Risk model simplifies BOP-pull decisions

Tool mapping 600-plus BOP components, 35 functions streamlines complex decision-making process

By Katherine Scott, associate editor

The decision-making process to pull a subsea blowout preventer (BOP) can be as complex as the tool itself. “When something goes wrong with the BOP at the bottom of the ocean, you’re shut down for an undetermined number of days. It’s such a complicated problem and more than just a failure. A number of stakeholders have to determine what that failure is, what level of risk it causes and then ultimately what the solution is,” Pieter van Asten, business concepts manager for Lloyd’s Register Energy – Drilling, said in an interview with Drilling Contractor.

Drilling contractors and operators are responding by enhancing risk management, Mr van Asten said. “The industry wants to show that they will be able to manage the risk involved with deepwater drilling,” he said.

The organization, along with Scandpower, another organization in the Lloyd’s Register Energy group, developed a BOP risk model in 2012 to specifically address the decision-making process of whether a BOP needs to be pulled. The model aims to streamline the process “by means of consistent risk-based failure investigation and effect modeling and due communication about the decision taken… It should be simple enough to be understood by somebody who needs to operate it on a rig in a stressful situation when you have a problem on your BOP.”

The model, which has been in use in the Gulf of Mexico (GOM) since November 2012, was also developed together with a primary drilling contractor, as well as the BOP Risk Model Review Panel, a group of well control experts, subsea specialists and operational managerial staff from five contractor and operator companies active in the GOM. The Lloyd’s Register groups created the panel in January 2012, then facilitated and hosted the meetings. Representatives from the US Bureau of Safety and Environmental Enforcement also attended.

Presented as a software tool, the model details more than 600 BOP components and 35 functions accounting for more than 65 top events. “For every component, we sat down and said, ‘This is a shuttle valve. How can it fail? What’s the local effect, and what’s the end effect?’ taking into account all regulatory requirements.”

It uses four colors – green, yellow, orange and red – as visual indication to express the risk level of the whole BOP, a subsystem or component. At each stage, the color is meant to suggest what should be done, whether it’s to stop operations and make a written risk assessment, or discontinue work altogether. “The model doesn’t force you. The whole responsibility of making the decision is still with the people.”

Mr van Asten noted that a subsea BOP is among the few pieces of equipment on the rig that combines multiple functions as an operations control, risk prevention tool and emergency response tool. “Those functions are combined in this very condensed and complex system, and if one component fails, it could affect all three functions.”

When it’s not immediately known which BOP component has failed, the risk model guides the user to only the components applicable to the symptom encountered and leaves out 98% of the rest, Mr van Asten said. “That speeds up the whole of decision making tremendously.” A “what-if” mode also allows the user to take out every component and see if the effects identify the symptom. “It allows people, even in a stressful situation, to focus very quickly on the problem and use the what-if scenarios in the model to more easily identify the components that have failed.”

Depending on water depth and the type of riser being used, an entire disconnect – making the well safe, disconnecting, pulling the stack up, repairs, deploying it again and testing – can take 10 to 12 days. On the other hand, if the decision is to leave the BOP down, you’ve agreed to take the risk, Mr van Asten said. “If you decide to pull it, you know that you are out for at least 10 days, but if I decide to leave it down, it might bring trouble because you may not know what happens on a risk management basis. These conflicting factors are, I think, the daily business on a drilling rig nowadays. Drilling operations and business aspects are a well-known field, but managing these conflicting factors from a risk-based perspective is one of the biggest problems.”

He notes that the time spent between identifying a problem and making the decision to either continue operations or pull the BOP has become longer on today’s rig operations. “Taking into account an enormous number of different components and functions can take days, not to say weeks, before you actually identify and justify if pulling the BOP, or leaving it down is the best decision.”

Prior to this project, when something went wrong on a BOP, it would take a lot of people to try to figure out what went wrong and what were the ramifications, Mr van Asten said. “Now all that work is done ahead of time, and it’s in the BOP risk model. So when something goes wrong, you see the fault tree and the risks associated… We’ve been informed about a couple of occasions where (a drilling contractor in the GOM) actually had a problem and used the model to communicate. So even preventing one unnecessary BOP pull proves its value.”