Implementing BOP Risk Models in the Gulf of Mexico

BOP case study header

Client: One of the world’s largest rig operators

The emergence of the BOP risk model

Drilling contractors and operators have begun responding to risks by innovating better solutions. Industry wants to show better capabilities to manage the risks involved with drilling. It is in this environment that Lloyd’s Register Energy began working in collaboration with industry partners to develop new and better risk management solutions.

At the end of 2011, Lloyd’s Register Energy began work on developing a BOP risk model together with one of the world’s leading rig operators, and a BOP risk model review panel.

The review panel comprised a group of well control experts, subsea specialists and operational managerial staff from five contractor and operator companies active in the Gulf of Mexico. As work progressed on the BOP risk model, Lloyd’s Register Energy hosted and facilitated a series of BOP review panel meetings which were also attended by U.S. regulatory body representatives.

By the end of 2012, Lloyd’s Register Energy had successfully developed a BOP risk model for two rigs in the GoM to help with decision making on whether a BOP needs to be pulled in a given situation of component failure when in operation.


The launch customer

Our client was instrumental in the development of the BOP risk model as well as being the first customer to implement it. The company is presently using the product on four of its rigs, including two of its ultradeepwater floaters in the GoM.

Our client’s Subsea Manager, North America, who was one of several technical experts consulted during the development of the BOP risk model, states “it has clear benefits over traditional BOP risk-assessment techniques.”

“Part of the intent was to create a  tool that took the human element out of the interpretation process, helping us to convey to other folks when it is okay to continue operating,” he continued. “It is a fantastic tool for the engineers on the rig.”

Practical application

In one multiple-issue case, there was preliminary evidence of a leak at the yellow pod on the lower blind shear rams (LBSR) close function.

During a function test on the BOP, the LBSR was functioned to close and the pod flow meter continued to count. When the function was put into the vent/block position, the flow stopped. A remotely operated vehicle (ROV) was deployed to determine the source of the leak. It was observed that the pod packer seal on the LBSR was leaking when the close function was selected.

The LBSR was taken out of service with the failure being a leak in the yellow pod from the solenoid to the shuttle valve. This failure put the BOP in an overall ‘orange’ status on the risk model user interface and the next steps were to stop, assess, decide, record and communicate. The orange status indicates the BOP was operating on a single point of failure: an additional failure in the close circuit in the blue pod would lead to the loss of the LBSR close.


In this situation, the BOP would  not meet API Standard 53 and the BOP status would become red. Documentation is readily available in the interface to support the logic. On the other hand, a failure immediately resulting in a ‘red’ status would have indicated a requirement to stop operations and a decision to pull the BOP stack.

Preliminary evidence also identified a small leak from the fitting on the pod wedge extend cylinder. During a routine ROV dive and BOP inspection, a small amount of fluid was also seen coming from the pod wedge area. The well was secured and a senior subsea engineer started venting/blocking functions one at a time until the leak was found. A fitting on the pod wedge cylinder extend circuit was confirmed to have a small leak.

While it was a symptom of the issue, the component that was taken out of service was the solenoid in the yellow pod for internal pod stab extend. The failure state was ‘the solenoid failed to open/energize/ unlock.’ This caused the stab extend function to fail to operate. Removing the solenoid from service put the BOP in an overall ‘orange’ status on the risk model interface, indicating to stop, assess, decide, record and communicate.

The combined effect of these two component failures created an overall orange status on the BOP risk model interface, requiring an assessment and decision to continue operations. The BOP risk model provided engineers the information to communicate with stakeholders to continue operations until a later point within the well program.

Without a clear understanding of risk provided by the BOP risk model, this multiple-issue scenario would have likely required a prolonged investigation or an immediate BOP stack pull.

“While the BOP risk model gives clear status indications that simplify and expedite decision-making and risk analyses,” our client said, “it has other ancillary benefits. For example, it can function as a document library which mandates that all documents are kept up to date.

How it works

Based on technology first applied in the nuclear industry the model automates risk assessment of the BOP based on available component failure information, with results that are objective, consistent and transparent using a process that has been approved by relevant regulatory authorities.

The model, presented in a userfriendly interface, details more than 600 BOP components and 35 different functions accounting for more than 65 different topevents. It uses four colors – green, yellow, orange and red – as visual indication to express the risk level of the whole BOP, a subsystem or component. At each stage, the color is meant to suggest what should be done, whether it’s to stop operations and make a written risk assessment, or discontinue work altogether. The model doesn’t enforce execution of the recommended action. The whole responsibility of making the decision is still with the people.

The risk model is able to do so because the risk assessment methodologies used to make a failure effect model are performed in advance by a team of subjectmatter experts equipped with the current diagrams and documentation for each individual BOP. For every component, the team asks, “What is the effect of its failure? What’s the local effect and what’s the end effect?” The risk-decision methodology is based on operating procedures, P&IDs, logic block diagrams, fault tree analysis, regional regulations and specifications from the oil and gas industry, including component manufacturers and operating procedures of the contractor using a specific BOP. Each BOP risk model is customized to the configuration and components and their functions of the specific BOP stack, and the operating and regulatory environment in which the rig will operate.

It is intuitive and doesn’t require extensive knowledge of risk modeling to use. During operation, a user can manually take equipment out of service associated with a failure mode and the BOP risk model will calculate the risk levels, displaying them through the user-friendly interface with a series of color-coded graphs.

The display supports accurate, logical component failure effect interpretation, risk-status assessment and trouble-shooting across a wide range of user-related experiences. Moreover, it offers experienced operators independent proof that their analyses of specific failures are correct, while rendering evidence to regulators and other less-knowledge-able stakeholders that risks are understood by the operator and are being managed.

This objective cause and consequence risk assessment greatly reduces the time it takes for operators and industry stakeholders to decide whether or not to stop well operations, while also minimizing unnecessary or risky decisions to stop production.

Realizing the BOP risk model’s potential

While this model is currently being used to report the operational risk associated with component failure, we recognize the potential of forecasting failure. Moving beyond simple component state information (the component is in or out of service), work is being done toward including component reliability information like MTTF or MUTF (Mean Time To Failure or Mean Usage To Failure) and later on condition-based component data which can be used to estimate the probability that particular components will fail at any given time. As the industry continues to deploy technology like this, it will continue to evolve into a more proactive tool.

Lloyd’s Register Energy believes that committing to new systems, methodologies and products such as the BOP risk model will produce compelling results in safety and performance. Advancement like this will assist the drilling industry to make a step-change in the way it assesses and manages the risk of a BOP failure, and the monitoring and maintenance of high-risk, safety-critical assets in general.