BOP Control Systems Review

BOP Control Systems Review

- Deepwater BOP Control Systems – A look at reliability issues

(2003 OTC abstract)

- New generation of subsea BOP equipment

(2008 Drilling Contractor Magazine)

- Design evolution of subsea BOP

(2007 Drilling Contractor Magazine)

- Subsea Drilling Systems (Cameron)

Drilling control systems

Emergency systems

- Acoustic Control System for BOP Operation (Kongsberg)

- BOP Hydraulics and Fluid Requirements (Cameron)

- Code of Federal Regulations for a subsea BOP stack

Copyright 2003, Offshore Technology Conference

This paper was prepared for presentation at the 2003 Offshore Technology Conference held in

Houston, Texas, U.S.A., 5–8 May 2003.

This paper was selected for presentation by an OTC Program Committee following review of

information contained in an abstract submitted by the author(s). Contents of the paper, aspresented, have not been reviewed by the Offshore Technology Conference and are subject tocorrection by the author(s). The material, as presented, does not necessarily reflect any posi-

tion of the Offshore Technology Conference or its officers. Electronic reproduction, distribution,or storage of any part of this paper for commercial purposes without the written consent of theOffshore Technology Conference is prohibited. Permission to reproduce in print is restricted to

an abstract of not more than 300 words; illustrations may not be copied. The abstract mustcontain conspicuous acknowledgment of where and by whom the paper was presented.

AbstractHistorically, drilling contractors have accepted without manyquestions the reliability of the Blowout Preventer (BOP) com-ponents and overall control system. A statistical reliabilityapproach to qualifying, purchasing, and maintaining deepwa-ter BOP control systems should provide a high level of confi-dence of being able to have long periods of time betweenplanned maintenance of these systems with very few, if any,failures.

A study of deepwater BOP control systems has been per-formed to look at reliability issues and a means to qualifysystems and components for a determined period betweenmaintenance. Of special attention are the regulators and howthey are typically arranged and used in the system. This paperwill describe a statistical process to determine the reliabilityand failure rate necessary to accomplish the maintenance goal.In addition, the qualification process will be described and adiscussion of the pressure control regulator issues discoveredin the study will be provided.

IntroductionTransocean, like many other offshore drilling contractors, re-cently went through an extensive rig newbuild and upgradeprogram, which required purchasing a significant amount ofcustomer-furnished equipment for the various shipyards. Aswith most “boom” cycles, the industry activity before thebuilding cycle had developed ideas for new rig technology,but lacked R&D resources to make them available to be manu-factured as already proven systems. Therefore, this buildingcycle, similar to all the rest, resulted in R&D efforts in parallelwith the manufacturing of new equipment to be installed onnew rigs. And, as before, this resulted in design and relatedproblems while in service that drove significant downtime, inmany instances.

At times, it appears the industry attitude is that we cannot af-ford R&D in advance of a defined need. However, the indus-

try seems to be able to afford to fix the problems associatedwith downtime due to an incomplete design.

Many of these problems are directly related to not having adetailed set of design and functional specifications to give tothe equipment manufacturer. Plus, the purchaser usually doesnot understand the duty cycle requirements, or demands, of theparticular equipment for an interval that is acceptable to per-form maintenance on the equipment without sustaining down-time.

For offshore floating drilling operations, especially in deep-water, one of the most expensive downtime events is associ-ated with having to pull the marine riser and subsea BOP be-cause of a problem. Any problem or failure that requires theriser and BOP to be round tripped will result in a cost of ap-proximately $1.00 MM per event. And whether the contractoror the operator absorbs this cost, it is expensive.

One of the more common causes for pulling the marine riserand subsea BOP is associated with the BOP control system.The deepwater BOP control system associated with dynami-cally positioned (DP) rigs is typically a Multiplexed Electro-Hydraulic (MUX) Control System. This is schematicallyshown in Figure 1. The demand on the subsea control systemis initiated at the surface. The demand signal is multiplexeddown the control umbilical to the subsea control system.There, the signal is decoded, confirmed, and performed. For ademand that requires a BOP Ram to close, for example, themultiplex signal would be received at the subsea control podand decoded. The decoded signal would cause a solenoid to beopened electrically which would send a hydraulic pilot signalto the proper hydraulic valve. This pilot signal would causethe hydraulic valve to shift and send stored and pressurizedhydraulic fluid to the BOP Ram to be closed.

Therefore, the subsea BOP control system consists of two ba-sic elements: electrical and hydraulic components. History hasshown that more subsea problems have been associated withthe hydraulic components than the electrical, causing the BOPand riser to be retrieved for repair.

Each subsea BOP system has two complete control pods. Eachpod is capable of performing all necessary functions on theBOP. While these systems may be considered redundant, anymajor problem associated with one pod will cause the systemto be retrieved to the surface for repair. If a major problem isfound, the control of the subsea BOP is transferred to the other

OTC 15194

DEEPWATER BOP CONTROL SYSTEMS - A LOOK AT RELIABILITY ISSUESEarl Shanks, Transocean; Andrew Dykes, ABS Consulting; Marc Quilici, ABS Consulting; John Pruitt, ABS Consulting

2 OTC 15194

pod and preparations will be made to retrieve the lower marineriser package (LMRP) and riser to surface. Some minor prob-lems may not require the system to be retrieved if considerednot necessary for critical operations.

Transocean has recently had an opportunity to review the ba-sic design and requirements for Deepwater MUX BOP Con-trol Systems. During this review, it was obvious: the best timeto perform major maintenance on a complicated BOP controlsystem was during the shipyard time of a mobile offshoredrilling unit (MODU) during its five-year interval inspectionperiod. This process would lead to minimal or no downtimeassociated with BOP controls and allow for planning properresources during the maintenance period.

Therefore, a project was initiated to determine what would berequired to manufacture a control system that would requiremajor maintenance only on a five-year interval.

Reliability DiscussionA brief investigation into the specifications given to BOPcontrol vendors revealed that rarely was any equipment per-formance requirements given. Very often, the system require-ments were developed between the contractor engineers, op-erations personnel, and vendors as the project progressed afterthe purchase order was given. Reliability was assumed to be asgood as the previous systems built. Or, in the case of a newdesign, it was assumed better than before.

During the bid and purchase negotiations between the con-tractor and vendor, emphasis is typically given to the follow-ing:§ Number, type, and size of specific functions to be

provided. The BOP stacks of the newbuilds werebuilt with more functions and volume requirementsthan in the past. Therefore, the control systems hadmore comp onents than before;

§ With a desire to make trouble-shooting problemseasier, the systems have more pressure and positionread-backs;

§ For ultra-deepwater applications, the working pres-sure and volume of the stored hydraulic fluid in-creased dramatically;

§ With the increased size of the two control systems onthe subsea riser package, careful attention was givento the architecture of the system to fit in the spaceavailable.

Currently, factory acceptance testing (FAT) requirements atdelivery of the system are generally were no more than func-tion tests to ensure all functions work according to the pipingand function drawings.

When the systems are accepted and integrated in the BOPstack, they are sent to the rig for continuing operations.

A new system on a rig generally has a learning curve associ-ated with maintenance requirements. Maintenance schedules

are typically established as problems are discovered. Becauseof the pressure on getting the equipment back to work, rootcause analysis of the failures is generally not performed. Inmany operations, high maintenance is accepted as a necessaryevil to prevent downtime.

High maintenance can be a tool to reduce failures in operation.However, this is a very expensive approach, and it is also anopportunity to introduce human error into the system. Also,this method does not establish reliability based on a failurerate.

In general, operating reliability is maintained on rigs mostlythrough regular maintenance intervals rather than specifying areliability of a system or component to minimize maintenance.

Project Scope of WorkFloating drilling rig downtime due to poor BOP reliability is acommon and very costly issue confronting all offshore drillingcontractors. Transocean, as a major player in offshore explo-ration worldwide, operates numerous floating rigs of variouscapabilities and configurations. Depending on the drillingcontract in place and the nature of the downtime cause, BOPfailure can result in substantial revenue loss for the drillingcontractor.

In order to reduce the risk of revenue loss to the contractor oroperator, Transocean is committed to actively pursuing im-provements in BOP reliability at all levels during the equip-ment lifetime, including the design stage. As part of this proc-ess, individual BOP component reliability goals are necessaryto ensure that the desired overall BOP reliability target isachieved.

Since the hydraulic components of the control system histori-cally have had more problems that have required the riser andBOP stack to be pulled, the first efforts were directed at thehydraulic system, including all hydraulic stack-mounted com-ponents. The systems under review consist of the solenoidpilot valve through to the end function.

The following reliability goals were established for the sole-noids and hydraulic components:§ Overall service life of system is 20 years;

§ Pressure regulators maintenance 5 years, body 20years;

§ Solenoids 20 years, body 20 years;

§ Solenoid shear seal valves maintenance 5 years, body20 years;

§ SPM valves maintenance 5 years, body 20 years;

§ Shuttle valves maintenance 5 years, body 20 years;

§ Other valves maintenance 5 years, body 20 years;

§ Hoses with couplings 5 years;

§ Piping and connections 20 years.

OTC 15194 3

Also, a method was established to design a specification tooperate a Subsea BOP system for five years without needingto pull the system to the surface for unplanned maintenance;this project determined the method to design a specification tomeet this goal. This discussion focuses on the reliability testspecification that is necessary to ensure the use of highly reli-able components that will result in the hydraulic control sys-tem meeting this objective.

The need for highly reliable sub-sea BOP system componentsresults from the following assumptions that are based on ac-tual experience.§ The BOP has a large number of hydraulic control

system components;

§ During a 5-year period, an individual valve will getcycled many times;

§ Within the current design, a failure of any one of thecontrol components may require pulling the BOP tothe surface.

This paper estimates the magnitude of the testing requirementsnecessary to demonstrate the desired level of reliability. Thisis accomplished by scoping the mission success criteria basedon a representative system configuration and a detailed analy-sis of the required testing. Next, an estimate of the componentfailure rate goals is established based on the desired opera-tional reliability of the system and the test demands that vari-ous component-type groups within the system are expected tobe exposed to over the desired duration (5 years). Then, anestimate is made of the number of cycles of a reliability testingprogram required to provide confidence that the componentswill perform reliably to achieve the BOP hydraulic controlsystem reliability goal.

This scope of work is accomplished by addressing the fol-lowing major categories:§ Control System Design Considerations – This proc-

ess will look at all components to be considered inthe study and group the components into “Family”types for further analysis;

§ Estimate of Component-Type Reliability Require-ments – The requirements of each component for themaintenance interval will be determined and a reli-ability goal is established to meet the criteria;

§ Elements of the Reliability Testing Plan – Each fa m-ily of components has its own failure rate goal tomeet the overall failure rate goal of the system;

§ Amount of Testing to Provide Statistical Confidence– The amount of testing to satisfy the failure goalsand desired statistical confidence is specified;

§ Component Testing Program – Test program to meetthe stated goals.

Control System Design ConsiderationsComponent Family Type Grouping Within SystemA representative rig was chosen to perform the study. Thiswas a 5th-Generation DP semisubmersible capable of drilling

in water depths to 10,000 feet. A worksheet was developed toprovide a complete listing of the components in the hydrauliccontrol system. Family types group the components. The term,“Family Type,” refers to the general function that the valvesaccomplish (e.g., pilot valve, check valve, shuttle valves, etc.)It is assumed that within a given component type the comp o-nent designs are similar enough to assume that the reliabilityperformance of the components may be modeled by one fail-ure rate, regardless of size. The family types are listed belowalong with an indication of the number of components of thatfamily within the representative system.

Check Valves - There are 22 check valves.Pilot Assisted Check Valves – There are 6 pilot as-sisted check valves.Piloted Hydraulic Valves – Dual Function –There are38 dual-function pilot valves,Piloted Hydraulic Valves – Single Function –Thereare 42 single-function pilot valves.Regulators - There are two types of regulators, fourmanually set regulators and eight hydraulically con-trolled regulators. The operational success criteria forthe regulator valve are still under evaluation. The“demands” associated with the regulator relate to thepressure control function performed during periodictesting of specific functions, which is required overthe period during which the control valves are beingcycled. The severity of the challenges depends onfactors in the system that is still being investigated.Shuttle Valves – There are 74 shuttle valves used inthe system.Solenoid Valves – There is no variation in solenoidvalves. All 142 valves are 1/8”, 3 way, 2-positionvalves.

Estimate of Component-Type ReliabilityRequirementsThe goal of this project is to develop a control system that hasthe potential to operate 5 years between major maintenancewithout a failure. However, to have a starting point for devel-oping failure rates, it was established that an acceptable failurerate would be one failure in 10 years that would cause a BOPstack to be retrieved to the surface.

Operational Test SummaryAn Operational Test Summary worksheet was establishedshowing the BOP operational testing program for the BOP thatconstitutes the 5-year success criteria for the hydraulic controlsystem. The results for a 10-year period was also establishedto develop targeted failure-rate goals. The mission is based onthe participation of valves in various subsystems of the BOPin a functional testing program of the BOP, both on the sur-face and subsea. The test program consists of 7 separate BOPControl tests that are conducted over a typical 8-week welldrilling operation. An 8-week average per well drilled wasassumed. Therefore, for a 5-year duration, approximately 33wells would be drilled. For a 10-year interval, 65 wells wouldbe drilled.

The component function cycles were established by the fol-

4 OTC 15194

lowing test sequences:

Test 1. – Function tests a BOP Control function whenthe stack is retrieved to surface, without pressuretesting. This is to remove salt water in the pod.Test 1A – Emergency Disconnect Test and RemoteOperated Vehicle Tests.Test 2. – Surface pressure test prior to running BOP.Test 3. – Run and land BOP, lock wellhead connectorand line up BOP valves for drilling operations.Test 4. – Bi-weekly subsea pressure and function testfor the duration of the well.Test 5. – Line up valves in preparation of pullingBOP. Unlock wellhead connector and adjust accu-mulator pressure on trip to surface.

This worksheet calculated the total number of componentfunctional cycles based on the years of service that will formthe basis for the reliability requirement. Figure 2 is a summaryof the component functional cycles occurring due to the op-erational test sequences by Family Type. This summary showsthe resultant total number of demands for valve positionchanges over the specified operational testing period. It can beseen in this summary, over 87,000 valve-cycle demands wouldhave to be performed successfully subsea. And, almost140,000 total cycles would occur during the 5-year period.

Specification of Reliability GoalsA Reliability Goal Evaluation provided a means to estimateindividual component failure rate goals based on system reli-ability goals. Figure 3 represents a worksheet used to providean interactive tool for evaluating different reliability goals. Asshown, it is an estimate of the component-type group failurerates required to produce an average of 1 failure, among all sixcomponent types, within the hydraulic control systems per rigper 10-years of operation.

The estimate is designed to produce component failure ratesthat produce a system reliability that has been “balanced.” Asevery component must function successfully when requiredduring tests, the BOP hydraulic control is a series system; itsreliability is modeled by the product of the reliabilities of allthe components. This is done in two stages. First, an equalreliability requirement is allocated to each component-typegroup. Then the reliability requirement is allocated to eachcomponent within that group through the specification of afailure rate that will produce the component-type reliabilitywhen applied against the total number of test demands for thatgroup. The resultant component failure rates are given in thecolumn labeled “Comp onent Failure Rate Goal.”

Those component types that must respond to the most de-mands should be the most reliable, which agrees with commonsense. For example, Solenoid Operated Valves are exercisedabout twice as much as any other component type. Conse-quently, they should have the lowest failure rate. Conversely,those valves that are not challenged as often as others can havesomewhat higher failure rates without becoming a dominantcontributor to failure.

A number of sensitivity studies with the worksheet developedthe table at the bottom of the worksheet. It illustrates the cur-rent reliability of the system and the required improvement infailure rates needed to achieve system reliability goals of up to95% over a 5-year period. This table shows that very low fail-ure rates are needed to achieve a high reliability.

As shown, the upper two tables reflect the goal of averagingone failure per rig per 10 years of operation (65, 8-week testcycles or wells drilled). The system reliability goal is varieduntil component group failure rates are obtained that as acomposite produce an expected value of 1 failure over themore than 171,000 subsea valve demands made during thatperiod. The values in the “Comp. Failure Rate Goal” columnthen becomes the failure rates to be demonstrated by the reli-ability testing program.

Elements of the Reliability Testing PlanEach group of similar valve types needs to undergo reliabilitytesting to provide confidence of its failure rate. If any one ofthe valve types has a significantly higher failure rate than itsfailure rate goal, it will generate a “weakest link” systemwhose reliability would be dominated by that component. Thefailure rate goal for each of the Family Groups is shown inFigure 4.

A binomial process for demand-related failures and the Pois-son process for time-related failure modes may represent thefailure rate. Both of these processes assume that observed fail-ures result from random failures of a population of comp o-nents characterized by a failure rate independent of the previ-ous life cycle of the valves under test. This implies that:§ A FAT has verified that manufacturing defects and

any infant mortality failure mechanisms are not pres-ent;

§ The total cycling of the valve is not of an amount tocause wear that is significant enough to precipitatewear-out failure mechanisms.

For demand-related failures, when the failure rate is low andthe number of demands is large, the binomial process may beapproximated by a Poisson process, so that the formulation ofthe statistical analysis of both time and demand related ismathematically the same, with only the units differing. (ThePoisson process relates a continuous time-related failuremechanism with units of failures/unit of time. A large numberdemands may be considered to occur over time, so the simi-larity of form should not be difficult to accept.)

Valves placed under test must be randomly selected in order tobe representative of the population. If the vendor conducts thetest, the components to be tested should be selected by some-one independent from the vendor.

The design of the test will depend on the historically observedfailure mechanisms that contribute to failure.§ If cycling the valves put stress on them, then the reli-

ability tests should involve repeated operationalevolutions where they are demanded to open and

OTC 15194 5

close in accordance with the operational require-ments;

§ If exposure to the subsea environment precipitates thefailures, the test must include exposure to these con-ditions, or more severe conditions that can acceleratethe mechanisms, for a period of time that can simu-late the total exposure.

As both mechanisms are most likely involved, the reliabilitytest needs to address both environmental exposure and opera-tional evolutions.

Testing alone does not improve reliability or guarantee that nofailures will occur within a given time frame. It verifies thatsystems and components are reliable or serves to identifyweak spots if they are not. To be effective, a reliability testneeds to account for the following:§ The tests need to be similar to actual operational con-

ditions;

§ The duration and/or operational evolutions in the testneeds to be large enough to provide confidence thatthe needed reliability can be achieved;

§ The root causes of any observed failures and anoma-lies need to be identified and corrected.

Testing done by specific purposes, such as burn-in, FAT andendurance testing to identify wear-out life, can provide indi-rect evidence that will increase confidence that a group ofsimilar valves will perform its mission successfully.

Amount of Testing to Provide Statistical ConfidenceClassical statistics relies strictly on outcome of valid tests oractual experience to provide statistical confidence in the reli-ability of a system or component. The higher the reliabilityrequirement, the more tests needed to provide that confidence.

The confidence limit is a means of judging the impact of theuncertainty of the component failure rates. When one estab-lishes failure rate estimates on the results of reliability tests orsamples from actual experience, it must be recognized that anygiven sample result can be produced by populations with dif-ferent failure rates. The confidence limit is a means of ex-pressing the probability that the sample result might have beenthe result of a “lucky” statistical outcome of a population thatactually has an unacceptably high failure rate. That is, if thetest were repeated again, the result would most likely beworse.

For the BOP system, it is assumed that the failure rate of allcomponents within each of the 6 component-type groups, de-fined previously, can be modeled by a single-componentgroup failure rate. The impact of component failure rate un-certainty on the uncertainty of system failure rate is illustratedby Figure 6. The curve on the left-hand side of the chart repre-sents 1 of 6 components having equal failure rates (equivalentto the 6 component-type groups in the BOP hydraulic controlsystem). The curve is typical of the uncertainty in failure rates.It illustrates that one does not have to demonstrate componentreliability to a very high confidence limit when it is part of a

larger series system. With many random variables, the impactof the higher end of the distribution of 1 component tends toget balanced by the lower portions of the distributions of othercomponents. For this 6-component series system, an 80% con-fidence that each component group failure rate <0.006/missionproduces 90% confidence that the system FR is no more than0.036/mission. This means that one can achieve reasonableconfidence of a given system reliability with less test cyclesfor the individual component groups.

Using the system reliability goal of 1 failure per 10 years ofsubsea operation. Figure 5 was generated from a Poissonworksheet. The table illustrates the number of test cycles withno failures required to meet the failure rate goals with 80%confidence for each of the component family groups.

Component-Testing ProgramThe component-testing program should focus on exercising asmany different hydraulic control system component types aspossible within an integrated test bed capable of mimickingfunctions associated with the hydraulic control subsystems.Such a test bed should require that subsystem and componentinterfaces be adequately tested under the range of operationaland environmental conditions expected during actual subseaoperations. It is anticipated that there are many functionalsimilarities among the 8 subsystems, such that a representativetest bed could be designed and built which would also be at ascale that would permit enclosing it in a suitable environ-mental chamber

Each type of control system will probably have its own re-quirements for a specific reliability test, such as number ofcomponents and number of cycles that should be in the pro-gram. However, the following types of tests should be in-cluded:§ A test to verify that manufacturing defects that leads

to early infant mortality are not present. (The valvemanufacturer should be doing this before it deliversthe valve);

§ Tests that demonstrate the anticipated operational lifeof the components in the anticipated subsea environ-ments. This test would need to identify controllingparameters and correlate accelerated testing condi-tions to those parameters so that confidence in theoperational life can be obtained in a reasonable pe-riod of time;

§ Reliability tests on a suitable test bed that simulatessubsea conditions of a set of components comprisingall the major component groups and interfaces. Thistest bed should be able to exercise the componentsover all the significant operational evolutions thatwould be required in the actual BOP system;

§ Product-acceptance tests for batches of componentsbeing delivered by vendors;

§ Post-maintenance tests for field use that can assist inverifying that the component has been returned to anacceptable condition.

6 OTC 15194

The program should focus on known problems based ontracking previous problems, but it also needs to maintain somekind of confirmatory testing for all component groups.

Pressure RegulatorsMost components in a control system, such as solenoid valves,piloted hydraulic valves, shuttle valve, etc., have a discretenumber of cycles in a 5-year life and can be determined byknowing the frequency of BOP tests or operations. However, aregulator typically has many cycles during a large volumedemand function such as an annular close. Figure 7 shows asample of the original modeling of a pipe ram close for a pre-vious project. Obviously, there appears to be a lot of activityof the regulator position during the function.

And, clearly, it would be impossible to determine the numberof cycles, or movements, of the regulator in a 5-year period.Therefore, an additional project has been initiated to determineif the regulator spool can be controlled or calibrated to be ableto determine its cycle behavior under various volume de-mands. This project is on going.

ConclusionsThe process described in this paper is contrary to how the off-shore industry typically specifies its equipment. Historically,functionality has been the primary focus of bid specifications.However, the content of this paper shows it is feasible, andshould be practical, to specify the equipment used on our Mo-bile Offshore Drilling Units (MODU’s) by performance speci-fications which meet our planned requirements.

It must be noted that component failures are random eventsand may still occur. However, demonstrated component reli-ability at this level provides a high confidence that significantdowntime can be minimized over the drilling cycle.

Obviously, the requirements contained in this paper will re-quire additional R&D by the vendors as well as a greater effortby the purchasers to understand and specify the requirementsfor any particular system. The end result of purchasing a morereliable system will be some form of additional cost. Plus, thevendors that can deliver a control system that can go 5 yearswithout maintenance will only see spare purchases once every5 years for each rig. The desire of vendors to provide this typeof equipment and service should allow a possible new eco-nomic model to be developed which allows the vendor, con-tractor, and operator to share in the savings resulting from nocontrols-related downtime.

OTC 15194 7

FIGURE 1. Multiplex Electro-Hydraulic Control System

FIGURE 2. Estimated Cycles

8 OTC 15194

FIGURE 3. Reliability Goal Spreadsheet

FIGURE 4. Component Failure Rates

OTC 15194 9

FIGURE 5. Component Testing

FIGURE 6. Confidence Level for Component Group and System

10 OTC 15194

FIGURE 7 Regulator Piston Position

96 March/April 2008 D R I L L I ND R I L L I N G C O N T R A C T O R

W E L L C O N T R O L

New generation of subsea BOP equipment, controls smaller, stronger, cleaner, smarter

WITH THE HIGH price of oil , it’s become more economical to go to deeper water depths and more challenging reser-voirs . With those more challenging reser-voirs, comes a whole new set of problems designing the next generation of drilling rigs and subsea BOP equipment. Those new challenges have inspired a new age of BOPs that have been made smaller by reducing the number of stack-mounted accumulators, stronger by increasing the available shear force, cleaner by develop-ing a complete fluid recovery system, and smarter by improving the control system diagnostic systems.

DEPTH COMPENSATEDACCUMULATORSToday’s designed operating environment for stack-mounted accumulators is chal-lenging. Design criteria include 12,000-ft water depths, temperatures as low as 40ºF and surface temperatures of 120ºF, rapid discharge (Adiabatic), as well as higher minimum system pressures.

All of these things add up to a large number of bottles on a lower BOP stack. It is not uncommon to see as many as 126 accumulator bottles on a lower BOP stack, 98 of which are dedicated to the shear system alone (Figure 1). This adds weight to the overall assembly, increases maintenance requirements and decreases stack equipment access. By using the water column pressure and mechanically boosting the hydraulic pressure, a depth compensated accumulator has reduced the total number of stack-mounted shear circuit bottles from 98 conventional 6,000-psi, 15-gallon accumulators to seven depth compensated bottles (Figure 1).

Before we can understand how this hap-pens, it is important to understand what effect the subsea operating environment has on accumulators and gas. There are three major factors that effect gas performance subsea: temperature, dis-charge type and water depth.

TEMPERATUREColder gas equals d enser gas. Take this example problem using a 15-gal-lon, 6,000-psi accumulator. A surface temperature of 120ºF is used, assuming

the bottles are in the sun on the vessel before it is deployed and are charged to the maximum rating for those bottles of 6,000 psi. The effect on the gas from a reduction in temperature to 40ºF is the gas pressure reducing to 4,785 psi. More than 1,200 psi precharge pressure is lost just from reducing the temperature.

ADIABATIC DISCHARGE Adiabatic discharge equals rapid dis-charge. T he definition of an “adiabatic process” is a process by which no energy is absorbed or released into the environ-ment. When compressing a gas, that process will heat the gas. Conversely, when decompressing a gas (accumulator discharge), the gas gets colder.

Accumulators dedicated to shear are rapidly discharged, and there is no time for the outside temperature to re-heat the gas. Therefore, when the gas is dis-charged, it is colder in its discharged state. Remember, colder gas equals denser gas; therefore more gas is needed to compensate for this condition. About twice as much gas is required for an adiabatic discharge compared with an isothermal discharge (isothermal assumes the environment has time to re-heat the gas, and it stays at a constant temperature).

WATER DEPTH Deeper water equals lower compression ratio. To understand how water depth effects gas performance, there is a basic measure of gas performance called “compression ratio.” Compression Ratio is:

minmaxPPCR =

Where:

• CR = compression ratio

• Pmax = maximum system pressure, the pressure at which the system pumps turn off.

• Pmin = minimum pressure required to operate a function, i.e., 3,000 psi for the shear rams.

The higher the compression ratio, the more springy the gas is, the better it performs. For example the compression ratio at surface is:

1. 76630005000

minmax

===psipsi

PPCR Surf

When the bottles are placed subsea, the pressure created from the water column from depth is additive to those pressures. Therefore the compression

By Frank Springett and Dan Franklin,National Oilwell Varco

Figure 1: In this comparison of lower BOP stacks, the configuration on the left has 15-gallon, 6,000-psi N2 accumulators that can add up to more than 100, with 98 dedicated to just the shear system. At right are depth compensated accumulators that reduce overall assembly weight and maintenance needs.

97March/April 2008

W E L L C O N T R O L

D R I L L I ND R I L L I N G C O N T R A C T O R

ratio at a 12,000-ft water depth (5,350 psi pressure from water column) becomes:

1. 428350

103500003 05350005 0535

12000 ==++

=psipsiCR ft

Therefore, the gas compresses less and more volume (bottles) must be added to compensate (Figure 2).

For the following condition, one 15-gal-lon, 6,000-psi nitrogen accumulator yields only half a gallon of usable vol-ume.

• Discharge type = adiabatic.

• Surface pressure = 5,000 psi to 3,000 psi.

• Surface temperature = 120ºF

• Subsea temperature = 40ºF

• Water depth = 12,000 ft

For those same conditions but at a water depth of zero (at surface), the usable vol-ume is 2 ½ gallons. Imagine being able to have accumulators perform subsea like they do at surface. That is exactly what has been accomplished with the depth compensated accumulator. Figure 3 shows how it works.

The system is comprised of a double piston accumulator, with the two pistons connected by a connecting rod. This con-figuration creates four distinct chambers in the accumulator.

The first chamber has a vacuum or very low pressure in it; the second chamber is exposed to sea water pressure. The sea water pressure (5,350 psi at 12,000 ft) acting on the piston, with the vacuum on the opposite side, creates a large force on the piston connecting rod. The third chamber has system hydraulic fluid, and it counters the sea water pressure by holding the same pressure (5,350 psi). Now add nitrogen in the fourth chamber, and it further adds to the third cham-ber’s hydraulic pressure (5,000 psi), boosting the hydraulic pressure to 5,000 + 5,350 = 10,350 psi. The compression ratio for the nitrogen pressure in opera-tion at 12,000 ft water depths is the same as it is at surface.

1. 76624004000

=psipsiCRSurf

So how does the depth-compensated accumulator perform relative to other industry solutions? Figure 4 shows how

nitrogen and helium perform with a 6,000-psi and 7,500-psi bladder or piston accumulator. Helium can only be used with piston accumulators, and the gas needs to be transported out to the rigs. Nitrogen is available on some rigs via a nitrogen generator and high-pressure compressors. Note the comparison is

in percentages, which shows how much gas is required for a particular function, regardless of volume of the function. As can be seen in Figure 4, the depth compensated accumulator is a major improvement over existing industry solu-tions.

5000 psi

12,000 ftD

EPTH

Pump

BOP

10350 psi

= 1.6750003000

Surface

= 1.24103508350

Subsea

100%

87%

63%

52%

0%

25%

50%

75%

100%

6000 psi - N2 7500 psi - N2 6000 psi - He 7500 psi - He DCB

NITROGEN

Helium

25%

DCB

Figure 2 (above): Compression ratio mea-sures the effect of water depth on gas performance, where deeper water equals a lower compression ratio.

Figure 3 (left) shows how a depth com-pensated accumulator works.

Figure 4 (below) compares the depth compensated accumulator with existing industry solutions.

98 March/April 2008 D R I L L I ND R I L L I N G C O N T R A C T O R

W E L L C O N T R O L

22-IN. 5,000-PSISHEAR OPERATORSThe more challenging drilling environ-ments have required that drill pipe become stronger, tougher and heavier. Because of this, higher shear forces are required. Previous systems have been limited to 1.2 million lbs of shear force, where as the next generation of BOP operator is capable of 1.9 million lbs . These shear rams have three basic features : high shear force, tail shaft lock and split piston .

HIGH SHEAR FORCE Shear force is a function of cylinder size, tandem booster configurations, as well as hydraulic pressure capacity. The largest system manufactured in the past by National Oilwell Varco has been a 14-in. main piston with an 18-in. booster at a maximum pressure of 3,000 psi, which creates 1.2 million lbs of shear force. The next generation of BOP opera-tor has a single piston 22 in. in diameter (approximately the same area as the 14x18 configuration, but shorter and

easier to manage) and is designed to use a maximum continuous system operating pressure of 5,000 psi, yielding a shear force of 1.9 million lbs.

TAIL SHAFT LOCK Industry regulations require that an automatic lock be utilized that will maintain BOP integrity should there be a loss of hydraulic pressure. The 22-in. 5,000-psi shear operator has a tail shaft locking mechanism that is both simple yet robust. On the tailshaft of the opera-tor, there is an upset (reduction in diam-eter) at the end of the tail shaft. When the shear operator closes nearly all the way, a series of radial locking dogs are exposed to the upset on the tail shaft. A secondary piston drives the lock dogs on to the tail shaft. Once the ram is all the way closed, the lock dogs are com-pletely recessed on the tail shaft upset, and the secondary locking piston passes completely over the top of the lock dogs, preventing them from moving out radi-ally again should hydraulic pressure be lost. (See Figure 5.)

SPLIT PISTON Further to this system, there is an inno-vative split piston system integrated into the 22-in., 5,000-psi shear operator. In order to understand why this split piston design is required, first we must look at the force balance equation for the shear operator, as well as the shear rams with their associated seals. Once the tubular has been sheared, and the shear opera-tors are nearly fully closed, the shear ram contacts the shear ram on the oppo-site side. There are rubber seals inside the shear ram blocks, which is what the rams react against. The area of rubber that makes contact is 12.5 sq in. Without the split piston, the entire force from the shear operator (1.9 million lb) is reacted on that area (Figure 5), creating a poten-tial rubber pressure of:

psi

inlbs

inpsiinPrubber 251 , 000

21 .51, 009 , 000

21 .55000380

22

2

==×

=

In order to alleviate this, there is an outer and inner piston. The outer piston has a diameter of 22 in., which is used through all of the stroke of the shear operator with the exception of the last ½ in. The inner piston has a diameter of 12 in., and it slides inside the outer piston during that last ½ in. of stroke. The force created by the inner piston is 565,000 lbs (Figure 6), which in turn cre-ates a much smaller rubber pressure of 45,000 psi.

psi

inlbs

inpsiinPrubber 54 , 000

21 .5565 , 000

21 .55000113

22

2

==×

=

By reducing the rubber pressure, the rubber has less of a tendency to extrude which in turn increases rubber life. Lower rubber pressure also reduces the stresses on the shear ram blocks as it does not need to contain as much rubber pressure.

FLUID RECOVERY SYSTEMSome area regulations require that the BOP control fluid be recovered for envi-ronmental reasons. Today’s systems are designed such that the hydraulic fluid is water-based with additives to add some lubricity and anti-corrosion character-istics. In many areas of the world, this fluid is considered environmentally safe; therefore, when a BOP is operated, its exhaust fluid is dumped to the environ-ment (sea). Figure 7 shows a basic lay-out for a conventional system.

An easy way to recover the fluid could be to run a return line to surface, wouldn’t it? Unfortunately, this is not the case, as the high return flow rates create high

Figure 5 (top): Without the split piston, a potential rubber pressure of 152,000 psi is created. Figure 6 (bottom): By using an outer and inner piston, a much smaller rubber pressure of 45,000 psi is created.

F = 1,900,000 lbs

A = 12.5 in2

22”

A = 380 in2

P = 152,000 psi

12”

F = 565,000 lbs

A = 12.5 in2 A = 113 in2

P = 45,000 psi

100 March/April 2008 D R I L L I ND R I L L I N G C O N T R A C T O R

W E L L C O N T R O L

back pressures. The high back pressure can then cause other BOP functions to inadvertently close. This phenomena is created by the difference of area between open and close side of a BOP operator (area of close side > area of open side). The high back pressure acts on both those areas simultaneously, which then creates a net force closing the rams (Figure 8).

kcaB sserpAreakcaB sserpAreaForce OpeningolC golC g ..sinsin ×−×=

This force can be as high as 60,000 lbs, plenty of force to close the BOP opera-tor. The solution to this problem is to pump the fluids to surface with a com-plete fluid recovery system. The system design and its components can be seen in Figure 9.

PUMP A reciprocating pump was designed to keep the system simple, easily powered by hydraulics and to use as much exist-ing subsea technology as possible. The flow capacity and the ratio of hydraulic power section to discharge pumping sec-tion is a function of discharge pressure. Discharge pressure is a function of the length and diameter of the return tube and pump discharge flow. The piping used to pump the fluid to surface is one of the rigid conduit lines on the riser (12,000 ft and 2.32-in. inside diameter).

Some annular functions can see inter-mittent flows of up to 225 gallons/min , which equals a back pressure of up to 4,000 psi. A pump this size (225 gallons/min , 4,000 psi discharge pressure) would be exceedingly large and consume too much hydraulic fluid to pump it to sur-face. It was decided to design a more reasonable, smaller pump and add a reserve capacity. The decided ratio of the hydraulic section to the discharge section was 6:1, which yields a discharge pressure of 500 psi.

At 12,000-ft water depths, the flow capacity is approximately 60 gallons/min. Over- and underpressure protection was added to the returns line to ensure the integrity of the system when it is deployed or should the fluid recovery pump fail, the fluid is dumped to the environment and the BOP can still func-tion in an emergency situation.

RESERVE CAPACITY The reserve capacity serves two pur-poses. First, it provides a surge capacity for the high return flows from the BOP s when the return flow is greater than the

Figure 7 (right) shows the basic layout for a conventional fluid

recovery system. Fig-ure 8 (below, middle)

shows that in a conventional system,

high back pressure can cause other BOP functions to inadver-

tently close. Figure 9 (bottom) shows a

fluid recovery system that can resolve this

problem.

BOP Operator

VENT TO SEAPressure = 5350 psi

Subsea Bottles

Surface Bottles

Pump

Valve

Control POD

Area Open < Area Close

Return P = 2000+ psiOver 2000 psiBack PressureINADVERTANT

CLOSURE!!!

RETURN LINE TO SURFACE

PRESSUREPROTECTION

Sea Level

BACK PRESS REG VALVECompensates for Density difference

between SW & Hyd FluidSurface Bottles

Pump

BOP OperatorSubseaBottles

ValveReturn Press < Sea Water Press

RESERVECAPACITYAllows for

smallerpumps

MINI PISTONKeeps Return

System below SWPress

Pumps FluidBack toSurface

FLUIDRECOVERYPUMP

102 March/April 2008 D R I L L I ND R I L L I N G C O N T R A C T O R

W E L L C O N T R O L

pump flow rate. Once the high return flow surge has ceased (the BOP has closed/opened), the pump can continue to pump out the reserve capacity. The second function equalizes the pressure between the environment (sea water) and hydraulic returns. By equalizing the pressure for the return fluids, the sys-tem acts the same as a system without the fluid recovery system. The reserve capacity is comprised of an 80-gallon bladder type accumulator . Hydraulic returns are fed into the steel side of the accumulator. Sea water is introduced into the bladder side of the accumulator, and the bladder is the barrier between the two.

MINI-PISTON The challenge is to keep the hydraulic fluid evacuated from the reserve capac-ity bottle when the BOP s have been func-tioned. This is performed via an innova-tive mini-piston that keeps the hydraulic return side of the reserve capacity at a slightly lower pressure (up to 45 psi) than the sea water pressure. Figure 11 shows a cross section of the fluid recovery pump, where the mini piston is identified. It is simply a tube that always has system pressure on it. This tube and associated pressure forces the piston down creating a negative pressure on the return volume, as well as compensat-ing for seal drag on the pistons of the pump.

BACK PRESSUREREGULATING VALVEThe density of sea water is heavier than that of the water-based hydrau-lic fluid. Although they are very close,

the difference in pressure at 12,000-ft water depths can be as high as 150 psi. Without a back pressure regulating valve, the under-pressure protection valve would open, allowing sea water to enter the return line until the pres-sures equalized. With the back pressure regulating valve located on the return line, this issue is resolved. The pressure setting of the back pressure regulating valve is set to the equivalent density dif-ference between the fluids at depth.

PUMP CONTROLS The hydraulic pump controls are simple, passive and use existing valve components. The MUX control system only needs to command when the fluid recovery system is to be turned on, the reciprocating motion of the pump is done via mechanical and pilot actuation of the valves on the pump, no discrete input/output is required for the reciprocating motion of the pumps. Once the reserve capacity is evacuated, the pump stalls and waits for another BOP function to be fired. The valves used are the same types of valves used on BOP control sys-tems for the past 20 years.

SMART CONTROLSImagine a control system that knows it will fail before it fails. The more chal-lenging reservoirs and higher burden rates require this level of diagnostics. Let’s look at a basic overview of the control system to understand how this is possible (Figure 10).

On the vessel, at the surface, are redun-dant controllers, which communicate commands to the BOP via the MUX cable. Once the MUX cable reaches the

BOP stack, commands are received by the redundant control pods. In the pod are input / output bricks that convert those commands to signals to drive the solenoids or other field devices.

MUX CABLE MONITORING The MUX cable is comprised of both fiber cores for communication, as well as copper cores to transmit power to the BOP. It is probably one of the most criti-cal, complicated, robust and expensive cables on a rig today. Because of the critical nature of the cable, continuous monitoring has been implemented. The fiber signal strength can be measure by db of light signal, and the copper cores are measured by ground fault monitor-ing. The monitoring is then trended over time to see if there has been any degra-dation of any particular portion of the cable and can be rectified prior to loss of signal.

SYSTEM CHECK Monitoring the MUX cable is only one part of the electrical controls for the BOP stack. To check the rest of the sys-tem, a complete system test is performed every 8 minutes. The system test checks the signal from the controller to the pod, through the output brick to the solenoid by sending a command for each sole-noid to fire for 5 ms. This time isn’t long enough to actuate the hydraulic valve, but it is long enough to confirm the integrity of all the system components. In the event that one of the redundant system components fails, an alarm is activated.

In conclusion, the next generation of BOP stacks and controls are smaller, by advent of an innovative depth compen-sated accumulator; stronger, by increas-ing the piston size and designed to con-tinuously operate at 5,000 psi; cleaner, by way of a complete fluid recovery sys-tem; and smarter, by continuously moni-toring MUX cables and doing frequent complete system checks.

About the authors: Frank Springett, a new product line engineer with National Oilwell Varco, has 13 years of experience in the petro-leum industry . He is a mechanical engineer by training and holds a B.S. in mechanical engineering and marine engineering technol-ogy from the California Maritime Academy. Dan Franklin is the engineering manager for Koomey Control Systems at National Oilwell Varco. He is an electrical engineer by train-ing and holds a B.S. in electrical engineering from the University of Nebraska.

This article is based on a presentation at the IADC International Well Control Conference & Exhibition, 28-29 November 2007, Singapore.Figure 10: An overview of the subsea control system that provides high-level diagnostics.

36 May/June 2007 D R I L L I ND R I L L I N G C O N T R A C T O R

S P E C I A L M A R I N E E D I T I O N

Design evolution of a subsea BOP

THE FIRST RAM BOP was devel-oped in 1920, and, in the last 90 years, the principle of operation of a ram BOP has not deviated much from the original concept.

In a typical design, a set of 2 rams is mechanically or hydraulically closed either around a wellbore tubular to form a pressure-tight seal against downhole pressure or wellbore fluids. Shearing rams were introduced in the 1960s. These rams sheared the pipe in the wellbore, but an additional BOP cav-ity containing a set of blind rams was required to seal the bore. Later, these functions were combined into shearing blind rams, commonly known as SBRs, which reduced the number of BOP cavi-ties required to 1.

From the 1st BOP design to the pres-ent designs, the basic mechanisms have remained constant: A BOP body is sandwiched between 2 operating sys-tems. The rams are opened and closed mechanically either by manual interven-tion or by hydraulically operated pistons.

What has changed, however, and is in a constant state of flux are the oper-ating parameters and the manner in which BOPs are used in today’s drilling activities. Today, a subsea BOP can be required to operate in water depths of greater than 10,000 f t, at pressures of up to 15,000 psi and even 25,000 psi, with internal wellbore fluid temperatures up to 400° F and external immersed temper-atures coming close to freezing (34° F).

THE CHALLENGEThe deepwater challenges being expe-rienced by drilling contractors and oil companies alike are critical technical challenges that must be overcome if drilling is to move into deepwater envi-ronments

Today’s deepwater BOPs can be required to remain subsea for extended periods of time ranging from 45 to 90 days for a single well, to more than a year in cases where drilling and completions on multiple wells are required. In all cases, however, when the BOP is called on to function in an emergency situation, it is the main barrier protecting human life, capital equipment and the environment.

Therefore, it must function without fail. One possible enhancement involves tak-ing advantage of advances in metallurgy to use higher-strength materials in ram connecting rods or ram-shafts.

The newbuild drilling and production facilities under construction for today’s market are limited for space and han-dling capabilities and, therefore, require that BOP stacks be lighter-weight and take up less space on the rig while pro-viding the accustomed functionality. In addition, existing limited capacity rigs have the potential to be upgraded for use in deepwater with higher-capabil-ity equipment, but the upgrade must be accomplished within limited height and weight parameters. With deck space and load capacity of these rigs already at a premium, lighter weight BOPs can help offset distribution of alternative equipment such as subsea riser joints necessary for increased water-depth capability.

BOPs today are also being used not only in drilling and workover applications but also in completions and production envi-ronments . The industry is not just deal-ing with drilling mud anymore.

By Melvyn F (Mel) Whitby,Cameron’s Drilling System Group

The above shows a typical BOP operating piston assembly with a transverse-mounted locking mechanism.

Blowout preventer requirements get tougher as drilling goes ever deeper

37May/June 2007

S P E C I A L M A R I N E E D I T I O N

BOPs have traditionally evolved using conventional design methodology. Today the envelope is rapidly changing, forc-ing some fundamental paradigm shifts. Emerging technologies give way to new manufacturing techniques and innova-tion of design of operation. Sealing tech-nology has improved radically with new materials and compounds being used to formulate sealing elements able to with-stand extreme temperatures and hostile fluid environments.

RELIABILITY OF OPERATION The increased design complexity of mod-ern-day BOPs can come at a price. While high-tech solutions may seem desirable, the intricate mechanical components that may result must be considered, along with other factors, such as pos-sible leak paths and redundancy of criti-cal seals.

In addition, control system functions can be limited and, in order to save func-tion availability, hydraulic functions are often combined. An example of this is the integrated closing and automatic lock-ing of the BOP when the closing function is initiated. This combined function has now been discarded, in many instances, in favor of separate close and lock func-tions. It is now understood that the chances of a locking system problem are increased with a proliferation of locking cycles.

Many drilling contractors today are reluc-tant to operate the locks subsea in order to prevent unnecessary unlocking prob-lems. The locks are tested on the surface for assurance that they will operate should the situation arise. In the perfor-mance characteristics section of API 16A, API suggest that the locks be fatigue-tested in concurrence with a 546 cycle, 78 pressure cycle API ram fatigue test.

This test initially was designed to simulate 1 closure per day and a weekly pressure test for an estimated period of 18 months’ service. In combining the locking system test into this test, it was recommended that every 7th pressure cycle be conducted in locked mode. This means that during the course of an 18-month service period, the locks were expected to be used a total of 11 times.

Combining the closing and locking system function meant that the locks were being exposed to a locking opera-tion every time the BOP was operated, requiring a complicated mechanical or hydraulic sequencing arrangement be incorporated. In addition , a locking sys-

tem can be exposed to extremely high load forces during a shearing operation and is therefore required to be extremely robust by design. The complexity of such systems and their mechanical function can be impaired by the acute mechani-cal detail required to make them work adequately.

FLUID CONSUMPTION,ACCUMULATOR VOLUMEFluid consumption is a double-edged sword: Less fluid typically comes at a high cost because conventional design philosophy often means that smaller pis-tons yield smaller force output. In deep-water applications, this force is addition-ally reduced by the hydrostatic column of seawater and/or drilling mud. In order to mitigate these factors, 2 things must be considered — closing ratio and piston area.

Smaller-diameter pistons mean that wellbore-exposed areas are minimized and, therefore, will not “rob” the oper-ating system of much-needed power. However, the piston area must be large enough to provide sufficient power for ram seal energizing and rubber feed, and must provide the power to shear high-strength, ductile tubulars when necessary.

The downside of traditional design phi-losophy is that a piston large enough to provide the much-needed power is almost the same area in opening as it is in closing. Ergo, a BOP that requires 22 gallons of fluid to close will require approximately 18 gallons to open, a fac-tor that can affect the surface and sub-sea accumulator bottle count.

Another negative impact is that a larger BOP opening area can actually put the equipment and the environment at risk. If opening pressure is inadvertently applied to a BOP that is retaining well-bore pressure or residual pressure, damage can result to the connecting rod and/or the ram to connecting rod interface. This damage can result in the loss of sealing integrity or ram control, leaving the rig at risk and increasing the potential for environmental harm, not to mention the associated downtime neces-sary for repair.

By separating the closing function from the opening function and reducing the opening area, a number of benefits can be realized:

• Reduced operating volume. More clos-ing power can be achieved by using

D R I L L I ND R I L L I N G C O N T R A C T O R

38 May/June 2007 D R I L L I ND R I L L I N G C O N T R A C T O R

S P E C I A L M A R I N E E D I T I O N

a large closing piston diameter and a second smaller piston diameter for the opening function. For example a closing area of 224 sq in. and an opening area of 41 sq in. results in 22 gallons to close but only 8 gallons to open.

• Reduced opening area. Smaller oper-ating piston diameter reduces the effec-tive opening ratio of the BOP, thereby protecting against accidental operation with wellbore or residual pressure in the BOP bore. In the event that open-ing pressure is applied in this case, the operating piston would stall, preventing potential damage to the connecting rod or ram.

• The closing piston and opening piston seals may be separated, preventing pos-sible leak communication. Additionally, in the unlikely —but not impossible — event that wellbore pressure was to bypass the connecting rod seals, the structural integrity of the BOP bonnet would not be at risk.

LOCKING OPERATION,RELIABILITYOver the course of BOP development, mechanical locking systems have by nature become more and more complex. Considerable BOP downtime has been attributed to errant operation or inabili-ty to unlock when required. These events typically involve possible milling through closed rams and eventual tripping of the BOP back to the surface for repair or remedial work. A lock should ultimately be reliable, but with complexity comes risk. Multiple parts must interface for proper operation.

Taking a step back in time, surface BOPs have utilized a simple but effective form of mechanical lock — a simple rotating threaded locking screw placed behind the operating piston after hydraulically

closing the BOP. With recent subsea advancements in

hydraulic gear motors for torque applica-tions, it may be time to

look down this path for a simple, reliable locking operation. A number of benefits could be real-

ized, including simplicity, ease of maintenance and reliability, to

name but a few.

SUBSEA INTERVENTIONCAPABILITY A simple, mechanical-type locking system for subsea BOPs may open up opportunities for intervention by a remote-operated vehicle (ROV), thereby allowing for intervention subsea. ROVs are already doing this work in other applications that require mechanical intervention, such as on subsea trees that require manual override and the torque-up of API Class 1 – 4 flange con-nections.

HEIGHT AND WEIGHTThe height and weight of a BOP body is determined by factors such as ram cav-ity height and geometry, and the operat-ing system or bonnet design. Minimal cavity height can realize height savings but at the sacrifice of ram packer vol-ume, which is important for the longevity of the sealing mechanisms in operation subsea. Large operating systems require excess distances between the cavities of double and triple BOP bodies.

By careful redesign of the operating system, cavity height can be increased for effectiveness while minimizing height impact. In one such case, using an 11.5-in. tall cavity, the height of a double BOP body was reduced from 83 in. tall to 72 in. tall while maintaining a large operating system area. This could be achieved either by using a binocular-style operating piston arrangement or an oval-shaped piston instead of the tra-ditional circular style piston. Shortening the height of the BOP components in a subsea stack either allows for a shorter drilling substructure arrangement or allows for the incorporation of BOP cavi-ties within existing substructure height envelopes.

MAINTENANCE, OPERABILITYEase of use and simplicity of operation and maintenance are key components to BOP design. In order to achieve these

goals, several factors should be consid-ered:

• Leak paths between critical functions should be minimized.

• Redundancy of seals should be utilized wherever possible.

• A means of isolating hydraulic func-tions to the BOP should be employed, if possible, to minimize personnel risk while conducting maintenance opera-tions with the bonnets open.

• Provision should be made to allow safe handling of the bonnets should removal for repair or maintenance be required.

• Efforts should be made to minimize the handling of components weighing more than 20 lbs, or lifting arrangements should be provided to assist in their safe removal.

While efforts within the industry have been made to reduce or even remove the bonnet securing bolting, the benefits have been offset by the associative com-plexity and thereby increasing the risk of serious mechanical problems. These problems can cause excessive downtime when the BOPs are finally pulled back to the surface, not to mention the pos-sibility of debris and cement causing problems with internal bore style bonnet retaining mechanisms. The complexity of these arrangements, while appearing to be high-tech, do little to enhance the subsea performance and surface main-tainability of the equipment.

One reasons that BOPs have changed very little over the years is that it is extremely difficult to improve on simplic-ity without sacrificing reliability.

Melvyn F (Mel) Whitby is senior manager of research and development at Cameron’s Drilling System Group.

This article is based on a presentation at IADC World Drilling 2007, 13-14 June 2007, Paris.

A 3D view of a BOP operating pistonassembly with transverse mountedlocking mechanism.

An example of a 18 ¾-in. 15M subsea BOP with 18-in. operating pistons.

Cameron supplies integrated subsea drilling systems designedspecifically to tackle the demands of deepwater, high pressureapplications including BOP stack systems, control systems, risersystems and choke systems. Cameron subsea drilling componentsinclude the following:

Subsea Drilling System Components (Surface)Control System

1. Auxiliary Remote Control Panel and Battery Bank2. Driller’s Panel3. Hydraulic Power Unit4. Accumulator Bank5. Hose/Cable Reels

Choke System6. Choke Manifold7. Choke Manifold Control Console

Riser System8. Telescoping Joint

Motion Compensation System9. Drill String Compensator10. Riser Tensioner

Subsea Drilling System Components (Subsea)Control System

1. Hydraulic Conduit Supply Line2. MUX Control Pod3. Conduit Valve

Riser System4. Riser Joint5. Riser Connector6. Termination Spool

Lower Marine Riser Package7. Flex Joint8. Annular BOP9. Choke/Kill Connector

BOP Stack10. Subsea Gate Valve11. Double Ram-Type BOP

with Super Shear12. Double Ram-Type BOP13. Guide Structure14. Collet Connector

9S U B S E A D R I L L I N G S Y S T E M S

Riser System

Stack System

17D R I L L I N G C O N T R O L S Y S T E M S

The subsea MUX electro-hydraulic BOP control systemfrom Cameron offers state-of-the-art controls for

Cameron BOP systems. Each system is designed with a true systems approach

for maximum efficiency. The modular structure of thesystem allows Cameron to look at each drilling programfrom a total systems level, not just from an equipment level.Only Cameron combines this approach with the fulltechnical and project management resources of theCameron organization, offering customers:

• Subsea retrievability Unlike any other system in theindustry, the modular design of the Cameron systemallows the subsea control pod to be retrieved andreplaced without pulling the riser stack.

• Redundant system architecture Component levelredundancy eliminates single point failures. All criticalsystem functions have been engineered with multipleback-ups for continuous operations.

• Robust components Subsea components are rated forup to 10,000 ft (3000 m).

• Smaller and lighter Cameron subsea MUX drilling controlsystems are the smallest and lightest in the industry.

• Functionality Cameron MUX systems provide up to 112hydraulic functions per subsea control pod.

L A N D A N D P L AT F O R M B O P C O N T R O L S Y S T E M SCameron offersreliable, econom-ical direct hydraulicdrilling controlsystems for use onland or platform.Systems are design-ed in accordancewith API 16D

specifications, as well as all appropriate codes and standards for explosive andhazardous area classification. Dual control panels providemaximum flexibility, while the modular components delivermaximum reliability and field serviceability.

Cameron cellar deck-mounted piloted control systemsare unprecedented

for control ofBOP stacks onjackup typerigs. Proventhrough years

of fieldapplications,these systems

provide significantly increased response time for control ofsurface-mounted equipment.

M U X S U B S E A C O N T R O L P O D SThe Cameron subsea MUX drilling control pods combinerapid response time with an array of features that makethem both reliable and economical at depths of 10,000 ft(3000 m).

The Mark I Pod, capable of 72 functions, is designed formost typical and deepwater applications, offering a compact

footprint and weight of10,000 lb (4536 kg). TheMark II Pod, capable of 112functions, is designed forultra deepwater environ-

ments and weighs 15,000lb (6804 kg). The pod

houses the hydraulic moduleand electronic MUXpackage. Two accumulator

banks are placedconveniently aroundthe BOP stack.

The hydraulicmodule is a standard

Cameron modular pod. Modulesfeature seawater tolerant, stainless steel valves and pressureregulators with sliding, metal-to-metal, shear type seals.

The electronic MUX package consists of the SubseaElectronics Module (SEM) and the solenoid valve package.The SEM contains dual redundant electronics which providecommunications via modem with the surface electronicsystem. The solenoid valve package converts the electroniccommands into hydraulic signals which actuate the largevalves in the hydraulic module.

S U B S E A P I L O T E D A N D D I R E C T H Y D R A U L I CC O N T R O L S Y S T E M SFor operating the BOP stack and associated equipment inshallower depths of 5000 ft (1500 m) or less, Cameronoffers piloted hydraulic drilling control systems.These systems offer the same robust, field-proven components as the MUX system,but they are controlled via hydraulicconnections between the surfacecontrols and subsea control pod.

Like the subsea MUX systems, the piloted systems featureredundant architecture for absolutereliability, and are fully retrievablewithout pulling the riser. Subsea system functions can be operated byeither the driller’s control panel, tool-pusher’s control panel or touchscreen, as well as by thetertiary operator panel located on the diverter control unit.

MUX Control Pod

Hydraulic Control Pod

Platform Control System

Land Closing Unit

M o R P H D R I L L I N G C O N T R O L S Y S T E M18

The new Cameron MoRPH™ Drilling Control System is theblending of technologies to provide a simple, quick,

economical solution for extending the water depth range of second to fourth generation drilling rigs.

The MoRPH system offers a hybrid design which is idealfor rigs drilling in mid-range water depths. MoRPH systems

control time-critical functions by electrical signals (similar to

MUX systems) while non-criticalfunctions are controlled by pilot lines

(like the current shallow water systems). In order to do this, MoRPH systems divide BOP stack

control functions into two basic categories:

• Time-critical functions such as opening and closing ram and annular BOPs that must meet the API timingrequirement

• Non-time-critical functions

Time-critical functions are controlled by electrical signals,while non-time-critical functions are controlled by pilot lineslike the current shallow water systems. This ensuresadherence to the API requirement by converting critical“shut-in” functions to an electro-hydraulic system, yetretains the simplicity of direct hydraulics for other functions.

The MoRPH system is easily adapted to existing pilotedhydraulic systems.

Toolpusher’s Control Panel

Driller’s Control Panel

Hydraulic Interface

MoRPH Umbilical Reel

Umbilical Clamps

LMRP, FITA and Clamp assembly

Existing Hydraulic Pod

Subsea Stack

MoRPH Pod

Electric/HydraulicFlying Leads

Complete MoRPH system

M o R P H C O N V E R S I O N R E Q U I R E M E N T S

Existing Equipment MoRPH System

Driller’s and toolpusher’s control panels, Use as issurface wiring, manifold, accumulators, pumps, reservoir, UPS, surface hose umbilicals, guide arms, BOP and LMRP plumbing, shuttles valves, etc.

Riser hydraulic line(s) Use if over 2-7/8”

Hose clamps Use w/ adapting bushing

All hydraulic pods Use w/ new mounting holes

All hydraulic hose reels and umbilical Remove

Hydraulic interface New

Distribution junction box New

ROVs parking plates New

Umbilical and reel New

controls and major catastrophes (such as damage to theriser system). Cameron offers a variety of emergency, back-up and deepwater control systems to meet the needs of allthree types of situations. The choice of which system isrequired in a particular situation depends upon the specificneeds of each individual application.

19E M E R G E N C Y S Y S T E M S

Greater concerns for our environment and for the safetyof employees are making the automated systems for

shutting in a well become standards on all drilling rigs.Three types of systems emergency situations could poten-tially require use of emergency backup systems: operatorinitiated procedures, emergency mitigated by loss of main

EDS (Emergency Disconnect Sequence)A system to close the rams with a program-med sequence of events when a button isactuated by an operator.

AcousticA system to activate a limited number offunctions from the rig when no othercommunications are possible.

ROV PanelsA system to operate a limited number offunctions by the use of an ROV whennormal operation is not available.

Deadman (Automatic Mode Function)A system to automatically close the shearrams when there is catastrophic loss of theriser systems.

Automatic Disconnect SystemA system to automatically close the shearrams when the riser angle exceeds a certainpredetermined limit.

Autoshear A system to automatically close the shearrams when there is an unplanned disconnectof the LMRP

SD 034582

PipeBonnet

ShearBonnet

ClosePressure

TandemStandard

OpenPressure

UM BOP Open and Close Hydraulics(13-5/8” 10,000 Shown)

PipeBonnet

ShearBonnet

ClosePressure

OpenPressure

TC1542 20

UM BOP Operating Data and Fluid Requirements

Bore Size andWorking Pressure

Gals to Open Pipe Rams(1 set)

Gals to Close Pipe Rams(1 set)

Gals to Close Shear Rams(1 set)

Closing Area(Sq. inches)

Locking Screw Turns(Each End)

ClosingRatio

OpeningRatio

7-1/16” All WP 2.2 2.3 2.4 67.3 18 11.7:1 3.8:1

11” Except15,000 psi 6.2 6.2 7.4 113.8 27 13.7:1 3.7:1

11” 15,000 psi - - - - - - -

13-5/8” Except15,000 psi 7.5 7.5 8.8 110.15 32 8.7:1 2.3:1

13-5/8” 15,000 psiModel B - - - - - - -

Bore Size andWorking Pressure

Liters to Open Pipe Rams(1 set)

Liters to Close Pipe Rams(1 set)

Liters to Close Shear Rams(1 set)

Closing Area(Sq. cm)

Locking Screw Turns(Each End)

ClosingRatio

OpeningRatio

7-1/16” All WP 8.3 8.7 9.1 434 18 11.7:1 3.8:1

11” Except15,000 psi 23.5 23.5 28.0 734 27 13.7:1 3.7:1

11” 15,000 psi - - - - - - -

13-5/8” Except15,000 psi 28.4 28.4 33.3 711 32 8.7:1 2.3:1

13-5/8” 15,000 psiModel B - - - - - - -

UM BOP Tandem Booster Operating Data and Fluid Requirements*

Bore Size andWorking Pressure

Gals to Open Pipe Rams(1 set)

Gals to Close Pipe Rams(1 set)

Closing Area(Sq. inches)

Locking Screw Turns(Each End)

Closing Ratio Opening Ratio

7-1/16” All WP - - - - - 3.8:1

11” Except15,000 psi 6.2 13.1 201.8 27 24.3:1 3.7:1

11” 15,000 psi - - - - - -

13-5/8” Except15,000 psi 7.5 10.4 198 32 15.6:1 2.3:1

13-5/8” 15,000 psiModel B - - - - - -

*All volumes based on shear ram configuration

Bore Size andWorking Pressure

Liters to Open Pipe Rams(1 set)

Liters to Close Pipe Rams(1 set)

Closing Area(Sq. cm)

Locking Screw Turns(Each End)

Closing Ratio Opening Ratio

7-1/16” All WP - - - - - 3.8:1

11” Except15,000 psi 23.5 49.6 1302 27 24.3:1 3.7:1

11” 15,000 psi - - - - - -

13-5/8” Except15,000 psi 28.4 39.4 1277 32 15.6:1 2.3:1

13-5/8” 15,000 psiModel B - - - - - -

*All volumes based on shear ram configuration

TC1542 21

The capital letters in the following designations refer to the UM BOP dimensional views below and dimensional charts shown on thefollowing page.

A-1 Length - bonnets closed, locking screws lockedA-2 Length - bonnets opened, locking screws unlockedB-1 Height - flangedB-2 Height - studdedC Width - no side outletsD Centerline of preventer to outlet flange or hub face. This distance is variable and must be determined per individual specifications.E Centerline of side outlet to bottom flange faceF Top of ram to top flange faceG Height of ram

UM BOP Assembly, Single with Tandem Boosters

SD 034566

A

C

B

EF

G

D

TC1542 10

Code of Federal Regulations

TITLE 30 - MINERAL RESOURCES (December 2005)

CHAPTER II - MINERALS MANAGEMENT SERVICE, DEPARTMENT OF THE

INTERIOR

SUBCHAPTER B - OFFSHORE

PART 250 - OIL AND GAS AND SULPHUR OPERATIONS IN THE OUTER

CONTINENTAL SHELF

subpart d - OIL AND GAS DRILLING OPERATIONS

250.442 - What are the requirements for a subsea BOP stack?

(a) When you drill with a subsea BOP stack, you must install the BOP system before drilling

below surface casing. The District Supervisor may require you to install a subsea BOP system

before drilling below the conductor casing if proposed casing setting depths or local geology

indicate the need.

(b) Your subsea BOP stack must include at least four remote-controlled, hydraulically operated

BOPs consisting of an annular BOP, two BOPs equipped with pipe rams, and one BOP equipped

with blind-shear rams.

(c) You must install an accumulator closing system to provide fast closure of the BOP

components and to operate all critical functions in case of a loss of the power fluid connection to

the surface. The accumulator system must meet or exceed the provisions of Section 13.3,

Accumulator Volumetric Capacity, in API RP 53, Recommended Practices for Blowout

Prevention Equipment Systems for Drilling Wells (incorporated by reference as specified in

250.198). The District Supervisor may approve a suitable alternative method.

(d) The BOP system must include an operable dual-pod control system to ensure proper and

independent operation of the BOP system.

(e) Before removing the marine riser, you must displace the riser with seawater. You must

maintain sufficient hydrostatic pressure or take other suitable precautions to compensate for the

reduction in pressure and to maintain a safe and controlled well condition.

[68 FR 8423, Feb. 20, 2003]