused by seal wear and other mechanical damage discussed above. Such leak events are assessed to occur once every two years. A high frequency of rebuilding the valves and a high frequency of wear leading to leaks call for a detailed look at the maintenance practices followed during the overhaul. It is also to be noted that a comparative assessment with the failure data collected from the drilling contractor and the OEM did not show any failures of the double-acting SPM valves discussed above. Hence, this item will be discussed with the IPs to verify the assessment results. The Shuttle Valve external leaks were assessed as one of the top 10% of critical equipment failures. Shuttle valves are evaluated as a single point of failure and depending on the function, the valve failure may lead to worst consequences. The team assessed external leaks caused by seal leaks, fittings or O-ring leaks to occur less than twice a year to at least once every year. It is also to be noted that these leaks will not be detected until the function is fired. A review of maintenance practices shows that these valves are rebuilt or rotated every 18 months and checked for tightness of fittings on every trip. A comparative assessment with the failure data collected from the drilling contractor and the OEM did not show high failure occurrences. This could be attributed to the limited amount of available failure data collected owing to the unavailable historical records reported during the data collection phase. However, in the case of such uncertainties, the judgment based on the experience of the team members from the operator, drilling contractor and OEM should be relied upon during the assessment.

34

The inability to operate the choke and kill lines and valves when needed while closed on the drill pipe or on an open hole by rams, or to circulate the wellbore, were assessed to be in the top 25% of the criticality rankings. Such failures were attributed to mechanical failure of these gate valves owing to spring failure, damage to the piston/operator cylinder, damage to the gate/seat, damage to the tail rod, damage to the grease plate which prevents gate from moving, or failure of connections and bolts. Such failures were assessed by the team to occur less than twice a year to at least once every year. A review of the MIT practices showed that the gate and seat are replaced every 18 months. The valves undergo an overhaul schedule every three years and a hydraulic chamber test every year. It is also to be noted that multiple choke and kill valves are available, depending on the ram that is being functioned. Hence the team lowered the failure occurrence ranking by giving credit for the redundancy. A comparative assessment with the failure data collected from the drilling contractor and the OEM did show occurrences of gate valve failures during surface tests, and some significant downtime associated with their repair when such failures occurred during operation. The failure data also showed external leaks from choke and kill lines being detected during surface tests. The preliminary FMECA results show the annular to be in the top 25% of the critical equipment list. The possibility of mechanical damage to the annular body was assessed as once every 2 to 5 years. Such damages caused either by cutting/milling debris in the wellbore fluid, or wear of the sealing element due to normal operation, or any corrosion or erosion issues specific to the well bore chemical or sea-water environment, will only be detected during visual inspection of the elements at the end of well. Such wear or damages, if kept unchecked, and other seal leaks (like adapter seal, piston inner & outer seals, bonnet seal) will lead to external leak events. The annulars are overhauled every five years. A comparative assessment with the failure data collected from the drilling contractor and the OEM did show a couple of occurrences of annular upper element failures with significant downtime associated with its repair. The pipe ram was also assessed as one of the top 25% of the critical equipment, owing to the severity of the failure of the functions associated with their operation. The failure of the poppet, damage to the piston rod/cylinder/lock, ram housing, damage to the door lock/hinges/bolts, and worn ram packers were assessed to have the likelihood of occurrence of once every 2 to 5 years. The review of MIT practices showed that the ram doors are overhauled every 3 years and the body every 5 years. In addition to that, the locks and the ram cavity are inspected every year. The door hinges are greased between wells. Apart from weekly functional and bi-weekly pressure tests, wellbore pressure tests are performed every month to detect leaks. However, a comparative assessment with the failure data collected from the drilling contractor and the OEM showed that external leaks associated with the pipe rams were found only during tests on surface. The external leaks caused by damage to the ball/ball seat or O-ring and tubing failure of Solenoid valve fluid end, leaks caused by failure of the seals and elements of single-acting SPM valves and associated tubing and piping in the subsea hydraulic fluid lines, place these equipment items in the top 15% of the criticality list. The solenoid valve fluid end and single-acting SPM valves have a rebuild or rotation period of 18 months. The external leaks can be detected either by surface/subsea

35

flow meter indication, by ROV visual monitoring during the weekly functional tests or during operation. A comparative assessment with the failure data collected from the drilling contractor and the OEM showed several occurrences of external leaks in SPM valves and tubing, mostly during tests while on surface. One occurrence of a tubing leak on one pod during operation led to a significant downtime event. Owing to the mechanical damage and subsequent failure, the HKR and MKR regulators, and the Pilot operated check valves (POCVs) were assessed as one of the top 25% of critical equipment. These equipment items are rebuilt or rotated every 18 months. The external leaks in the Rigid Conduit (Surface Control) and Rigid Conduit Manifold Valve (Subsea Control) were also categorized under the top 25% of critical equipment failures. A comparative assessment with the failure data collected from the drilling contractor and the OEM did not show high failure occurrences. This can also be attributed to the limited amount of failure data collected owing to the unavailable historical records reported during the data collection phase. However, in the case of such uncertainties, the judgment based on the experience of the team members from the operator, drilling contractor and OEM should be relied upon during the assessment. The RPN results are presented to reflect the criticality of the functions that were assessed during the FMECA. Table 3-4 lists the top 25% of effects/functional failures with the highest average RPN for all of the equipment failures associated with that functional failure. The complete table is provided in Appendix C. Another way of evaluating the data is to calculate the number of occurrences of each equipment level failure linked to a functional failure as presented in Table 3-5. The complete table is provided in Appendix D. However, the reader is advised that Tables 3-3 and 3-4, and the method of the average RPN score depend on the categorization of functions, categorization of equipment and the level of detailed analysis, and results may slightly differ for different studies. It is suggested that the reader should review the system and equipment breakdown for this particular study before assessing tables 3-3 & 3-4.

36

Table 3-4: Functional Failures with Highest Average RPN

Effects # of Occurrence Cumulative

FF RPN Average FF RPN

Failure of Pipe Ram to Seal on Demand - Failure to seal or partial seal on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.4.1)

2 400 200

Failure to Maintain Adequate Sealing Pressure on Pipe Ram - Failure to seal or partial seal on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.4.2)

2 400 200

Partial seal - C&K Valves leaking - Failure to seal or partial seal on drill pipe through annular(s) - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.3.3)

1 192 192

Partial seal - C&K Valves leaking - Failure to seal or partial seal on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.4.3)

1 192 192

Failure to Close Annulars on Drill String on Demand - Failure to close annulars - Strip the drill string using the annular BOP(s) (linked to 1.3.1.3)

2 320 160

Inability to Operate C&K Valves as Needed - Failure to circulate/seal the wellbore - Circulate the well after drill pipe disconnect (linked to 1.9.1.3)

3 450 150

Failure to Close Annular on Demand - Failure to close on drill pipe through annular(s) - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.1.3)

3 448 149

Inability to Operate C&K Valves as Needed - Failure to seal wellbore after drill pipe disconnect - Circulate the well after drill pipe disconnect (linked to 1.9.4.3)

3 432 144

Inability to Operate C&K Valves as Needed - Failure to close on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.2.4)

3 416 139

Inability to Operate C&K Valves as Needed - Failure to close on open hole through blind shear ram - Close and seal on open hole and allow volumetric well control operations, on demand (linked to 1.2.1.6)

3 416 139

Degraded Flow Pressure / Restricted Flow Path - Failure to circulate at desired flow rate - Circulate across the BOP stack to remove trapped gas (linked to 1.10.2.1)

3 400 133

37

Table 3-4: Functional Failures with Highest Average RPN (contd)

Effects

# of Occurrence

Cumulative FF RPN

Average FF RPN

Inability to Operate C&K Valves as Needed - Failure to circulate - Circulate across the BOP stack to remove trapped gas (linked to 1.10.1.3)

3 400 133

Inability to Operate C&K Valves as Needed - Failure to close on drill pipe through annular(s) - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.1.4)

4 516 129

Degraded Flow Pressure / Restricted Flow Path - Failure to circulate at desired flow rate - Circulate the well after drill pipe disconnect (linked to 1.9.2.1)

4 504 126

Failure of Annular to Seal on Demand - Failure to seal or partial seal on drill pipe through annular(s) - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.3.1)

7 832 119

Failure to Maintain Adequate Sealing Pressure on Annular ( high and low) - Failure to seal or partial seal on drill pipe through annular(s) - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.3.2)

7 832 119

Failure to Supply Hydraulic Fluid & Pressure to Shear Ram - Failure to close - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 1.6.2.1)

41 3330 85

External Leak - Loss of containment - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.8.1)

18 1486 83

External Leak - Loss of containment - Close and seal on open hole and allow volumetric well control operations, on demand (linked to 1.2.5.1)

19 1526 80

External Leak - Loss of containment - Emergency Operation - EDS - Disconnect and/or Shear the drill pipe and seal the wellbore (linked to 1.7.6.1)

17 1240 73

External Leak - Loss of containment - Normal operation - Shear the drill pipe and seal the wellbore (linked to 1.5.6.1)

17 1240 73

Failure to Supply Hydraulic Fluid & Pressure to Pipe Ram or C&K Valves When Demanded - Failure to close on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.2.2)

33 2260 73

38




Failure to Supply Hydraulic Fluid & Pressure to Shear Ram - Failure to shear the drill pipe - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 1.6.3.1)

33 2260 73

Failure to close/partial close - Failure to open / close fail-spring assist valves - Circulate the well after drill pipe disconnect (linked to 1.9.3.1)

33 2199 71

Failure to Supply Hydraulic Fluid & Pressure to Shear Ram - Failure to close - Normal operation - Shear the drill pipe and seal the wellbore (linked to 1.5.1.2)

32 2120 71

Actuates Too Slowly on Demand - Closes too slowly - Close and seal on open hole and allow volumetric well control operations, on demand (linked to 1.2.4.1)

31 2020 70

Actuates Too Slowly on Demand - Closes too slowly - Emergency Operation - EDS - Disconnect and/or Shear the drill pipe and seal the wellbore (linked to 1.7.5.1)

31 2020 70

Actuates Too Slowly on Demand - Closes too slowly - Normal operation - Shear the drill pipe and seal the wellbore (linked to 1.5.5.1)

31 2020 70

Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram - Failure of hang-off ram to close - Hang-off the drill pipe on a ram BOP and control the wellbore (linked to 1.4.1.2)

31 2020 70

Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram in preparation to Disconnect - Failure of hang-off ram to close- Hang-off the drill pipe on a ram BOP in preparation to Disconnect (linked to 1.4.4.2)

31 2020 70

External Leak - Loss of containment - Normal operation - Shear the drill pipe and seal the wellbore (linked to 1.5.6.1)

17 1240 73

Failure to Supply Hydraulic Fluid & Pressure to Pipe Ram or C&K Valves When Demanded - Failure to close on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.2.2)

33 2260 73

Failure to Supply Hydraulic Fluid & Pressure to Shear Ram - Failure to close and/or disconnect - Emergency Operation - EDS - Disconnect and/or Shear the drill pipe and seal the wellbore (linked to 1.7.1.2)

31 2020 70

39




Actuates Too Slowly on Demand - Closes too slowly - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 1.6.6.1)

35 2210 67

Failure of Annular to Seal on Demand - Failure to seal /lubrication - Strip the drill string using the annular BOP(s) (linked to 1.3.3.1)

34 2134 67

Failure to Supply Hydraulic Fluid & Pressure to C&K Valves - Failure to circulate/seal the wellbore - Circulate the well after drill pipe disconnect (linked to 1.9.1.2)

33 2037 66

Failure to Supply Hydraulic Fluid & Pressure to C&K Valves - Failure to seal wellbore after drill pipe disconnect - Circulate the well after drill pipe disconnect (linked to 1.9.4.2)

33 2037 66

Failure of Shear Ram to Seal On Demand - Failure to seal the wellbore - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 1.6.4.1)

3 180 60

Failure of Shear Ram to Seal On Demand - Failure to seal the wellbore - Emergency Operation - EDS - Disconnect and/or Shear the drill pipe and seal the wellbore (linked to 1.7.3.1)

1 60 60

Failure of Shear Ram to Seal On Demand - Failure to seal the wellbore - Normal operation - Shear the drill pipe and seal the wellbore (linked to 1.5.3.1)

1 60 60

Failure to Close Pipe Ram on Demand - Failure to close on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation, on demand (linked to 1.1.2.3)

3 180 60

Failure to Maintain Sealing Pressure on Shear Ram - Failure to seal the wellbore - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 1.6.4.2)

3 180 60

Failure to Maintain Sealing Pressure on Shear Ram - Failure to seal the wellbore - Emergency Operation - EDS - Disconnect and/or Shear the drill pipe and seal the wellbore (linked to 1.7.3.2)

1 60 60

Failure to Maintain Sealing Pressure on Shear Ram - Failure to seal the wellbore - Normal operation - Shear the drill pipe and seal the wellbore (linked to 1.5.3.2)

1 60 60

40




Failure to Supply Hydraulic Fluid & Pressure to C&K Valves - Failure to circulate - Circulate across the BOP stack to remove trapped gas (linked to 1.10.1.2)

33 1824 59

Failure to Maintain Adequate Sealing Pressure on Annular ( high and low) - Failure to seal /lubrication - Strip the drill string using the annular BOP(s) (linked to 1.3.3.2)

29 1516 56

Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the LMRP from BOP stack - Disconnect the LMRP from the BOP stack (linked to 1.8.1.3)

31 1622 56

Failure to Maintain Hydraulic Fluid & Pressure to Annulars ( low and high pressure) - Failure to maintain stripping pressure - Strip the drill string using the annular BOP(s) (linked to 1.3.2.1)

31 1622 56

Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure to close annulars - Strip the drill string using the annular BOP(s) (linked to 1.3.1.2)

31 1622 56

Moves too slowly to disconne

blow out preventer bop fmeca

Documents

equipmentlevel fmeca

fmeca study

fmeca analysis

equipmentlevel failure

summary of fmeca

specific equipment failure

associated equipment

fmeca worksheets