Reliability of Deepwater Subsea

Blowout Preventers
Per Holand, SINTEF Industrial Management

Summary
Operational experience data from deepwater subsea blowout preventers (BOPs) used in the U.S. Gulf of Mexico (GOM) in 1997 and
1998 have been collected and analyzed to reveal BOP reliability
problems. Results focus on rig downtime caused by BOP failures,
criticality of failures in terms of ability to control a well kick, and
BOP subsea test-time consumption. Results have been compared
with corresponding results from previous BOP reliability studies carried out for other areas and periods. An overall conclusion is that there
are no main differences in overall reliability of deepwater BOPs vs.
BOPs operating in normal water depths, except for increased
downtime caused by increased BOP handling time in deep waters.
Introduction
From 1982 to 1999, the Foundation for Scientific and Industrial
Research at the Norwegian Inst. of Technology (SINTEF) carried
out several reliability studies of subsea BOP systems on behalf of
various oil companies, the Norwegian Petroleum Directorate, and
the Minerals Management Service (MMS). Studies were based on
data from wells drilled in the North Sea, Brazilian waters and the
GOM Outer Continental Shelf (OCS).
Phase I to Phase V of the subsea BOP reliability studies were
based on data from wells drilled in shallow Norwegian waters in the
period 1978 to 1990. Studies were based on a total of 256 wells.1-9
The Phase I Deepwater (DW) study was based on data from
deepwater wells (water depths deeper than 1,312 ft) drilled in
Brazilian waters and shallow Norwegian waters in the period 1992
to 1997. Of 144 wells examined, 100 were deepwater wells.10,11
The Phase II DW study was based on experience from 83 deepwater wells drilled in the GOM OCS in 1997 and 1998.12
A study concerning reliability of platform BOPs was completed in 1992.13 The study was based on data from 48 development
wells drilled from three North Sea platforms.
This paper focuses on results from Phase II DW. Results from
Phase I DW studies serve as reference for comparison.
The main objective of the Phase II DW study was to investigate
and present deepwater subsea BOP reliability for GOM OCS rigs,
and, further, to compare results with the reliability of subsea BOPs
from other areas.
The first part of the paper focuses on the data source and how
data were analyzed. Thereafter, BOP failures, associated downtime, and criticality are presented and discussed. BOP subsea test
time consumption is presented and discussed.
Data for the Reliability Study
BOP Design. Fig. 1 shows a typical BOP used for deepwater drilling.
The BOP has an 183/4-in. throughbore with rated working pressure of
either 10,000 or 15,000 psi. It is stacked with two annular preventers
and four ram-type preventers. The typical system has three or four
choke/kill line outlets. Each outlet is connected to the choke or kill line
through two redundant failsafe gate valves. Most subsea BOPs used
for DW drilling are identical to subsea BOPs used for shallow waters.
Some DW BOPs, however, are controlled by a multiplex control system to reduce the BOP activating time. Some DW BOPs include two
blind shear rams (BSRs) to increase the probability of being able to
cut the drillpipe and to seal off the well in case of a rig driftoff.

Copyright 2001 Society of Petroleum Engineers Inc.

This paper (SPE 70129) was revised for publication from paper SPE 66186, an unsolicited
manuscript. Original manuscript received for review 26 July 2000. Revised manuscript
received 22 September 2000. Manuscript peer approved 17 October 2000.

12

In Phase II, DW reliability experience from 26 BOPs was collected and analyzed.
Six of the 26 BOPs had only one annular preventer.
One BOP had two shear rams.
Most BOPs had both fixed and variable rams.
Two BOPs had only variable bore rams (VBRs).
One rig had only fixed rams.
Some BOPs have a VBR as the lower pipe ram (LPR), while
most prefer to have a fixed ram as the LPR.
The number of choke and kill valves on each stack varied from
four up to ten. Two of the BOPs had the lower choke or kill line
outlet above the LPR; the remaining 24 had the lower outlet below
the LPR. In May 1999 MMS issued a Notice to Lessees and
Operators (NTL-99-G09), stating that the choke line lowermost
outlet is not permissible below the lower ram, but a kill line is.
Only three rigs had a multiplex control system; the remaining 23
had either a pilot control or a precharged pilot-control system.
None of the rigs included in the study had an acoustic backup BOP
control system.
BOP Failure Data. Data regarding BOP failures and malfunctions
were collected from 26 semisubmersible rigs and drillships for 15
different operators. Data were reviewed from 83 deepwater wells,
spudded between July 1, 1997 and May 1, 1998. Actual water
depth for the wells ranged from 1,335 to 6,725 ft. All relevant operators were asked to release data for the study, but a few did not submit any data.
Main data sources for failure information were daily drilling
reports (mostly in electronic formats, but some hardcopies) and
BOP test reports.
Additional information required for the study has been wellcasing information, BOP stack configuration, BOP key maintenance procedure, and general rig information. This information
came from daily drilling reports, well-casing reports, drilling contractors, oil companies, and public sources.
BOP failures are observed mainly during function and pressure
testing of the BOP and during normal drilling operation. Only failures observed during the BOP stump test prior to running the BOP,
during running of the BOP, and when the BOP is on the wellhead,
are regarded as BOP failures. Failures observed between wells during maintenance are not regarded as failures.
All observed failures were fed into a database system tailored
to keep track of BOP failure and maintenance information. All
information related to BOP subsea testing were fed into the same
database system.
General Information. General information collected included
key rig information; well information (water depth, well depth,
spud date, BOP run date, etc.); casing information (mainly sizes
and depths); and BOP equipment information.
BOP-Failure Information. BOP-failure information collected
included the incident date; equipment involved; a description of
the failure (how it was observed, failure mode, etc.); and downtime
associated with the failure.
BOP-Test Information. BOP-test information for all subsea
tests included test pressures, detailed test-time consumption, and
description of the tests.
Downtime Calculation. Downtime (or lost time) associated with
a failure includes all time lost related to the specific failure.
Downtime recorded is the calendar time from when the failure is
observed until the drilling can proceed from the same position as
when the failure was observed. If, for instance, a BOP failure
March 2001 SPE Drilling & Completion

If, during the repair on the rig, some maintenance activities not
linked directly to a failure are carried out, this is not considered as
a separate BOP failure.

Flexible joint

Upper annular preventer (UAP)

Lower marine riser

package (LMRP) connector

Lower annular preventer (LAP)

Upper choke
valves

Failure Rate and Mean Time to Failure (MTTF) Calculations.

For data sets for which no trend is observed, the number of failures
during a specific time period is modeled by a homogeneous
Poisson process, with failure rate, l.14 l may be estimated by,
Number of failures
n
= f.
Accumulated operating time t

. . . . . . . . . . . . . . . . (1)

The number of BOP-days=the number of days from the day the

BOP is landed on the wellhead the first time until it is pulled from
the wellhead. The number of BOP days multiplied by the number
of items=accumulated operating time (days in service) for BOP
failures. If the well is temporarily abandoned for a period, these
days are not regarded as BOP-days.
MTTF is the inverse value of the failure rate, l, i.e.,

Blind shear ram (BSR)

Upper pipe ram (UPR)

Lower choke valves

Middle pipe ram (MPR)

MTTF=1/l.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . (2)

Downtime Caused by BOP Failures

Overall BOP Item-Specific Performance. Table 1 shows the
number of failures and total downtime associated with BOP component/subsystems in Phase II DW. More than 50% of the failures
were observed in the main control system. The connector, annular
preventers, ram preventers, choke and kill lines, and choke and kill
valves each represented 7 to 11% of the failures. Major contributors to downtime were ram preventers and the main control system.

Kill valves
Lower pipe ram (LPR)

Wellhead connector

Fig. 1Typical DW BOP in the data set.

occurs that requires the BOP to be pulled, the total time for plugging the well, pulling and repairing the BOP, rerunning the BOP,
and drilling the well plug is regarded as downtime associated with
this failure. The BOP test where the failure was observed also is
regarded as downtime, but not the test after landing the BOP,
because one BOP test was scheduled.
If, during the repair on the rig, another BOP failure not
linked to the original failure is observed, this is regarded as a
new failure. Downtime related to this failure is only the actual
repair time, while time for running the BOP is still linked to the
original failure.

Comparison With the Previous BOP Deepwater (Phase I DW)

Study. Table 2 shows a comparison of some key results from
Phase I DW and Phase II DW.
Table 2 shows MTTF was longer in Phase II DW than in Phase I
DW. Average downtime caused by BOP failures was a little lower in
Phase II DW than in Phase I DW. It is important to note the comments
below Table 1. If the lost time mentioned had been regarded as downtime caused by BOP failures, Phase II DW average downtime would
be approximately 10% higher. It also should be noted that for many
of the failures observed in Phase II DW, it was decided not to pull the

TABLE 1OVERVIEW OF BOP FAILURES

BOP Subsystem
Annular preventer
Connector*
Flexible joint **
Ram preventer
Choke/kill valve
Choke/kill lines, all
Main control system
Dummy item
Total

BOP-Days
in Service
4,009
4,009
4,009
4,009
4,009
4,009

Total Days
in Service
7,449
8,018
4,009
16,193
31,410
4,009

4,009
4,009
4,009

4,009

Total
Lost Time
(Hours)
336.50
117.75
248.50
1,505.25
255.50
36.50

No. of
Failures
12
10
1
11
13
8

MTTF
(BOP-Days)
334
401
4,009
364
308
501

1,021.50
116.00
3,637.50

60
2
117

67
2,005
34.3

Avg. Downtime
per BOP-Day
(Hours)
%
0.35
0.08
0.12
0.03
0.26
0.06
1.56
0.38
0.27
0.06
0.04
0.01
1.06
0.12
3.78

0.25
0.03
0.91

* Lost time for one LMRP connector failure unavailable because of missing daily drilling reports. Two to three days were lost.
** For the flexible joint failure, 250 hours more time was used to work on stuck pipe/fishing problems after the flexible joint failure was repaired. This work was most
likely a result of the flexible joint failure.
Includes two BOP failures that were impossible to link to a specific BOP item. Both failures occurred when preparing to run the BOP and were poorly described.

TABLE 2COMPARISON OF KEY FIGURES, PHASE I DW AND PHASE II DW

Study

BOP-Days
in Service

Total
Lost Time
(Hours)

No. of
Failures

MTTF
(BOP-Days)

Avg. Downtime
per Failure
(Hours)

Avg. Downtime

Phase I DW*

3,191

3,457.5

138

23.1

25.1

%
4.51

Phase II DW

4,009

3,637.5**

117

34.3

31.1

3.78

per BOP-Day
(Hours)
1.08
0.91**

* Does not include Phase I DW shallow water wells and acoustic back-up control system failures.
** For the flexible joint failure, 250 hours more time was used to work on stuck pipe/fishing problems after the flexible joint failure was repaired. This work was most likely
a result of the flexible joint failure.

March 2001 SPE Drilling & Completion

13

the BOP or LMRP to be pulled to surface. Fig. 4 shows a regression line for BOP/LMRP running and pulling times vs. water depth
for merged Phase I DW and Phase II DW data.
Figs. 3 and 4 show that water depth has a significant influence
on BOP handling time, as expected. For a BOP in 200 ft of water,
10 hours for pulling and 10 hours for running the BOP can be
expected. For a well in 6,500 ft of water, 50 hours for running and
50 hours for pulling the BOP can be expected.

Annular
Connector

Phase I DW
Phase II DW

Flexible
Ram
Choke/kill

BOP Item-Specific Reliability Comments

Flexible Joints. Today, most rigs have a flexible joint with a flexible element. Some do, however, still have a flexible joint based on
the ball-joint principle. Failures in flexible joints are rare. This is
the same experience as from previous subsea BOP studies.1-11 In
the beginning of the 80s, when ball joints were used frequently,
several failures were observed in the North Sea. From earlier BOP
studies, it can be concluded that the flexible joint principle is more
reliable than the ball joint principle.
In this study, five of 26 rigs had ball joints. These rigs represented 18.5% of BOP-days in service.
One flexible joint failure was observed in the study. This failure
was in a ball joint. The cause of the failure was an external leakage,
not the flexing principle. The reason for the failure most probably
was a welding error caused by inadequate heat treatment.
The drilling crew observed that mud was drained from the riser
(water depth 2,130 ft) and a subsequent well kick. The pipe became
stuck and had to be cut and the well killed prior to pulling the
LMRP for repair. Another 250 hours, not included as flexible-joint
downtime, was spent working with a stuck pipe before deciding to
abandon the well after reconnecting the LMRP.

Choke/kill lines
Main control
0

0.05

0.1

0.15

0.2

0.25

0.3

0.35

0.4

0.45

Average downtime per BOP-day, hours

Fig. 2Average downtime caused by failures of various BOP items.

BOP to repair the failure after MMS had granted a waiver (MMS
granted twelve such waivers). The failures in question were typically
in components that were backed up by another component in the BOP
stack. Similar decisions were taken in Phase I DW.
Fig. 2 shows a comparison of the BOP item-specific average
downtime in Phase II DW and Phase I DW.
The most notable differences between the two data sets are the
differences in the downtimes of the ram preventers and the choke
and kill lines. In Phase II DW, some very time-consuming rampreventer failures occurred, while only minor ram-preventer failures were observed in Phase I DW. Choke and kill line leakages
seem to be a minor problem in the GOM deepwater wells. These
lines caused substantial problems in Phase I DW, and also caused
severe problems in earlier BOP studies for normal water depths.1-11
In previous studies, some rigs had several problems with these
lines while other rigs had no problems. In Phase II DW, no rigs had
severe problems.
The connector average downtime per day in service was higher
in Phase I DW than in Phase II DW. This was caused by longer
average downtime per failure and a higher failure frequency.

Annular Preventers. Six leaks through a closed annular were

observed. These failures produced 317 hours of downtime. One
failure caused 169 hours of downtime. The annular failed to test
after a well-control operation because the element was worn. One
failure causing 124 hours of downtime was observed during the
installation test. The piston seal was damaged. Three leaks
observed when the BOP was on the wellhead were not repaired
before the BOP was pulled for other reasons. The last failure was
observed when the BOP was on the rig.
Six failures with the failure mode failed to fully open caused
a total of 19.5 hours of downtime. This problem normally is
observed when pulling large-diameter tools or wearbushings
through the annular preventers.

Water Depth vs. Downtime. No trend was observed in failure rate

vs. the water depth. However, a trend in water-depth-related downtime was observed. This trend was caused by increased
BOP/LMRP handling time in deep water. Pulling and running
times have been recorded in the database for most BOP failures
which caused the BOP or the LMRP to be pulled from the wellhead. Fig. 3 shows BOP/LMRP running and pulling times sorted
by water depth for Phase I DW and Phase II DW failures requiring

Ram-Type Preventers. One failure of a BSR with failure mode

failed to close was observed. The failure was caused by a leak on

140

120

Hours

100

Run
Pull

80

60

40

5,843

5,607

5,184

4,478

4,274

3,924

3,600

3,255

3,240

3,012

2,978

2,959

2,799

2,789

2,700

2,690

2,690

2,428

2,402

2,395

2,395

2,350

2,124

2,046

1,781

1,694

1,692

1,447

1,148

1,148

1,148

410

1,148

246

246

246

20

Water depth, ft
Fig. 3BOP/LMRP running and pulling times sorted on water depth for Phase I and Phase II DW data.
14

March 2001 SPE Drilling & Completion

120
100

Hours

80
60
40

7,000

6,600

6,200

5,800

5,400

5,000

4,600

4,200

3,800

3,400

3,000

2,600

2,200

1,800

1,400

600

200

1,000

20

Water depth, ft
Fig. 4Regression line for BOP/LMRP running and pulling times vs. water depth based on Phase I and Phase II DW data.

the BSR hard pipe from the shuttle valve to the ram body. This failure
caused 475 hours of downtime. Three failures in pipe rams and one in
a BSR caused ram preventers to leak during testing. In total, 140 hours
were lost. The failure mode failed to open was observed three times
in ram preventers. This failure mode was not observed in any previous subsea BOP studies.1-11 Failures were observed for fairly new
locking systems. These failures may create hazards because access to
the wellbore is restricted, and a large-diameter tool may be below the
ram. The failures were time-consuming to repair; in total, 852 hours
were lost. External leakages in bonnet seals have become rare; one
such failure was observed during testing prior to running the BOP.
Hydraulic Connectors. Six failures with failure mode failed to
unlock were observed. Three of these failures were observed in
wellhead connectors when abandoning the well. One failure was
observed in the LMRP connector when attempting to unlock before
a storm. Two failures were observed when the BOP was on the rig.
These six failures produced 37 hours of downtime.
Four external leakages were observed. Two were observed in
the wellhead connector after installing the BOP on the wellhead,
and two when the BOP was on the rig. In total, 81 hours were lost.
No external leakages were observed after the BOP had been landed and the installation test accepted.
Spurious disconnects are discussed under BOP control systems.
Failsafe Valves. External leakage is the most critical failure mode
for a choke/kill valve. Four external leakages were observed in this
study, but only one was observed when the BOP was on the wellhead. This leakage occurred between the inner valve and the BOP
body during the installation test. A total of 189 hours were lost.
Six internal leakages were observed. Four were observed prior
to running the BOP and two were observed when the BOP was on
the wellhead. Failures occurring when the BOP was on the wellhead were not repaired because MMS granted a waiver. One failure with the failure mode failed to open was observed during a
periodic BOP test. The failure was not repaired because MMS
granted a waiver.

always has been a major contributor to rig downtime. It should be

noted that only three of 26 rigs had a multiplex-control system
that is the default control-system option for drilling in waters
deeper than 5,000 ft. Therefore, average results presented in this
paper should be used with care if evaluating the reliability of
multiplex-control systems.
The failure mode loss of all functions both pods was not
observed in the 80s. In Phase II DW, two such failures were
observed. Both were related to the hydraulic supply. One was
observed when the BOP was on the rig; the other was observed
when the BOP was on the wellhead. The drill crew observed that
accumulator fluid was running away on the rigid conduit line in a
multiplex control system. Similar failures were observed in Phase
I DW. Some modern BOP control systems have less redundancy
than older systems. The main problem is that pods are not as independent as they were in old systems. A single subsea failure should
not drain both blue and yellow pods as may be the result for many
modern BOP control systems.
The failure mode loss of all functions one pod has been
observed in all BOP studies. In this study, seven such failures
were caused by a leakage in the hydraulic-supply line, one by a
faulty pod-selector valve, and one by a failure in the subsea
electronic module.
All three spurious operation of BOP function failures
observed were related to spurious disconnect of an LMRP connector. One occurred during an abandonment operation. The quickdisconnect plate on the pod reel was changed to install the running
plate when the LMRP suddenly disconnected. The second spurious
operation was observed during swapping from the yellow to the
blue pod to function test the BOP after pressure testing when the
LMRP connector then disconnected. The third spurious operation
was observed during a BOP test prior to running. When the riser
connector on the LMRP was placed in the block position, the connector unlatched. Troubleshooting the problem revealed pressure
trapped in the unlatch-function pilot line.

Choke and Kill Lines. Eight failures in the choke and kill lines
were observed in Phase II DW. Choke and kill line leaks are a
minor problem in GOM deepwater wells compared with other
areas. These lines caused substantial problems in Phase I DW, and
also caused severe problems in earlier BOP studies in normal water
depths.1-11 The Phase I DW failure rate was 5.5 times higher than
in Phase II DW.

Failure Observation and Criticality

Failures that occur when the BOP is on the rig, during running of
the BOP, and during installation testing are not regarded as critical
well-control failures because the BOP is not acting as a well barrier.
After installation testing is completed and accepted, drilling starts
and the BOP acts as a well barrier. All BOP failures occurring after
the installation test are regarded as safety-critical failures. The criticality of each failure, however, will depend on what part of the
BOP system fails and the failure mode.

BOP Control Systems. Hydraulic-control systems caused rig

downtime in the same order of magnitude in Phase II DW as in
all previous BOP reliability studies. The BOP-control system

When Are BOP Failures Observed? Table 3 presents the location of the BOP and the tests during which various BOP failures
were observed.

March 2001 SPE Drilling & Completion

15

TABLE 3OBSERVATION OF BOP FAILURES

Rig BOP
Test prior
to running
BOP

Normal
operation

BOP Subsystem
Flexible joint
Annular preventer
Ram preventer
Connector
Choke and kill valve
BOP attached line
Riser attached line
Jumper hose line
Control system
Dummy Item
Totals

Running BOP

Unknown

Test
during
running
BOP

Wellhead BOP

Normal
operation

Installation
test

Test after
running
casing or
liner

Safety Non-Critical Failures

1
3
2
9
1
1
16
2
35

2
34%

3
3

Normal
operation

Total

Safety Critical Failures

2
1
2
1
5

Test by
time

1
1
2
1

4
5

3
1

10

1
6

15

17

1
3
4

1
9%

13

13

22

1
12
11
10
13
2
4
2
60
2
117

57%

Table 3 shows that 34% of failures were observed when the

BOP was on the rig prior to running the BOP. Approximately 9%
of failures were observed during running the BOP, and the remaining 57% were observed when the BOP was on the wellhead. Of 67
failures observed when the BOP was on the wellhead, 15 were
observed during installation testing and 52 failures, regarded as
safety-critical failures, were observed during regular BOP tests or
during normal operations.
An installation test is here defined as the BOP test after landing
the BOP the first time or during subsequent landings of the BOP or
the LMRP.

BOP Testing Experience

Subsea BOP testing is important with respect to both the BOPs
ability to act as a safety barrier and test-time consumption.
A variety of different test tools are commonly used. Each rig
is equipped with several devices that may be used for BOP testing. Different tools are designed to seal against the different wellheads used.
When testing the BOP, conventional test tools require the wear
bushing to be pulled prior to testing but combined-test tools do not.
The BOPs also are tested against the seal-assembly running and
retrieving tools, also called casing pack-off tools.

Safety-Critical Failures. From a well-control point of view, important failures are the failures observed in the safety-critical period.
Frequency of safety-critical failures observed in Phase II DW
was similar to the frequency observed in Phase I DW.
In Phase II DW, the most severe failure modes, leakage in the
wellhead connector and leakage in the choke and kill valve to stack
connection below the LPR, were not observed.
Rams and annulars, however, failed at a higher rate in the safetycritical period in Phase II DW than in Phase I DW.
The severe failure mode loss of all functions both pods
occurred more frequently in Phase I DW than in this study.
It should be noted, however, that many BOPs in the previous
study were equipped with an acoustic backup-control system
as well.
Table 4 shows a coarse ranking of the most severe failures
observed in the safety-critical period in Phase II DW alongside the
same ranking for Phase I DW. Phase I DW is represented with
approximately 20% longer time in service.

Test-Time Consumption. Time consumption for 333 BOP tests

was recorded. Fig. 5 shows average test times vs. average water
depths sorted and presented for each rig.
Fig. 5 illustrates a trend in test time vs. average water depth.
However, the variation is large from rig to rig for similar water
depths. The main reasons for the rig-to-rig variation are that some
rigs have more tool problems than others and that test practices
vary from rig to rig. There is a significant potential for making
BOP testing more efficient for many of the rigs.
Total test time consumption was 4,761 hours representing 5%
of the total number of BOP days, or, on average, 1.19 hr/BOP-day.
Average BOP test time for each test was 13.9 hr/test for Phase
II DW. Average BOP test time for deepwater wells drilled in Phase
I DW was 9.6 hr/test.
Average water depth for each test was 3,031 ft in Phase I DW
(only deepwater wells included), compared to 2,947 ft in Phase II
DW. This difference has an insignificant effect on the average BOP
test-time difference recorded for the two studies.

TABLE 4COARSE RANKING OF MOST IMPORTANT SAFETY CRITICAL FAILURES

Phase I DW BOP Study
1. One failure causing wellhead connector external leakage.
2. One involving failure to shear the pipe during a disconnect
situation.
3. One external leakage in the connection between lower
inner kill valve and the BOP stack.
4. Five failures that caused total loss of BOP control by the
main control system.
5. Two shear ram leakages in closed position.
6. Two failure-to-disconnect-the-LMRP failures.
7. Seven failures that caused loss of all functions on one pod.
8. One UPR leakage.
9. One spurious closure of the shear ram.
10. Three annular preventers that leaked in closed position.
11. Six choke and kill line leakages.

16

Phase II DW BOP Study

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.

One control system failure caused total loss of BOP

control.
One spurious opening of the LMRP connector (control
system failure).
One shear ram failed to close.
One shear ram leak in closed position.
Two failed to open pipe ram failures.
Two failures where the pipe ram leaked in closed position.
External leak in flexible joint.
One failed to disconnect the LMRP failure.
Four failures that caused loss of all functions on one pod.
Loss of one function on both pods (annular close).
Four annular preventer leaks in closed position.
One choke and kill line leak (jumper hose).

March 2001 SPE Drilling & Completion

25.0

Average test time

Trend line
Average BOP test time, hours

20.0

15.0

10.0

5.0

6,537

5,292

5,221

4,274

4,135

3,800

3,649

3,283

3,240

3,101

2,963

2,902

2,788

2,592

2,350

2,032

1,962

1,945

1,889

1,853

1,751

1,697

1,693

1,668

1,590

1,464

0.0

Average water depth, ft

Fig. 5Rig specific average BOP test times sorted on average water depth.

The main reasons for differences in average BOP test time are:
In Phase II DW, VBRs normally were tested on two diameters,
thus increasing the number of tests. Normally a telescopic-type test
joint was used for this testing. Due to problems with a dart for this
type of test joint for some rigs, frequently two test plug runs with different joint diameters were made. (The U.S. GOM OCS regulations
state Variable rams shall be pressure tested against all sizes of pipe
in use. This requirement is the most significant contributor to the
average BOP test-time difference observed in the two studies.)
In Phase I DW, relatively more tests were performed after
running casing (periodic tests were seldom performed) using the
casing pack-off tool. Average test time when using the casing packoff tool for BOP testing is lower than when using other tools. In
Phase II DW, only 4 or 5 rigs tested the BOP against the casing
pack-off tool regularly.
In Phase II DW, the BSR test pressures were held for 30 minutes, while in Phase I DW they were held for 3 to 10 minutes.
If the casing leaked in Phase II DW, frequently an extra trip
was performed to test the shear ram against the plug. This was not
normally done in Phase I DW.
One rig frequently tested the shear ram with a separate plug in
Phase II DW.
From a safety point of view, testing VBRs on both diameters in
a subsea BOP has an insignificant effect on the BOP safety availability due to the redundancy in the BOP stack. Most ram failures
will be revealed if pressure testing the ram on one diameter only.
One possible effect of such a requirement is that operators may
prefer only fixed rams instead of VBRs to save time during BOP
testing. This will reduce redundancy in the stack in general and
thereby, safety availability.
Therefore, MMS should consider removing this specific
requirement from the regulations. An alternative regulation would
be a requirement that the test joint for testing rams shall include
diameters reflecting all sizes of pipe in use. This will reduce the
average BOP test time significantly (on average, 2 to 3 hours per
BOP pressure test) without any safety reduction.
Various BOP test strategies and the ability to close in a well
kick are further discussed in Ref. 12.
Conclusions
1. Subsea BOP failures and malfunctions produce significant
downtime. For deepwater drilling, approximately 4% of drilling
time is lost due to BOP failures. Increased average downtime/day in deep water compared to shallow water can be
explained by the increased BOP handling time to repair each
failure. Water depth seems to have no influence on the occurrence of failures. BOP preventive maintenance is crucial when
seeking to reduce downtime caused by BOP failures.
2. Some new designs have caused problems with respect to downtime. A major problem seems to be locking systems for new
March 2001 SPE Drilling & Completion

types of rams. Some very time-consuming failed to open failures were observed. This failure mode has not been observed in
earlier BOP studies with older equipment.
3. In deepwater drilling, spurious opening of the LMRP connector
is far more critical than in shallow water drilling because many
well sections are drilled without a riser margin. When this
occurs, control of the BOP is lost. This type of incident was
observed in both Phase I DW and Phase II DW. Underlining the
importance of this failure mode in deepwater drilling, the MMS
homepage (http://www.gomr.mms.gov) reports that on 28
February 2000, an accidental riser disconnect and subsequent
blowout occurred on Mississippi Canyon block 538.
4. Backup BOP control systems are more important in deepwater
drilling than in shallow water drilling to control incidents in
which the riser accidentally disconnects from the BOP because
of the absence of riser margin in many well sections.
5. Some modern BOP control systems have less redundancy
between yellow and blue pods compared to older control systems. In some modern systems, a single failure in the hydraulics
may cause total loss of BOP control. Such failures have been
observed. Pod redundancy must be focused when designing
BOP control systems.
6. On average, BOP testing consumes 5% of drilling time. The
requirement to pressure test the variable rams against all sizes
of pipe in use should be discarded because it adds no safety
availability, but consumes costly time.
7. Some rigs have a far higher average BOP test time than other
rigs for similar water depths. Rigs should compare their BOP
testing practices with the objective to reduce BOP test time.
Nomenclature
nf = number of failures
t = accumulated operating time, days
l = failure rate, days-1
Acknowledgment
I wish to thank the Minerals Management Service which sponsored
the Phase II DW study, and Petrobras, Agip, Statoil, and Saga
Petroleum which sponsored the Phase I DW study. Further, I wish
to thank all previous sponsors of BOP reliability studies. Last, I
wish to thank Professor Marvin Rausand at the Norwegian U. of
Science and Technology. He has been involved in all the BOP reliability studies carried out since 1980.
References
1. Holand, P.: Subsea BOP Systems, Reliability and Testing Phase V,
revision 1, SINTEF report STF 75 A89054, Trondheim, Norway
(August 1995).
2. Holand, P.: Subsea Blowout-Preventer Systems: Reliability and
Testing, SPEDC (December 1991) 293.
17

3. Holand, P.: Reliability of Subsea BOP Systems, Presented at the 1991

IADC European Well Conference, Stavanger, Norway, June 1113.
4. Holand, P. and Rausand, M.: Reliability of Subsea BOP Systems,
Reliability Engineering, Elsevier Applied Science Publishing Ltd,
London, England (1987) 19, No. 4, 263-275.
5. Holand, P.: Reliability of Subsea BOP SystemsPhase IV, SINTEF
Report STF75 F87007, Trondheim, Norway (February 1987).
6. Holand, P. and Molnes, E.: Reliability of Subsea BOP Systems
Phase III, Testing and Maintenance, Main Report, SINTEF Report
STF75 F86004, Trondheim, Norway (February 1986).
7. Holand, P. et al.: Reliability of Subsea BOP SystemsPhase II Main
Report, SINTEF Report STF18 F84515, Trondheim, Norway
(February 1985).
8. Rausand, M. and Engen, G.: Reliability of Subsea BOP Systems,
paper OTC 4444 presented at the 1983 Offshore Technology
Conference, Houston, May 25.
9. Rausand, M.: Reliability of Subsea BOP Systems, SINTEF Report
STF18 F83003, Trondheim, Norway (October 1983).
10. Holand, P.: Reliability of Subsea BOP Systems, Fault Tree Analysis,
SINTEF Report STF38 F97425, Trondheim, Norway (October 1997).
11. Holand, P.: Reliability of Subsea BOP Systems for Deepwater
Application, SINTEF Report STF38 F97417, Trondheim, Norway,
1997. (October 1997).

18

12. Holand, P.: Reliability of Subsea BOP Systems for Deepwater

Application, Phase II DW, SINTEF Report STF38 A99426
(Unrestricted version). Trondheim, Norway (November 1999).
13. Holand, P.: Reliability of Surface Blowout Preventers (BOPs), SINTEF Report STF75 A92026, Trondheim, Norway (May 1992).
14. Hyland, A. and Rausand, M.: System Reliability Theory; Models and
Statistical Methods, John Wiley & Sons, New York City (1994).

SI Metric
ft
in.
psi

Conversion Factors
3.048*
E - 01 = m
2.54*
E - 02 = m
6.894 757
E + 05 = kPa

*Conversion factor is exact.

SPEDC

Per Holand is a senior research engineer in the safety and

reliability department at SINTEF Industrial Management in
Trondheim, Norway. e-mail: per.holand@indman.sintef.no.
He has worked with risk, reliability, and safety issues related
to the offshore industry since 1983. Holand holds an Ms
degree in mechanical engineering and a PhD degree in
safety and reliability engineering from the Norwegian Inst. of
Science and Technology in Trondheim, Norway.

March 2001 SPE Drilling & Completion