A.

r_

tta - !A\
SUB.'ECT

?EXPfiES@)Ln!
ExproSoft AS Enterprise no.: NO 881 559 692 Main office -Trondheim S. P. Andersensvei 158 N-7465 Trondheim,Norway Telephone: (+47r73 59 11 48 (+47)73 59 11 49 Fax Branch office - Stavanger/Sandnes: Gravarsveien 32 N-4306Sandnes,Norway Tlf./Phone: (+47\ 51 67 63 70 (+47)51 67 63 71 Fax
CLASSIFICATION

Reliability of Acoustic BOP Controls,

Preliminary work

DISTRIBUTION

Tor Taklo, Shell Deepwater Services

Restricted
PROJECT NUMBER

20r047
DATE No, oF PAGES CONTACT SIGNATURE

30052042

l3

Per Holand

Per Holand

1.

ACOUSTIC SUBSEABOP CONTROL SYSTEM DESCRIPTION...................,..........2 1.1 1.2 1.3 1.4

1.5

........2 INrRoDUcrroN ............2 CoNrRolFuNcrroNs....... ......................2 MerNSussvsrEMs 3 roR CoruuaNo-/srcNAl SreunNce Acousrlc CoNrRolSvsrsus...............................
ELscTno-FIyDRAULIc STcNeI CoNVERSION AND INTERFACESWITH THE MAIN

CoNrRor SvsreN4 2. ACOUSTTCSYSTEMFATLURES

.......................4 .......................6

Rsuenu-nyDATA .................6 2.1 ExpERIENcEAND souRcEs................ DATA 2.2 AcousrrccoNTRoL FArLURES..... ........7 sysrEM 2.2.1 .........................7 Obsemation Failures... of 2.2.2 Failure Modes .....................7 2.2.3 FailureFrequencies ...........9 2.3 PRoeasil-rrv Acousrrc Svsrsv FuNcrroN oF WHEN DEMANDED ............... l0 FATLURE 2.3.1 Probability ........................ 10 OnDemand 2.3.2 MeanFractional DeadTime(MFDT) ........................ I0 2.3.3 Acoustic ......... System Unavailability....... .................. I1 2.3.4 Discussion... ....................-.. Il 3. SHELL CONCEPT VS. CONVENTIONAL BOP ACOUSTIC SYSTEMS................12

H:\Shell SSOD\hosjektmemo Shell acostic.doc

CONFIDENTIAL

ExhibitNo'WorldwideCourt

CAM_CrV_0406933

-2-

exprosonro

1. O
1.1

AcousticSubsea BOPGontrol System Description

Introduction

An acousficsubsea BOP controlsystem up to now alwaysbeena back-upBOP control has system. The intentionof the system beento controlvital BOP functionsin case an has of emergency. Suchan emergency would typical be a situationwherethe primary controlsystem had failed completelyandthe BOP shouldbe closedto preventa hazardous situation. Todaytlere arethreemajor suppliers acoustic of back-upBOP control systems. They are: Nautronix(http://www.nautronix.com (http://www.sonardyre.com) Sonardyne Kongsberg SimradOttp//www.kongsberg-simrad.com)

They all deliversystengrated 3000- 4000meters. to The valvepackage typical delivered is by the BOP supplier. 1.2 GontrolFunctions

Table 1 showstypical BOP acoustic system control functions. Table 1 Typical BOP acoustic system controlfunctions
Functions Riserconnector tsltnd-snear ram Middleoioeram Lowerpioeram Arm Reset Operations Disconnect Close Close Close Supplvcontrol fluidto slidevalvemanifold Shutoff control fluidto slidevalvemanifold

For ram preventerswith a hydraulically operatedlock frrnction (for instanceCameron Wedgelocks) additionfunctionswould be required. typical acousticcontrol system A that is deliveredtodaycancontrolup to 16 BOP functions. The functionscaneitherbe activated a permanently via mountedcontrol systemon the platform, or via a portableunit from the platform,standby vesselor a life boat. 1.3 Mai6 Subsystems

The main subsystems a typical subsea in acoustic control systems are: Surfaceequipment - Surfacecontrol units (one fixed and one portable with ths samefunction) - Transducers (hull mountedfor the fixed controlunit andportable)

equipment subsea
Subsea ControlUnit (s), SCU (or Subsea ElectronicModule, SEM) (oneon eachsideof tle BOP) Transducers

CONFIDENTIAL

cAM_CtV_0406934

-3-

xprcsoro

(solenoidvalvesandpilot valves) valvepackage Subsea Accumulators Shuttlevalves

In addition the systemsare typically equippedwith battery chargersand test units' systemeitherincludes; The subsea tansducers,or one - two sefaratesubsea controlunits (SCU),eachconnected ofthe subsea transducers one of the subsea - u .ingl" SCU with intemal duplication, eachpart connected 1.4 Sequencefor Acoustic Control Systems GommandJsignal

of The operationof the BOP control systeminvolves the following sequence events, presupposed systemhasbeenarmed: the 1. The operatorselectsand initiates the desiredBOP control commandin the surface controlunit. 2. The commandis transmittedinto the waterthrough the hull-mounted (or portable) transducer. and tansducers signatvia oneofthe subsea the controlunit receives acoustic 3 . The subsea message. the decodes acoustic has - Onesupplierhasa reed-back statingthat the command interpreted message surfacecontrol unit, before the surfaceunit transmitsa signal correctly back to the commandingthe requiredvalve function to be executed valve package. 4. An electric signal is then sentto the appropriatesolenoidin the subsea pilot hydraulic flow to a pilot valve 5 . The solenoid directs a BOP function. 6. The pilot valve shiftsandallowshydraulicflow to the appropriate pilot valves that verifies that the operationis sentto the SCU. t . A feedbacksignal from the backto the surface. transmitted informationis thenacoustically 8 . The feedback receivesand interpretsthe reply transducer 9. The surfacecontrol unit via the hull-mounted and displays the appropriatecommandstatus. Eachof the abovestepsis indicated. of Figure I . 1 showsthe abovesequence eventsgraphically.

seguencefor acoustic control systems Figure 1.f Command-/signal

CONFIDENTIAL

cAM CrV 0406935

-4-

zExpr@$@tRE

A.-

1.5

Electro-hydraulic Signal Gonversionand Interfaceswith the Main Control System

Figure 1.2showsa typical electro-hydraulic signalconversion interfaces and with the main controlsystem and subsea controlunit for and acoustic Bop conhol svstem.

Pilotvatue, DUMP

Pilot valvs, CI-IARGE

I I I I tl tl

==/ ___-r;r
'll

i:trr{
lgi t to --9

.lr;

trl
l r l' l llr

tl
;l

i:j:!:: :,.;1::-

lr Il

To BOP turcdon 1

ililil ililtl lltltl lltrtl lllltl lltltl llll;l llllgl llllll ll1l1l ll1l1l llllll illttl

t' 'll

-ll: , lI l :
To BoP

, t i l , tunc{im2

.)r,r,'L
To BOP ftmction 3

ToBOP nnctls 4

t'

BOPtunctim5

-:- _- _- _- _-- -- _- _- _= _: _To sea

_=__-__-:=: _: _,)

Figure 1.2 Electro-hydraulic signal conversionand interfaceswith the main control system and subsea control unit

CONFIDENTIAL

cAM CtV 0406936

-5-

exprcsofi

are The acousticsystemhas interfacesto the main control system.The acousticaccumulators by the main charged the main control system,the acousticsystemdump valve areconfrolled by from the main control system contol system,and the acousticBOP functions are separated hydraulic pressureis 3000psi' functionsby a shuttle valve. The typically pre-charged To actually activatean acousticBOP function at first the arm sigrralhasto be transmitted'This fluid that againwill shift the arm pilot andallow high pressure signalwill shift the arm solenoid function pilot valves.When activating a BOP function solenoidvalve this will shift to the BOP BOP fluid to the associated BOP functionpilot valve and allow high pressure the associated pilot valves haveread-backsignalsso it canbe verified that they have actually function. The shiftedposition. Tpically the acousticsystemsare function testedwithout arming the system.The read-back signalsfrom the pilot valves verify that they have actually shifted position. The arm function is ttpicatly testedby activating the shearram when they are out of hole, frequentlyin association test. with a casing From time to time other BOP functionsare actually testedwith the acousticconhol systemas well.

CONFIDENTIAL

CAM_CrV_0406937

-6-

9rrrprcS@ft

2.

Acoustic System Failures

studyis based on variousstudies usedas input datafor the proposed The reliability experience carriedout by PerHolandwhen he wasemployedby SINTEF.The various studiescarriedout arelisted at http://www.sintef.no/units/indman/sipaa/prosjekUbop.htm. 2.1 Reliabilitydata experienceand data sources

acoustic statistical materialregarding BOP control systems Table2 showstheavailable reliability. Table2 Acoustic
Study r ear Gompleted EUF {elaD[[y or SuDsaa 985 ;vstems - Ptase l, 1987 Reliability SubseaBOP of jystems - PhaselV 989 iubsea BOP Systems,Reliability rnd Testino. PhaseV ieliability of SubsoaBoP iystems for Deepwater Prase, DIY \oDlication.

data
unilrng pen(Xr NO. Ot I ovil no, BOP days wells ofBOP dacoustlc and area drvg sYgtem 150 8 11 5 6161 977-1983, {orwav 58 3809 3809 198,f-1986, Norwav t987-1989, {orvmv
NO. Ol

falluree
rac6r.Lal

35

uowntlme caus, od by acoustlc svstem fhrsl 458.5 455

13 8 13

47

2636 48r',6 4009

2636
3718

1U
258,5

r997
t999

BOP Reliability Subsea of Systems Deepwater for Piasell DW \oolication.

138 1992- 1996, Brazil,Nor-way, Italv,Albania 1997- 1998,US 83 3oM oCS 476

total

?3415

18324

69

t306

BOP-days is defined as the number of days from the BOP has landed on the wellhead the first time until it is pulled from the wellheadthe last time. If the BOP is pulled during the operation due to a BOP failure this is regardedas included in the BOP time. If the well is temporarily beforereturning to tlre well, this is not abandoned the rig is carrying out other operations and includedin the BOP-davs. About the studies The PhaseII studywas basedon wells drilled in Norwegianwater in the period 1977- 1983. The water depth was between70 to 370 meters(230 - 1200 ft) of water. The use of acoustic in was not mandatory Norway before 1981,so thereforefor some back-upBOP conhol systems back-upsystemwas not included. of the wells an acoustic The PhaseIV studywas basedon wells drilled in Norwegianwater in the period 1984- 1986. The water depth was between91 to 405 meters (300 - 1330 ft) of water. Acoustic backup wereusedfor all the BOPs. systems The PhaseV study was basedon wells drilled in Norwegianwater in the period 1987- 1989. The water depth was between 85 to 491 meters (280 - 1610 ft) of water. Acoustic backup wereusedfor all the BOPs. systems wells mainly drilled in Brazilian waters and The PhaseI DW study was basedon deepwater wells were "shallow" water wells drilled in Norwegian waters. In addition eight deepwater drilled in Italian and Albanian waters. Acoustic back-up systemswere used for all the wells

CONFIDENTIAL

cAM CrV 0406938

-7-

$OrprcSolfe

drilled in Norway and many of the wells drilled in Brazil. The wells were drilled in the period 1992- 1996. Thewaterdepthwasbetween to 1855meters (180- 6090ft). 55 Tabfe 3 Waterdepth for PhaseI DWwells where an acoustic back-up BOP control system were used
< 400 Numberof wellsdrilled

400300
19

Water deoth (ml >1200 80&1200

Total
103

42

29

13

The PhaseII DW studywasbased US GoM OCSdeepwater on wells. None of these BOPswere equippedwith an acoustic back-upcontol system. Data source The main datasourcefor all the BOP studies beenthe daily dritling reportsfrom the wells has includedin the studies. the earlierstudies In hard copiesofthe daily drilling reportshavebeen usedas datasource. the laterstudies electronic In versionsof the daily drilling reportshave the beenused. 2.2 Acoustic control system failures

2.2.1 Observatlon Fallures of Failures on the acousticsystemsare normally observedduring testing of the systems. From 7992therehasbeena requirement functiontestthe acoustic to systemweekly whenthe BOP is locatedat the seafloor. Before 1992thetypical testof the acousticsystemwasto closetheblind shearram to testcasingbeforedrilling out ofcasing Table4 showsan overviewof the BOP location when acoustic systemfailureswereobserved. Table 4 Overview of the BOP location when observing acoustlc system failures
Study
Phasell Phase lV PhaseV Phase I DW Total Locationof BOP n the riq orior to runnino On the wellhead

)urinsrunnino BOP
1

Tolal

22 3
5

13
o

35 13
q

7 8

't3
69

29

38

Table 4 showsthat of the failures observedmore than 50% of the failures were observed when testingthe BOP whenit wason the wellhead. From a safetypoint of view the failuresobserved when the BOP is on the rig duringrunningand duringthe BOP installationtesthayeno effect.

2.2.2 Failure Modes Table5 showsthe failure modesfor the failuresthat wereobserved during the BOP installation testand duringregularBOP testsor operation.

CONFIDENTIAL

cAM CtV 0406939

-8-

9exproScm

test and during Table S Failuremodes for faituresobservedduring the BOP instatlation regular BOP tests or oPeration
rnodo Failure test lnstallation Regular or ooeration test I 11
tarnaalr reer

BoP ie e!lhq{9!!!eag--

Total

3
rclin svstem

one sourious ooe,ration BOPfunction

..^r

2 3
I

22 3 2
6 1 1
1

3
I

(oneof twoelectronp tbe-lnglggeag)_ G". "fredundancv inr{inalinn rG^^ .,^tr,^ aaoirian

^r^ -^-lL^^r^i^a^l

Total

18

19

37

and during the Failuresthat occur when the BoP is on the rig, during running of the BoP in terms of well control' During these installation testing arenot regardedas critical failures testing is phasesof the opeiation the B-OPis not acting asa well barrier. After the installation actingasa well barrier' Failuresthat the andaccepted, drilling startsandthe BOP is completed are after the installation test areregardedas safetycritical failures' The failures that occur from a safetypoint of observedduring regular BOP testsoioperations arethe failures interesting view. affect the complete When looking at the failure modesit is observedthat the majority of failures Only few failures are system,and ttre result of the failure is that the systemcan not be operated' affecting one function onlY. Table 6 showsthe failure modesvs. the type of failure that haveoccurred. Table 6 Type of failure vs. failure mode
Failuremode
Eait^d r^ anaata El6D

iJiE of failurefor failuresobservedduring regulartest or operallol Total Unknown Signal Electric/- Mechanical transmission electronic 1'l 1 4 4 2

3
FAiledto operateone BOP functionby the acousticsvstem Wronqlalve Dositionindicalqq

3
e

2
1
o

Total Grand

1 7

19

is and mechanical signaltransmission equally Table6 showsthat the electric/electronic, andFailed tofunction on hull BOP for responsible the critical failuremodesFailed to operate transducer. mounted and transducer the subsea One of the elecfic/electronicfailureswas relatedto both onesubsea For one failure the failed equipmentis unknown. Threeof control unit for the other transducer. by the failureswere caused failuresin the hull mountedtransducer. leaksin the failureswere all relatedto hydraulicsubsea The mechanical accumulatorsandthe arm valve. the supply areabetween

CONFIDENTIAL

CAM_ClV_0406940

-9-

grpnosorfi

Frequencies 2.2.3 Failure in communication the failure arerelatedto problemswith theacoustic The signaltransmission any specific equipmeni/partfailure. seawater, and not carriedout. TableT showsthe MeanTime To Failure(MTTF) for the variousBOP studies Tabte7 Gomparisonof acousticsystem reliability in the various studies
Sludy Failuremode Failed lo ooerateBOP Failedto functionon hull mountedtransducer Wrono valve Dosition indication
ROtr is nn lha wallhead

test BOP days Regular

nr nnemlion

in service

MTTF {davs)

Phase ll

2
1
o

'hase ll Total

Unknown 6161 3809

2636 685 3 1 4 1 2

Phase lV

Failedto operateBOP Failedto functionon hull mountedtransducer Phase lV Total Failedto oDerateBOP Phase V PhaseV Tote Phase I DW Failed to oDerateBOP Failedto operateone BOP functionby the acoustic
svqlam

952 2636

3
5 19 3718 16324 744 859

Phase I DW Total fotal

Table 7 showsthat the while PhaseII, PhaseIV and PhaseI DW all have approximatelysame MTTF, while PhaseV show better results.The reasonwhy thereis a differencehas not been but investigated, it is likely that randomstatisticalvariationsis the major cause. failure modespecificMTTFs. Table8 showsthe average Table8 Failure mode specific MTTFs
:ailure mode Regulartest or ooeration 7 BOP days in service 16324 MTTF (days)

2332 Failedto operate BOP (mechanical, failure) electric,felectronic 16324 Not relevant,on 4 Failedto operate BOP (signaltransmission demand probability' oroblems) 5441 16324 3 Failedto functionon hull mountedhansducer 5441 16324 3 Failedto operateone BOP functionby the acoustic svstejn '16324 16324 Wronovalve oositionindication 1 1 16324 16324 Unknown 't9 Total is Signal transmissionproblemscomesand goesthe probability of occurrence more likely to correlateto number oftests than number ofdavs in service

It was selectednot to give a MTTF figure to the failure modeFailed to operqteBOP (signal problems)sincethis is a randomfailure that comesandgoes.If this failue occurs transmission typically the acousticsystemis testedsomehours later and everythingis OK. When carrying out problemsoccurred fairly frequently,but claimed that these the abovestudiesdrilling personnel in they werenormally not reported the daily drilling rsports.To seeif this still is a problemwith rig, of from several superintendent haveexperience that BOP control a maintenance acoustic them a fairly new floating productionplatform.He saidthat this still was a problem.From time

CONFIDENTIAL

cAM CtV 0406941

-10-

9rrprcSore

they loose timesto get contact,andsometimes several to time theyhaveto call up the acoustics failure type will be followed up by the contactwith the BOP during the acoustictesting.This rigs to working offshore Norway for both new rigs and deepwater engineers talking to subsea checkif this problem hasbeenimproved. 2.3 Probabitityof Acoustic System FunctionFailurewhen Demanded

For sirnplicity only the failure modesaffecting the completeacousticsystemhavebeenusedfor of the quantified analyses the unavailability. The failure modeaffecting one BOP function only will havean insignificant effect on the systemunavailability, and hasthereforebeendisregarded. are: The failure modesincluded in the quantified analyses problems) BOP (sigrraltransmission Failedto operate (mechanical,electric/electronicfailure) Failed to operateBOP ^ Failedto functionon hull mountedtransducer

Probabillty 2.3.1 On Demand The on demandprobability is usedfor the failure modeFailed to operateBOP (signal test that the an acoustic havebeencarriedout before problems).If assuming transmission casing,a total of 473 testsof andsurface the drilling out of casing,disregarding 30" conductor I II, were carriedout in Phase IV andV. For Phase DW, 129testsincluding system the acoustic testsin the datamaterial. an acoustic were listed.This gives a total of 602 acoustic test The on demandprobability for a failure can be estimatedby: No. of failuresA.Io.of demands Basedon the 4 signal transmissionfailures and the 602 teststhe on demandprobability will be: 4/602= 0,66%. Dead Tlme(MFDT) Fractlonal 2.3.2 Mean The meanfractional deadtime is used for the failure modesFailed to operateBOP (mechanical, transducer.The MFDT of a and electric/electronicfailure) Failed tofunction on hull mounted componentis the meanproportion of the time wherethe componentis in a failed state.Consider to Failures are only assumed be discoveredat tests,which are a componentwith failure rate 7u, are performedafter fixed intervalsof lengtht. Failedcomponents repairedor replaced immediatelyafter discovery. is The meanfractionaldeadtime of sucha component MFDT: (),* r)12

I The effect ofrunning the portableunit into the seahas not beenconsidcred. This will take sometime. For the Shell shearand disconnectoperation. SSODD conceptthere will be no time for running the portableunit if an emergency

CONFIDENTIAL

cAM CrV 0406942

- 1l -

9expnoSm

r:7 days week; every tested is system function that If assuming theacoustic = BOPdays (7 BOPdays/ +3) failures 1632 MTTF= 16324 day failures/BoP l. = l/lvlTTF:0.0006126 7/2= MFDT=0.0006126* 0.21%
Unavallability System 2.3.3 Acoustlc willbe an and probability (0.66%0) the MFDT (0.21%o) The sum of the aboveon demand systemwill fail if it is i.e. for approximation the unavailability, probabilitythat the acoustic The needed. unavailabilitywill thenbe: + 0.66% 0.21%: 0.87% 2.3.4 Dlscusslon and It is likely thatthe majority of failuresrelatedto the seriousmechanical electric/electronic probability calculated failures areincluded in the basisfor the aboveMFDT, but the on demand to problemsis assumed be all too optimistic.This because transmission on based the acoustic in temporarylack of acousticcontactbetweenthe rig and the BOP is underreported the data problems communication used(seesection2.2.3).Evenwith the relativelyfew acoustic source reportedthis problem dominatesthe acousticsystemunavailability. If the occulrencerate of this this failure type hasbeenunderestimated, failure type will totally dominatethe probability of a to related the probabilityof this typeof failure will Furtherinvestigation unsuccessful operation. be carriedout.

CONFIDENTIAL

CAM_CtV_0406943

-72-

9exprcSo,rru

3.

Shell concept vs. Conventional BOP Acoustic Systems

has A conventional BOP acoustic system a limited amountof functionsrelatedto closingsome device preventers disconnecting LMRP. The Shellshutoff anddisconnect and the selected (SSODD) will needfar more functionsboth relatedto openingthe preventersand connectors and controlling the acousticsystemitself. BOP control systemit will nedthe If the proposed SSODDshallbe built similar asan acoustic following functions: l. Arm function 2. Disarmfunction lock 3. Riserconnector 4. Riser corurector un-lock un-lock secondary 5. Riserconnector 6. Ram I close 7. Ram I open 8. Ram2 close 9. Ram 2 open lock 10.Wellheadconnector un-lock I l. Wellheadconnector 12.Dump valve open 13.Chargevalveopen annsexpand 14.Transducer arn 15.Transducer collapse The systemwill needa hydraulic supply line to chargethe accumulators. 2.3 As shownin Section themain problemfrom a safetypoint of view will be failuresthat number of functions is therebynot expectedto aflects all functions,and the increased point of view the increased the significantlyreduce systemavailability.From an operational number of functionswill however causea regularity problem.Failuresin pilots and solenoid havepods rig valvesneedfto be repaired, will cause downtime.New BOP acousticsystems this wrt that canbe pulled for repair.Similar type of podsshouldbe investigated the SSODD. L' zARelyingon an acousfic questionable. normaloperations For systenlwith a ROV back-upseems and in as connecting riser to the welhead, disconnecting badweathersituations, closingopening sigrralthat acceptable. for kansmittingan emergency But it ramsfor routinepurposes seems it dubious.If the acousticsystemfails therewill be sequence seems startsa shearanddisconnect fairly high anda systemfailure seems no tirne for usingan ROV. Theprobability of an acoustic systemthat canbe activatedfast enoughshouldbe evaluated. back-upemergency Such a systemf could be a strain gaugosystemthat is activatedin sasethe stresson the riser a exceeds certainlevel.Alternativelythe primary conhol of the SSQDDiwies.scuklbe a _ as simple singlepod multiplex systemwith the acousticsystem a back-upsvstem

CONFIDENTIAL

CAM_CtV_0406944

13-

9gtproSom

Other SSODD Considerations Whenevaluating success tle probabilityof a closeanddisconnect sequence the SSODDit for will also be important to evaluatethat the connectormay be stuck due to mechanicalproblems and that the shearram may actually fail to shearthe pipe. This part of the problernswill, however,be similar to a conventionaldeepwater BOp operation. In a studycarriedout forNorske Shell someyearsagoNorwegianwells drilled in the period 1984- 1996werereviewed. Theblind shear ramswereactivated cut pipe duringoperation to six times. Of the six activationsfive was successfirl one wasnot. For the activation that and failed they attemptedto sheara tooljoint. Tracking tooljoints andblind shearram shear capacities pipe usedwill be utrnostimportant, vs. Basedon the BOP studies carried,a connector will fail to disoonneot approximately out of in one 100attempts. To be ableto testthe subsea sheartam wrt. internalleaks,a chokeline below the ram is normally required. Whentestingthe BOP system includingboth surface BOP andthe SSODD,the testplug should be set in the subsea wellheadto veriff that t}ere areno extemal leaks in the SSODD andthe riser.

CONFIDENTIAL

cAM CtV 0406945