OTC-28782-MS

BOP Testing and It's Availability on Demand-A Case Study

Muhammad Zulqarnain, Louisiana State University

Copyright 2018, Offshore Technology Conference

This paper was prepared for presentation at the Offshore Technology Conference held in Houston, Texas, USA, 30 April–3 May 2018.

This paper was selected for presentation by an OTC program committee following review of information contained in an abstract submitted by the author(s). Contents of
the paper have not been reviewed by the Offshore Technology Conference and are subject to correction by the author(s). The material does not necessarily reflect any
position of the Offshore Technology Conference, its officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written
consent of the Offshore Technology Conference is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may
not be copied. The abstract must contain conspicuous acknowledgment of OTC copyright.

Abstract
Blowout Preventer (BOP) is an integral component of defense in depth approach adopted in deepwater
drilling operations. Regulatory bodies require frequent testing of these barriers, to make sure that they will
be available to perform their intended functions when demand arrives. As BOP works only in demand mode,
therefore the calculation of average probability of failure on demand (PFDavg) is one of the technique that
can provide the critical information about the availability of these barriers.
In this study PFDavg formulation is used to carry out s systematic performance evaluation a BOP's barrier
elements. A sensitivity analysis is also performed to account for some of the real demand conditions
that cannot be tested during routine tests, an example is the testing of shearing capability of blind shear
rams. Multilevel test formulations are used that accommodates both of proof test and partial stroke testing
concepts. The interdependency of these barrier elements is modeled by using beta factor model, which
account for common cause failures.
The results are presented for three flow paths of open wellbore flow, flow through drillpipe-casing
annulus and flow through drillpipe. Corresponding BOP's barrier elements are used to estimate the
availability of these barriers when they are demanded. The analysis results indicate high common cause
failures of BOP's main control system with an average value of 0.25. Which is a significantly high
dependency of both of the BOP's control pods on some of the common elements that can fail them
simultaneously. The results also show that average availability of drillpipe-casing annular and open-hole
barrier channels is dominated by the BOP's main control system, mainly due to its high failure rates. The
analysis also revealed that a beta factor contribution significantly impacts the unavailability of drillpipe-
casing annular channel barrier elements.
Results for other demand scenarios and combination of working of these barrier elements are also
presented. The presented results highlight some of the critical safety measures of BOP's barrier element
performance and also highlight some of the deficiency areas that need to be taken care of to improve the
system's performance. It is therefore hoped that the presented results will be helpful to gain insight into
different modes of operation and in improving the system's performance.
2 OTC-28782-MS

Introduction
As the quest to find new oil reserves is moving to deeper waters, the increase in complexity of operations and
the equipment involved is inevitable. Today's deepwater oil and gas operations involve the usage of some
of the most sophisticated and complex technologies of modern times. The combination of technological
and operational complexities brings increased risks. Large spill disasters like Macondo blowout signify the
magnitude of the environmental and associated economic Negar and Mayank (2017) losses.
Therefore defense-in-depth approach is adopted in deepwater drilling operations to take care of these
extreme conditions. Therefore multiple layers of well barriers are installed to prevent unintended formation
fluid flow. These well barriers are designed to prevent, control and mitigate the unintended flow of fluids
from well, and can broadly be classified as proactive and reactive. The proactive barriers prevents the
hazardous event from occurring, while reactive barriers are activated once the hazardous event occurs. They
are used to control the hazardous event and terminate the sequence of events before the predefined end
sequence is reached.
Maintaining hydrostatic overbalance is a proactive barrier, while BOP elements act as reactive barriers
during well control operations. A barrier is also defined as ‘Technical, operational and organizational
elements which are intended individually or collectively to reduce possibility for a specific error, hazard
or accident to occur, or which limit its harm/disadvantages' (PSA, 2013 a). Therefore if an operator has to
perform some manual actions in the case of an event, then his actions are an example of an operational barrier
Tangstad (2014). Therefore the performance of a barrier system depends on both technical and operational
barriers.
Secondary dynamic deepwater drilling well barriers consists of BOP, drill string safety vale (DSSV) and
inside blowout preventers valve (IBOP). BOP's sub elements consists of pipe rams (PR), annular preventers
(AP) and blind shear ram (BSR). Regulatory bodies require frequent testing of these barriers, to make sure
that, they are available to perform their intended functions when demanded.
The main objective of this study is the performance evaluation of technical secondary dynamic well
barriers for normal conventional overbalanced deepwater drilling operations. It is also the intent to present
the relevant formulations and present a case study to show the necessary steps. This will help in identification
of key barrier elements whose performance improvement will greatly enhance the availability of these
systems when demanded.

A brief literature survey of most relevant past studies

A brief review of some of the most relevant past research work conducted to study the reliability of offshore
drilling and production flow barrier elements is presented in this section. Corneliussen (2006) used PFDavg
calculations to conduct well system reliability analysis of surface controlled subsurface safety valves. The
researcher used the concept of test independent failures (TIF) to account for imperfect testing conditions.
Rolén (2007) studied the subsea oil and gas production tree and accounted for imperfect test conditions, in
the form of partial stroke test. Lundteigen (2009) studied the effects of imperfect test conditions that may
occur during the testing of oil and gas safety instrument systems. The researcher used the partial stroke test
concept and also suggested a method to determine the test coverage.
Brissaud and Luiz (2015) proposed the concepts of diagnostic test coverage and proof test coverage.
They compared the Fault tree, Markov, Stochastic Petri nets, and PFD and showed that these techniques
can produce very similar results. Hauge et al. (2010) used the test coverage concept and conducted an
example calculation of PFD of blind shear ram. They also compared the test coverage (TC) and test
independent failures (TIF) techniques and showed that under some circumstances these may provide similar
results. Tangstad (2014) conducted an assessment of dynamic well barriers to stop the flow in the drillpipe-
casing annulus. The researcher did not used the test coverage concept or beta factors to account for CCF.
Lundteigen and Rausand (2007) highlighted the difficulties that arises in quantification of CCF for oil
OTC-28782-MS 3

and gas operations. They suggested to use checklist and analyzing the root cause and coupling analytical
techniques to overcome these difficulties. Sun (2013) compared the pros and cons of different methods
adopted to study CCF in in process industry including oil and gas sector and pointed out some of the
difficulties that may arise in using these methods. The author also stressed the need to developed better
formulations for CCF modeling.
Lundteigen and Rausand (2009) conducted reliability analysis of oil and gas equipment used in well
workover operations in hydrocarbon production operations. They presented a systematic approach to study
such systems with relevant formulations. In a separate study Lundteigen and Rausand (2008) highlighted
the steps necessary to find partial stroke test coverage. They proposed checklist method for that purpose
and also highlighted the need for development of a generic and widely accepted checklist.
Continia et al. (2013) studied the effect of test policy on PFD by carrying out sensitivity analysis of
CCF for systems with different redundancy and pointed out the conditions under which staggered testing
should be preferred over sequential testing. Martinez (2014) highlighted the importance of test interval
on PFD calculations for oil and gas workover equipment and stressed the need for proper collection of
reliability data for these systems. Ocheni (2015) studied the impact of partial and imperfect test conditions on
reliability assessment of SIS and highlighted the importance of disregarding the unrevealed failures on PFD
calculations. Eisinger et al. (2015) suggested the use of multilevel approach to study the average probability
of failure on demand of BOP systems. Mutlu et al. (2017) used fault tree analysis to qualitatively study the
real time availability of BOP's control system. Rausand and Engen (1983) studied the reliability of BOP
system and highlighted the significance of equipment maintenance and safety culture for its reliability. In
this we study BOP on a system level by using the easy to understand formulations and cover some aspects
that were not thoroughly studied before.
A brief introduction of these barrier elements and their testing requirements are provided in next section,
followed by relevant formulations used in this study and then followed by results.

Deepwater Drilling Well Barrier Elements and Testing Requirements

When a kick occurs in a drilling well, it can travel up inside the wellbore and may discharge to subsea
(subsea blowout) or it travel through the rock and may or may not appear at the sea floor (underground
blowout). The focus of this investigation is the case of a subsea blowout in which reservoir fluids flow
inside the well, and exit through the subsea BOP. Depending on the circumstances the fluid flow may be
happen inside the drillpipe, inside the drillpipe-casing annular space or inside the open wellbore (called
Worst Case Discharge (WCD)) when drill pipe is out of the hole. A modern subsea BOP configuration
and three possible fluid flow paths and corresponding barrier elements are shown in Figure 1 (a) and (b)
respectively. A brief description of each element follows.
4 OTC-28782-MS

Figure 1—(a) A modern BOP configuration, (b) three flow paths and corresponding physical barriers

Annular Preventer: can seal around any object in the wellbore or can also seal the wellbore without any
object in the wellbore. It operates by compression of a reinforced elastomer packing element by using the
hydraulic pressure from BOP's main control system. Mainly it is designed to seal around irregular shape
objects in the wellbore and it may not provide good sealing capabilities for open wellbore. Moreover it is
permitted that for a BOP stack of 15,000 psi working pressure ratings, annular preventers of 10,000 psi
working ratings may be used, API-STD-53 (2012). Other than that during pressure testing it is tested up to
only 70% of its maximum rated working pressure 30-CFR-250-449 (2015). The drilling regulation require
that when BOP is on wellhead, the annular will be function tested every 7 days and pressure tested every
14 days. They are also pressure tested at the rig floor, before lowering BOP to subsea wellhead.
Pipe Rams: are designed to seal around the different pipe sizes in the wellbore and prevent the drillpipe-
annular flow. Variable pipe rams can close on various pipe sizes, while fixed bore are designed to close
around a fixed pipe size only. These rams have metallic ends, and are basically designed to hold back
high pressures. They are operated by the hydraulic pressure from the BOP's main control system. They
are required to be function tested every 7 days and pressure tested every 14 days 30-CFR-250-449 (2015).
They are also pressure tested at the rig floor, before lowering the BOP to the subsea wellhead. Under some
circumstances these pressure test conditions may be different than the real demand conditions, which may
involve closure of these rams in the presence of high liquid flow rates and against high pressures. Therefore
some of the hidden failures may only be revealed during the real demand conditions.
Blind shear Rams: The blind shear ram is designed to shear the tubular in the wellbore, hold it, and
seal the well against high pressures. It can also seal the well when there are no tubulars inside the wellbore.
It is required to be pressure tested every 30 days or at all new casing points, whichever comes first. The
test interval should not exceed 30 days 30-CFR-250-449 (2015). It is pressure tested at the rig floor, before
lowering the BOP to wellhead. The blind shear ram is only tested for its wellbore sealing capacity, its
shearing function is not required to be tested. This may leave significant dangerous failure hidden till the
real demand arrives, in which it has to shear the pipe and seal the well.
OTC-28782-MS 5

BOP's main Control System: is a combination of pumps, valves, lines, accumulators, and other items
necessary to open and close the BOP equipment. In modern subsea BOP configuration two independent
control PODS are installed, but these PODS share a lot of common sub systems. These PODS work in
parallel and after receiving command from rig floor, actuates different valves to provide hydraulic power to
close or open pipe rams, annulars and blind shear rams. These PODS are also equipped with accumulators
that can be used in emergency situation to shut the well, when the power from the rig is disconnected. The
control system is tested fully during functional and pressure testing, therefore only a fraction of undetected
failures may remain hidden.
Drill String Safety Valve and Inside BOP Valve: Drill string safety valve is used to stop the upward
flow inside drill pipe, it is located at the bottom of the drillpipe. On the other hand inside BOP valve is
usually stabbed on the open end of drill pipe at or below rig floor. Both of these valves are required to be
pressure tested at 14 days interval, 30-CFR-250-449 (2015). They are also required to be pressure tested at
the rig floor, before start of drilling operations as well.
Now we briefly go over the nature of the different type of test performed on these barrier elements in
next section.

Functional, Pressure and Proof Testing

As mentioned earlier that functional and pressure testing are prescribed for BOP barrier elements during
normal drilling operations, when BOP is attached to the subsea wellhead. BOP's main control system is
used to close annulars, pipe rams and blind shear rams. Therefore whenever these elements are tested in
either functional or pressure test, control system is automatically tested. Now we briefly look at the nature
of these tests.
Functional Testing: in functional testing of annular preventer, pipe rams and blind shear ram, their
closing time in seconds is noted, after issuing a command from the rig floor. The annular should close in
60 seconds and rams should close in 45 seconds. Please note that the functional testing of well barriers is
not the same as it is normally used for Safety Instrument Systems (SIS).
Pressure Testing: In pressure testing, the test ram at the bottom of the BOP stack and the barrier element
to be tested are closed and fluid is injected through choke and kill lines to achieve the desired operating
pressure of these elements. Pressure testing is equivalent to functional testing term normally used for SIS.
Testing at Rig floor Stump Testing: BOP is pressure tested before it is lowered and attached to subsea
wellhead at the start of drilling operations. An average of 63 days is assumed for this testing procedure,
which is the average duration of drilling a deepwater well in GoM, Zulqarnain (2015). In current study it
is referred as proof testing.
As BOP works only in demand mode, therefore the calculation of average probability of failure on
demand PFDavg is one of the technique that can provide critical information about the availability of these
barriers. A brief introduction of PFDavg is provided in next section.

Average Probability of Failure on Demand (PFD)

For safety functions that are working in the background and are activated only when some safety limits
are exceeded, the average probability of failure on demand calculations are performed (demand mode).
While, for safety functions that are in place continuously the probability of a dangerous failure is expressed
in terms of a given period of time (per hour) (continuous mode). Probability of Failure on Demand is a
value that indicates the probability of a system failing to respond to a demand. The average probability of
a system failing to respond to a demand in a specified time interval is referred as average probability of
failure PFDavg. PFD is also the safety unavailability. A PFD of 0.001 means that approximately the system
may not be available one time out of 1000 demands. In the rest of this document the PFDavg and PFD are
interchangeably used for average probability of failure on demand.
6 OTC-28782-MS

For a component that is tested at regular intervals of time τ, has a constant failure rate λDU, the survivor
function is , and PFDavg is given as Rausand (2014),

(1)

Expanding the exponent term by using Taylor series, we have

(2)

when λDUτ is small, such that λDUτ≤ 10−2 Lundteigen and Rausand (2009), the Eq. (2) can be written as

(3)

This approximation is used in practical calculation, Rausand (2014). It is a conservative approximation,

as it is always greater than values in Eq. (1). This formulation has inherent assumption that all dangerous
undetected failures are revealed during the testing process after time interval τ. As pointed earlier under some
circumstances real demand conditions for BOP elements cannot be tested. Therefore not all hidden failures
can be reveled during testing. Proof test coverage concept is used to address this issue and is explained in
next section.

Proof Test Coverage (PTC)

A test in which all dangerous failures are revealed and where safety instrument system (SIS) is restored to an
as good as new condition, is called a perfect test, Lundteigen and Rausand (2008). In reliability formulations,
it is generally assumed that functional test are perfect test and all dangerous failures can be detected by
functional tests Rausand (2014). Imperfect testing may leave some of the failures undetected. An example
is the case of pressure testing the blind shear ram. The intended function of blind shear ram is to cut the
tubulars, hold it, and seal the well bore against the rated working pressure. But these rams are only required
to be tested for their sealing capacity, without testing their cutting capabilities. Another deviation could be
that in some circumstances, these rams may be required to cut tubulars in presence of high fluid flow and
at high pressures. These conditions are a significant deviation from the test conditions in which these rams
are first closed and then pressure is gradually increased to the maximum rated working pressure. Therefore
testing may not reveal some of the failure that may occur when demand of cutting a tubulars, holding it in
place and sealing the wellbore arises, especially in the presence of high fluid flow and high pressures.
Proof test coverage (PTC) concept is used to handle imperfect test conditions Lundteigen and Rausand
(2009). In PTC it is assumed that a fraction of the dangerous failure are only revealed during real demand
conditions. Therefore dangerous failures can be expressed by
(4)
where is the fraction of the dangerous undetected failures revealed during proof testing and is the
fraction not revealed. The equation (4) can be written as

where PTC is given by the following formula

OTC-28782-MS 7

and Eq. (4) takes the following form

(5)
Incorporating the PTC to account for imperfect testing associated with different BOP components, Eq.
(5) take the following form

(6)

As we deal with only dangerous undetected failures, therefore in the remaining part of the document λDU
is simply expressed as λ. Partial stroke test can be used to account for functional, pressure and recertification
tests. A multilevel test procedure that combines the proof test coverage and partial stroke test concepts into
one formulation is presented in next section.

Multilevel Test
As state earlier, BOP undergo different type of tests when it is working as a barrier like functional test and
pressure test. Some tests are performed at the drilling rig floor before lowering it to subsea wellhead and
it is also tested after leaching to the wellhead. Multi test level formulation encompasses the concepts of
proof test coverage and partial stroke test coverage as well. By using multiple level test concept suggested
by Eisinger et al. (2015), we can define three test levels according to the tests performed on BOP. Level-1
denotes the functional test of a component, Level-2 for pressure test and Level-3 for final test in which all
the remaining hidden failures are reveled and the system is restored to its original condition. Therefore the
formulations incorporate the concept of PTC as well. Three testing levels can be considered as independent
component of a series system. Then the average probability of failure for a single component undergoing
these three level of testing is given Eisinger et al. (2015) as
(7)
where subscript denotes the level numbers, PFD1 denotes functional testing level, PFD1 denotes pressure
testing level and PFD1 denotes the recertification testing. Substitution of PFD value from equation (3) into
equation (7)) results in

(8)

where λ1 is the fraction of dangerous undetected failures revealed during functional testing interval of τ1, λ2
is the fraction of dangerous undetected failures revealed during pressure testing interval of τ2 and λ3 is the
fraction of dangerous undetected failures revealed during recertification testing interval of τ3. Here we have
assumed that a fraction of dangerous undetected failures are revealed during these three tests such that.
(9)
or

(10)

So far we have looked at the formulation of PFD for a single component, let's look at the formulations
for multicomponent systems.

PFD Formulations for Multicomponent Systems

In this section different formulation of PFD for systems with redundant components are presented. These
systems are generally referred as K out of N systems. These systems work if K components of out of N
works where N > K. For the system under consideration, the assumption is that the system will work if at
8 OTC-28782-MS

least 1 out of N works. In this case the system equation are simplified Eisinger et al. (2015) and are provided
in next section sub sections.
1oo2 and 1oo3 and Independent components. In current study we will deal with probability of failures
for 2 and 3 independent components with three test levels and their formulation is given by as Eisinger
et al. (2015)

(11)

(12)

Now we look at component that have some type of common cause failure contribution and are not fully
independent.
Dependent components. For dependent compensates, we have to incorporate the dependent failures often
referred to as common cause failures. A common cause failure (CCF) is a failure where two or more items
fail in such a fashion that the system cannot perform its intended functions and are taken care in this section.
Beta-factor model due to its simplicity is normally used for CFF calculations. In beta-factor model, the
failure λ rate is split into an independent λI and a dependent λc part, such that

The beta-factor is than given by

The beta value may be based on experimental judgement, checklists or observed data. The guidance to
find beta factor are provided in IEC-61508 (2010)]. These are based on the 40 question that cover a wide
range of condition including but not limited to physical separation, redundancy and human interface to name
a few. A value between 0.5% & 5% is suggested for logic solvers and between 1 to 10% is suggested for
sensors and final elements IEC-61508 (2010). After inclusion of CFF, the PFD of a system with identical
but dependent components takes the following form for 1oo2 and 1oo3 components

(13)

(14)

Equations 8,11,12,13 and 14 are used for the PFD calculations in this study.
OTC-28782-MS 9

Data and Analysis

The failure data of dynamic well barrier used in this study is provided in Table 1. The failure rate of drill
string safety vale and inside BOP valve are considered same due to the same nature of the equipment and
unavailability of data for each element separately.

Table 1—Failure rates of dynamic well barriers

Real Demand Scenarios

Real demand conditions in drilling operations may not be unique subsea. Therefore in order to account for
these variations we consider two scenarios shown in Table 2.

Table 2—Barrier element's test intervals and assumed revealed failure fractions for two considered scenarios

In first scenario S1 we assume that real demand conditions are very similar to testing conditions, so
that only a small fraction of dangerous failures remain hidden until real demand arrives or they are reveled
during recertification process and fixed. This is the case when a kick (reservoir fluid influx) is detected in its
earliest stages and barrier elements are engaged promptly, with minimal flow of reservoir fluids. Pressure
builds up after closure of these elements, and this is the same conditions against which they are tested for.
Therefore in this scenario the fraction of unrevealed dangerous failures during real demand conditions is
low. In second scenario S2 it is assumed that a delay in kick detection occurs and real demand conditions are
different than the test conditions. Well starts flowing heavily, therefore in this case more hidden failures are
revealed during recertification process or under real demand mode. This scenario will help us in quantifying
the influence of real demand departure conditions on PFD. The assumed failure fraction for each scenario
are based on the nature of the test conducted and reveled failures.
The PFD calculation results for the barrier elements are presented in next section.
10 OTC-28782-MS

Results and Discussions

The results are divided into three categories based on three flow paths and relevant barrier elements.

PFD of open wellbore channel

According to historic GoM statistics nearly 11% of kicks occurred when drill pipe was out of hole i.e.,
wellbore was open to flow Zulqarnain and Tyagi (2014). In this case shear ram and annular preventers are
available to stop flow. As pointed earlier in some of the cases the annular preventer have lower working
pressure ratings than BOP's rated working pressure. Even if they have same working pressure, they may
not be able to withstand against high pressure after sealing the well. This is mainly due to their rubberized
material that is expanded during their deployment, which may not withstand high stresses. Therefore in this
study a conservative approach is adopted, in which annulars are not considered as final physical barriers
for open wellbore flow. So we are only left with blind shear ram. The reliability block diagram (RBD) of
barrier elements for open wellbore flow is shown in Figure 2.

Figure 2—Reliability block diagram (RBD) of open wellbore barrier elements

Failure of these barriers in presence of a kick will result in highest fluid discharge rate, usually referred
as worst case discharge (WCD). Main control pods have 1 out of 2 configuration with identical elements,
and their average PFD is given by equation 14. The beta factor for the BOP's main control system can be
found from the following formulation Borcsok et al. (2007)

where m = number of events when multiple similar components failed, n= number of events when only a
single component failed. It is to be worth mentioning that the BOP's main control systems are not totally
independent systems. They share a lot of common sub-systems and this is evident from their failure data
shown in Table 4.

Table 3—BOP main control system failures Holand and Awan (2012)

Using this data the beta factor for main control system be found as
OTC-28782-MS 11

The PFD for blind shear ram is calculated from equation 8. The channel's PFD for RBD of Figure 2 is
given by the following equation

The analysis results are shown in Table 4. The first case in each of Table 4, 5 and 6 is considered as a
reference case, and the relative percentage error of other cases is estimated against this reference case. For
reference case the real demand conditions are the same as test conditions and beta factor is the calculated
or assumed value. The difference between case1 and case2 is the beta factor, and relative %age error show
how much improvements in system's performance can be achieved if CCF contribution is eliminated. In
Case-3 the real demand conditions are not the same as test conditions, and its relative difference with case-1
provide the quantitative measure of system's PFD departure under assumed failure fractions. Case-4 show
the improvements in systems’ performance when CCF are reduced to zero for cases with dissimilar test
and real demand conditions.

Table 4—Probability of failure on demand of open-hole barriers (i.e. when drill pipe is out of hole)

Table 5—Average probability of failure on demand for barriers to stop flow inside the drillpipe

Table 6—Probability of failure on demand of annular flow path barrier

It can be observed from the table that the elimination of contribution of CCF for BOP's main control
system results in substantial improvements in systems availability. A relative decrease of nearly 67% in
channel's PFD is noted for the case OH2. Channel's PFD value jumps up to nearly 17% when the assumed
real demand conditions deviates from the test conditions for OH3. Even under these conditions improvement
in system's performance can be achieved by eliminating the CCF contribution of BOP's main control
system. A decrease of approximately 157 % in channel's PFD value is noted when cases OH3 and OH4
and compared.
12 OTC-28782-MS

PFD of inside drillpipe channel

Flow inside drill pipe occurs when annulus is perfectly sealed and barriers to stop flow inside drill pipe
depicted in Figure 1 (b) fail. The RBD of these barriers is shown in Figure 3. Historic data suggest that in
11% of the blowouts cases, the reservoir fluids took this path Zulqarnain and Tyagi (2014).

Figure 3—reliability block diagram (RBD) of barrier elements for flow inside drill pipe

The channels PFD is calculated by the following equation

The results of PFD calculations for barriers installed to stop flow inside the drill pipe are shown in Table 5.
In this set of barriers, only BOP's main control system has the CCF contribution and all other elements
are 1 out of 1 system. Channel's PFD values in these cases are not very high, even though the individual
component PFD values of DSSV/IBOP are very high. For these two components the PFD values are very
conservative in nature, as the assumption of λDU τ≤ 10−2 is violated for these components. The reliability of
DSSV and IBOP needs to be improved to lower their failure rates. Elimination of CCF contribution brings
about some positive changes in channels PFD values and a reduction of nearly 67% in noted in PFD value
for case-DP2. Therefore if design parameters for 1oo1 components cannot be improved, even than systems
performance can be improved by reducing the CCF contribution of BOP's main control system.
A significant increase of up to 1.5 times is noted in the channels PFD value, when the barrier elements
have to operate under assumed conditions dissimilar to test conditions. Elimination of CCF in this case also
bring about some positive improvements in channels PFD value and a reduction of up to 102 % is noted
between DP4 and DP3.

PFD of annular channel

This flow path and relevant barrier are very important as according to historic data, in nearly 78% of the
blowout cases, the formation fluids took this path. The RBD of annular flow path barriers is shown in Figure
4. For most modern BOP configurations the barrier elements for this flow path consists of a set of 3 pipe
rams and two annular preventers, and a blind shear ram.
OTC-28782-MS 13

Figure 4—Barrier diagram of annular flow path, (a) well barriers, (b) Corresponding RBD

The system will function if at least one of the pipe ram or annular preventer or blind shear ram works.
Based on the deepwater horizon BOP configuration, all pipe rams are considered as variable bore pipe rams,
which makes it to be 1 out of 3 type system.
In this approach we first calculate the PFD of pipe rams and annulars by incorporating CCF contribution
of 0.1 for their sub-components, and then treat them as independent systems and calculate the PFD of the
annular flow path. Pipe rams are 1 out of 3 configuration and their PFD can be calculated by the equation
11. The PFD of annular channel is estimated by

From the results are shown in Table 6, it can be observed that a reduction of up to 94% can be achieved,
when the subcomponent of multicomponent elements are treated as independent, i.e. CCF contribution can
be reduced to zero as is the case for AN2 case.
Under the assumed dissimilar conditions the consequences of dissimilarity of real demand conditions
from test conditions are not very severe as were in the cases of open hole or drill pipe flow. Only an increase
of up to 8% in channels PFD value is observed when dissimilar real demand conditions exist. Improvements
in channel's performance can be obtained even under these conditions by eliminating the dependence of
subcomponents of multicomponent barrier elements. Channels PFD is dictated by the PFD or main control
system.

Assumptions and Their Implications

• The assumption of λDUτ ≤ 10−2 in deriving the basic PFD formulation is violated in some cases,
mainly due to higher failure rates of some of the components. Therefore the results presented in
this study are very conservative in nature and present high PFD values.
• The BOP's main control system is treated as a 1oo2 system due to two independent control PODS
working in parallel. But these PODS are not truly 1 out of 2 type parallel system. They share a lot of
common sub components. This is also reflected by high CCF value of 0.25. Further considerations
14 OTC-28782-MS

of shared resources may results in higher PFD values as compared to 1oo2 system values reported.
But that will require extensive failure data for this classifications.
• The assumed failure fractions for scenario S1 and S2 are based on engineering judgement and the
nature of test being conducted and systems response's. These assumed fractions may be improved
by incorporating the field data if available.

Concluding Remarks
The results of average probability of failure on demand (PFD) of a modern deepwater subsea Blowout
Preventer are presented in this study. The study is subdivided into investigation of three fluid flow paths
that reservoir fluids can take while moving inside the BOP during uncontrolled flow situations. Existing
formulation for PFD are used to conduct a cases study using publically available historic well barrier
element data from U.S. Gulf of Mexico. It was noted that some of the real demand conditions during drilling
operations cannot be replicated in their entirety in controlled field test conditions. Therefore neglecting
the deviation of test conditions from real demand conditions may leave some of the undetected dangerous
failure remain hidden until a real demand arrives. Proof test coverage and partial stroke test concept are
used to handle imperfect testing and different type of test performed for barrier elements studied, by using
the multilevel test concepts. The analysis results show that BOP's main control system and blind shear
ram are the major contributors in the PFD of all of the three flow paths. Main control system due to its
high failure rate and blind shear ram due to its test condition deviations from the real demand conditions
under some circumstances. In open wellbore flow case which is also referred as worst case, only available
barrier element is the blind shear ram. Therefore improving the testing conditions, specifically testing first
it's shearing and then sealing capabilities will substantially increase the availability of this barrier element.
Under the assumed reveled failure fractions, the PFD of the open wellbore flow path channel increases up
to nearly 17%, when real demand condition are very different than the test conditions. Other sensitivity
results are also presented, that provide quantitative measure of the performance of deepwater drilling barrier
elements. It is hoped that the presented quantitative results help in improving the subsea BOP performance.

References
30-CFR-250-449. (2015). What Additional BOP Testing Requirements Must I Meet? Code of Federal Regulations, U.S.
(Reprint).
API-STD-53. 2012. Blowout Prevention Equipment Systems for Drilling Wells, American Petroleum Institute.
Borcsok, J., Schaefer, S., Ugljesa, E. 2007. Estimation and Evaluation of Common Cause Failures. Proc., Systems, 2007.
ICONS ‘07. Second International Conference on, 41–41.
Bourgoyne, A. T. J. 2002. Study of Drill String Safety Valves, Craft and Hawkins Department of Petroleum Engineering,
LSU, USA.
Brissaud, F., Luiz, F. 2015. Average probability of a dangerous failure on demand: Different modelling methods, similar
results (Reprint).
BSEE. 2013. Blowout Preventer (BOP) Reliability, Availability, and Maintainability (Ram) Analysis 1, The Bureau of
Safety and Environmental Enforcement.
Continia, S., Copelli, S., Raboni, M., Torretta, V., Cattaneo, C., Rota, R. 2013. Effect Of Test Policy On The Probability
Of Failure On Demand Of Safety Instrumented Systems. Chemical Engineering Transactions 33: 487–492.
Corneliussen, K. 2006. Risk Control in the Operational Phase of Offshore Wells PhD, Department of Production and
Quality Engineering, Norwegian University of Science and Technology Norway.
Eisinger, S., Oliveira, L. F., Chame, L. M., Netto, J. D. A., Fernandes, R. 2015. Reliability Analysis of Safety Systems
Subject to Multiple Testing Levels. Proc., ESREL, Zurich, Switzerland.
Hauge, S., Håbrekke, S., Lundteigen, M. A. 2010. Reliability Prediction Method for Safety Instrumented Systems –PDS
Example collection, 2010 Edition.
Holand, P., Awan, H. 2012. Reliability of Deepwater Subsea BOP Systems and Well Kicks.
Functional safety of electrical/electronic/programmable electronic safety-related systems. 2010: International
Electrotechnical Commission.
OTC-28782-MS 15

Lundteigen, M. A. 2009. Safety instrumented systems in the oil and gas industry: Concepts and methods for safety and
reliability assessments in design and operation. PhD, Department of Production and Quality Engineering, Norwegian
University of Science and Technology Norway.
Lundteigen, M. A., Rausand, M. 2007. Common cause failures in safety instrumented systems on oil and gas installations:
Implementing defense measures through function testing. Journal of Loss Prevention in the Process Industries 20 (3):
218–229. http://www.sciencedirect.com/science/article/pii/S0950423007000137.
Lundteigen, M. A., Rausand, M. 2008. Partial stroke testing of process shutdown valves: How to determine the test
coverage. Journal of Loss Prevention in the Process Industries 21 (6): 579–588. http://www.sciencedirect.com/science/
article/pii/S095042300800034X.
Lundteigen, M. A., Rausand, M. 2009. RELIABILITY ASSESSMENT OF SAFETY INSTRUMENTED SYSTEMS IN
THE OIL AND GAS INDUSTRY: A PRACTICAL APPROACH AND A CASE STUDY. International Journal of
Reliability, Quality and Safety Engineering 16 (02): 187–212. https://doi.org/10.1142/S0218539309003356.
Martinez, W. A. A. 2014. Methods for determining PFD/SIL for workover control systems with short test-intervals and
imperfect testing. MS, Department of Production and Quality Engineering, Norwegian University of Science and
Technology, Norway.
Mutlu, M., Arnold, Z., Franchek, M. A., Meraz, J. 2017. Qualitative Fault Tree Analysis of Blowout Preventer Control
System for Real Time Availability Monitoring. Proc., Offshore Technology Conference.
Negar, D. T., Mayank, T. 2017. Impacts of Major Offshore Oil Spill Incidents on Petroleum Industry and Regional
Economy. Journal of Energy Resources Technology 139 (2): 022913–022913-7. http://dx.doi.org/10.1115/1.4035426.
Ocheni, E. S. 2015. Impact of partial and imperfect testing on reliability assessment of safety instrumented systems. MS,
Department of Production and Quality Engineering, Norwegian University of Science and Technology, Norway.
Rausand, M. 2014. Reliability of Safety-Critical Systems, Theory and Applications. New Jersey, USA, John Wiley & Sons,
Inc (Reprint).
Rausand, M., Engen, G. 1983. Reliability of Subsea BOP Systems. Proc.
Rolén, H. 2007. PARTIAL AND IMPERFECT TESTING OF SAFETY INSTRUMENTED FUNCTIONS Department of
Industrial Economics and Technology Management, Norwegian University of Science and Technology
Sun, W. 2013. Determination of Beta-factors for Safety Instrumented Systems. Master Thesis, Department of Production
and Quality Engineering, Norwegian University of Science and Technology, Norway.
Tangstad, J. R. 2014. Assessment of dynamic barriers in oil/gas well operations. MS, Norwegian University of Science
and Technology, Norway.
Zulqarnain, M. 2015. Deepwater Gulf of Mexico Oil Spill Scenarios Development and Their Associated Risk Assessment.
PhD, Louisiana State University, Baton Rouge, LA, USA.
Zulqarnain, M., Tyagi, M. 2014. Quantitative Risk Assessment (QRA) of an Exploratory Drilling Oil Spill in Deepwater
Gulf of Mexico. (45455): V005T11A034. http://dx.doi.org/10.1115/OMAE2014-24685.