BOP failures

Although the ultimate cause of a blowout is human error to control the hydraulic wellbore pressure with drilling mud, in some cases the failure of the BOP to control the situation also contributed to the incident. The causes of the BOP failures are analyzed below ... 

Balance of plant (BOP) failure and loss of off-site power ... 

Consultants ABS have carried out a detailed FMECA of blowout preventers Blowout preventer (BOP) failure mode and effect criticality analysis (FMECA) for the Bureau of Safety and Environmental Enforcement, Final Report, 2650788-DFMECA-3-D2, June 28, 2013. 

BOP failure (of battery, blind shear ram and emergency disconnect system). 

The BOP- or PyBOP-mediated SPPS of phosphinot or phosphono peptides can be carried out without protecting the phosphinic or phosphonic acid group. Indeed, phosphinic acids are activated, but the P—N bond is not formed. Phosphonic acids are also acti-vatedt and in fact an amide of methyl phenylphosphonic acid has been obtained, however, in the case of protected a-amino phosphonic acids, phosphonamides are only obtained by using AT-phthalyl protection. Side-chain unprotected phosphorylated tyrosine [Tyr(P03H2)] can be coupled by solid-phase synthesis using BOP (PyBOP), but pyrophosphate formation is also observed and some particular Tyr(P)-peptide syntheses are prone to total failure. ... 

The fibril orientation in Figure 6 indicates that they were formed from material piled up in front of stylus due to plowing. Since this material is anchored to the sides of the wear tracl it becomes stretched and oriented into long fibrils. These fibrils make a large contribution to the lateral force exerted on the stylus. The high strength of oriented polyethylene ensures that failure initiates in the relatively unoriented material where the fibril is anchored to the side of the wear track. One end of the fibril is essentially tom from fhe matrix. Catastrophic fibril failure produces a large, rapid drop in lateral force and allows the stylus to junq> forward. This results in the sharp current spike coincident with the load (bop. 

The importance of corrosion in these balance of plant (BOP) systems increased tremendously for nuclear plant owners in the 1980s. Leakage and functional failures in safety-related and nonsafety-related cooling systems as a result of general corrosion, localized corrosion (especially... 

Unprotected loss of heat sink (ULOHS) - isolation of the balance of plant (BOP) with a failure to scram. 

Examples of inadequacies or failures of engineering controls include BOP malfunction, hydraulic failure, gauge or indicator equipment error or malfunction, power disruption, and valve failure. Engineering controls are subject to failure due to inadequate design, installation, inspection, testing, and maintenance. 

Administrative control failures include deviation from standard operating procedures, failure to close valves, failure to activate the emergency shutdown system, and failure to activate the BOP. Administrative controls are subject to failure when procedures have not been adequately developed, implemented, audited, and enforced. 

In those few minutes 2140-2149, there was perhaps a window of opportunity for the Well Site Leader to activate the BOP and shut down the well. This would have been an admission of failure - the Macondo well had blown, and the BOP would have been isolated on the seabed, the months of work required to reach that point would have been wasted. Perhaps there was a reluctance to activate the BOP until it was too late. There was a conflict of interest the Well Site Leader, responsible for bringing the well to operational readiness, also had an opportunity to take a decision which might, in effect, have killed the project at a stroke. 

The BOP also had a deadman system which should have operated automatically. This failed too. The BOP was supposed to be a high-integrity system, probably intended to meet SIL 3 requirements or equivalent. The failure of the BOP is discussed further below. 

As previously stated, the blowout preventer (BOP) was designed and manufactured by Cameron International of Houston, Texas. It was owned and maintained by Trans-ocean, the owners of Deepwater Horizon. Failure of the BOP was an absolutely key aspect of the accident this was a multiple-channel high-integrity redundant systan, the sole function of which was, in extremis, to cut the drill pipe within the well bore and seal off the well, and yet it did not work. 

The BOP was eventually recovered from the seabed and taken to NASA s Mi-choud facility in New Orleans for forensic examination, initially by DNV, a major consultancy. DNV s report was published one year after the accident. Four years after the accident, in June 2014, the US Chemical Safety and Hazard Evaluation Board (the CSB) pubhshed another extremely detailed report on the failure of the BOP. There were three main findings. 

Pre-accident test procedures were incapable of revealing these failures, because the design of the BOP control system did not allow independent functional testing of the redundant systems, neither while the BOP was on the rig nor while it was in subsea service. Withont snch independent functional testing, latent failures had caused three of the four channels to fail. (Appendix 2B of the CSB report.)... 

To summarize the BOP was intended to be a high-integrity system, bnt it was mechanically ineffective in its main function of shearing the drill pipe, because the drill pipe was eccentric in the well bore. Furthermore, its four-channel control systems were incapable of being independently tested, so latent failures that existed in three of the four channels were unrevealed - and the fourth channel would have failed also, except there were two failures in one channel which serendipitously canceled each other out. 

However, litigation continues (2014) and these amounts are unlikely be final. BP and Halliburton may share responsibility for the failure of the cement plug, while BP, Transocean and Cameron may share responsibility for failure of the BOP to operate. 

All STAR reactors drive a Brayton cycle rather than a Rankine steam cycle. Absence of a feedwater heater failure hazard means that the return temperature from the BOP to the invessel reactor heat exchangers is guaranteed to exceed the 327°C freezing temperature of Pb by at least 100°C - even in BOP upset conditions. This assurance combined with the less corrosive nature of Pb compared to Pb-Bi alloy as core outlet temperature is raised to 800°C -plus the avoidance of a Po source term have in combination led to our selection of Pb over Pb-Bi eutectic for STAR reactors. (Preliminary screening has shown encouraging performance of SiC or SiC composite for cladding STAR- H2 and structures - see Fig. 3). 

Finally, Type III failures can be prevented with the installation of a blowout preventer (BOP) with adequate features that ensure performance as preventer and integrate in prevention system, with actions such as follows [3] ... 

---