Copyright 2003, Offshore Technology Conference

This paper was prepared for presentation at the 2003 Offshore Technology Conference held inHouston, Texas, U.S.A., 58 May 2003.

This paper was selected for presentation by an OTC Program Committee following review ofinformation contained in an abstract submitted by the author(s). Contents of the paper, aspresented, have not been reviewed by the Offshore Technology Conference and are subject tocorrection by the author(s). The material, as presented, does not necessarily reflect any posi-tion of the Offshore Technology Conference or its officers. Electronic reproduction, distribution,or storage of any part of this paper for commercial purposes without the written consent of theOffshore Technology Conference is prohibited. Permission to reproduce in print is restricted toan abstract of not more than 300 words; illustrations may not be copied. The abstract mustcontain conspicuous acknowledgment of where and by whom the paper was presented.

AbstractHistorically, drilling contractors have accepted without manyquestions the reliability of the Blowout Preventer (BOP) com-ponents and overall control system. A statistical reliabilityapproach to qualifying, purchasing, and maintaining deepwa-ter BOP control systems should provide a high level of confi-dence of being able to have long periods of time betweenplanned maintenance of these systems with very few, if any,failures.

A study of deepwater BOP control systems has been per-formed to look at reliability issues and a means to qualifysystems and components for a determined period betweenmaintenance. Of special attention are the regulators and howthey are typically arranged and used in the system. This paperwill describe a statistical process to determine the reliabilityand failure rate necessary to accomplish the maintenance goal.In addition, the qualification process will be described and adiscussion of the pressure control regulator issues discoveredin the study will be provided.

IntroductionTransocean, like many other offshore drilling contractors, re-cently went through an extensive rig newbuild and upgradeprogram, which required purchasing a significant amount ofcustomer-furnished equipment for the various shipyards. Aswith most boom cycles, the industry activity before thebuilding cycle had developed ideas for new rig technology,but lacked R&D resources to make them available to be manu-factured as already proven systems. Therefore, this buildingcycle, similar to all the rest, resulted in R&D efforts in parallelwith the manufacturing of new equipment to be installed onnew rigs. And, as before, this resulted in design and relatedproblems while in service that drove significant downtime, inmany instances.

At times, it appears the industry attitude is that we cannot af-ford R&D in advance of a defined need. However, the indus-

try seems to be able to afford to fix the problems associatedwith downtime due to an incomplete design.

Many of these problems are directly related to not having adetailed set of design and functional specifications to give tothe equipment manufacturer. Plus, the purchaser usually doesnot understand the duty cycle requirements, or demands, of theparticular equipment for an interval that is acceptable to per-form maintenance on the equipment without sustaining down-time.

For offshore floating drilling operations, especially in deep-water, one of the most expensive downtime events is associ-ated with having to pull the marine riser and subsea BOP be-cause of a problem. Any problem or failure that requires theriser and BOP to be round tripped will result in a cost of ap-proximately $1.00 MM per event. And whether the contractoror the operator absorbs this cost, it is expensive.

One of the more common causes for pulling the marine riserand subsea BOP is associated with the BOP control system.The deepwater BOP control system associated with dynami-cally positioned (DP) rigs is typically a Multiplexed Electro-Hydraulic (MUX) Control System. This is schematicallyshown in Figure 1. The demand on the subsea control systemis initiated at the surface. The demand signal is multiplexeddown the control umbilical to the subsea control system.There, the signal is decoded, confirmed, and performed. For ademand that requires a BOP Ram to close, for example, themultiplex signal would be received at the subsea control podand decoded. The decoded signal would cause a solenoid to beopened electrically which would send a hydraulic pilot signalto the proper hydraulic valve. This pilot signal would causethe hydraulic valve to shift and send stored and pressurizedhydraulic fluid to the BOP Ram to be closed.

Therefore, the subsea BOP control system consists of two ba-sic elements: electrical and hydraulic components. History hasshown that more subsea problems have been associated withthe hydraulic components than the electrical, causing the BOPand riser to be retrieved for repair.

Each subsea BOP system has two complete control pods. Eachpod is capable of performing all necessary functions on theBOP. While these systems may be considered redundant, anymajor problem associated with one pod will cause the systemto be retrieved to the surface for repair. If a major problem isfound, the control of the subsea BOP is transferred to the other

OTC 15194

DEEPWATER BOP CONTROL SYSTEMS - A LOOK AT RELIABILITY ISSUESEarl Shanks, Transocean; Andrew Dykes, ABS Consulting; Marc Quilici, ABS Consulting; John Pruitt, ABS Consulting

2 OTC 15194

pod and preparations will be made to retrieve the lower marineriser package (LMRP) and riser to surface. Some minor prob-lems may not require the system to be retrieved if considerednot necessary for critical operations.

Transocean has recently had an opportunity to review the ba-sic design and requirements for Deepwater MUX BOP Con-trol Systems. During this review, it was obvious: the best timeto perform major maintenance on a complicated BOP controlsystem was during the shipyard time of a mobile offshoredrilling unit (MODU) during its five-year interval inspectionperiod. This process would lead to minimal or no downtimeassociated with BOP controls and allow for planning properresources during the maintenance period.

Therefore, a project was initiated to determine what would berequired to manufacture a control system that would requiremajor maintenance only on a five-year interval.

Reliability DiscussionA brief investigation into the specifications given to BOPcontrol vendors revealed that rarely was any equipment per-formance requirements given. Very often, the system require-ments were developed between the contractor engineers, op-erations personnel, and vendors as the project progressed afterthe purchase order was given. Reliability was assumed to be asgood as the previous systems built. Or, in the case of a newdesign, it was assumed better than before.

During the bid and purchase negotiations between the con-tractor and vendor, emphasis is typically given to the follow-ing: Number, type, and size of specific functions to be

provided. The BOP stacks of the newbuilds werebuilt with more functions and volume requirementsthan in the past. Therefore, the control systems hadmore comp onents than before;

With a desire to make trouble-shooting problemseasier, the systems have more pressure and positionread-backs;

For ultra-deepwater applications, the working pres-sure and volume of the stored hydraulic fluid in-creased dramatically;

With the increased size of the two control systems onthe subsea riser package, careful attention was givento the architecture of the system to fit in the spaceavailable.

Currently, factory acceptance testing (FAT) requirements atdelivery of the system are generally were no more than func-tion tests to ensure all functions work according to the pipingand function drawings.

When the systems are accepted and integrated in the BOPstack, they are sent to the rig for continuing operations.

A new system on a rig generally has a learning curve associ-ated with maintenance requirements. Maintenance schedules

are typically established as problems are discovered. Becauseof the pressure on getting the equipment back to work, rootcause analysis of the failures is generally not performed. Inmany operations, high maintenance is accepted as a necessaryevil to prevent downtime.

High maintenance can be a tool to reduce failures in operation.However, this is a very expensive approach, and it is also anopportunity to introduce human error into the system. Also,this method does not establish reliability based on a failurerate.

In general, operating reliability is maintained on rigs mostlythrough regular maintenance intervals rather than specifying areliability of a system or component to minimize maintenance.

Project Scope of WorkFloating drilling rig downtime due to poor BOP reliability is acommon and very costly issue confronting all offshore drillingcontractors. Transocean, as a major player in offshore explo-ration worldwide, operates numerous floating rigs of variouscapabilities and configurations. Depending on the drillingcontract in place and the nature of the downtime cause, BOPfailure can result in substantial revenue loss for the drillingcontractor.

In order to reduce the risk of revenue loss to the contractor oroperator, Transocean is committed to actively pursuing im-provements in BOP reliability at all levels during the equip-ment lifetime, including the design stage. As part of this proc-ess, individual BOP component reliability goals are necessaryto ensure that the desired overall BOP reliability target isachieved.

Since the hydraulic components of the control system histori-cally have had more problems that have required the riser andBOP stack to be pulled, the first efforts were directed at thehydraulic system, including all hydraulic stack-mounted com-ponents. The systems under review consist of the solenoidpilot valve through to the end function.

The following reliability goals were established for the sole-noids and hydraulic components: Overall service life of system is 20 years;

Pressure regulators maintenance 5 years, body 20years;

Solenoids 20 years, body 20 years;

Solenoid shear seal valves maintenance 5 years, body20 years;

SPM valves maintenance 5 years, body 20 years;

Shuttle valves maintenance 5 years, body 20 years;

Other valves maintenance 5 years, body 20 years;

Hoses with couplings 5 years;

Piping and connections 20 years.

OTC 15194 3

Also, a method was established to design a specification tooperate a Subsea BOP system for five years without needingto pull the system to the surface for unplanned maintenance;this project determined the method to design a specification tomeet this goal. This discussion focuses on the reliability testspecification that is necessary to ensure the use of highly reli-able components that will result in the hydraulic control sys-tem meeting this objective.

The need for highly reliable sub-sea BOP system componentsresults from the following assumptions that are based on ac-tual experience. The BOP has a large number of hydraulic control

system components;

During a 5-year period, an individual valve will getcycled many times;

Within the current design, a failure of any one of thecontrol components may require pulling the BOP tothe surface.

This paper estimates the magnitude of the testing requirementsnecessary to demonstrate the desired level of reliability. Thisis accomplished by scoping the mission success criteria basedon a representative system configuration and a detailed analy-sis of the required testing. Next, an estimate of the componentfailure rate goals is established based on the desired opera-tional reliability of the system and the test demands that vari-ous component-type groups within the system are expected tobe exposed to over the desired duration (5 years). Then, anestimate is made of the number of cycles of a reliability testingprogram required to provide confidence that the componentswill perform reliably to achieve the BOP hydraulic controlsystem reliability goal.

This scope of work is accomplished by addressing the fol-lowing major categories: Control System Design Considerations This proc-

ess will look at all components to be considered inthe study and group the components into Familytypes for further analysis;

Estimate of Component-Type Reliability Require-ments The requirements of each component for themaintenance interval will be determined and a reli-ability goal is established to meet the criteria;

Elements of the Reliability Testing Plan Each fa m-ily of components has its own failure rate goal tomeet the overall failure rate goal of the system;

Amount of Testing to Provide Statistical Confidence The amount of testing to satisfy the failure goalsand desired statistical confidence is specified;

Component Testing Program Test program to meetthe stated goals.

Control System Design ConsiderationsComponent Family Type Grouping Within SystemA representative rig was chosen to perform the study. Thiswas a 5th-Generation DP semisubmersible capable of drilling

in water depths to 10,000 feet. A worksheet was developed toprovide a complete listing of the components in the hydrauliccontrol system. Family types group the components. The term,Family Type, refers to the general function that the valvesaccomplish (e.g., pilot valve, check valve, shuttle valves, etc.)It is assumed that within a given component type the comp o-nent designs are similar enough to assume that the reliabilityperformance of the components may be modeled by one fail-ure rate, regardless of size. The family types are listed belowalong with an indication of the number of components of thatfamily within the representative system.

Check Valves - There are 22 check valves.Pilot Assisted Check Valves There are 6 pilot as-sisted check valves.Piloted Hydraulic Valves Dual Function There are38 dual-function pilot valves,Piloted Hydraulic Valves Single Function Thereare 42 single-function pilot valves.Regulators - There are two types of regulators, fourmanually set regulators and eight hydraulically con-trolled regulators. The operational success criteria forthe regulator valve are still under evaluation. Thedemands associated with the regulator relate to thepressure control function performed during periodictesting of specific functions, which is required overthe period during which the control valves are beingcycled. The severity of the challenges depends onfactors in the system that is still being investigated.Shuttle Valves There are 74 shuttle valves used inthe system.Solenoid Valves There is no variation in solenoidvalves. All 142 valves are 1/8, 3 way, 2-positionvalves.

Estimate of Component-Type ReliabilityRequirementsThe goal of this project is to develop a control system that hasthe potential to operate 5 years between major maintenancewithout a failure. However, to have a starting point for devel-oping failure rates, it was established that an acceptable failurerate would be one failure in 10 years that would cause a BOPstack to be retrieved to the surface.

Operational Test SummaryAn Operational Test Summary worksheet was establishedshowing the BOP operational testing program for the BOP thatconstitutes the 5-year success criteria for the hydraulic controlsystem. The results for a 10-year period was also establishedto develop targeted failure-rate goals. The mission is based onthe participation of valves in various subsystems of the BOPin a functional testing program of the BOP, both on the sur-face and subsea. The test program consists of 7 separate BOPControl tests that are conducted over a typical 8-week welldrilling operation. An 8-week average per well drilled wasassumed. Therefore, for a 5-year duration, approximately 33wells would be drilled. For a 10-year interval, 65 wells wouldbe drilled.

The component function cycles were established by the fol-

4 OTC 15194

lowing test sequences:

Test 1. Function tests a BOP Control function whenthe stack is retrieved to surface, without pressuretesting. This is to remove salt water in the pod.Test 1A Emergency Disconnect Test and RemoteOperated Vehicle Tests.Test 2. Surface pressure test prior to running BOP.Test 3. Run and land BOP, lock wellhead connectorand line up BOP valves for drilling operations.Test 4. Bi-weekly subsea pressure and function testfor the duration of the well.Test 5. Line up valves in preparation of pullingBOP. Unlock wellhead connector and adjust accu-mulator pressure on trip to surface.

This worksheet calculated the total number of componentfunctional cycles based on the years of service that will formthe basis for the reliability requirement. Figure 2 is a summaryof the component functional cycles occurring due to the op-erational test sequences by Family Type. This summary showsthe resultant total number of demands for valve positionchanges over the specified operational testing period. It can beseen in this summary, over 87,000 valve-cycle demands wouldhave to be performed successfully subsea. And, almost140,000 total cycles would occur during the 5-year period.

Specification of Reliability GoalsA Reliability Goal Evaluation provided a means to estimateindividual component failure rate goals based on system reli-ability goals. Figure 3 represents a worksheet used to providean interactive tool for evaluating different reliability goals. Asshown, it is an estimate of the component-type group failurerates required to produce an average of 1 failure, among all sixcomponent types, within the hydraulic control systems per rigper 10-years of operation.

The estimate is designed to produce component failure ratesthat produce a system reliability that has been balanced. Asevery component must function successfully when requiredduring tests, the BOP hydraulic control is a series system; itsreliability is modeled by the product of the reliabilities of allthe components. This is done in two stages. First, an equalreliability requirement is allocated to each component-typegroup. Then the reliability requirement is allocated to eachcomponent within that group through the specification of afailure rate that will produce the component-type reliabilitywhen applied against the total number of test demands for thatgroup. The resultant component failure rates are given in thecolumn labeled Comp onent Failure Rate Goal.

Those component types that must respond to the most de-mands should be the most reliable, which agrees with commonsense. For example, Solenoid Operated Valves are exercisedabout twice as much as any other component type. Conse-quently, they should have the lowest failure rate. Conversely,those valves that are not challenged as often as others can havesomewhat higher failure rates without becoming a dominantcontributor to failure.

A number of sensitivity studies with the worksheet developedthe table at the bottom of the worksheet. It illustrates the cur-rent reliability of the system and the required improvement infailure rates needed to achieve system reliability goals of up to95% over a 5-year period. This table shows that very low fail-ure rates are needed to achieve a high reliability.

As shown, the upper two tables reflect the goal of averagingone failure per rig per 10 years of operation (65, 8-week testcycles or wells drilled). The system reliability goal is varieduntil component group failure rates are obtained that as acomposite produce an expected value of 1 failure over themore than 171,000 subsea valve demands made during thatperiod. The values in the Comp. Failure Rate Goal columnthen becomes the failure rates to be demonstrated by the reli-ability testing program.

Elements of the Reliability Testing PlanEach group of similar valve types needs to undergo reliabilitytesting to provide confidence of its failure rate. If any one ofthe valve types has a significantly higher failure rate than itsfailure rate goal, it will generate a weakest link systemwhose reliability would be dominated by that component. Thefailure rate goal for each of the Family Groups is shown inFigure 4.

A binomial process for demand-related failures and the Pois-son process for time-related failure modes may represent thefailure rate. Both of these processes assume that observed fail-ures result from random failures of a population of comp o-nents characterized by a failure rate independent of the previ-ous life cycle of the valves under test. This implies that: A FAT has verified that manufacturing defects and

any infant mortality failure mechanisms are not pres-ent;

The total cycling of the valve is not of an amount tocause wear that is significant enough to precipitatewear-out failure mechanisms.

For demand-related failures, when the failure rate is low andthe number of demands is large, the binomial process may beapproximated by a Poisson process, so that the formulation ofthe statistical analysis of both time and demand related ismathematically the same, with only the units differing. (ThePoisson process relates a continuous time-related failuremechanism with units of failures/unit of time. A large numberdemands may be considered to occur over time, so the simi-larity of form should not be difficult to accept.)

Valves placed under test must be randomly selected in order tobe representative of the population. If the vendor conducts thetest, the components to be tested should be selected by some-one independent from the vendor.

The design of the test will depend on the historically observedfailure mechanisms that contribute to failure. If cycling the valves put stress on them, then the reli-

ability tests should involve repeated operationalevolutions where they are demanded to open and

OTC 15194 5

close in accordance with the operational require-ments;

If exposure to the subsea environment precipitates thefailures, the test must include exposure to these con-ditions, or more severe conditions that can acceleratethe mechanisms, for a period of time that can simu-late the total exposure.

As both mechanisms are most likely involved, the reliabilitytest needs to address both environmental exposure and opera-tional evolutions.

Testing alone does not improve reliability or guarantee that nofailures will occur within a given time frame. It verifies thatsystems and components are reliable or serves to identifyweak spots if they are not. To be effective, a reliability testneeds to account for the following: The tests need to be similar to actual operational con-

ditions;

The duration and/or operational evolutions in the testneeds to be large enough to provide confidence thatthe needed reliability can be achieved;

The root causes of any observed failures and anoma-lies need to be identified and corrected.

Testing done by specific purposes, such as burn-in, FAT andendurance testing to identify wear-out life, can provide indi-rect evidence that will increase confidence that a group ofsimilar valves will perform its mission successfully.

Amount of Testing to Provide Statistical ConfidenceClassical statistics relies strictly on outcome of valid tests oractual experience to provide statistical confidence in the reli-ability of a system or component. The higher the reliabilityrequirement, the more tests needed to provide that confidence.

The confidence limit is a means of judging the impact of theuncertainty of the component failure rates. When one estab-lishes failure rate estimates on the results of reliability tests orsamples from actual experience, it must be recognized that anygiven sample result can be produced by populations with dif-ferent failure rates. The confidence limit is a means of ex-pressing the probability that the sample result might have beenthe result of a lucky statistical outcome of a population thatactually has an unacceptably high failure rate. That is, if thetest were repeated again, the result would most likely beworse.

For the BOP system, it is assumed that the failure rate of allcomponents within each of the 6 component-type groups, de-fined previously, can be modeled by a single-componentgroup failure rate. The impact of component failure rate un-certainty on the uncertainty of system failure rate is illustratedby Figure 6. The curve on the left-hand side of the chart repre-sents 1 of 6 components having equal failure rates (equivalentto the 6 component-type groups in the BOP hydraulic controlsystem). The curve is typical of the uncertainty in failure rates.It illustrates that one does not have to demonstrate componentreliability to a very high confidence limit when it is part of a

larger series system. With many random variables, the impactof the higher end of the distribution of 1 component tends toget balanced by the lower portions of the distributions of othercomponents. For this 6-component series system, an 80% con-fidence that each component group failure rate

6 OTC 15194

The program should focus on known problems based ontracking previous problems, but it also needs to maintain somekind of confirmatory testing for all component groups.

Pressure RegulatorsMost components in a control system, such as solenoid valves,piloted hydraulic valves, shuttle valve, etc., have a discretenumber of cycles in a 5-year life and can be determined byknowing the frequency of BOP tests or operations. However, aregulator typically has many cycles during a large volumedemand function such as an annular close. Figure 7 shows asample of the original modeling of a pipe ram close for a pre-vious project. Obviously, there appears to be a lot of activityof the regulator position during the function.

And, clearly, it would be impossible to determine the numberof cycles, or movements, of the regulator in a 5-year period.Therefore, an additional project has been initiated to determineif the regulator spool can be controlled or calibrated to be ableto determine its cycle behavior under various volume de-mands. This project is on going.

ConclusionsThe process described in this paper is contrary to how the off-shore industry typically specifies its equipment. Historically,functionality has been the primary focus of bid specifications.However, the content of this paper shows it is feasible, andshould be practical, to specify the equipment used on our Mo-bile Offshore Drilling Units (MODUs) by performance speci-fications which meet our planned requirements.

It must be noted that component failures are random eventsand may still occur. However, demonstrated component reli-ability at this level provides a high confidence that significantdowntime can be minimized over the drilling cycle.

Obviously, the requirements contained in this paper will re-quire additional R&D by the vendors as well as a greater effortby the purchasers to understand and specify the requirementsfor any particular system. The end result of purchasing a morereliable system will be some form of additional cost. Plus, thevendors that can deliver a control system that can go 5 yearswithout maintenance will only see spare purchases once every5 years for each rig. The desire of vendors to provide this typeof equipment and service should allow a possible new eco-nomic model to be developed which allows the vendor, con-tractor, and operator to share in the savings resulting from nocontrols-related downtime.

OTC 15194 7

FIGURE 1. Multiplex Electro-Hydraulic Control System

FIGURE 2. Estimated Cycles

8 OTC 15194

FIGURE 3. Reliability Goal Spreadsheet

FIGURE 4. Component Failure Rates

OTC 15194 9

FIGURE 5. Component Testing

FIGURE 6. Confidence Level for Component Group and System

10 OTC 15194

FIGURE 7 Regulator Piston Position