User Guide for WCR Equipment Failure Form

A User Guide for Reporting
Well Control Equipment Failure

USDOT Bureau of Transportation
Statistics
November 30, 2017
Rev. 2.00

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Table of Contents
1.0

Background, Scope, and Purpose ................................................................................................................... 4
1.1

Background ............................................................................................................................................... 4

1.2

Purpose ..................................................................................................................................................... 4

1.3

Scope.. ...................................................................................................................................................... 5

2.0

Definitions and Acronyms ............................................................................................................................... 6
2.1

Definitions ................................................................................................................................................ 6

2.2

Acronyms .................................................................................................................................................. 6

3.0

Accessing the SafeOCS Reporting System....................................................................................................... 7

4.0

Submit a WCR Failure Notification online....................................................................................................... 9

5.0

Submit a WCR Failure Notification through file uploading ........................................................................... 14

6.0

Update and add files to an existing WCR equipment failure notification .................................................... 17

7.0

Delete files attached to an existing WCR equipment failure notification .................................................... 22

8.0

Detail Instructions on How to complete the WCR Failure Notification online ............................................. 22
8.1

Record Identification, Well Identification, Rig Owner, and Operator Information................................ 23

8.2

Equipment Data and History .................................................................................................................. 25

8.3

Site Specific Information and Event Data ............................................................................................... 27

8.4

Root Causes: Definitions and Examples ................................................................................................. 29

8.5

Compliance ............................................................................................................................................. 30

9.0

Investigation and Failure Analysis................................................................................................................. 31
9.1 Failure Causes ................................................................................................................................................ 31
9.1.1 Physical Causes ........................................................................................................................................... 31
9.1.2 Human Factor Causes ................................................................................................................................. 31
9.1.3 Systemic Causes.......................................................................................................................................... 32
9.2 Analysis Overview .......................................................................................................................................... 32
9.3

Level One: Cause Immediately Known ................................................................................................... 33

9.3.1

Example of Cause Immediately Known .................................................................................................. 33

9.3.2

Resources ............................................................................................................................................... 33

9.3.3

Closure .................................................................................................................................................... 33

9.4

Level Two: Subject Matter Expert Review (SME) .................................................................................. 34

9.4.1

Example of a SME Review ...................................................................................................................... 34

2

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

9.4.2

Resources ............................................................................................................................................... 34

9.4.3

Closure .................................................................................................................................................... 35

9.5

Level Three: Root Cause Failure Analysis Required (RCFA) .................................................................... 35

9.5.1

Physical Evidence.................................................................................................................................... 36

9.5.2

Resources ............................................................................................................................................... 36

9.5.3

Closure .................................................................................................................................................... 37

9.6

Compliance ............................................................................................................................................. 37

10.0

Capture and Share Lessons Learnt ................................................................................................................ 37

11.0

Reporting Design and Procedural Changes ................................................................................................... 37

12.0

Submit a SPPE Failure Notification (Coming soon) ....................................................................................... 38

13.0

Submit a Safety Event Report (Coming soon) ............................................................................................... 38

APPENDIX 1.

Definitions ........................................................................................................................................ 39

APPENDIX 2.

Failure Notification Form ................................................................................................................. 43

APPENDIX 3.

Failure Reporting Process ................................................................................................................ 44

3

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

1.0

Background, Scope, and Purpose

1.1

Background

In August 2013, the U.S. Department of the Interior's Bureau of Safety and Environmental Enforcement (BSEE) and
the U.S. Department of Transportation's Bureau of Transportation Statistics (BTS) signed an Interagency Agreement
(IAA) to develop and implement SafeOCS, as a voluntary program for confidential reporting of 'near misses'
occurring in oil and gas production on the Outer Continental Shelf (OCS). BSEE and the BTS entered into a
Memorandum of Understanding (MOU) in August 2016 to allow BTS to collect equipment failure data required
under BSEE rules for reporting blowout preventer (BOP) system or component failures (30 C.F.R.§ 250.730(c)) and
safety and pollution prevention equipment (SPPE) failures (30 C.F.R.§ 250.803). On October 26, 2016, the BSEE
director announced the expansion of the SafeOCS program beyond near miss reporting to include the confidential
collection of equipment failure data pursuant to regulations 30 C.F.R.§ 250.730(c) and 30 C.F.R.§ 250.803.
Data collected by BTS under the IAA is protected under the Confidential Information Protection and Statistical
Efficiency Act of 2002 (CIPSEA) (44 U.S.C. §3501). This means: a) data collected by BTS under SafeOCS are protected
from inquiries of other government agencies, including BSEE, Freedom of Information Act (FOIA) requests, and
subpoena; b) data on near miss incidents collected under SafeOCS may not be used for regulatory purposes; and c)
only aggregate statistics and analytical results generated from the data will be made available to interested parties
or released to the public.

1.2

Purpose

This document was developed to assist the offshore drilling operators and their representatives with the
completion and submission of equipment component failure notifications pursuant to regulation 30 C.F.R.§
250.730(c).
Federal regulation 30 C.F.R.§ 250.730(c) was established to ensure accurate reporting of BOP system and
component failures, from initial notification to investigation and failure analysis, communication of failure
information and lessons learned, and design and procedural changes.

4

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

1.3

Scope

This document applies to submissions of well-control equipment failures to SafeOCS in accordance with 30 C.F.R.§
250.730(c), including all American Petroleum Institute (API) S53 components and adjacent equipment, such as:
•

Auxiliary Equipment (Drillstring valves, gas separation equipment, top drives, and test equipment)

•

BOP Stack

•

BOP Controls (Primary, Secondary and Emergency)

•

Choke Manifold Equipment

•

Diverter System

•

Riser System (Including choke and kill lines).

This document establishes the criteria and provides guidance on:
•

Accessing the SafeOCS data system (Section 3)
o

On-line link to the SafeOCS website

o

Creating a new account

o

Starting the online reporting process

•

Reporting WCR equipment component failure online (Section 4)

•

Reporting WCR equipment component failure through file uploading (Section 5)

•

Updating and adding files to an existing WCR equipment failure notification (Section 6)

•

Deleting files attached to an existing WCR equipment failure notification (Section 7)

•

Detail instructions on how to complete the WCR failure notification online form (Section 8)

•

Conducting component investigation plus failure analysis and documentation (Section 9)

•

Reporting supplemental information to support learning (Section 10)

•

Reporting design and procedural changes (Section 11)

•

Submitting a SPPE Failure Notification (Section 12, Coming soon)

•

Submitting a Safety Event Report (Section 13, Coming soon)

5

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

2.0

Definitions and Acronyms

2.1

Definitions

A list of definitions is provided in Appendix 1.

2.2

Acronyms
API

American Petroleum Institute

BOP

Blowout Preventer

BSEE

Bureau of Safety and Environmental
Enforcement

BTS

Bureau of Transportation Statistics

BWM

Between Wells Maintenance

HSE

Health, Safety and Environment

IADC

International Association of Drilling Contractors

JIP

Joint Industry Project

LMRP

Lower Marine Riser Package

NPT

Non-Productive Time

OEM

Original Equipment Manufacturer

QA/QC

Quality Assurance/Quality Control

RCFA

Root Cause Failure Analysis

RWP

Rated Working Pressure

SFI

Skipsteknisk Forskningsinstitutt

SME

Subject Matter Expert

WCR

Well Control Rule

6

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

3.0

Accessing the SafeOCS Reporting System

The SafeOCS Reporting System is accessed through the website of the SafeOCS program at www.safeocs.gov.
(Figure 3.1)

Figure 3.1 SafeOCS Web Page

•
•
•

To submit a Well Control Rule (WCR) equipment component failure notification, select the WCR button on
the home page or the WCR Failure Notification tab on the main navigation bar.
To submit a Safety and Pollution Prevention Equipment (SPPE) failure notification, select the SPPE button
on the home page or the SPPE Failure Notification tab on the main navigation bar.
To submit a Safety Event report, select the Safety Event button on the home page or the Safety Event
Report tab on the main navigation bar.

Since data reported to SafeOCS are confidential and protected under the Confidential Information Protection and
Statistical Efficiency Act of 2002 (CIPSEA) (44 U.S.C. §3501 note), a user has to register and create an account in
the SafeOCS Reporting System before he/she can submit equipment failure notifications or safety event reports.

7

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

To register an account in the SafeOCS Reporting System, select the Register tab on the main navigation bar of the
SafeOCS website (Figure 3.2).

Figure 3.2 SafeOCS Registration page

8

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

4.0

Submit a WCR Failure Notification online

Step 1: Login to your SafeOCS account
Provide your Email and Password to login to your SafeOCS account at the Login page for WCR Failure Notification
submission. (Figure 4.1)

Figure 4.1 SafeOCS Log in page

Step 2: Confirm your agreement to the Confidentiality and Burden Statements
After login, the user is required to read and consent to the Burden Statement and Pledge of Confidentiality. Check
the “I have read - - -,“ box and select the Start New Report button to continue (Figure 4.2).

Figure 4.2 POC and Burden Statement
webpage

9

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Step 3: Select a mode of submission
SafeOCS offers three ways to submit WCR equipment component failure notifications: Online, Upload, and Postal
Mail (Figure 4.3). Select “Submit New WCR Equipment Component Failure Notification” online tab to make a report
online.

Figure 4.3 SafeOCS web portal

10

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Step 4: Complete the online WCR Equipment Component Failure Notification form
The selection of the “Submit New WCR Equipment Component Failure Notification” online will bring up the WCR
online form (Figure 4.4) for the user to complete.

Figure 4.4 WCR equipment failure form

Detailed instructions on how to complete the WCR Equipment Component Failure Notification on-line are provided
in Section 8. Please refer to that section, if there are questions about the meaning of or the expected values/entries
for any of the data fields.

11

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Step 5: Review, edit the WCR Equipment Component Failure Notification form before submitting
It is important to review and edit the completed notification form before submitting to correct any data-entry
errors. Once a notification is submitted, it will not be available for review or edit anymore and errors made in data
entries can only be corrected by submitting an update to the original notification.
Step 6: Submit the completed notification form
Submit the completed notification form by selecting the “Submit” button (Figure 4.5).
Please note:
•
•
•

Only when the “Submit” button is selected, information entered in the online form is saved to the SafeOCS
database and a BTS reference number is generated for the notification.
If the user closes the online form without submitting it, all information entered in the form will be lost.
Once a notification is submitted, it will not be available for review or edit by the user. Corrections to a
submitted notification can only be achieved by submitting an update to the original notification.

Figure 4.5 WCR equipment failure form

12

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

When a notification is successfully submitted, a message will show on the screen of the SafeOCS website to inform
the user that the notification has been successfully submitted (Figure 4.6). An email of Acknowledgment of Receipt
will also be sent to the reporter’s email account registered with SafeOCS (Figure 4.7).

Figure 4.6 WCR submittal page

From: SafeOCS
Sent: Wednesday, November 22, 2017 3:26 PM
To: email address of the reporter
Subject: Acknowledge of Receipt - WELL CONTROL

User Name,
The following WCR equipment failure reports you submitted through the SafeOCS online system at
3:26:04 PM on Nov 22, 2017 have been received by SafeOCS:
IADC Incident Number

BTS Reference Number
WCR2017#00xxxx

If you have any questions, please email [email protected] or call 1-844-OCS-FRST (1-844-627-3778).
Thank you,
The SafeOCS Team
[email protected]
1-844-OCS-FRST (1-844-627-3778)

Figure 4.7 SafeOCS email account page

13

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

5.0

Submit a WCR Failure Notification through file uploading

Step 1: Login to your SafeOCS account (Refer to Section 4.0 for details)
Step 2: Confirm your agreement to the Confidentiality and Burden Statements (Refer to Section 4.0 for details)
Step 3: Select a mode of submission:
Among the three modes of submission (Online, Upload, and Postal Mail), select the link “Upload PDF Form” or the
link “Upload Excel Form” (Figure 5.1).

Figure 5.1 WCR Failure Notification page

14

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Step 4: Select and upload completed WCR failure notifications to SafeOCS
Selecting the link “Upload PDF Form” or the link “Upload Excel Form” will bring up an interface to allow the user to
select and upload completed WCR failure notifications to SafeOCS (Figure 5.2).

Figure 5.2 WCR Upload Excel Form

Upload instructions:
•

•
•

•

“Reporting Operator” in the interface is a required field. If the name of the operator for which you are
submitting a failure notification is not in the dropdown list of the field, please select “Other” at the bottom
of dropdown list and then type in the operator’s name in the pop-up text field.
“Select File” is another required field. The “Browse” function allows the user to select and upload only one
file at a time. However, multiple failure notifications can be included in one file.
“Number of Notifications Included” in the file to be uploaded is a field with a default value of 1 and max
value of 15. The value selected for this field will determine the number of BTS Reference Numbers the
system generates for this submission. Since it is important for the system to have a unique BTS Reference
Number for each failure notification included in the file to be uploaded, the number selected should match
the number of failure notifications included in the file.
“IADC Identification No.” is an optional field. The purpose of this field is to allow operators to match their
records of failure notifications submitted to SafeOCS with those submitted to IADC. The number of rows
for entering IADC Identification No. is determined by the number selected for the “Number of Notification
Included” field. Changes to the number of rows of the “IADC Identification No.” will also automatically
change the value of the “Number of Notifications Included.”

15

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

When a file is successfully uploaded, a message shows on the screen of the SafeOCS website to inform the user that
notifications included in the file has been successfully submitted (Figure 5.3, with example case). An email of
Acknowledgment of Receipt is also sent to the user’s email account registered with SafeOCS (Figure 5.4, with
example case).

Figure 5.3 WCR Equipment Failure Notification

From: SafeOCS
Sent: Wednesday, November 22, 2017 3:26 PM
To: email address of the reporter
Subject: Acknowledge of Receipt - WELL CONTROL

User Name,
The following WCR equipment failure reports you submitted through the SafeOCS online
system at 3:00:xx PM on Nov 22, 2017 have been received by SafeOCS:
IADC Incident Number

BTS Reference Number

Rxxxxxxxxxxxx001

WCR2017#00xxxx

Rxxxxxxxxxxxx002

WCR2017#00xxxx

If you have any questions, please email [email protected] or call 1-844-OCS-FRST (1-844627-3778).
Thank you,
The SafeOCS Team
[email protected]
1-844-OCS-FRST (1-844-627-3778)

Figure 5.4 Acknowledgment of Receipt

16

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

6.0

Update and Add Files to an Existing WCR Equipment Failure Notification

Additional information, such as pictures, graphs, detailed descriptions, or updates, can be added to the record of a
notification after the original notification has been submitted. This can be done by using the “Update and Add Files
to an Existing WCR Equipment Failure Notification” function (Figure 6.1).

Figure 6.1 WCR update and add files web page

17

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

To ensure that the additional information is attached to the correct notification, the user must select the BTS
reference number from the dropdown list of the BTS Reference Number field (Figure 6.2) before clicking on the
“Go” button to bring up the file uploading interface.

Figure 6.2 WCR Update and Add Files web page

Please note:
•

To protect confidentiality, a registered user will only be able to see the BTS reference numbers of the
notifications he/she submitted, unless he/she is authenticated to be the operator’s representative by a duly
authorized official of the concerned operator. An operator’s representative will be able to see BTS reference
numbers of all notifications submitted under the operator’s name and add additional information to those
notifications.

18

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Selecting the “Go” button will bring up the file uploading interface (Figure 6.3). Clicking the “Add files” button in
the interface will bring up the libraries window allowing the user to select files in any folder/directory that is
accessible to the user’s computer. (Note: Multiple files may be selected.)

Figure 6.3 WCR attachment web page

19

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

When the selection is done, the selected files will be listed in the file upload interface (Figure 6.4). From the list,
click on the “Upload” button to upload a selected file to SafeOCS. Click on the “Cancel” button to delete a file from
the list.

Figure 6.4 WCR attachment web page

20

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Once a file is uploaded, the user can remove a file that has been added to the record of a notification if he/she
desires so by selecting the delete button (Figure 6. 5).
All uploaded files will be listed in the interface and can be deleted (removed) from the records of the notification
later.

Figure 6.5 WCR attachment web page

When all the selected files have been uploaded, clicking on the “Done” button will return the user to the interface
of the Update and Add File function.

21

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

7.0

Delete files attached to an existing WCR equipment failure notification

The Update and Add Files function can be used to delete files that have been attached to the record of a notification.
Here are the steps:
•

At the page of the Update and Add Files function, select the BTS Reference Number of the notification from
which an attached file is to be deleted and then select “Go”, which will bring up a page similar to Figure 6.5
and with a list of all the files attached to the notification.

•

Select the “Delete” button associated with a file to delete the file from the database.

•

Select the “Done” button to return to the interface of the Update and Add Files function.

8.0

Detailed Instructions on How to complete the WCR Failure Notification online

Detailed instructions and information on completing the WCR Failure Notification Form are provided below. The
failure notification form should be completed as much as possible (fields marked with an asterisk* are mandatory).
After completing the form, press the ‘Submit’ button to save the data into the SafeOCS database. Data entered
into the form will not be saved if the reporter leaves the webpage without pressing the ‘Submit’ button.

22

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

8.1

Record Identification, Well Identification, Rig Owner, and Operator Information

23

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

SafeOCS database will automatically assign each submission with a unique identifier (BTS reference number). The
system will also provide an optional data field for the operator/company-assigned reference number and IADC
Incident number, if applicable.
Lease No. – Number as provided by operator.
Well No. – Number as provided by operator.
API Well No. – Number as provided by operator.
Rig Owner / Drilling Contractor – Select a company name from a dropdown list of rig owners/drilling contractors
currently in the database. If the name of the Rig Owner/Drilling Contractor for which you are submitting a failure
notification is not in the dropdown list of the field, please select “Other” at the bottom of dropdown list and then
type in the name in the pop-up text field.
Rig Name – Select a name from the dropdown list of rigs owned by the selected rig owner. If the name of the Rig for
which you are submitting a failure notification is not in the dropdown list of the field, please select “Other” at the
bottom of dropdown list and then type in the Rig’s name in the pop-up text field.
Operator – Select a name from a dropdown list of operators currently in the database. This includes both members
and non-members of the JIP. If the name of the operator for which you are submitting a failure notification is not in
the dropdown list of the field, please select “Other” at the bottom of dropdown list and then type in the operator’s
name in the pop-up text field.
Owner’s Primary Contact – Title of person who is familiar with the issue in case further information is required. This
can be the person reporting, based on the company’s decision.
Contact Email – Email address for the Primary Contact.
Name of Person Reporting – Name of person who submitted the report.
Name of OEM Representative Onboard, if applicable – Name of any OEM representative on the rig that was involved
in the component analysis.
Owner’s Specific Equipment ID Number – An anonymous SFI code or similar that the equipment owner uses to
identify the specific equipment or component.
OEM Incident Reference Number – Reference number issued by the OEM if involved.
Equipment sent on shore for – NO should be selected in this dropdown box if the equipment was not sent ashore. If
the equipment was sent ashore, the appropriate reason should be selected.

Note: *Not every well has all of these numbers. Provide the number that has been assigned to your well. If the
rig is not under contract, then state “Not Applicable”.

24

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

8.2

Equipment Data and History

25

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Type of Well Control Equipment (WCE) System – Subsea; Surface Offshore; Land.
Select SUBSEA if the system utilizes a subsea BOP designed to be operated underwater; Select SURFACE OFFSHORE
or LAND, as appropriate, for others.
Equipment Integrator – Select the OEM who assembled the BOP stack and/or the BOP control system in this
dropdown box. If the name of the equipment integrator for which you are submitting a failure notification is not in
the dropdown list of the field, please select “Other” at the bottom of dropdown list and then type in the name in the
pop-up text field.
Subunit – Select the system subunit that was involved in the failure being reported. The selection of a subunit will
determine the list of items available for the next selection.
Item – Select the item involved in the failure being reported. The selection of an item will determine the list of
components available for the next selection.
Component – Select the component involved in the failure being reported. (This is the lowest maintainable item that
failed. Do not give the control pod details for a failed pressure regulator.)
Component Manufacturer – Select the manufacturer of the component in this dropdown box. If the name of the
component manufacturer for which you are submitting a failure notification is not in the dropdown list of the field,
please select “Other” at the bottom of dropdown list and then type in the name in the pop-up text field.
Observed Failure – Select the failure mode for the component in this dropdown box. The list of failure modes
available for selection is dependent on the selected combination of subunit, item, and component.
Model – A free text field to enter the manufacturer’s equipment model for the defective component.
Size – Two dropdown boxes to input the whole and fractional size (in inches) for the component.
Item/Component Pressure Rating – Two dropdown boxes to first select the standardized pressure rating and second,
to select whether this is ‘Well Bore’ or ‘Operating Circuit’ pressure.
OEM Part Number – Free text field to enter the identifying part number as established by the OEM.
OEM Serial Number – Free text field to enter the OEM unique identifying serial number.
Date Affected Component Installed –Select the date that the component was installed into the system on the rig.
This could be the date that the equipment was delivered, or it could be the date after a major
inspection/maintenance (e.g. mm/dd/yyyy).
Maintenance Deferred on Equipment – YES/NO dropdown box to record whether planned maintenance was overdue
at the time of failure or not applicable.
-If YES, what maintenance was deferred – Free text field to describe the planned maintenance that was deferred
(BWM, Quarterly, Annual, 5-Year, etc.).
Date of Last Maintenance –Enter the date (mm/dd/yyyy) of the last planned maintenance actually completed.
Description of Completed Last Maintenance – Free text field to describe the maintenance that was performed. (i.e.
Corrective, BWM- visual and lubrication), Annual – Somewhat invasive for measurements and or operator tests or
5-year – Total disassembly) and any comments that may link the failure with the last maintenance carried out.
Amount of Usage at the Time of Failure – Enter the number and select Hours or Cycles. If you have automatic cycle
counters, or the discipline to actually count the cycles, then record them for valves, cylinders and pistons. Record
usage hours for pumps.

26

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

8.3

Site Specific Information and Event Data

27

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Type of well work at the time of event - Free text field to describe the operation at the time of equipment failure.
Note: For rigs that have two BOP’s, describe the rig’s operation that correspond to the component failure being
reported.
IADC Code Description – Dropdown box with a listing of IADC codes and associated descriptions of rig operations. If
the name of the IADC Code for which you are submitting a failure notification is not in the dropdown list of the field,
please select “Other” in the list and then type in the description in the pop-up text field.
Location (Region) – Dropdown box to select appropriate continent for the rig operation.
Location (Country) – Dropdown box to select appropriate countries within the selected region.
Water depth – Free text field to input the depth and a dropdown box to select the unit of measure (Feet or Meters)
for the integer.
Drilling Fluid Type – Dropdown box to select from the commonly used fluids.
BOP Control Fluid Manufacture – Free text fields to record the details for the BOP control fluid Manufacturer.
BOP Control Fluid – Drop Down box and/or “Other” maybe selected to access the free text box to input fluids that is
not included in the dropdown selection.
BOP Control Fluid Concentration – Number field to record the percentage of control fluid concentrate in the mixture.
Glycol Concentration – Number field to record the percentage of glycol in the mixture.
Was the last laboratory sample acceptable? – Select YES/NO to record the results of the last laboratory sample (as
opposed to a rig test) or not applicable.
Date of last sample –Select the date (mm/dd/yyyy) of the last laboratory analysis.
Event Date – This is a calendar field on line (mm/dd/yyyy) to record the date (free test field on the downloadable
form).
Event Date means – Dropdown box to select what the event date mean: ‘Date of Occurrence’, ‘Date of Detection’.
This is an explanation field to provide information about the Event Date provided above.
Where did the event occur? – Dropdown box to select when the failure occurred: ‘BOP #1 In Operation’, ‘BOP #1 Not
in Operation’, ‘BOP #2 In Operation’, ‘BOP#2 Not in Operation’. If there is only one BOP, then select the appropriate
version of BOP #1. Note: Consult Appendix A for event definitions.
Description of Event – Free text field where sufficient, but concise, information should be stated so that the reader
understands what failed, what were the symptoms, what was being functioned at the time of failure and why was
it being functioned. Include any details deemed pertinent.
Hours of NPT – Field to record number of hours that is inclusive of BOP recovery and reinstallation etc., plus all time
in-between when the failure occurred.
Hours of Repair time – Number field that includes only the time to repair and test the failed component.
Did the event cause a BOP Stack pull? – Select YES/NO to record if a subsea BOP stack retrieval was required. Note:
See Appendix A for definition of a stack pull.
Detection Method – Dropdown box to select how the failure was discovered.

28

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Immediate Corrective Action – Dropdown box to select the action taken on the rig to place the component back into
an operational state. If the immediate corrective action for which you are submitting a failure notification is not in
the dropdown list of the field, please select “Other” at the bottom of dropdown list and then type in the corrective
action in the pop-up text field.
Root Cause – Dropdown box to select the cause of the failure. See section 3.6 for additional guidance on the
dropdown options. If a specific root cause for which you are submitting a failure notification is not in the dropdown
list of the field, please select “Other” at the bottom of dropdown list and then type in the root cause in the pop-up
text field.
Reason for root cause chosen- Free text field where sufficient, but concise, information should be stated so that the
reader understands the process for the root cause selection.
RCA Status- Select NO RCA if the cause was immediately known; select YES-DONE or YES-TO BE DONE, if a RCFA was
required. Note: A RCFA is required for all “stack pulls”.
Additional Comments- A free test field to provide any additional information concerning the component including
the success of improvement actions.

8.4

Root Causes: Definitions and Examples

The following are options available from the Root Cause dropdown box.

Assessment Pending:

This should be selected if, for instance, the BOP stack is still subsea. The failure
will be investigated when the BOP stack becomes accessible and the root cause
can be evaluated.

Design Issue:

Inadequate equipment design or configuration.
This is typically identified after a root cause failure analysis (RCFA) has been
completed, or if the design issue has been previously identified by an RCFA or
manufacturer’s notification.

Documentation Error:

Failure related to procedures, specifications, drawings, reporting, etc.
For example, a control valve was delivered with documentation stating that the
rated working pressure (RWP) was 5,000 psi. The valve leaked and the subsequent
investigation showed that the valve was really only rated for 3,000 psi. This was a
documentation error because of the stated RWP.

Maintenance Error:

Mistake, misuse, or oversight during maintenance.
For example, a choke line flange leaked after the maintenance had been completed.
Investigation showed that the flange studs had been torqued to 380 Nm instead of
the 380-ft-lb stated in the procedure. This was a Maintenance Error.

29

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Procedural Error:

Mistake, misuse, or oversight during operation.
For example, the BOP ram leaked, because test pressure was applied after closing
pressure was vented, but without the ram having first been mechanically locked.
This was an Operational Error.

QA/QC Manufacturing:

Failure related to manufacturing.
For example, a new annular piston was purchased from the OEM, but we were
unable to install it. Investigation showed that it had been machined incorrectly.

Wear and Tear:

An expected condition of a component that has reached a point where it is unable
to perform intended function as the result of usage.
If wear and tear is repeatedly selected for equipment that fails in operation, then
that could indicate that a review of the maintenance procedure is required.

RCFA Required:

Currently unknown root cause.
For example, a RCFA is always required if there was; a loss of a well barrier, if there
was an unplanned stack/LMRP recovery, or if there was a systemic/reoccurring
event. Either of the other investigation requirements can be promoted to an RCFA
if necessary.

Other / Comment:

The root cause is known, but is none of the above. Selection of ‘Other’ will open a free text
comment box.

8.5

Compliance

Completion and submission of the Failure Notification Form (Section 8.0) will ensure compliance with the written
failure notice requirements of 30 C.F.R.§ 250.730(c).

NOTE: Submission of the Failure Notification Form to SafeOCS does not fulfill the requirement of 30 C.F.R.§
250.730(c) to report failures to the OEM.

30

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

9.0

Investigation and Failure Analysis

In the event of a BOP system or component failure it is important to conduct an effective investigation and failure
analysis in order to identify the causes (i.e., physical, human, and systemic) and root cause(s) of a failure. This will
establish a knowledge base that the industry can use to instill safety and improve equipment/component reliability.

There are several major approaches to investigation and failure analysis that are used within the industry, e.g.,
events and causal factor analysis, change analysis, barrier analysis, management oversight and risk tree analysis,
etc. Any one of these approaches should be selected in order to verify the root cause (see section 8.4) and identify
the causes (physical, human, or systemic) of the failure.

The scope of any investigation and analysis related to the equipment/component failure must be based on factual
information (e.g. hose failure, valve leaking in closed position).

9.1 Failure Causes
As part of the investigation and failure analysis process, three types of causes are identified. These are: physical,
human factor, and systemic causes.

9.1.1 Physical Causes
The consequence, manifestation, or results determined through evidence that have influenced or triggered a
component failure. Examples include corrosion, fatigue, excessive stress, erosion, rupture, etc.

9.1.2 Human Factor Causes
These are related to human activities that have contributed to the failure of a system or component. Identifying
and understanding the contribution of human factors during component failure investigations will improve
corrective action identification and component performance. Examples include maintenance error, failure to follow
procedures, etc.

31

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

9.1.3 Systemic Causes
These are related to any system or process activity rather than other specific isolating factors, including failures in
the procedures used to execute the work.
NOTE: If the failure is part of a wider event, then the appropriate investigative procedure may need to be
followed IN ADDITION to the creation of the WCR report on component failure.

9.2 Analysis Overview
This section presents the three levels of investigation and failure analysis. Please refer to the flow chart in appendix
3 for additional information and clarification:
•

Cause Immediately Known

•

Subject Matter Expert (SME) Review

•

Root Cause Failure Analysis

NOTE: If an investigation at one level fails to sufficiently determine the root cause(s) of the failure, then analysis
can proceed to the next level.
If the root cause is immediately known, then this information is submitted to SafeOCS (See Appendix 3).
If the equipment failure 1) resulted in a loss of a well barrier, 2) required the LMRP or BOP stack to be retrieved, or
3) has become a systemic/recurring event, then a Root Cause Failure Analysis (RCFA) should be conducted,
documented, and submitted to SafeOCS.
If the equipment failure does not involve any one of the above-mentioned events (1, 2, or 3), then a SME Review
should be conducted, documented, and submitted to SafeOCS.
NOTE: There will be occasions when a component failure previously categorized as either ‘Cause Immediately
Known’ or ‘SME Review’, is reclassified as ‘Systemic/Reoccurring’ (#3) due to multiple occurrences
requiring a ‘RCFA’. As such, the previously submitted report does not need to be re-classified and may be
referenced (and modified if necessary) in the SME Review or RCFA.

32

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

The Failure Notification Form can be updated (as needed) during the investigation and analysis process. The
document can be uploaded, along with additional information, using the BTS unique reference number or identifier
that was assigned to the original Failure Notification Form.

9.3

Level One: Cause Immediately Known

9.3.1 Example of Cause Immediately Known
An O-ring damaged during installation normally can be easily categorized as Cause Immediately Known. It is
important to report such issues, because if this were to escalate to a systemic/reoccurring event, then it may
warrant a change to the design or installation/maintenance procedures.

9.3.2 Resources
The Senior Subsea Engineer should discuss what happened with another technical member of crew to determine:
•

What happened?

•

How it happened?

•

Why it happened?

A description of the event and other appropriate information should be provided on or with the Failure Notification
Form.

9.3.3 Closure
The investigation is considered closed when the cause is immediately known and the information is provided (see
9.3.1 and 9.3.2). The system will process the resubmittal, thus fulfilling the regulatory requirement. Cases that do
not show a cause immediately known are discussed next under Level Two (9.4) and Level Three (9.5).
If the Failure Notification Form has previously been submitted as “final”, it may still be modified or updated as
appropriate. Supporting documentation can be added by using the unique BTS reference number or an equivalent
unique identifier that was assigned to the original Failure Notification Form by the SafeOCS system.

33

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

9.4

Level Two: Subject Matter Expert Review (SME)

A SME Review should be conducted when the cause of the failure is questionable and the component failure has
not triggered an RCFA (not an unplanned BOP pull, loss of well barrier, or a systemic/reoccurring event).
An SME Review is conducted when:
•

a failed component requires disassembly to ascertain the cause of the failure,

•

the event frequency is not systemic – (see Appendix 1), or

•

the consequence (no loss of barrier or BOP retrieval) of the component failure are considered low.

However, a Root Cause Failure Analysis (RCFA) might be triggered based on a SME review findings.

9.4.1 Example of a SME Review
If a ram failed to hold pressure during pre-deployment testing and upon opening the doors/bonnets it was apparent
that the packers were well worn, then a SME Review could check the records to see if the number of functions met
expectations. Then, after the rams have been successfully tested with new packers to confirm that there was no
other issue, and assuming the number of functions met expectations, the failure can be attributed to ‘Wear and
Tear’. However, if the rams fail to test and/or the function cycles are less than expected, then the causal agent is
something other than ‘Wear and Tear’.

9.4.2 Resources
Two or more SME’s.
The SME Review should show a logical conclusion based on sound evaluation of the physical causes of what, how,
and why a failure occurred. Furthermore, the report must be produced either by cross-referencing the assigned
unique reference numbers or located using the following information contained within the report:
•

Details of the component that failed (Part Number, Serial Number, Description)

•

Date of the failure

•

Details of the failure

•

Date that the SME Review commenced and was completed

•

Investigation team member description

34

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

•

Failure cause(s)

•

Findings

•

Corrective Actions taken

•

Recommendations

9.4.3 Closure
The incident can be considered closed when the component failure form in the database is updated (closing the
initial report) and the final report is published. A Failure Notification Form that has either been modified or updated,
must include the necessary documentation supporting the identified cause(s) and attached using the unique BTS
reference number or equivalent unique identifier.

9.5

Level Three: Root Cause Failure Analysis (RCFA) Required

The RCFA is a more detailed investigation requiring more time and resources to complete. There are three specific
triggers for when a RCFA should be carried out (see Figure 9.1).
The result of the RCFA can be used to correct specific problems and prevent reoccurrence, for instance: OEM
product bulletins, equipment owner maintenance system changes, etc.

Was there loss of a
well barrier?

YES

NO

Was there an
unplanned stack/LMRP
recovery?

YES

The Operator ensures
that a RCFA is arranged.

NO

Is it a systemic/
recurring event?

YES

NO

Figure 9.1. RCFA Triggers

35

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

9.5.1 Physical Evidence
In many instances, well control component failures are frequently field repairable, but there may be cases when a
replacement assembly may not be readily available. In such an event, ensure that a full and detailed documentation
of the physical evidence is provided. In extreme and pressing circumstances photographs, dimensions, sketches,
and written reports can also be substituted and submitted as further evidence.

9.5.2 Resources
Typically, this includes at least one SME plus an OEM representative or a suitably qualified third party.
The RCFA report should include the causes (physical, human, and systemic) and the reasons (what, why, and how)
for the failure occurrence.
To be considered in compliance with the regulatory requirements (30 C.F.R.§ 250.730(c)), the RCFA documentation
should include the following:
•

A copy of the initial report

•

An accurate description of the failure

•

Detailed information on the operating conditions that existed at the time of the malfunction or failure
and any applicable operating conditions that existed prior to or immediately after the failure

•

Description of the immediate corrective actions that were taken as identified in the failure
notification

•

Any relevant operating history of the equipment prior to the failure (e.g. field repair, modifications
made, etc.)

•

Description of any inspection, testing, laboratory analysis, or other activities conducted to determine
the root cause and causal factors

•

Description of the causal factors determined to be associated with the failure

•

Additional equipment problems beyond the initial failure notification identified during the failure
analysis

•

Other conclusions or findings resulting from the investigation and failure analysis

•

Corrective actions recommended and taken in addition to the immediate corrective actions noted in
the initial report, if known at the time of the investigation and analysis report

•

Photographs, pressure tests, inspection records, laboratory analyses results, verification documents,
etc. to support the investigation and failure analysis conducted.

36

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

9.5.3 Closure
The incident can be considered closed when the component failure report in the database is updated (closing the
initial report) and the final report is published. A Failure Notification Form that has either been modified or updated
must include the necessary documentation supporting the identified cause(s) and attached using the unique
reference number or equivalent unique identifier.

9.6

Compliance

Pursuant to 30 C.F.R.§ 250.730(c), a failure report shall be generated for each failure of any well control
system/component whether there is NPT or not. To facilitate the accomplishment of this responsibility, this
guidance document established protocols governing the reporting and subsequent investigations of a well control
incident.

10.0 Capture and Share Lessons Learned
When developing protocols for identifying, investigating, reporting, and maintaining records of incidents and
failures, it is important that each of these events serves multiple purposes. For instance, proper investigation and
reporting assists OEM’s and owners identifying problematic areas and weaknesses that can be improved ensuring
equipment safety and reliability.
Pursuant to 30 C.F.R.§ 250.730(c), it is important that lessons learnt from component failures are shared with the
appropriate industry stakeholders.

11.0 Reporting Design and Procedural Changes
Pursuant to 30 C.F.R.§ 250.730(c), changes in design and operating procedures (resulting from a failure) that were
not submitted as part of the Failure Notification or Investigation and Failure Analysis reporting process must be
submitted to SafeOCS within 30 days. This information should include the unique reference number assigned by
the SafeOCS system or an equivalent unique identifier established when the Failure Notification Form was originally
submitted.

37

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

12.0 Submit a SPPE Failure Notification (Coming soon)

13.0 Submit a Safety Event Report (Coming soon)

For questions contact SafeOCS
www.safeocs.gov
1-844-OCS-FRST (1-844-627-3778)

38

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

APPENDIX 1

DEFINITIONS

GENERAL DEFINITIONS
BOP Stack Pull (Subsea)

When either the BOP is removed from the wellhead or the LMRP is
removed from the lower stack to repair a failed component. The BOP stack
cannot be classified as a stack pull until after it has been in-operation.

BOP Stack Pull (Surface)

When a BOP component fails during operations and requires well
conditioning and a mechanical barrier placement to make necessary
repairs.

Cause

Something that initiates, shapes, or influences an outcome.

Cause Immediately Known

When there is a high degree of certainty in the failure cause, the failure
information described in Section 3 is completed describing the failure and
defining the root cause based on inspection and maintenance personnel
experience and knowledge.

Corrective Action

An action, which is taken to correct a failure and/or the failure’s cause.

Effect

An event or condition that is caused by another event or condition.

Evidence

Information, data and/or items gathered which directly relate to, or have
been, affected by the failure.

Failure

A condition that prevents the component from operating as designed,
e.g. A leaking O-ring is a failure even if the piston that it should seal can
fully stroke.

In-Operation (Subsea)

A BOP stack is in-operation after it has completed a successful pressure
test of the wellhead connection to the well-bore per approved well plan.

In-Operation (Surface)

A surface BOP stack is in-operation after it has completed a successful
pressure test of the wellhead connection to the well-bore per approved
well plan.

Non-productive time (NPT)

The number of hours that is inclusive of BOP recovery and reinstallation
etc., plus all time in-between failure detection and getting back to the
point (in the well operation) at which the failure occurred.

39

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Not in-operation (Subsea)

The BOP stack changes from in-operation to not in-operation when either
the BOP is removed from the wellhead or the LMRP is removed from the
lower stack. When running or pulling (retrieving) the stack, the BOP stack
is not in-operation.

Not in-operation (Surface)

A surface BOP changes from in-operation to not in-operation when the
well is conditioned and a mechanical barrier is set in the wellbore.

Preventative Maintenance

Maintenance carried out at predetermined intervals or according to
prescribed criteria and intended to reduce the probability of failure or the
degradation of the functioning of an item.

Rated Working Pressure (RWP)

The maximum internal pressure that equipment is designed to contain or
control in the form of standardized pressure ratings.

Reoccurring/Systemic Event

A failure that occurs periodically or repeatedly. A reoccurring event, also
known as a systemic event, may be identified at:

Root Cause

•

an individual component or equipment system level,

•

a company’s level, or

•

an industry-wide level.

The cause (condition or action) that begins a cause/effect chain and ends
in the equipment component failure. If eliminated, it would prevent the
reoccurrence of the event (under investigation) and similar occurrences.

Root Cause Failure Analysis (RCFA)

A comprehensive systematic investigation process undertaken to identify
Physical, Human Factors and Systemic root causes of a component
failure.

SafeOCS Subject Matter Expert

A person or persons with an in-depth knowledge of a subject of interest,
hired or appointed by the Government to evaluate failure submissions in
accordance with 30 C.F.R.§ 250.730(c).

SafeOCS SME Review

An evaluation of failure submissions by a SafeOCS SME to determine the
gravity of a failure event’s potential consequence with respect to
equipment context, causal factors, and other considerations.

Skipsteknisk Forskningsinstitutt (SFI)

Ship Research Institute of Norway

40

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Subject Matter Expert

Your designated person or persons with an in-depth knowledge of a
subject of interest. Such knowledge will have been gained through direct
and practical dealings with subject matter of interest.

SME Review

An internal assessment of the possible and probable local root cause of
the component failure reviewed by a SME with the intent of
recommending intermediate actions or changes to reduce the probability
of reoccurrence.

ROOT CAUSE DEFINITIONS (as used in the failure notification Input Form (Appendix 2) and Section 1 of the
Investigation and Failure Analysis Summary Form.
Assessment Pending:

This should be selected if, for instance, the BOP stack is still subsea. The failure will
be investigated when the BOP stack becomes accessible and the root cause can be
evaluated.

Design Issue:

Inadequate equipment design or configuration.
This is typically identified after an RCFA has been completed or if the design issue
has been previously identified by RCFA or manufacturer’s notification.

Documentation Error:

Mistake or oversight in the documentation used by equipment operatives.
The installation, operations and maintenance documents were followed but there
were inherent errors in the documentation supplied. The documentation can be in
the form of drawings, manuals, procedures, work instructions and work orders and
can be supplied by the OEM, System Integrator or the Equipment Owner.

Maintenance Error:

Mistake, misuse or oversight during maintenance.
A choke line flange leaked after the maintenance had been completed.
Investigation showed that the flange studs had been torqued to 380 Nm instead of
the 380-ft-lb stated in the procedure. This was a Maintenance Error.

Procedural Error:

Mistake, misuse or oversight during operation.
The BOP ram leaked because test pressure was applied after closing pressure was
vented, but without the ram having first been mechanically locked. This was an
Operational Error.

QA/QC Manufacturing:

Failure related to manufacturing.
A new annular piston was purchased from the OEM but we were unable to install
it. Investigation showed that it had been machined incorrectly.

41

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

Wear and Tear:

An expected condition of a component that has reached a point where it is unable
to perform intended function as the result of usage.

RCFA Required:

Currently unknown root cause.
An RCFA is always required if there was; a loss of a well barrier, if there was an
unplanned stack/LMRP recovery, or if there was a systemic/reoccurring event.
Either of the other investigation requirements can be promoted to an RCFA if
necessary.

Other / Comment:

The root cause is known, but the option is not available. Selection of ‘Other’ will
open a free text comment box.

42

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

APPENDIX 1.

FAILURE NOTIFICATION FORM

43

SafeOCS Well Control Failure Reporting Guidance Document. Rev. 2.00

APPENDIX 2.

FAILURE REPORTING PROCESS

(Note: Clarifying information discussed on the right hand blue portion of this diagram is generally viewed as verbal
information during a telephone call. Such a request for clarifying information does not affect the status of the
equipment being placed back into service.)

44