STRATEGIES FOR A SYSTEMATIC FOLLOW-UP OF BOPs
MetadataVis full innførsel
The Deepwater Horizon accident and the role played by the blowout preventer (BOP), formed the basis for this Master thesis. The purpose of this report is to identify some of the challenges related to the BOP. This has been done through studying the technical aspect of the system and safety-critical functions performed by the BOP. Possible failures with a main focus on systematic failures introduced during operation and maintenance have been investigated. Key requirements in relation to the operation and maintenance of the BOP have been identified and the current maintenance practice has been inquired into. Based on this, recommendations to a systematic follow-up of BOP performance that may solve some of the identified challenges shall be presented. Both drilling specific standards and more general standards have been studied in the work with identifying key requirements. Much of the topside equipment has independent protection layers installed to mitigate the risk associated with the operation of a specified hazardous system. This is called safety instrumented systems (SIS). In the event of a demand the SIS can function independently of control system and by this mitigating the risk. For SIS there are two standards, IEC 61508 / 61511, and they apply to all safety instrumented systems in the oil and gas industry. It is these standards which are referred to as “general standards” in this report. The key findings and challenges identified in this report: The main difference between the BOP and other top side equipment is accessibility. BOPs are most of the time stationed subsea, and the time available to perform maintenance is limited. Usually maintenance is performed during the time between wells, and typically the time frame to perform all the necessary activities is too short. The requirements given for maintenance of BOPs (disregarding the test regime of the BOP) is imprecise and insufficient. Therefore maintenance program today is based much on recommendations from the suppliers. This causes problems because very often the recommendations from the supplier are so extensive that it is not possible to execute them during the time available. In connection with SIL verification it is also a problem with exaggerated performance claims made by equipment manufacturers. In regards to BOP failures the control pod is the component which seems to have the highest failure rate. This is because of increasing complexity in the system during the course of time. The annular preventer also has a higher failure rate in comparison to other components. The reason is because the annular preventer is more frequently subjected to wear than other components during well control activities. It could also be subjected to excessive stress more frequently. Systematic failures are believed to be a contributing factor to BOP failures, both for the control pods, annular preventers and other components. Regarding reliability of the BOP system the drilling specific standards do not state any specific requirements. In OLF 070 on the other hand, which is a guide to the application of IEC 61508 / 61511 in the Norwegian oil industry, there are given three minimum SIL requirements for the three most important safety-critical functions of the BOP. This is the closing of the annular preventer, the pipe ram and the blind shear ram, and they have all been given a minimum SIL 2 requirement. There are however several limitations with these requirements, and factors needed to be considered when verifying SIL requirements for the BOP: . The PFD value is very dependent on the test interval, and with extensive testing it is theoretically possible to meet high SIL requirement with less reliable systems. . Not all failures reveal themselves trough functional testing, and therefore the calculated PFD can give a false sense of safety. . Systematic failures are usually not quantified according to IEC 61508 and therefore most systematic failures are not included in the SIL verification calculations Recommendations: It is important to try to identify all possible failures and failure modes, including systematic failures. Not only is it important to identify systematic failures in order to prevent them, but to the extent possible systematic failures should also be quantified. By doing so it is possible to get a more accurate calculation of the PFD for BOPs. To address systematic errors for BOP systems it can be favorable to look at the IEC 61508 standard. The techniques recommended to be utilized in this report to address systematic errors are: - Project / Lifecycle management - Documentation - Checklists - Inspection of the specification The limited time available to perform necessary maintenance activities for the BOP has also been a recurring theme throughout this report. It is reason to believe that the time period between wells when maintenance work is being done, also is a time period where systematic failures are implemented into the system. Together with other systematic failures such as manufacturing defects, specification mistakes and implementation errors, all should be addressed by the lifecycle management. This then could result in new activities in the maintenance program / testing regime, for instance actual shear testing with pipe (destructive testing). Control function monitoring should be utilized in respect of documenting and analyzing to optimize the preventive maintenance. Effective BOP preventive maintenance requires accurate record keeping on all BOP function cycles, and this can be provided by such a system. By optimizing the preventive maintenance several advantages can be experienced, like for instance reduced downtime, a reduction of unnecessary maintenance, a reduction in systematic errors and increased reliability of the BOP. To address the challenge with limited time to perform maintenance, a second solution should be looked at as well. This involves equipping every drilling rig with two BOPs, which would give the rig crew much more time to insure the integrity of the BOP. Already some rigs do have one spare pod that is installed after each well. The pod taken out is then overhauled and ready to be re-installed after the next well and this method is suggested to be applied for not only the control pod but the entire BOP system. A problem is that most rigs today are not built for having two BOPs onboard.