2016 SafeOCS Annual Report.

2016SafeOCSAnnualReport.pdf

Barrier Failure reporting in oil and gas operations on the Outer Continental Shelf.

2016 SafeOCS Annual Report.

OMB: 2138-0046

⚠️ Notice: This form may be outdated. More recent filings and information on OMB 2138-0046 can be found here:

2023-03-02 - Reinstatement without change of a previously approved collection

Document [pdf]

Download: pdf | pdf

2016 SAFEOCS ANNUAL REPORT
BLOWOUT PREVENTION SYSTEM EVENTS
AND

EQUIPMENT COMPONENT FAILURES

U.S. Department of Transportation
Bureau of Transportation Statistics

ACKNOWLEDGEMENTS
U.S. Department of Transportation

Major Contributors

Elaine L. Chao

Lindsay Beattie

Secretary of Transportation

Stephen Brumbaugh
Amanda Lemons

Jeffrey A. Rosen
Deputy Secretary of Transportation

Other Contributors

Bureau of Transportation Statistics

Anton Mighty

Patricia Hu
Director
Rolf Schmitt
Deputy Director
Produced under the direction of:
Demetra Collia
SafeOCS Program Manager

QUALITY ASSURANCE STATEMENT
The Bureau of Transportation Statistics (BTS) provides high-quality information to serve government,
industry, and the public in a manner that promotes public understanding. Standards and policies are used
to ensure and maximize the quality, objectivity, utility, and integrity of its information. BTS reviews
quality issues on a regular basis and adjusts its programs and processes to ensure continuous quality
improvement.

Notice
This document is disseminated under the sponsorship of the Department of Transportation in the
interest of information exchange. The U.S. Government assumes no liability for its contents or use
thereof.

Interagency Agreement
The Moving Ahead for Progress in the 21st Century Act (MAP-21) (Public Law 112-41) amended
Title 49 U.S.C by adding a new chapter (Chapter 63) for the Bureau of Transportation Statistics (BTS).
Section 6306 of the chapter authorizes the BTS Director to enter agreements with Federal, State, Local
or private agencies for the purposes of transportation data collection and analysis.
The Interagency Agreement between the U.S. Department of the Interior's Bureau of Safety and
Environmental Enforcement (BSEE) and the U.S. Department of Transportation's Bureau of
Transportation Statistics (BTS) governing the efforts undertaken in this report was entered pursuant to
the authority of the Economy Act of 1932, as amended (31 U.S.C 1535) and adheres to the Federal
Acquisition Regulations (FR) 6.002. To the best of DOI and DOT’s knowledge, the work performed
under the agreement does not place BTS in direct competition with the private sector.

TABLE OF CONTENTS
Executive Summary ...................................................................................................................... 1
Introduction ................................................................................................................................... 2
About the SafeOCS Program ....................................................................................................................................... 2
About the BSEE Well Control Rule ............................................................................................................................ 2
About the American Petroleum Institute (API) ....................................................................................................... 3
Collaboration and Participation ................................................................................................................................... 4
About the Report ............................................................................................................................................................ 4
Scope of Analysis ........................................................................................................................... 5
BOP Equipment Systems................................................................................................................................................ 5
Well Activity Reports (WAR) ...................................................................................................................................... 5
Drilling and Non-Drilling Operations ......................................................................................................................... 6
Data Collection and Validation .................................................................................................... 6
Reporting Well Control Equipment Failures ............................................................................................................ 6
SafeOCS User Guide ...................................................................................................................................................... 7
Subject Matter Expert (SME) Review ......................................................................................................................... 7
Data Confidentiality ........................................................................................................................................................ 8
Data Analysis: Overview ............................................................................................................... 8
Rig Activity Measures and Component Counts .....................................................................................................10
Who Reported Equipment Failures ..........................................................................................................................11
How Equipment Failed .................................................................................................................................................11
How Failures Were Detected ....................................................................................................................................12
Why Equipment Failed .................................................................................................................................................13
Data Analysis: BOP Equipment Failures................................................................................... 15
Data Analysis: Subsea BOP Equipment Failures...................................................................... 17
In-Operation Failures ....................................................................................................................................................19
Mechanical Barriers and Barrier Support Systems .........................................................................................19
Component Failures Associated with Subsea Stack Pulls .............................................................................21
Not-in-Operation Failures ...........................................................................................................................................22
Mechanical Barriers and Barrier Support Systems .........................................................................................25
iii

Data Analysis: Surface BOP Equipment Failures ..................................................................... 28
In-Operation Failures ....................................................................................................................................................28
Mechanical Barriers and Barrier Support Systems .........................................................................................29
Components Associated with Surface BOP Stack Pulls ................................................................................29
Not-in-Operation Failures ...........................................................................................................................................29
Conclusions .................................................................................................................................. 29
Key Findings ....................................................................................................................................................................29
Next Steps: Opportunities for Improving Data Quality ......................................................................................30
Appendix A:

Glossary and Acronym List .............................................................................. 31

Appendix B:

Relevant Standards ............................................................................................ 35

Appendix C:

Schematics of BOP System Boundaries .......................................................... 37

Appendix D:

Example Subsea BOP Component Counts ..................................................... 41

LIST OF FIGURES
Figure 1: Drilling and Non-Drilling Activity in the Gulf of Mexico ........................................................................ 9
Figure 2: Equipment Failures Reported by Month, July 28 to December 31, 2016 ......................................... 10
Figure 3: Equipment Failures Reported by Operator .............................................................................................11
Figure 4: Notifications by Observed Failure .............................................................................................................12
Figure 5: Failure Detection Methods ..........................................................................................................................13
Figure 6: Suspected Root Causes and RCFA Status for Component Failures .................................................. 14
Figure 7: Failed Equipment Components Sent for Follow-Up Procedures........................................................ 15
Figure 8: Failure Events by BOP Stack Type .............................................................................................................16
Figure 9: Failure Events by BOP System Type ..........................................................................................................17
Figure 10: Equipment Failures Reported In-Operation and Not-in-Operation (Subsea) ............................... 18
Figure 11: Component Failure Distribution by System (Subsea In-Operation) ................................................ 19
Figure 12: Component Failures Associated with Barriers and Barrier Support Systems
(Subsea In-Operation) ....................................................................................................................................................21
Figure 13: Equipment Failures In-Operation Versus Not-in-Operation by Rig (Subsea) ............................... 24
Figure 14: Component Failures by System (Subsea Not-in-Operation) .............................................................25
Figure 15: Component Failures Associated with Barriers (Subsea Not-in-Operation) .................................. 26
Figure 16: Component Failures Associated with Barrier Support Systems (Subsea Not-in-Operation) ... 27
Figure 17: Reported Equipment Failures on Surface Stacks ..................................................................................28
Figure 18: Example Choke and Kill Manifold for Subsea Systems........................................................................37
Figure 19: Example Subsea BOP Stack with Optional Locations for Choke and Kill Lines ........................... 38
Figure 20: Example Subsea Ram BOP Space-Out ....................................................................................................39
Figure 21: Example Surface BOP Ram Space-Out ...................................................................................................40

EXECUTIVE SUMMARY
About the Report
The SafeOCS 2016 Annual Report, produced by the Bureau of Transportation Statistics (BTS),
summarizes blowout prevention (BOP) equipment failures on marine drilling rigs in the Outer
Continental Shelf. It includes an analysis of equipment component failures and other key information
such as failure causes, operational impacts, and opportunities to improve data quality.
The report is based on information collected through SafeOCS, a data program initiated in response to
recommendations by the National Commission on the BP Deepwater Horizon Oil Spill and Offshore
Drilling. The commission recommended that the Department of the Interior’s Bureau of Safety and
Environmental Enforcement (BSEE) develop requirements to collect more accurate data on leading
indicators of potential risk to all offshore activities.
BTS, a principal federal statistical agency, entered an interagency agreement with BSEE in 2016 to
operate the SafeOCS program. BTS began collecting notifications of equipment component failures as
required by BSEE’s Well Control Rule, which went into effect July 28, 2016. All SafeOCS data are
collected under the Confidential Information Protection and Statistical Efficiency Act of 2002 and
protected from legal discovery and FOIA. The data are precursor safety information, and none of the
events were associated with loss of well containment, adverse environmental impact, or negative effect
on personnel safety.
To review the notifications, BTS retained subject matter experts in drilling operations, equipment
testing, equipment design and manufacturing, root cause failure analysis, quality assurance and control,
and process design. BTS also consulted with an external technical review team including representatives
of the International Association of Drilling Contractors (IADC), contractors, and operators.

Key Findings
•
•
•

•

•
•
•

BTS received 821 rig equipment component failure notifications from July 28 to December 31,
2016. The reported failures involved 37 of the 46 rigs with activity in the Gulf of Mexico.
Four out of the 14 operators who submitted failure notifications accounted 81.3 percent of
SafeOCS notifications and 61.4 percent of BOP activities.
Over three-quarters (77.7 percent) of SafeOCS notifications are from component failures
associated with BOP mechanical barriers or barrier support systems. Subsea BOP stacks are
more complex and accounted for 91.8 percent of these notifications; surface stacks accounted
for the remaining 8.2 percent.
The top failure types cited were external leakage (44.9 percent), internal leakage (22.0 percent),
and mechanical damage (8.8 percent). None of the reported component failures resulted in
environmental damage.
Just over half of equipment failures (54.0 percent) were detected through testing.
The main reported causes of component failure were wear and tear (32.0 percent) and
maintenance error (16.2 percent).
Nearly four-fifths of the reported failures (77.2 percent) were found when the BOP was
not-in-operation.
1

INTRODUCTION
The 2016 SafeOCS Annual Report, produced by the Bureau of Transportation Statistics (BTS), presents
information on equipment component failures occurring during drilling and non-drilling operations in the
outer continental shelf (OCS). BTS intends to publish this report and share the results through joint
industry forums, workshops, presentations, and follow-up meetings with industry groups.

About the SafeOCS Program
In August 2013, the Bureau of Safety and Environmental Enforcement (BSEE) and BTS signed an
interagency agreement to develop and implement SafeOCS, a voluntary program for confidential
reporting of “near misses” occurring in the OCS. This program offers a resource to help industry
capture and share key lessons from significant near-miss and other safety events, with the objective of
preventing, identifying, and mitigating potential high-consequence risks.
In April 2016, the SafeOCS program was expanded to include reporting of blowout prevention (BOP)
system and BOP system component equipment failures as mandated by BSEE’s Well Control Rule.
BTS and BSEE formally expanded the program in a memorandum of understanding signed on
August 18, 2016.

About the BSEE Well Control Rule
BSEE published the Oil and Gas and Sulfur Operations in the Outer Continental Shelf-Blowout
Preventer Systems and Well Control Final Rule (WCR) on April 29, 2016, becoming effective on
July 28, 2016, as referenced in 30 CFR 250.730. 1 WCR defines an equipment failure as any condition
that prevents the equipment from meeting the functional specification and requires reporting of such
failures. More specifically, pursuant to 30 CFR 250.730 (c), operators must:
(1) Provide a written notice of equipment failure to the Chief, Office of Offshore Regulatory Programs,
and the manufacturer of such equipment within 30 days after the discovery and identification of
the failure.

1 https://www.federalregister.gov/documents/2016/04/29/2016-08921/oil-and-gas-and-sulfur-operations-in-the-outercontinental-shelf-blowout-preventer-systems-and-well

(2) Ensure that an investigation and a failure analysis are performed within 120 days of the failure to
determine the cause of the failure. Further, any results and corrective action are to be documented.
If the investigation and analysis are performed by an entity other than the manufacturer, the Chief,
Office of Offshore Regulatory Programs and the manufacturer receive a copy of the analysis report.
(3) If the equipment manufacturer sends notification of any changes in design of the equipment that
failed or changes in operating or repair procedures as a result of a failure, a report of the design
change or modified procedures must be submitted in writing to the Chief, Office of Offshore
Regulatory Programs within 30 days.
Per the memorandum of understanding, all notifications related to equipment failure are submitted to
SafeOCS.

About the American Petroleum Institute (API)
The BSEE WCR adopts industry standards developed by the American Petroleum Institute (API), a
national trade association that provides advocacy, research and statistics, standards, certification, events,
and training. API develops and maintains 685 petroleum and petrochemical equipment operating
standards, specifications, and recommended practices. API standardization procedures ensure
appropriate notification and industry participation in the developmental process to be designated
as an API standard.
API Standard 53, Blowout Prevention Equipment Systems for Drilling Wells, represents a composite of
the practices employed by various operating and drilling companies in drilling operations. The objective
of this standard and its requirements is to assist the oil and gas industry in promoting personnel safety,
public safety, integrity of the drilling equipment, and preservation of the environment for land and
marine drilling operations.
When regulatory agencies adopt industry standards into rule making, these standards are “incorporated
by reference” into the agency standard and become mandatory by law. For the WCR, BSEE
incorporated by reference API Standard 53 and Specs 16A, C, D, 6A, 17D, H, and Q1, as listed in
30 CFR 250.198. Operators are required to submit equipment failure reports as mandated by
30 CFR 250.730 (c) which incorporates reporting practices found in the aforementioned API Standards
and Specifications. API 53, Blowout Prevention Equipment Systems for Drilling, is the recognized
industry standard for installing and testing BOP systems for land and marine (offshore) drilling rigs.
Section 6 in API 53 lists the requirements for surface BOP systems. Surface BOP equipment event data
3

reported by jack-ups, offshore platforms and offshore barges are reported in the surface BOP section.
Section 7 lists the requirements for subsea BOP systems. Subsea BOP equipment event data reported by
Mobile Offshore Drilling Units and other offshore installations are reported in the subsea BOP section.
See Appendix B for a list of relevant standards. In the initial implementation of this effort, BSEE
requested BTS and industry to focus efforts on API Standard 53.

Collaboration and Participation
The International Association of Drilling Contractors (IADC) and the International Association of Oil
and Gas Producers (IOGP) created a Joint Industry Project (JIP) to collect BOP reliability data prior
to the issuance of the WCR. To improve the accuracy of data collected, the JIP released a guidance
document for the RAPID-S53 (Reliability and Performance Information Database for Well Control
Equipment covered under API S53) on March 13, 2017 with subsequent revisions. 2
BTS collaborated with the JIP to develop standardized data collection forms, establish an informative
process on how to provide the data to SafeOCS, and create a web-based data reporting system. The
JIP also supported BTS in developing the User Guide to help operators comply with the reporting
requirements of the BSEE WCR. The SafeOCS program has received substantial input from the
IADC JIP.
SafeOCS also collaborated with BSEE staff to obtain geographic information for drilling rig operations
with subsea and surface BOP equipment active in 2016. With continued commitment from the industry
and BTS, continuous process improvements to perform safe and environmentally responsible offshore
well control equipment activities are possible.

About the Report
The interagency agreement between BSEE and BTS requires BTS to publish a report on the status of
SafeOCS, modifications made to the data collection process, lessons learned, and emerging trends based
on collected data. This report serves as the first annual report for SafeOCS. The report covers the
analysis of equipment component failure notifications as mandated by WCR, and other key information
such as operational impact, failure causes, and possible data improvement opportunities. The data
analyzed includes failure notifications submitted directly to BTS through SafeOCS (which are protected
by data confidentiality regulations described later), as well as notifications reported to BSEE and
2

https://www.safeocs.gov/forms/WCR_Guidance_Rev2.1.pdf

provided to BTS (which are not). To provide context for the failure notifications, additional analysis was
performed using the Well Activity Reports (WAR-30 CFR 250.743) provided by BSEE.
The report begins by analyzing aggregate equipment component failure data, then focuses separately
on the two major types of BOP stacks: surface and subsea. Within each of those sections, failure
notifications are analyzed by whether the failure occurred in-operation or not-in-operation, and whether
the failing component was associated with a mechanical barrier system or its support systems. Appendix A
contains a glossary with detailed definitions of these terms.

SCOPE OF ANALYSIS
The report summarizes BOP equipment component failures on marine drilling rigs (platform, bottomsupported, and floating) within the Gulf of Mexico outer continental shelf reported to SafeOCS and
BSEE from July 28, 2016 to December 31, 2016. BSEE defines a failure as any condition that prevents the
equipment from meeting the functional specifications. In this report, the terms “notice,” “notification,”
and “event” generally refer to reported equipment component failures. While the SafeOCS program
received a limited number of equipment failure reports for non-rig units in 2016, this year’s report
examines equipment failures on rigs only.

BOP Equipment Systems
BOP equipment systems protect personnel and protect the environment by confining well fluids to
the wellbore and by providing a means to control adding or removing fluid from the wellbore. BOP
equipment systems are a combination of assemblies, many of which are redundant, with each of the
assemblies comprising a multitude of components. The redundant systems provide important backup so
that equipment can continue to operate in the event of equipment failures, and are required by BSEE
regulations and rules, industry standards, and company policies. BOP equipment systems consist of
blowout preventers (BOPs), choke and kill lines, choke manifolds, control systems, and auxiliary
equipment.

Well Activity Reports (WAR)
Well activity reporting in the Gulf of Mexico, Pacific, and Alaska regions is codified in procedures
contained in BSEE Notice to Lessees and Operators (NTL) 2009–G20, Standard Reporting Period for
the WAR, and BSEE NTL 2009–G21, Standard Conditions of Approval for Well Activities. Rig owners
5

and operators report well activity to BSEE daily or weekly (depending on the region), per 30 CFR
250.743. Well activity includes drilling and non-drilling operations such as pre-spud operations, drilling,
workover operations, well completions, tie-back operations, recompletions, zone change, modified
perforations, well sidetracking, well suspension, temporary abandonment, and permanent abandonment.
WAR submissions include well activity performed by all drilling rigs, snubbing units, wireline units, coil
tubing units, hydraulic workover units, non-rig plug and abandon (PA) operations, and lift boats.
SafeOCS staff and Subject Matter Experts (SMEs) reviewed WAR data submitted to BSEE for the
reference period (July 28, 2016, to December 31, 2016) to provide context for the equipment
component failures reported to SafeOCS—specifically, to determine the amount of activity performed
on each rig. WAR data also typically provide daily logs of offshore well activities and can be used to
determine when equipment component failures can occur.
Drilling and Non-Drilling Operations
Drilling rigs primarily perform drilling and completion operations, but can also perform operations
typically performed by less expensive non-rigs such as well intervention, workover, temporary
abandonment, and permanent abandonment. These activities are typically performed by non-rig units
such as coil tubing units, hydraulic workovers, wireline units, plug and abandon (P&A) units, snubbing
units, and lift boats.

DATA COLLECTION AND VALIDATION
Reporting Well Control Equipment Failures
Drilling and non-drilling operations can involve three groups: rig operators, rig lessors, and rig owners
(also known as drilling contractors). Rig operators receive authorization from rig lessors to manage
operations on the designated area and then contract out to rig owners (also called drilling contractors)
to set up their rig on the designated area to conduct drilling and drilling-related operations. Operators
tend to contract with more than one rig owner if they receive authorization through multiple leases, and
rig owners often own more than one rig. In addition, some operators own rigs and some production
platforms have rigs on the platform on a permanent or temporary basis.
Operators must report failures of BOP systems and their system components to BSEE and the original
equipment manufacturers (OEM) within 30 days of discovering and identifying a failure. BSEE has
directed industry to submit all notifications to SafeOCS. Prior to the SafeOCS system deployment, BSEE
6

received approximately 600 notifications in 2016. The remainder of the failure notifications were
submitted directly to SafeOCS, and BSEE transferred all notifications it received directly to SafeOCS.
Operators submitted the notifications in several forms: handwritten forms, Excel summaries, and
SafeOCS website forms. Within the notifications received, 11 notifications were from non-rig units
performing non-drilling operations. Due to the limited number of notifications received, equipment
component failures associated with non-rig units could not be analyzed in this first year.
SafeOCS User Guide
SafeOCS solicited input from the JIP to create a guidance document to assist operators in reporting
BOP equipment failures. 3 The SafeOCS user guide provides detailed instructions and definitions to the
OCS oil and gas industry operators for selecting and inputting data in the form. This will improve the
quality of the data being reported and the analysis that can be conducted. Updates to the guidance
document will occur periodically.
Subject Matter Expert (SME) Review
SafeOCS retained subject matter experts (SMEs) in drilling operations, production operations, subsea
engineering, equipment testing, well control equipment design and manufacturing including BOPs, root
cause failure analysis, quality assurance and quality control, and process design. The SMEs assisted in
developing the data collection forms and process and reviewing notification data for accuracy and
consistency. They also contributed to validating and clarifying SafeOCS data and BSEE WAR data. Finally,
they provided support for verifying and validating facts and providing input to the 2016 SafeOCS Annual
Report.
BTS and SafeOCS staff also consulted with an external technical review team with members
representing the IADC–IOGP JIP, contractors, and rig operators. The review team not only
collaborated with BTS to improve the data collection and reporting process, but also provided
invaluable assistance identifying improvements that would benefit industry efforts. Failures at the
component level were of most interest for industry, such as which specific components failed, why they
failed, and where the failure occurred. Time in operation prior to failure was also noted as important,
which will be a subject for future analysis.

https://www.safeocs.gov/forms/WCR_Guidance_Rev2.1.pdf

Data Confidentiality
The confidentiality of all data submitted to SafeOCS is protected by the Confidential Information
Protection Efficiency Act of 2002 (CIPSEA). However, data submitted directly to BSEE are not protected
by CIPSEA. Data protected under CIPSEA may only be used for statistical purposes. This requires the
following: a) only summary statistics and data analysis results will be made available; b) microdata on
incidents collected by BTS may not be used for regulatory purposes; and c) information submitted under
this statute is also protected from release to other government agencies including BSEE, as well as
protection from Freedom of Information Act (FOIA) requests and subpoenas.

DATA ANALYSIS: OVERVIEW
Key Findings
•

SafeOCS received 832 notifications from July 28 to December 31, 2016, for an average of
160.4 reports per month from August to December.

•

Two-thirds of observed equipment component failures (67.0 percent) involved external or internal
leaks.

•

The three most frequent observed failures were external leaks (44.8 percent), internal leaks
(22.2 percent), and mechanical damage to components (8.9 percent).

•

Just over half of the equipment component failures (53.8 percent) were detected through testing.

•

More than three-quarters (77.2 percent) of the failures were found not-in-operation.

•

Nearly half of the reports that reported root causes cited wear and tear (32.1 percent) or
maintenance error (16.2 percent) as root causes.

•

The four most active operators in the Gulf of Mexico reported 81.3 percent of SafeOCS
notifications, and accounted for 61.4 percent of BOP days.

The WCR covers drilling and non-drilling operations in the OCS, which includes three BSEE regions
(Gulf of Mexico, Pacific, and Alaska). For 2016, SafeOCS received equipment failure notifications from
one region, the Gulf of Mexico. Figure 1 illustrates the drilling and non-drilling activity locations for
July through December of 2016 and does not represent location of reported failures. Exact locations of
reported equipment component failures are not disclosed in this document to protect the confidentiality
of the data.

Figure 1: Drilling and Non-Drilling Activity in the Gulf of Mexico

NOTE: Rig and non-rig unit markers indicate locations of drilling and non-drilling activity only, and not reported component
failures.
SOURCE: Bureau of Safety and Environmental Enforcement Data Center, available at
https://www.data.bsee.gov/Main/Default.aspx.

SafeOCS received 832 equipment failure notifications during the reporting period of July 28 to
December 31, 2016, as shown in Figure 2. Eleven notifications associated with non-drilling operations by
non-rig units were excluded from the analysis due to their small number. Therefore, the final number of
notifications analyzed for 2016 was 821, submitted by 37 out of the 46 rigs indicating activity in the Gulf
of Mexico, as reported in the WAR data. The average number of notifications per month from August
to December 2016 was 160.4.

Figure 2: Equipment Failures Reported by Month, July 28 to December 31, 2016
250
200
150
100
50
0

NOTE: The 2016 reported component failures did not indicate any loss of well containment, adverse environmental impact, or
negative effect on personnel safety. The July reporting period covers July 28–31.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

Rig Activity Measures and Component Counts
Measures of rig activity provide important context for evaluating the risk of equipment component
failure. All other things being equal, a rig with more activity has a higher risk of equipment component
failure than a rig with less activity. To measure rig activity, SafeOCS staff analyzed WAR data and
calculated the number of days each rig was active. Some rigs have more than one BOP stack, and
SafeOCS staff adjusted the days of activity on a rig to account for the number of BOP stacks. The final
measure, BOP days, offers a reasonable approximate measure of “rig activity” or the time period
(in days) when an equipment component failure could have occurred.
The number of components on a rig also provides important context for evaluating equipment
component failures. A rig may have more than 4,000 reportable components, and some types of
components are much more common than others. Appendix D lists reportable components on a
typical subsea BOP stack. BTS is working with the IADC–IOGP JIP to obtain rig-specific component
information from the Rapid-S53 data, and will use the information in future reports to provide more
context for equipment failures.

Who Reported Equipment Failures
Figure 3 shows SafeOCS notifications from 14 operators that submitted equipment failure notifications.
Four of the 14 operators reported 81.3 percent of the failure notifications, and accounted for over half
(61.4 percent) of the total rig activity for the reporting period, measured in BOP days. Rig activity varies
across reporting operators compared to their contributing failure notifications. The difference is partly
due to operators contracting with multiple rig owners, or the same rig owner multiple times, over the
course of the reporting period.
Figure 3: Equipment Failures Reported by Operator
30
25

Percent

Percent of total BOP days
Percent of total failures

15
10
5
0

Reporting operator

NOTE: Operator names have not been disclosed to preserve reporter confidentiality. The reported events did not cause any
environmental impact or harm to persons, and do not imply that loss of well containment occurred.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

How Equipment Failed
Reporting operators are asked to specify the type of failure each component experienced, which depicts
what was actually observed at the time of failure. Examples of failure types include leakage, loss of
pressure, failure to seal, or loss of communication between the control system and other components.
Figure 4 reveals that leaks represent 67.0 percent of the equipment failures. External leaks
(44.8 percent) and internal leaks (22.2 percent) are the most commonly reported types of failure. An
external leak means that a component (such as an SPM valve, regulator, or control tubing) is leaking fluid
from a contained space to an uncontained space—for example, in the air for surface components, or in
11

the sea for subsea components. The fluids are primarily environmentally safe control fluids, not well
fluids. Over 81.8 percent of external leaks were discovered while the BOP was not operating. Any
unplanned external control fluid leaks and well fluid leaks are reported to appropriate regulatory
agencies. An internal leak means that a component is leaking pressurized fluid from one contained
space to another.
Mechanical damage—for example, worn pistons or damaged bladders, springs, and bolts—was the third
most reported observed failure (8.9 percent). These failures occurred mainly on internal components
such as seals, seats, and actuating elements, and did not have any negative environmental impact.
Figure 4: Notifications by Observed Failure

Ground fault
1.5%
Fail to seal
2.6%
Inaccurate indication
3.0%
Mechanical damage
8.9%

Other failures
17.1%
External leak
44.8%

Internal leak
22.2%

NOTE: The reported events did not cause any environmental impact or harm to persons, and do not imply that loss of well
containment occurred.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

How Failures Were Detected
How failures are detected can be important for increasing early detection and reducing consequences of
failures. Equipment failures are detected via several methods:
•

Testing: applying pressure (pressure testing) or commanding equipment to function (function
testing) to determine if the equipment performs properly or maintains integrity, often
performed on a schedule.

•

Inspection: Visual or electronic observation, via a camera on a remotely operated vehicle
(ROV), usually involving some disassembly and often performed on a schedule.

•

Casual observation: visual observation not requiring disassembly and not on a schedule.
12

•

Continuous condition monitoring: continuous monitoring with automated sensors and
gauges, often with predetermined alarms.

The majority of equipment failures (53.8 percent) were detected through testing, which included
function testing in-operation, pressure testing in-operation, function testing on deck, and pressure
testing on deck (i.e., testing not-in-operation) (Figure 5). Most (78.5 percent) of the 442 failures
detected during testing were found not-in-operation. Continuous ROV (for subsea equipment
in-operation) and human surveillance (for surface equipment or when equipment is on deck) have
been essential for detecting BOP system failures via casual observation (18.4 percent).
Figure 5: Failure Detection Methods

Casual
Observation
18.4%
Continuous condition
monitoring
10.5%

In-operation testing
11.8%
Testing
53.8%

Not-in-operation
testing
42.0%

Inspection
8.0%
Periodic maintenance
3.8%
Periodic condition monitoring
3.0%
Corrective maintenanceOn demand
0.9%
1.6%
NOTE: The reported events did not cause any environmental impact or harm to persons, and do not imply that loss of well
containment occurred.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

Why Equipment Failed
Many factors can cause a component to fail. For example, an equipment design error could lead to a
malfunction, or the equipment could experience normal wear and tear. In some instances, the cause is
immediately known; in other instances, the cause is less clear. Depending on the type of failure, the
component may be repaired or replaced without further investigation, or the failed component may be
sent to the OEM or a third party for a root cause failure analysis (RCFA). RCFAs can help the operator,
rig owner, and OEM identify underlying issues which may contribute to reoccurring failures.
13

Some reports have limited information on root causes and limited information on whether the
equipment was sent to the OEM or a third party because the original SafeOCS form did not request
this information. A new form, introduced in November 2016, included data fields for this information.
The 2017 SafeOCS report will contain more information on RCFA efforts.
Figure 6 lists the root causes reported for equipment failures, including root causes identified by SMEs
reviewing the reports. Nearly half of the 821 reports cited wear and tear (32.1 percent) or maintenance
error (16.2 percent) as root causes. No root cause can be determined for 27.4 percent of the reports,
and 7.7 percent reported that an assessment was pending. Almost one quarter of the equipment failures
(24.4 percent) had a RCFA completed or in process, as indicated by the orange sections of the bars in
Figure 6.
Maintenance error is the most actionable cause identified. There were 58 cases for which the failure
was identified as a maintenance-induced failure, detected during pre-deployment testing required before
returning the equipment to service. These failures occurred on 23 different components and were
primarily due to maintenance errors.
Figure 6: Suspected Root Causes and RCFA Status for Component Failures
Wear and tear
Not determined

2.4

25.0

Maintenance error

4.0

12.2

Assessment pending

7.6

Other

1.5

4.3

Design issue

2.9

QA/QC manufacturing
Procedural error

4.8

27.3

1.9

No RCFA performed
RCFA performed

2.1 0.9
1.5 1.2

Documentation error
0

Percent

NOTE: Labels not shown for percentages under 0.5 percent. The reported events did not cause any environmental impact or
harm to persons, and do not imply that loss of well containment occurred.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

RCFAs are generally completed by the OEM after receiving failed equipment components (Figure 7).
One quarter of the notifications (24.6 percent) stated that the equipment was not sent to shore for
repair, maintenance, or failure evaluation. The data field for root causes was not included in the original
short form, and the follow-up procedures could not be determined for over half (54.0 percent) of the
failure notifications.
Figure 7: Failed Equipment Components Sent for Follow-Up Procedures
Data field unavailable

54.0%

Not sent to shore

24.6%

Unknown

11.0%

OEM (analysis)
OEM (repair)

7.2%
1.9%

Disposal

0.7%

Third-party analysis

0.6%

DATA ANALYSIS: BOP EQUIPMENT FAILURES
Key Findings
•

Subsea BOP stacks are more complex than surface stacks and contribute the majority (91.8 percent)
of the failure reports.

•

More than three-quarters (77.4 percent) of BOP failure reports involve components associated with
mechanical barriers or barrier support systems.

There are two types of BOP stacks used, subsea and surface. Subsea stacks have substantially more
components than surface stacks—approximately 4,000 for a typical subsea stack versus 480 for a typical
surface stack—suggesting that subsea stacks (and associated redundant control systems on those stacks)
are more complex, with greater numbers of components, than surface BOP stacks. The equipment
failure notifications reflect this pattern, with the majority of BOP equipment failures (91.8 percent)
15

occurring on subsea stacks (Figure 8). Thirteen of the 37 rigs operating in the Gulf of Mexico during the
reporting period (35.1 percent) had surface BOP stacks, but surface stacks account for only 8.2 percent
of the failure notifications. Due to the differences between subsea and surface systems, the following
analysis will focus on each system separately.
Figure 8: Failure Events by BOP Stack Type

Subsea BOP
stack
91.8%

Surface
BOP stack
8.2%

Well mechanical barriers and the barrier support systems are essential elements of a BOP stack, with a
level of component redundancy to maintain proper functionality. The mechanical barriers actively
contain the oil and gas from the well, and the barrier support systems supply the energy and control the
mechanical barrier equipment. Of the 821 equipment failure notifications, 635 (77.4 percent) involved
components associated with mechanical barriers or barrier support systems, as defined in “Mechanical
Barriers and Barrier Support Systems” (Figure 9).

Figure 9: Failure Events by BOP System Type

Other
support
22.7%

Mechanical
barrier
26.2%

Barrier
support
51.2%

NOTE: The reported events did not cause any environmental impact or harm to persons, and do not imply that loss of well
containment occurred. Totals may not add up to 100 percent due to rounding.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

Most BOP components have a high level of redundancy. For example, there can be multiple versions
of a component, such as choke and kill valves, in one BOP. The location of the component, level of
redundancy, and the nature of the failure will determine the potential impact of that component failure
on the associated mechanical barrier. If there are multiple redundant components or if the failure will
not prevent the component from functioning, then that component failure would not disable the
mechanical barrier.

DATA ANALYSIS: SUBSEA BOP EQUIPMENT FAILURES
Key Findings
•

Nearly four-fifths of the SafeOCS reported failures (79.8 percent) for subsea BOP stacks were
found when the BOP was not-in-operation.

The subsea BOP system is the more complex of the two types of stacks, and had 91.8 percent of failure
notifications for the reporting period. A subsea stack is comprised of major systems such as the marine
risers, lower marine riser package (LMRP), and the lower BOP stack. (Appendix C contains diagrams of
BOP systems.) The LMRP is comprised of a riser transition, flex joints, annular BOP, and control pods.
The lower stack is typically comprised of blind shear rams, pipe rams, casing shear ram, choke and kill
system, and wellhead connector. Additional safety systems are in place, which may include the
17

emergency disconnect system/sequence (EDS), autoshear system, deadman system, ROV intervention
system, and acoustic system. Some rigs have redundant, or two, subsea BOP stacks to improve
productivity. Of the 37 rigs that reported failures, 16 rigs were equipped with 2 BOP stacks each.
On subsea stacks, the BOP is subject to extensive testing prior to deployment and installation. During
these phases of operation, the BOP is considered not-in-operation. Once the BOP has successfully gone
through this pre-deployment testing, the BOP is run down to the sea floor and attached to the wellhead.
The BOP stack is considered in-operation after it has completed a successful pressure test of the
wellhead connection per approved well plan.
The BOP stack changes from in-operation to not-in-operation when the BOP is removed from the
wellhead or when the LMRP is removed from the lower stack. For example, when running or pulling
(retrieving) the stack back to the surface, the BOP stack is considered not-in-operation.
For the analysis of subsea failures, the report will be organized first by events occurring in-operation
and then by events occurring out of operation, with each section focusing on failures that affected
mechanical barriers and support systems for those barriers. Figure 10 shows in-operation and not-inoperation notifications received for subsea stacks.
Figure 10: Equipment Failures Reported In-Operation and Not-in-Operation (Subsea)

In-operation
20.2%

Not-in-operation
79.8%

In-Operation Failures
Nearly three-quarters of the subsea notifications occurring in-operation had a component failure
associated with a well mechanical barrier (25.0 percent) or the mechanical barrier support system
(44.1 percent) (Figure 11). As stated above, not all failures have equal operational implications.
Depending on the component and the nature of the failure, there could be redundant systems in place
to assure continuation of operations safely, or the failure was minor enough and the component
remained operational. As a result, only 9.2 percent of the component failures (7.9 percent mechanical
barrier, 1.3 percent barrier support) disabled a mechanical barrier or barrier support system. Based
on the reported data, none of these events were associated with loss of well containment, adverse
environmental impact, or negative effect on personnel safety. The next section examines these failures
in more detail.
Figure 11: Component Failure Distribution by System (Subsea In-Operation)

Other support
30.9%

Mechanical
barrier
25.0%

Disabled the barrier
(7.9% mechanical barrier,
1.3% barrier support)

Barrier support
44.1%

NOTE: Stack configurations may vary due to operators exceeding the regulatory requirements and meeting their own safety
protocols. These configurations could add components to the BOP stack and supporting systems.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

Mechanical Barriers and Barrier Support Systems
Regulations require operators to maintain two barriers for well control in an oil or gas well:
1. Conditioned drilling fluid (commonly called “mud”) in the wellbore, which exerts pressure on
the geological formation to prevent an influx of formation fluids such as pressurized seawater
or gases such as hydrocarbons.

2. The BOP stack which is connected to the subsea wellhead and can include a combination of the
following equipment: annular preventer, drill string valve, pipe ram preventer, riser connector,
riser mandrel, shear ram preventer, stack choke and kill system, and wellhead connector.
There are generally two types of mechanical barriers within the BOP: one set designed for use when
pipe is present in the BOP (barriers that close on the pipe); and one set designed for use when pipe is
not present in the BOP (barriers that close off the wellbore). During operations when pipe is present in
the BOP, the BOP rams (pipe rams, blind shear rams, and annular preventer), wellhead connector,
inside BOP (drill pipe), and choke and kill valves contain the drilling fluid in the wellbore. During
operations when pipe is not present in the BOP, the barriers (annular preventer, blind shear rams,
hydraulic connector lower choke and kill valves) contain the drilling fluid in the wellbore. These
wellbore fluid-containing devices are mechanical barriers. Each mechanical barrier is composed of many
components, as well as a barrier support system.
Figure 12 depicts subsea BOP stack components with five or more reported failures that also had
failures associated with mechanical barriers. The green bars represent the total failures for each
component, the dark blue bars represent failures while in-operation, and the light blue bars represent
failures that were associated with a mechanical barrier or support system.
Figure 12 includes failures on two barrier components: choke and kill valves and ram block seals. For
those components, all of the in-operation failures were associated with mechanical barriers. Figure 12
also includes failures on barrier support systems, such as piping tubing and regulators. The majority of
these failures were found while the components were not-in-operation. Very few of the barrier support
system failures disabled a mechanical barrier because alternative support systems such as control
systems or electrical systems were available to operate the mechanical barrier.

Associated with a barrier support system

Associated with a barrier

Figure 12: Component Failures Associated with Barriers and Barrier Support Systems
(Subsea In-Operation)

Choke and Kill Valve

8
8

Ram Block Seal

In-operation failures
15

8
8

Flowmeter

5
5

11
6
5

Regulator

SPM Valve

Failures associated with barriers
or barrier support systems

Piping Tubing

Pump

Total subsea failures

5
5
0

Number of component failures
NOTE: The figure includes equipment components with 5 or more failure notifications received. The reported events did not
cause any environmental impact or harm to persons, and do not imply that loss of well containment occurred.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

Component Failures Associated with Subsea Stack Pulls
Stack pulls, which have high operational impact, are necessary to maintain reliability and BOP integrity
and can be planned or unplanned. Planned stack pulls are usually scheduled at the end of well activities
(between wells) or as necessary for required integrity checks. Unplanned stack pulls occur when either
the BOP is removed from the wellhead or the LMRP is removed from the lower stack to repair a
component that failed while the BOP is in-operation. Unplanned stack pulls are resource-intensive
activities and cause significant operational delays. When a component fails in a mechanical barrier or
support system on the BOP stack, an assessment is made of the remaining redundant barrier elements
to determine if a BOP stack pull is warranted to reduce hazard and perform repairs.
21

Unplanned in-operation BOP stack pulls, which represent 1.6 percent of the total reported subsea
failures in 2016, have the greatest impact on operations. There were 13 unplanned subsea BOP stack
pulls while in-operation (Table 1). The data show a correlation between stack pulls and component
failures that disabled a mechanical barrier: 7 of the 14 component failures that disabled a mechanical
barrier also led to stack pulls. One reason that not all barrier-related failures lead to stack pulls is that
the BOP stack often contains redundant mechanical barriers. The remaining 6 of the 13 unplanned stack
pulls were performed to restore redundancy even though the mechanical barrier was not disabled.
Table 1: Equipment Component Failures Leading to Unplanned In-Operation Stack Pulls
(Subsea)
Associated system

System component

Stack pulls

Annular preventer

Packing element

Autoshear deadman EHBS

SPM valve

Trigger valve

BOP control panel

UPS

BOP control pod

Regulator

BOP controls stack mounted

Piping tubing

Pipe ram preventer

Ram block hardware

Other mechanical elements

Bonnet operating seal

Other mechanical elements

Choke and kill valve

Shear ram preventer
Stack choke and kill system
Total

Per regulation, stack pulls are to be followed up with an RCFA to determine the specific details and
causes of the component failure that lead to the stack pull. These RCFAs are expected to provide
specific cause data to resolve equipment issues systematically. Four of the 13 subsea stack pulls had
RCFAs submitted to SafeOCS. Due to the small number of RCFAs, this report does not include an
analysis of RCFA results.

Not-in-Operation Failures
Failures discovered while not-in-operation are important for discovering potential issues with the
equipment before it goes in-operation. Most not-in-operation failures occur in one of two scenarios:

1. Testing, inspection, and routine maintenance performed on deck to identify and fix components
beginning to deteriorate in-operation. The deterioration may have been slight enough that the
components functioned normally in-operation, but the testing identifies issues before the
components are put back in service.
2. Routine testing and maintenance performed while components are not-in-operation. In this
scenario, operators can find and proactively fix any defects that may have been introduced by
maintenance before being put back in-operation.
Subsea BOP stacks are considered not-in-operation during pre-deployment, prior to latch-up to the
wellhead, and either the BOP is removed from the wellhead or the LMRP is removed from the lower
stack. Regular testing, inspection, and monitoring of the equipment occurs frequently during this time.
Routine 7- and 14-day testing, pre-deployment testing, inspections, and other monitoring are completed
to ensure equipment is operating properly before beginning drilling operations. The testing and
monitoring are meant to catch issues that could arise in-operation to reduce component failures in
critical systems.
Nearly four-fifths (79.8 percent) of the equipment component failures for subsea BOP stacks were
detected and resolved while the stack was not-in-operation (Figure 10). The failures had no
environmental impact. The current data appear to show a correlation between the proportion of
failures found not-in-operation versus in-operation (Figure 13). The higher number of failures found notin-operation on a rig appears to lead to fewer failures occurring in-operation, and potentially improving
the operational reliability of the BOP stack.

Figure 13: Equipment Failures In-Operation Versus Not-in-Operation by Rig (Subsea)
70

Stack pull
In-operation
Not-in-operation

Number of failures

Reporting rigs

NOTE: The figure includes subsea rigs with more than 10 equipment component failure notifications received. Rig names have
not been disclosed to preserve reporter confidentiality.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

Figure 14 illustrates these not-in-operation failures by system. For these failures, 58.0 percent occurred
on a barrier support system, 22.8 percent occurred on a mechanical barrier system, and 19.3 percent
occurred on other support systems. The percentage of barrier support system failures is higher for
not-in-operation stacks than for in-operation stacks (58.0 percent versus 44.1 percent).

Figure 14: Component Failures by System (Subsea Not-in-Operation)

Other
support
19.3%

Mechanical
barrier
22.8%

Barrier support
58.0%

Mechanical Barriers and Barrier Support Systems
Figure 15 illustrates components with five or more reported failures that had failures associated with
mechanical barriers. Similarly, Figure 16 illustrates components that had failures associated with barrier
support systems.

Figure 15: Component Failures Associated with Barriers (Subsea Not-in-Operation)

Bonnet Hardware

9
9

Bonnet Operating Seal

10
10

Choke and Kill Valve

Choke and Kill Valve Operator Seal

Associated with a barrier

16
16

7
7

Drillstring Safety Valve

5
5

Total subsea failures

5
5

Locking Device

Not-in-operation failures
Failures associated with barriers

Operating System Seal

13
13

Packing Element

6
6

Ram Block Hardware

12
12

Ram Block Seal

7
7

Figure 16: Component Failures Associated with Barrier Support Systems (Subsea Not-inOperation)
Accumulator

5
5
5

Depth Compensated Accumulator

Total subsea failures

Hose

Not-in-operation failures
Failures associated with
barrier support systems

6
6
6

PBOF Cable
Pilot Operated Check Valve

5
5

Piping Tubing

5
5
5

Pod Hose

11
11
11

Pod Receptacle
Associated with a barrier support system

10
10
10

Pod Stab
Pressure Gauge

14
13

Regulator

33
32

Relief Valve

Shuttle Valve

32
32

20
20
20

Slide Shear Seal Valve
Solenoid Valve Electric

8
8

Solenoid Valve Hydraulic

15
15

13
13
13

Solenoid Valves
SPM Valve

Subsea Electronic Assembly

9
9

20
30
40
50
60
Number of component failures

NOTE: The figure includes equipment components with 5 or more failure notifications received. The reported events did not
cause any environmental impact or harm to persons, and do not imply that loss of well containment occurred.
SOURCE: U.S. Department of Transportation, Bureau of Transportation Statistics, SafeOCS program.

DATA ANALYSIS: SURFACE BOP EQUIPMENT FAILURES
Surface BOPs are similar to subsea BOPs, but are less complex and often have fewer components.
Surface BOP stacks are normally used on fixed platforms, jack up rigs, spar platforms, and tension leg
platforms (TLPs). The equipment is readily accessible on the surface to perform installation, drilling, and
maintenance activities.
Sixty-seven of the 821 reported failures (8.2 percent) occurred on surface BOP stacks. Just over half
(52.2 percent) of those were found while the equipment was in-operation (Figure 17). The percentage
of failures occurring while in-operation is higher on surface stacks than on subsea stacks; however,
conclusions cannot be drawn from this small number of reports. Future reports will examine surface
BOP equipment failures in detail when more data become available.
Figure 17: Reported Equipment Failures on Surface Stacks

Not-inoperation
47.8%

In-operation
52.2%

In-Operation Failures
Like subsea BOPs, surface BOPs are only in-operation after they are attached to the wellhead and have
completed a successful pressure test of the connection to the wellbore per the approved well plan.

Mechanical Barriers and Barrier Support Systems
Twenty (57.1 percent) of the in-operation component failures were associated with the mechanical
barriers or their support systems.
Components Associated with Surface BOP Stack Pulls
A surface BOP stack pull occurs when a component fails in-operation and requires well conditioning and
a mechanical barrier placement to make necessary repairs. The BOP stack cannot be classified as a stack
pull until after it has been in-operation. (In other words, only in-operation BOP stacks can be classified
as stack pulls.) The three surface BOP stack pulls that were reported involved components (seals,
packing, and other hardware) associated with the mechanical barriers (ram preventer, annular
preventer, and shear ram preventer).

Not-in-Operation Failures
Surface stack equipment, like subsea stack equipment, undergoes testing, inspection, and other
monitoring while not-in-operation. The BOP stack changes from in-operation status to not-in-operation
status when the well is conditioned and a mechanical barrier (i.e., packer, test plug) is set in the
wellbore.

CONCLUSIONS
Key Findings
Equipment component failure notifications contain data describing what failed, where it failed, how it
failed, how it was discovered, and why it failed. Fourteen operators reported component failures to
SafeOCS, and the reports involved 37 of 46 rigs operating in the Gulf of Mexico in 2016. 4
Both types of BOP stacks (subsea and surface) reported component failures. Most of the SafeOCS
failure reports (91.8 percent) were from the more complex subsea BOP stacks, and 8.2 percent were
from surface BOP stacks. Seventy-seven percent of the SafeOCS reports are from component failures
associated with BOP mechanical barriers or their support systems.
Four of the 14 operators reported 81.3 percent of the failure notifications. Leakage (either internal or
external) was the primary observed component failure in 67.0 percent of the reports submitted. About
4

Other rigs may have had unreported failures.

half of equipment failures were detected through testing. Wear and tear and maintenance error were
the predominant reported causes of component failure (32.1 percent and 16.2 percent).
Knowing when the component failures occurred is also important. Nearly four-fifths of the SafeOCS
reported failures (77.2 percent) were found when the BOP was not-in-operation; 22.8 percent were
found when the BOP was in-operation. The higher number of failures found when the BOP was not-inoperation may lead to fewer failures occurring in-operation, improving the operational reliability of
the BOP stack. Some failures that occur in-operation require the stack to be pulled for repair. These
unplanned BOP stack pulls represent 1.6 percent of the total reported failures (13 stack pulls) in 2016.
Of the subsea component failures discovered in-operation, 69.1 percent were associated with
mechanical barriers or their support systems. Fourteen of these in-operation failures disabled the
mechanical barrier. None of these events were associated with loss of well containment, adverse
environmental impact, or negative effect on personnel safety.

Next Steps: Opportunities for Improving Data Quality
Failure notifications were first sent directly to BSEE using a short form to protect the reporter
identifying information. Once data collection protocols and procedures were established, the data
collection form was expanded to capture additional data fields and was included in SafeOCS. For the
2016 reporting period, operators used multiple forms and multiple routes of data submission, leading
to potential data inconsistencies. With extensive technical input from the JIP, SafeOCS/BTS has
substantially improved the data collection process, resulting in a more robust data set for the 2017
annual report. BTS will continue to work with the JIP and other stakeholders to optimize data input
(for example, through batch processing of reports), improve measures of exposure by collecting more
detailed component population data, and develop analytical tools to facilitate aggregate analysis of the
SafeOCS database by interested stakeholders.
Collecting and analyzing well control failure data has several applications for industry, including sharing
equipment information, establishing an equipment life expectancy database, identifying possible
improvement efforts, and contributing to standards improvement. Better data quality in equipment
failure reporting will improve the data’s usefulness in these efforts.

Appendix A: GLOSSARY AND ACRONYM LIST
Glossary
Accumulator: A pressure vessel charged with gas (nitrogen) over liquid and used to store hydraulic
fluid under pressure for operation of blowout preventers (BOPs).
Annular Preventer: A device that can seal around any object in the wellbore or upon itself.
Compression of a reinforced elastomer packing element by hydraulic pressure affects the seal.
Autoshear System: A safety system that is designed to automatically shut-in the wellbore in the event
of a disconnect of the LMRP. When the autoshear is engaged, disconnecting the LMRP closes the shear
rams.
Auxiliary Control Device/Panel: A system, function, or control strategy installed on a marine diesel
engine that is used to protect the engine and/or its ancillary equipment against operating conditions that
could result in damage or failure, or that is used to facilitate the starting of the engine. May also be a
strategy or measure that has been satisfactorily demonstrated not to be a defeat device.
Blind Shear Ram (Shear Ram): A closing and sealing component in a ram blowout preventer that
first shears certain tubulars in the wellbore and then seals off the bore, or acts as a blind ram if there is
no tubular in the wellbore.
Blowout Preventer (BOP): A device installed at the wellhead, or at the top of the casing, to contain
wellbore pressure either in the annular space between the casing and the tubulars or in an open hole
during drilling, completion, testing, or workover.
BOP Control Pod: An assembly of subsea valves and regulators hydraulically or electrically operated
which, when activated from the surface, will direct hydraulic fluid through special porting to operate
BOP equipment.
BOP Control System (BOP Controls): The system of pumps, valves, accumulators, fluid storage
and mixing equipment, manifold, piping, hoses, control panels, and other items necessary to hydraulically
operate the BOP equipment.
BOP Stack: The assembly of well control equipment including preventers, spools, valves, and nipples
connected to the top of the wellhead, or top of the casing, that allows the well to be sealed to confine
31

well fluids. A BOP stack could be a subsea stack (attached to the wellhead at the sea floor), or a surface
stack (on the rig or non-rig above the water).
BOP Stack Pull (Subsea): When either the BOP is removed from the wellhead or the LMRP is
removed from the lower stack to repair a failed component. The BOP stack cannot be classified as a
stack pull until after it has been in-operation as defined above.
BOP Stack Pull (Surface): When a BOP component fails during operations and requires well
conditioning and a mechanical barrier placement to make necessary repairs.
Check Valve: A valve that allows fluid to flow in one direction, containing a mechanism to
automatically prevent flow in the other direction.
Choke and Kill Manifold: An assembly of valves, chokes, gauges, and lines used to control the rate of
flow and pressure from the well when the BOPs are closed.
Choke and Kill Valve: BOP stack-mounted valves that are connected below selected BOPs to allow
access to the wellbore to either choke or kill the well.
Control Fluid: Hydraulic oil, water-based fluid, or gas which, under pressure, pilots the operation of
control valves or directly operates functions.
Disable a mechanical barrier: To cause a mechanical barrier not to perform its intended function
(for example, a failure that causes an annular preventer to fail to seal, or fail to open or close).
Deadman: Static holding device installed in the ground separate from the rig structure and to which
guyline(s) may be attached.
Diverter Control System: The assemblage of pumps, accumulators, manifolds, control panels, valves,
lines, etc. used to operate the diverter system.
Drill String: Several sections or joints of drill pipe joined together.
Gate Valve: A valve that employs a sliding gate to open or close the flow passage.
In-Operation (Subsea): A BOP stack is in-operation after it has completed a successful pressure test
of the wellhead connection to the well-bore per approved well plan.

In-Operation (Surface): A surface BOP stack is in-operation after it has completed a successful
pressure test of the wellhead connection to the well-bore per approved well plan.
Not-in-Operation (Subsea): The BOP stack changes from in-operation to not-in-operation when
either the BOP is removed from the wellhead or the LMRP is removed from the lower stack. When
running or pulling (retrieving) the stack, the BOP stack is not-in-operation.
Not-in-Operation (Surface): A surface BOP changes from in-operation to not-in-operation when the
well is conditioned and a mechanical barrier (i.e., packer, test plug) is set in the well bore.

Acronym List
ANSI: American National Standards Institute
API: American Petroleum Institute
BOP: Blowout Preventer
BSEE: Bureau of Safety and Environmental Enforcement
BTS: Bureau of Transportation Statistics
EDS: Emergency Disconnect sequence
HSE: Health, Safety and Environment
IADC: International Association of Drilling Contractors
JIP: Joint Industry Project
LMRP: Lower Marine Riser Package
MUX: Multiplex System
OEM: Original Equipment Manufacturer
RCFA: Root Cause Failure Analysis
SME: Subject Matter Expert
WAR: Well Activity Report (per 30 CFR)

Appendix B: RELEVANT STANDARDS
Industry Standards with Relevant Sections Incorporated by Reference in
3030 CFR 250.198
•

API Standard 53, Fourth Edition, November 2012

•

ANSI/API Spec. 6 A, Nineteenth Edition specification for Wellhead and Christmas Tree
Equipment

•

ANSI/API Spec. 16 A, Third Edition Drill Through Equipment

•

API Spec. 16 C, First Edition specification for Choke and Kill Systems

•

API Spec. 16 D, Second Edition specification for control systems for Drilling Well Control
Equipment and Control systems for Diverter systems

•

ANSI/API Spec. 17 D, Second Edition Design and Operate Subsea Production Systems, Subsea
Wellheads and Tree

•

API RP 17 H First Edition, Remotely Operated Vehicle Interface on Subsea Systems

•

API Q1

Federal Register Volume 81, Issue 83 (April 29, 2016), Page 26026
30 CFR 250.730 (a)(1) The BOP requirements of API Standard 53 (incorporated by reference in
§ 250.198) and the requirements of §§ 250.733 through 250.739. If there is a conflict between API
Standard 53, and the requirements of this subpart, you must follow the requirements of this subpart.

Final Federal Register Volume 81, Issue 83 (April 29, 2016), Page 25892
BSEE’s former regulations repeated similar BOP requirements in multiple locations throughout 30 CFR
part 250. In this final rule, BSEE is consolidating these requirements into subpart G (which previously
had been reserved). The final rule will structure subpart G—Well Operations and Equipment, under the
following undesignated headings:
•

General Requirements

•

Rig Requirements

•

Well Operations

•

Blowout Preventer (BOP) System Requirements

•

Records and Reporting
35

The sections contained within this new subpart will apply to all drilling, completion, workover, and
decommissioning activities on the OCS, unless explicitly stated otherwise.

Federal Register Volume 81, Issue 83 (April 29, 2016), Pages 26013 and 26015
For information about…

Refer to…

Application for permit to drill (APD)

30 CFR 250.subparts D and G

Oil and gas well-completion operations

30 CFR 250. Subparts D and G

Oil and gas well-workover operations

30 CFR 250. Subparts D and G

Decommissioning activities

30 CFR 250. Subparts G and Q

Well operations and equipment

30 CFR 250. Subpart G

Appendix C: SCHEMATICS OF BOP SYSTEM BOUNDARIES
Figure 18: Example Choke and Kill Manifold for Subsea Systems

SOURCE: API STD 53, Fourth Edition, November 2012. Reproduced courtesy of the American Petroleum Institute.

Figure 19: Example Subsea BOP Stack with Optional Locations for Choke and Kill Lines

SOURCE: API STD 53, Fourth Edition, November 2012. Reproduced courtesy of the American Petroleum Institute.

Figure 20: Example Subsea Ram BOP Space-Out

SOURCE: API STD 53, Fourth Edition, November 2012. Reproduced courtesy of the American Petroleum Institute.

Figure 21: Example Surface BOP Ram Space-Out

SOURCE: API STD 53, Fourth Edition, November 2012. Reproduced courtesy of the American Petroleum Institute.

Appendix D: EXAMPLE SUBSEA BOP COMPONENT COUNTS
BOP Stack (2 × 31 = 62 Major Components)
1 riser adaptor, 2 choke and kill flex loops, 1 flex joint, 2 annular preventers, 1 riser connector, 1 riser
mandrel, 2 choke and kill connectors, 2 sets of shear rams, 4 sets of pipe rams, 14 choke and kill valves
and 1 wellhead connector.

Stack Mounted Controls (2 × 398 Components)
2 accumulators, 8 cables, 16 electrical connectors, 2 flowmeters, 2 gas valves, 1 inclinometer, 2 pilot
operated check valves, 1 pressure temperature sensor, 117 shuttle valves, 12 SPM valves, 1 wet mate
connector and 234 hoses.

Control Pods (4 × 339 Components)
12 accumulators, 2 check valves, 1 compensated chamber, 4 electrical connectors, 4 filters, 1 flowmeter,
12 gas valves, 1 hot line manifold, 1 inclinometer, 2 inter-connect cables, 7 metering valves, 1 pod
receptacle, 1 pod stab, 15 pressure gauges, 15 pressure transducers, 1 primary gripper, 7 regulators, 1
secondary gripper and 5 shuttle valves.

Emergency Control Systems (2 × 68 Components)
5 check valves, 6 accumulators, 6 gas valves, 1 hydraulic stab, 1 metering valve, 11 pilot operated check
valves, 8 pressure transducers, 1 regulator, 4 relief valves, 10 solenoid valves and 15 SPM valves.

Secondary Control Systems (2 × 78 Components)
3 accumulators, 1 battery, 3 check valves, 1 compensated chamber, 4 filters, 3 gas valves, 1 hydraulic
stab, 5 interface seals, 8 pilot operated check valves, 9 pressure transducers, 1 regulator, 11 ROV
receptacles, 2 hot-stabs, 3 ROV plans, 8 solenoid valves, 9 SPM valves, 1 surface control units, 2
transducer deployment arms, 2 transducers and 1 wet mate connector.

Surface Control System (326 Components)
4 control panels, 2 UPSs, 82 accumulators, 75 ball valves, 12 check valves, 14 filters, 1 flowmeter, 75 gas
valves, 1 HPU panel, 2 pressure gauges, 28 pressure switches, 3 pumps, 5 relief valves, 11 solenoid valves
and 11 SPM valves.

Hose Reels and Cables (14 Components)
3 reels, 3 sheaves, 2 slip rings, 2 MUX cables, 2 MUX cable connectors, 2 slip rings.

Diverter System (136 Components)
1 housing, 1 assembly, 1 flex joint, 5 ball valves, 5 actuators, 10 accumulators, 13 ball valves, 2 check
valves, 11 pressure gauges, 26 pressure switches, 10 regulators, 1 relief valve, 17 shuttle valves and 23
solenoid valves.

Choke Manifold System (59 Components)
4 chokes, 52 gate valves, 2 drape hoses and 1 HPU.

Riser System (113 Components)
111 riser joints and 2 telescopic joints.

File Type	application/pdf
File Title	2016 SafeOCS Annual Report: Blowout Prevention System Events and Equipment Component Failures
Subject	SafeOCS, SafeOCS Annual Report, Equipment Component Failure, Blowout Prevention (BOP), BOP Stack pull, BOP Component Failures, D
Author	Bureau of Transportation Statistics
File Modified	2018-01-24
File Created	2017-09-22