For MeanMesa visitors brave enough to handle just a smidgen of "engineeree stuff," the following excerpt from WEST Engineering describes several aspects of typical approaches to down hole Blow Out Prevention for off shore production. Every radio pundit sober enough to jam the "live" switch on a microphone has been lamenting one part or another of the disaster which is now edging toward the rich wet lands of the Gulf States.
Most have either seriously mis-interpreted the facts concerning the technical details of the problems encountered on Trans Ocean's rig or have simply thrown up their hands, rapidly lowering their discussion to a series of "yuck yuck" guffaws designed to fill air time until the next commercial.
After all, research, investigation or even doing a little homework all require more effort than trotting out another conspiracy theory or yet another layer of undirected bitching.
Happily, in this case, a rather objective resource covering the details of the industry's efforts in this area is quickly available to anyone interested in knowing a little more about the events in the Gulf. Some of the relevant material is quoted below for the benefit of MeanMesa visitors who find themselves, well, less than satisfied with the "flying blind" approach.
Yes, we fully understand -- and are somewhat tolerant about -- the "engineering phobia" many citizens have adopted when it comes to technical discussions. However, this oil production disaster is simply too big for us not to have some real information about the relevant details.
So, give it a try! There may be terms or concepts which remain "out of reach," but the effort will pay concrete dividends even when there are a few "gaps" in comprehension. MeanMesa suggests that we pay especial attention to the section on acoustic well containment systems. This approach has been a central focus of the news on the subject.
Enjoy being a little more educated!
MeanMesa's thanks to West Engineering for compiling all this information. The original report was prepared for U.S. Minerals Management Service (MMS), part of the U.S. Department of the Interior. The MMS has also been a central topic of recent news coverage of a "too cozy" relationship between government agencies and the oil industry. Information about the MMS
To review the entire file quoted below, follow this link to:
Evaluation of Secondary
Intervention Methods in Well
Control
For
U.S. Minerals Management Service
What Would You Do?
· Loss of surface electrical control system. This situation would occur if the MUX
cables were parted, but would also occur should the surface computer fail. This has
happened in the past from such unexpected reasons as loss of GPS signal, which
resulted in the shut down of the entire BOP control system, including both pods. A
loss of surface electrical power would not typically cause loss of communication due
to backup batteries.
· Loss of hydraulic pressure. Total loss of hydraulic power without loss of MUX
communication is extremely rare, but has happened. In this case well control would
not be possible unless an independent, dedicated supply of hydraulic power were
available at the stack.
· Works in the presence of mud plume or noise. Should wellbore containment be
compromised after the LRMP is disconnected, a large flow of drilling mud and
associated debris would flow around the BOP stack. The concern is whether the
secondary intervention methodology would function well in this condition.
· Capable of containing well if LMRP is accidentally disconnected. When the LMRP
has been disconnected, there are no circumstances when the well should not be
secured via the shear rams.
· Capable of manually securing non flowing well. Without hydraulic or electronic
communication to the BOP stack, will the secondary intervention system secure a non
flowing well? This is the issue.
Shear Ram Blocks
Ram preventers are not designed to close and seal under high rate conditions if
closure rates are slow. API Specification 16A does not require testing for rams under
dynamic flowing conditions.
WEST Engineering Services, Inc Page 76 of 85
6.2 General
Decisions must be made regarding the level of security desired. There are many systems
available that will increase the security of a BOP system, similar to the way a belt adds
security to suspenders. This approach has the potential to create more problems than it
solves if not thoroughly thought out in advance, and the added complexity has proven
problematic in some cases.
An example would be the potential for an accidental disconnect of the LMRP connector.
Current MMS regulations state that the LMRP connector function must be covered to
prevent accidental unlatch, and goes on to say that the cover must be secured by a second
means so that it will be different from the cover over the blind shear rams. It would be a
fairly simple matter to add an interlock to prevent disconnection of the LMRP unless the
shear rams were closed and locked—a reasonable practice, but added complexity.
Unfortunately, there are several instances on record of the LMRP connector unlatching
accidentally due to piping errors, and other examples of an accidental unlatch without
human intervention due to causes such as back pressure. In that case it would seem that an
autoshear circuit with dedicated subsea accumulators would be desirable to immediately
close in the well. As a last line of defense we could add ROV or acoustic system
intervention, or both, in case all else fails.
The problem with the “belt and suspenders” method of safety is that it adds complexity to
an already complicated system. The more systems have to interact with each other, the
higher the risk of unintentional operation or failure to operate when needed. If two or more
systems interact to operate the same function independently of each other, a risk analysis
should be conducted and perceived risks mitigated. All leak paths must be explored to
verify that a leak in one system will not have an adverse effect on the other system. In
addition, no modifications should be allowed unless a full engineering review is performed
to assess the potential for “designed in” failure modes.
Virtually all of the systems discussed herein will be more dependable if the system design
and functionality is confirmed through a well thought out verification and testing program.
In an effort to understand where the various secondary intervention systems could be
enhanced, potential shortcomings have been delineated for each system. By defining the
potential shortcomings, coupled with collating the above-mentioned matrix of issues, risk reducing techniques can be more completely determined.
WEST Engineering Services, Inc Page 77 of 85
6.3 Deadman System
The deadman system is probably the most flexible system for deepwater rigs. If the riser
has parted it usually means that both MUX control pods are inoperable and all electrical
and hydraulic communication with the surface has been lost. In that scenario this system
will function to secure the well. This system also fulfills the role of an autoshear by
initiating the shear function if the LMRP is accidentally disconnected. The deadman
system is sufficiently fast acting to secure the well before environmental or safety issues
can occur in the event of riser failure or accidental disconnect.
Possible shortcomings of this system include the following:
1. Procedure implementation and training are critical to the correct and safe operation
of the system.
2. System is dependent on the shear rams being capable of shearing the pipe. The
subsea accumulator volume and power must be such that the pipe will shear and the
shear rams seal to contain the well.
3. The system is dependent on the drill pipe tool joint being in the right place, which is
simply a matter of chance. If the shear rams close on the tool joint the possibility of
a successful shear are remote.
4. The ability to shear tool joints or casing would be dependent upon the stack having
casing shear rams (also called super shear rams). There are no currently designed
casing shear rams capable of sealing the wellbore.
5. The system is dependent on having the correct installation and maintenance. On
one occasion a fault in the deadman system resulted in partial closure of the shear
ram, of which the rig crew was not even aware. This failure resulted in massive
damage to the BOP stack. On another occasion an incorrectly placed check valve in
the subsea hydraulic circuitry would have prevented activation of the deadman
system even if the entire riser was lost.
6. The system may be disarmed. If disarmed the system is totally disabled and cannot
be re-armed once communication with the BOP stack has been lost.
7. ROV capability as an emergency measure should include the ability to utilize
subsea accumulators as a supply source.
8. System diagnostics are essentially nonexistent. Deadman systems operate openloop.
There are no means to verify functionality of the deadman system. If the sensors, batteries, or electronics fail, the only (and first) indication of unavailability
is failure to operate when needed.
WEST Engineering Services, Inc Page 78 of 85
The systems in operation could be improved as follows:
1. Procedures must be in place to ensure that the drill pipe would shear.
a. Procedures should be in place to reduce the likelihood of the shear ram
blades contacting the drillpipe tool joint.
b. Sufficient accumulator pressure and volume to shear the drillpipe should be
verified. Methodologies to test the system should be established that take
into consideration water depth and mud weight.
2. Casing shear rams could be required if the rig is running casing and experienced
a well control event requiring secondary intervention. However there comes a
point of diminishing returns. A system utilizing casing shear rams would be
complicated by the need to add sequences to ensure the casing shear rams
closed before the blind shear rams. Much more useable accumulator volume
would be required to close two rams instead of one. In addition, many drilling
contractors at this time place the casing shear rams below the blind shear rams;
their plan is to lift the casing up and then secure the well with the blind shear
rams. Assuming the riser has parted a deadman sequence could result in casing
shear ram closure with an inability to close the blind shear rams due to
interference with the cut section of pipe. For these reasons, most systems accept
the risk associated with excluding secondary intervention from addressing
casing shear.
3. The design should be confirmed as sound. Change control should be in place to
avoid spurious ad hoc design changes. Well thought out testing methodologies
could confirm functionality and design.
4. Disarming the system for fear of accidental firing should be addressed in rig
procedures. An alternate consideration may be to add an acoustic or ROV
operated switch to fire the system. The risk with an acoustically operated
switch would be that communications might be degraded due to subsea noise or
a gas/mud plume if done after the well is flowing. Care must be exercised in
acoustic system selection.
5. The design should include diagnostics. Some indication should be provided of
the condition of the electronics, sensors, and batteries. This could be as simple
as an LED on the subsea electronics housing (visible to the ROV) that flashes if
all is well.
WEST Engineering Services, Inc Page 79 of 85
6.4 AMF System
This system is very similar to the deadman system described above. The AMF system uses
a circuitry housed in the existing SEM unit and some of the same hardware utilized by the
primary control system; thus, it is dependent on at least one pod being functional.
Comments made concerning the deadman system also apply with the following exception:
Unless equipped with an operable auto shear in addition to the AMF system the shear
function is not initiated if the LMRP is accidentally disconnected. The AMF system alone
will not fill the role of autoshear. All of the above issues discussed for the deadman system
are relevant to the AMF system. Rigs having an AMF system are (in addition to the above
problems with the deadman system) accepting the low risk that both pods might be
damaged beyond use at the same time.
Means to reduce the risk of existing AMF systems are
1. The AMF system could be improved by addressing the five items above included
for the deadman system.
2. If protection against an accidental disconnect is required, an autoshear feature must
be added.
3. Although it is hard to visualize a set of circumstances that would destroy both pods,
an in depth risk assessment should be performed on the potential for damage to
individual systems.
6.5 Emergency Disconnect System
An EDS secures the well and disconnects the drilling riser in the event of a drive or drift
off. It is manually initiated but performs the various functions of a safe disconnect in an
automatic sequence. Most EDS systems can complete the disconnect sequence in one
minute.
Possible shortcomings of this system include the following:
1. If MUX cables were non functional, it would not be possible to affect an EDS.
2. If both pods were damaged, it would not be possible to affect an EDS.
3. If an EDS is not initiated, the LMRP connector will not unlatch when required
and the wellhead could be pulled over, resulting in a catastrophic loss of
containment.
4. There is a chance that shearing will be on a tool joint, which will not shear unless
casing shear rams are included in the sequence.
WEST Engineering Services, Inc Page 80 of 85
Means to reduce the risk of existing Emergency Disconnect systems:
1. The EDS sequence should be flexible enough to allow for different drilling
activities. Some systems already incorporate such flexibility, for example the
choice of whether to include the casing shear ram in the sequence.
2. The EDS watch circle should take into consideration the strength of the wellhead,
casing, and formation supporting the casing at the sea floor.
3. If both pods are damaged, another means of secondary intervention such as auto
disconnect and auto shear would be required.
4. Incorporate operating procedures to avoid striking a tool joint.
6.6 Auto Disconnect
The auto disconnect automatically unlatches the LMRP when riser angle reaches a
predetermined point.
Possible shortcomings of this system include the following:
1. This system alone does not secure the well; it only provides an emergency
disconnect.
2. The mechanically operated valve used to unlatch the LMRP connector must be
correctly adjusted to prevent premature unlatch.
3. Like the deadman system, the auto disconnect must be armed in order to operate,
except that in this case it is armed by the ROV. However, an armed auto
disconnect may be more palatable to rig crews as it is mechanically activated and
doesn’t depend on a MUX system.
Means to reduce the risk of existing Auto Disconnect systems:
1. If combined with an autoshear circuit should be an effective means of
automatically disconnecting the riser and securing the well due to a drive or drift
off.
2. Include procedures to ensure that the LMRP connector is correctly adjusted to
prevent premature unlatch.
3. Include procedures that address the arming/disarming of the system.
WEST Engineering Services, Inc Page 81 of 85
6.7 Autoshear
The issues discussed above for the deadman system are also relevant to the autoshear
system.
Additional shortcomings of this system include the following:
1. The autoshear secures the well only in the event of an accidental or intentional
disconnect of the LMRP. If the riser is parted the autoshear is not activated.
2. The mechanically operated valve used to initiate function of the shear ram must be
correctly adjusted to prevent premature shearing of the pipe. WEST is aware of at
least one instance where the autoshear was initiated due to deflection of the LMRP
stab plate during pressure testing of the choke and kill lines.
3. Like the deadman system, the autoshear must be armed in order to operate.
4. There is a chance that shearing will be on a tool joint, which will not shear unless
casing shear rams are included in the sequence.
5. ROV capability as an emergency measure should include the ability to utilize
subsea accumulators as a supply source.
Means to reduce the risk of existing autoshear systems:
1. Perform an in depth risk assessment.
2. Verify that deflection of the LMRP/BOP plates during pressure testing is
insufficient to activate the autoshear. A safety factor should be included.
6.8 Acoustic Systems
An acoustic backup control system can be implemented as a stand alone system with
dedicated accumulators or if the rig has a MUX system, it can utilize existing MUX
solenoids and accumulators. Acoustic signals are transmitted through the water to operate
specified stack functions.
Possible shortcomings of this system include the following:
1. Some systems may not have hydrophones strong enough to penetrate a mud plume
that would be present in a disconnect situation.
2. The correct hydrophone must be specified for deep water.
3. Acoustic interference caused by the noise of a flowing well may make operation
unreliable.
4. Depending on the system, control valves may be too small to operate the ram BOP
in the API recommended time.
5. Hydrophones must be in the water in order to operate. There has been at least one
failure attributed to the hydrophone not being deployed when needed.
WEST Engineering Services, Inc Page 82 of 85
6. Acoustic communication can be unreliable if operated in water depth that differs
significantly from the design criteria (e.g. in water that is either much shallower or
much deeper than the design range). Signal intensity varies significantly with water
depth. An acoustic system optimized for 4,000 feet may be too loud at 1,000 feet
and have insufficient amplitude at 7,000 feet. Acoustic systems can be adjusted for
water depth. However, many rigs don’t have the tools or technical training to do so.
7. Many drilling companies do not use acoustic systems unless mandated by
regulation because of high cost and perceived high failure rates.
Ways to reduce the risk of existing Acoustic systems:
1. Verify hydrophone selection and source level setting are suitable for expected water
depth and high noise levels.
2. Subsea hydrophones or relay beacons deployed by ROV 100 meters from the BOP
stack could substantially improve communication during high well flow situations
or when a gas or mud plume exists.
3. A free fall “depth charge” beacon can be dropped next to the BOP – and thus below
any plume - to operate a desired function or set of functions.
4. Procedures should be put in place to deploy the hydrophones any time the stack is
subsea.
5. An aggressive between well maintenance system is critical to reliable operation.
Democracy always works best when those in charge
-- US! --
are well educated.
