BOP Failure Mode Effect Analysis PDF

BLOWOUT PREVENTER (BOP)
FAILURE MODE EFFECT CRITICALITY ANALYSIS (FMECA) – 2

FOR
THE BUREAU OF SAFETY AND ENVIRONMENTAL ENFORCEMENT
2650788-DFMECA-2-D2 3 Final Report 6/27/2013

2650788-DFMECA-2-D2 2 Issued for to BSEE as Draft for 4/20/2013
comments
2650788-DFMECA-2-D2 1 Issued for to IPs as Draft for 4/10/2013
comments
Report No. Revision Purpose of Revision Date
June 2013
This work was performed by American Bureau of Shipping and ABSG Consulting Inc. for the
Bureau of Safety and Environmental Enforcement (BSEE) under the terms of BSEE contract number
M11PC00027.
THIS PAGE INTENTIONALLY LEFT BLANK
ii
LIST OF CONTRIBUTORS:
ABS Consulting
Randal Montgomery
Philip Howard, PMP
James J Rooney, PMP
iii
iv
SUMMARY
As part of the Blowout Preventer (BOP) Maintenance and Inspection for Deepwater Operations study
(Bureau of Safety and Environmental Enforcement [BSEE] contract number M11PC00027),
American Bureau of Shipping (ABS) and ABSG Consulting Inc. (ABS Consulting) performed a
Failure Mode, Effect, and Criticality Analysis (FMECA) on specific BOP subsystems and
equipment. There were three FMECAs performed with three different teams of operators, drilling
contractors and original equipment manufacturers. This is the draft report of the FMECA conducted
with Team 2 and represents the study deliverable associated with Task 6.2.2.1 as outlined in the
contract.
This report presents the objective and scope of the FMECA study, FMECA methodology, FMECA
results/worksheets and discusses major findings of the two workshops (Functional-level and
Equipment-level) that were conducted on a selected BOP and associated equipment (Class VII BOP,
6 Rams,1 Annular) that met the study’s criteria (refer to Section 1.2 Analysis Scope for more detail).
The objectives of the FMECA analysis were to (1) establish the relationship between a specific
subsystem/equipment failure and a loss of system functionality, (2) identify the critical failures by
using risk-ranking methods, and (3) align the current maintenance, inspection, and testing (MIT)
practices and their associated frequencies with each functional failure and the associated subsystem
and equipment failures.
Section 2 of the report outlines the methodology used to conduct the FMECA. The FMECA was
conducted in two phases, functional-level and equipment-level. The functional-level (top-down)
FMECA was conducted to identify the functional failures that could degrade the BOP functions. The
equipment-level (bottom-up) FMECA was conducted to identify the impact of major equipment and
component failures on the BOP performance by evaluating equipment-level failure modes,
identifying specific equipment-level causes, identifying the safeguards to prevent or detect the failure
modes, and ranking the criticality of failure modes. In addition, the equipment-level FMECA was
used to align MIT activities with equipment-level failure modes and specific equipment failures.
In preparation for the FMECA, ABS Consulting engineers identified potential functional failures and
equipment-level failure modes to help guide the analysis team. Functional- and equipment-level
FMECA sessions were held with BOP subject matter experts from the original equipment
manufacturer (OEM), drilling contractor, and operator. ABS Consulting and ABS engineers
facilitated and documented the analysis using ABS Consulting’s Enterprise LEADER software tool.
v
The team identified the eight BOP functions in American Petroleum Institute (API) Recommended
Practices (RP) 53, Third Edition, Section 7.1.3, and one additional function prior to the FMECA
analysis to meet the above objectives. During the FMECA session, it was determined that the “shear
the drill pipe and seal the wellbore” function needed to be broken down into three functions based on
differing operating conditions. The following 11 BOP functions were considered in the functional-
level FMECA:
1. Close and seal on the drill pipe and allow circulation on demand.
2. Close and seal on open hole and allow volumetric well control operations on demand.
3. Strip the drill string using the annular BOP(s).
4. Hang-off the drill pipe on a ram BOP and control the wellbore.
5. Controlled operation – Shear the drill pipe and seal the wellbore.
6. Emergency Operation – Auto-Shear – Shear the drill pipe and seal the wellbore.
7. Emergency Operation – Emergency Disconnect System (EDS) – Shear the drill pipe and seal
the wellbore.
8. Disconnect the lower marine-riser package (LMRP)/BOP.
9. Circulate the well after drill pipe disconnect.
10. Circulate across the BOP stack to remove trapped gas.
11. Connect BOP and LMRP at landing (not included API recommended practices [RP] 53).
During the functional-level FMECA, the analysis team evaluated these 11 BOP functions and their
52 associated functional failures. Each function and its associated functional failures were evaluated
in detail by identifying (1) the potential end effects resulting from the functional failure,
(2) equipment-level causes and failure modes potentially resulting in the functional failure, and
(3) safeguards used to prevent and/or detect the potential functional failure. Appendix A presents the
Functional-level FMECA worksheets, Appendix B presents the Equipment-level FMECA
worksheets.
For the equipment-level FMECA, the analysis team and industry participants (IP) identified and
evaluated the following 3 major BOP subsystems and 21 major equipment categories:
1. Surface Control System

1.1. Hydraulic Power Unit (HPU)
1.2. Power
1.3. Multiplex (MUX) System and Communication Cables
1.4. Hydraulic Supply
1.5. Control Panels
1.6. Accumulators – Surface
1.7. Fluid Reservoir Unit
1.8. Secondary & Emergency Control Systems
vi
2. Subsea Control System
2.1. Blue and Yellow Control Systems – Electrical Section
2.2. Blue and Yellow Control Systems – Hydraulics
2.3. Accumulators
2.4. Emergency Control Systems (ECS)
2.5. Hydraulic Supply, Rigid Conduit and Manifold
3. BOP Stack
3.1. Annulars
3.2. Blind Shear Ram
3.3. Casing Shear Ram
3.4. Pipe and Test Rams
3.5. Choke and Kill Lines and Valves
3.6. Connectors
3.7. Autoshear System
3.8. Remote operated vehicle (ROV) Intervention Interface
Note:
1- For the purpose of this study the “BOP System” is the first level of indenture in the BOP hierarchy (e.g. Surface
Control System, Subsea Control System, BOP Stack) and “Major BOP Component” is considered the second level of
indenture (e.g. MUX System, Annular).
2- The above naming convention was adopted during the FMECA sessions and are used throughout this FMECA report
and may differ slightly from industry subsystem or equipment naming convention; see Table1-1 for additional
information
Boundaries were established to further define the major equipment items by identifying all of the
components included with each major equipment item.

During the equipment-level FMECA meetings, the analysis team evaluated each major equipment
item by first identifying potential equipment-level failure modes and then postulating on specific
equipment failure causes resulting in each failure mode. The team then identified the potential effects
resulting from each failure mode. The effects were then identified and classified into various BOP
functional failures. Based on this classification the equipment-level failure modes and BOP were
linked with a corresponding BOP functional failure. Once these links were established, the analysis
team identified any safeguards that are currently in place to detect, prevent or mitigate the failure
mode. The analysis team then identified specific MIT practices currently employed to prevent or
detect the specific equipment failure causes.
In order to establish the potential risk of each equipment level failure mode, the analysis team used a
Risk Priority Number (RPN) scoring methodology. The identified failure mode effects were ranked
according to their severity, occurrence, and detection. The RPN for each effect (functional failure)
was determined and recorded. The severity rankings were based on the worst-case end effect of each
functional failure assuming that there is no redundancy. The occurrence rankings were based on the
frequency of the failure mode occurring, giving credit for any system redundancy in the system(s).
vii
Finally, the detection rankings were based on the probability of the failure mode being detected by
current protections (e.g. alarms) and/or current MIT practices. Appendix B contains the results of the
equipment-level FMECA.
Section 3 of this report contains the analysis results. The analysis team identified and evaluated
132 functional and 144 equipment failure modes. Even though each equipment item and its mode of
failure will affect the functionality of the BOP to a certain degree, the FMECA team identified the
following equipment items as the most critical items contributing to the BOP’s potential functional
failure:
 Choke & Kill Lines & Valves

 Blind Shear Ram
 Casing Shear Ram
 Pipe & Test Rams
 Autoshear Systems
 Connectors
 Control Panels
 Blue & Yellow Control Systems - Hydraulics
 Accumulator-Subsea
Table S-1 highlights the top 15% of the equipment failures that could potentially result in a severe
impact on functionality of the BOP.
Table S-1: Failure Modes with Highest RPN

Major # of Effects
Failure Severity Occurrence Detection RPN
Component/ (Functional
Mode (S) (O) (D) (SxOxD)
Subsystem Failures)
Choke & Kill
Lines & Valves Plugged 10 4 4 160 4
- BOP Stack
Blind Shear External
Ram - BOP Leak/ 9 5 3 135 1
Stack Rupture
Blind Shear
Mechanical
Ram - BOP 9 5 3 135 1
Failure
Stack
Blind Shear
Ram - BOP Wear 9 5 3 135 1
Stack
Casing Shear External
Ram - BOP Leak/ 9 5 3 135 1
Stack Rupture
viii
Table S-1: Failure Modes with Highest RPN (cont’d)
Major # of Effects
Subsystem Failures)
Casing Shear
Mechanical
Ram - BOP 9 5 3 135 1
Failure
Stack
Casing Shear
Ram - BOP Wear 9 5 3 135 1
Stack
Choke & Kill External
Lines & Valves Leak/ 9 5 3 135 1
- BOP Stack Rupture
Choke & Kill
Mechanical
Lines & Valves 9 5 3 135 1
Failure
- BOP Stack
Pipe & Test External
Rams - BOP Leak/ 9 5 3 135 1
Stack Rupture
Pipe & Test
Mechanical
Rams - BOP 9 5 3 135 1
Failure
Stack
Autoshear Mechanical
System - BOP Failure 9 2 7 126 1
Stack
Blue & Yellow Corrosion/
Control Erosion
Systems -
9 2 7 126 1
Hydraulics -
Subsea Control
Systems
Blue & Yellow Mechanical
Control Failure
Systems -
9 2 7 126 1
Hydraulics -
Subsea Control
Systems
Connectors - Mechanical
9 2 7 126 1
BOP Stack Failure
Hydraulic Corrosion/
9 2 7 126 1
Supply: Rigid Erosion
ix
Major # of Effects
Subsystem Failures)
Hydraulic Mechanical
Supply: Rigid Failure
Conduit and
9 2 7 126 1
Manifold -
Subsea Control
Systems
Accumulators - External
Subsea Control Leak/ 10 2 6 120 2
Systems Rupture
Accumulators -
Internal
Subsea Control 10 2 6 120 2
Leak
Systems
Accumulators - Loss of
Subsea Control Function 10 2 6 120 2
Systems (general)
Accumulators -
Mechanical
Failure
Systems
Accumulators -
Subsea Control Wear 10 2 6 120 2
Systems
Autoshear
Mechanical
System - BOP 10 2 6 120 2
Failure
Stack
Ram - BOP Leak/ 10 2 6 120 4
Stack Rupture
Blind Shear
Ram - BOP Wear 10 2 6 120 4
Stack
Blind Shear
Mechanical
Ram - BOP 10 2 6 120 3
Failure
Stack
Blind Shear
Corrosion/
Ram - BOP 10 2 6 120 2
Erosion
Stack
x
Major # of Effects
Subsystem Failures)
Blind Shear
Internal
Ram - BOP 10 2 6 120 2
Leak
Stack
Blue & Yellow
Control
Systems - Corrosion/
10 2 6 120 2
Hydraulics - Erosion
Subsea Control
Systems
Blue & Yellow
Control
External
Systems -
Leak/ 10 2 6 120 2
Hydraulics -
Rupture
Subsea Control
Systems
Blue & Yellow
Control
Systems - Internal
10 2 6 120 2
Hydraulics - Leak
Subsea Control
Systems
Blue & Yellow
Control
Systems - Mechanical
10 2 6 120 2
Hydraulics - Failure
Subsea Control
Systems
Blue & Yellow
Control
Systems -
Plugged 10 2 6 120 2
Hydraulics -
Subsea Control
Systems
The Choke & Kill Lines & Valves - BOP Stack was the highest ranked piece of equipment that could
have an effect on the BOP’s functionality and operation. The team identified 6 functional failures
that contributed to the failure of the Choke & Kill Lines & Valves - BOP Stack. The result of these
failure modes could potentially reduce or eliminate the associated equipment functionality and
possibly a loss of BOP operation.
xi
As identified above, the Blind Shear Ram is ranked as the second ranked piece of equipment whose
failure could potentially have a severe effect on the BOP’s overall ability to function properly when
demanded. Even though the occurrence of such a failure is identified as being fairly low (i.e., less
than one event every 5 years to one event every 10 years), the high severity and high detection (i.e.,
hard to detect) increase the risk of such a failure. Therefore the Blind Shear Ram is considered to be
the most critical piece of equipment that could lead to the loss of the primary function of the BOP. In
this study, “loss of primary function of the BOP” is defined as controlling the well.
The high severity rating in this case is attributed to the fact that the failure of the Blind Shear Ram
will diminish or eliminate the last protection for controlling the well (i.e. loss of primary function of
the BOP). The high detection rating is due to the low chance of discovering such a failure during
normal BOP operation. For example, mechanical failures might not be detected during normal BOP
operation and could only be discovered during a major preventive or planned maintenance. As
indicated in the above table, the Blind Shear Ram failure modes resulted in 18 functional failures that
could potentially result in the loss of BOP operation
According to the findings of this study, it appears that the highest critical failures are associated with
the detectability of these failures. A piece of equipment might function properly during a function
test or pressure test, but a hidden or dormant failure could occur because of the frequency of the test
or after the tests are conducted. Additionally, some failure modes simply cannot be detected during
normal testing and these types of failures may not be fully discovered until there is a real demand or
the equipment is pulled from the well and inspected during major preventive maintenance.
When comparing these highly ranked failure modes with the lower ranked failure modes, it is evident
that the rigorous MIT activities increase the detectability of the failures, therefore resulting in lower
criticality or RPN.
During the FMECA study, the causes of each failure mode were identified. Depending on the
equipment and the failure mode, components or other failure causes such as SEM communication,
bolts, seals, packing elements, insufficient volume, clogged lines, loss of signal, regulators, SPM
valves, shuttle valves, and filters were considered (see Appendix B for more detail). The team
identified and aligned the MIT activities for each failure mode and its causes.
The occurrence and detection rankings of the failure modes are a good indication of these facts.
After aligning the MIT activities with the failure modes, it was evident that there are sufficient
indication and detection factors in place for mitigating the failures or reducing the criticality.
xii
TABLE OF CONTENTS
Section Page
SUMMARY .......................................................................................................................................... v
LIST OF TABLES ............................................................................................................................. xv
LIST OF FIGURES ........................................................................................................................... xv
1.0 INTRODUCTION.................................................................................................................... 1
1.1 Objectives ............................................................................................................................... 1
1.2 Analysis Scope........................................................................................................................ 1
1.3 FMECA Team Members and Meeting Schedule.................................................................... 6
1.4 Report Organization................................................................................................................ 7
2.0 ANALYSIS METHODOLOGY ............................................................................................. 9
2.1 Analysis Approach.................................................................................................................. 9
2.2 Analysis Procedures.............................................................................................................. 11
2.2.1 Functional Level (Top-Down) FMECA ........................................................................ 11
2.2.2 Equipment Level (Bottom-Up) FMECA ........................................................................ 14
2.2.3 Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking) ...... 16
3.0 FMECA RESULTS ................................................................................................................ 21
4.0 CONCLUSIONS .................................................................................................................... 57
Appendix A – Functional-Level FMECA Tables .......................................................................... A-1
Appendix B – Equipment-Level FMECA Tables.......................................................................... B-1
Appendix C – All Data Sorted By RPN.......................................................................................... C-1
xiii
xiv
LIST OF TABLES
Table Description Page
S-1 Failure Modes with Highest RPN .......................................................................................... viii
1-1 Equipment-Level FMECA Major Component Boundaries ....................................................... 4
1-2 IP FMECA Team Members....................................................................................................... 6
1-3 ABS and ABS Consulting FMECA Team Members ................................................................ 6
2-1 Functions and Functional Failures........................................................................................... 13
2-2 General Equipment Failure Modes .......................................................................................... 15
2-3 Severity Ratings....................................................................................................................... 17
2-4 Occurrence Ratings ................................................................................................................. 19
2-5 Detection Ratings ........................................................................................................................... 20
3-1a Failure Modes with Highest RPN – Sorted by RPN ............................................................... 21
3-1b Failure Modes with Highest RPN – Sorted by Major Component/Subsystem ....................... 25
3-2 Failure Modes with Severity ≥ 10 ........................................................................................... 29
3-3 Failure Modes with Occurrence ≥ 5 ........................................................................................ 48
3-4 Failure Modes with Detection ≥ 6 ........................................................................................... 49
3-5 Failure Modes with S = 10, O ≥ 4, and D ≤ 5 ......................................................................... 53
3-6 Functional Failures with Highest Average RPN ..................................................................... 54
3-7 Functional Failures with Greatest Occurrences Due to Equipment Failures........................... 55
LIST OF FIGURES
Figure Description Page
2-1 General FMECA Approach ..................................................................................................... 10
2-2 Functional-level FMECA Procedure ....................................................................................... 12
2-3 FMECA Bottom-up Procedures .............................................................................................. 15
xv
xvi
LIST OF ACRONYMS
ABS — American Bureau of Shipping

ABS Consulting — ABSG Consulting Inc.
API — American Petroleum Institute
BSEE — Bureau of Safety and Environmental Enforcement
BOP — Blowout Preventer
EDS — Emergency Disconnect System
FMECA — Failure Mode, Effect, and Criticality Analysis
HPU — Hydraulic Power Unit
IP — Industry Participant
MIT — Maintenance, Inspection, and Testing
MUX — Multiplex
LMRP — Lower Marine-Riser Package
OEM — Original Equipment Manufacturer
ROV — Remote Operated Vehicle
RP — Recommended Practices
RPN — Risk Priority Number
xvii
xviii
1.0 INTRODUCTION
As part of the Blowout Preventer (BOP) Maintenance and Inspection for Deepwater Operations study
(Bureau of Safety and Environmental Enforcement [BSEE] contract number M11PC00027),
American Bureau of Shipping (ABS) and ABSG Consulting Inc. (ABS Consulting) performed a
Failure Mode, Effect and Criticality Analysis on specific BOP subsystems and equipment. This
report represents the first draft Failure Mode, Effect, and Criticality Analysis (FMECA) deliverable
of the study associated with Task 6.2.2.1 as outlined in the contract.
Three FMECAs were performed with three different analysis teams. Each analysis team included
personnel from a BOP original equipment manufacturer (OEM), drilling contractor, and an operator,
with the condition that these three industry participants (IPs) have a working relationship and operate
a drilling rig using the BOP equipment manufactured by the OEM participating in the FMECA
sessions.
This report presents the objective and scope of the FMECA study, FMECA methodology and
worksheets and the results of the functional- and equipment-level FMECAs that were conducted on a
Class VII BOP with six rams and one annular. This section details the FMECA objectives, scope, and
analysis team participants.
1.1 OBJECTIVES
The objectives of the FMECA were to (1) establish the relationship between a specific
subsystem/equipment failure and a loss of system functionality, (2) identify the critical failures by
using risk-ranking methods, and (3) align the current maintenance, inspection, and testing (MIT)
practices and their associated frequencies with each functional failure and the associated subsystem
and equipment failures.
1.2 ANALYSIS SCOPE

The scope of this effort was the analysis of a selected BOP and associated equipment from one of the
OEMs, drilling contractors and operators participating in the study that meets the following criteria:
 Operation Location – Gulf of Mexico (majority of the operation and maintenance to be from
the Gulf of Mexico)
 Operating Depth – 5,000 Feet and Deeper
 BOP Configurations:
o Class VI BOP, five ram configuration and single annular or a four ram and dual annular
o Class VII BOP, five ram configuration and dual annular or a six ram and single annular
o Class VIII BOP, six ram configuration and dual annular(ram configurations can consist
of a combination of blind/shear ram, non-sealing casing ram and pipe ram preventers)
1
Class VI BOP Class VII BOP Class VIII BOP
The analysis included the compilation of information from IPs, followed by the review and analysis
of the selected BOP and associated control systems used by the driller.
The analytical scope for the functional-level FMECA consisted for the evaluation of the eight BOP
functions specified in American Petroleum Institute (API) recommended practices (RP) 53 Standard,
Section 7.1.3, and the additional functions identified by the analysis team. During the FMECA
session, it was determined that the “shear the drill pipe and seal the wellbore” function needed to be
broken down into three functions based on differing operating condition/logic. A total of 11 major
BOP functions and 52 functional failures were identified and agreed upon. The following BOP
functions were evaluated in this study:
1. Close and seal on the drill pipe and allow circulation on demand.
2. Close and seal on open hole and allow volumetric well control operations on demand.
3. Strip the drill string using the annular BOP(s).
4. Hang-off the drill pipe on a ram BOP and control the wellbore.
5. Controlled operation – Shear the drill pipe and seal the wellbore.
6. Emergency operation – Auto-Shear – Shear the drill pipe and seal the wellbore.
7. Emergency operation – Emergency Disconnect System (EDS) – Shear the drill pipe and seal
the wellbore.
8. Disconnect the Lower Marine-Riser Package (LMRP)/BOP.
9. Circulate the well after drill pipe disconnect.
10. Circulate across the BOP stack to remove trapped gas.
11. Connect BOP and LMRP at Landing (not included in API RP 53 Standard).
2
For the equipment-level FMECA, the BOP was divided into 3 major BOP subsystems and 21 major
equipment items. The following represents the selected functions and BOP systems/equipment for
the FMECA assessment:
1. Surface Control System

1.1. Hydraulic Power Unit
1.2. Power
1.3. Multiplex System and Communication Cables
1.4. Hydraulic Supply
1.5. Control Panels
1.6. Accumulators – Surface
1.7. Fluid Reservoir Unit
1.8. Secondary and Emergency Control System
2. Subsea Control System
2.1. Blue and Yellow Control Systems – Electrical
2.2. Blue and Yellow Control Systems – Hydraulic
2.3. Accumulators – Subsea
2.4. Emergency Control Systems (ECS)
2.5. Hydraulic Supply: Rigid Conduit and Manifold
3. BOP Stack
3.1. Annulars
3.2. Blind Shear Ram
3.3. Shear Ram (Casing)
3.4. Pipe and Test Rams
3.5. Choke and Kill Lines and Valves
3.6. Connectors
3.7. Autoshear System
3.8. Remote operated vehicle (ROV) Intervention Interface
In addition, boundaries were established for each major equipment item to identify all of the specific
components to be included with each major equipment item. Table 1-1 lists the boundaries used in
this specific analysis.
3
Table 1-1: Equipment-Level FMECA Major Component Boundaries
Specific Components Included With Major
Major Component
Component Boundary
Surface Control System
Hydraulic Power Unit (HPU) HPU including three HPU pumps and associated piping
and regulators
Power Power including Blue & Yellow Power Distribution
Panels, Power Isolation J-box; Blue & Yellow UPSs,
Blue & Yellow Subsea Transformers, and blue and
yellow distribution panels, umbilical J-box; and
connections to associated cabinets and equipment (e.g.,
MUX, control panels)
Multiplex (MUX) System MUX System, including Central Control Unit with
Communication Cables process array, blue & yellow processor array, and
associated equipment and cabinets; MUX cable reels and
MUX cables (to connections with Blue & Yellow Pods)
Hydraulic Supply Hydraulic Supply including blue & yellow hotline reels,
hotline hoses (to connection at Blue & Yellow Pods) and
rigid conduit (to connection with subsea accumulator
system)
Control Panels Control Panels including driller’s panel with system
controller and tool pusher’s panel with system controller
Accumulators – Surface Accumulators - Surface including one 300 gallon, 5K
rack; one 180 gallon 5K accumulator rack and
associated ball valve; and connectors to HPU
Fluid Reservoir Unit Fluid Reservoir Unit, including 650 gallon. glycol, 550
gallon concentrate, and 1350 gallon mixed fluid
reservoirs; glycol, concentrate, and mixed fluid pumps;
and associated piping, and mixing system
Secondary & Emergency Control Secondary & Emergency Control Units with process
Systems array, blue & yellow processor array, and associated
equipment and cabinets; MUX cable reels and MUX
cables, UPS
Subsea Control System
Blue & Yellow Control Systems – Blue & Yellow Control Systems including MUX
Electrical control, MUX POD power & communication, hydraulic
connections within the pod
Blue & Yellow Control Systems – Blue & Yellow Control Systems , E/H section
Hydraulics (hydraulics, power, communication, SEM interface,
pressure, temperature, and water sensors, transformer,
pod cabling, solenoid boards, solenoids)
4
Table 1-1: Equipment-Level FMECA Major Component Boundaries (cont’d)
Specific Components Included With Major
Major Component
Component Boundary
Accumulators – Subsea Accumulators - Subsea including associated hydraulic
piping and connections such as MUX pod and rigid
conduit connections, 16x 80gallon bottles
EDS Secondary & Emergency Control Systems - Subsea
including POD angle sensor, inclinometer, acoustic, and
deadman
Hydraulic Supply, Rigid Conduit, and Lower Valve Section including regulators and SPM
Manifold valves to the shuttle valve, Rigid conduit, crossover
BOP Stack
Annulars Blowout preventer that uses a shaped elastomeric sealing
element to seal the space between the tubular and the
wellbore or an open hole, including both lower and
upper annulars and hydraulic supply
Blind Shear Ram Ram BOP whose Ram Blocks incorporate a cutting
blade to shear the pipe and sealing elements to contain
well bore pressure upon shearing of the pipe, including
hydraulic supply
Shear Ram Ram BOP whose Ram Blocks incorporate a cutting
blade to cut casing and/or heavier grade tubulars within a
specific range. They do not seal the well bore.
Pipe & Test Rams Pipe Ram: A closing and sealing component in a ram
blowout preventer that seals around the outside diameter
of a tubular in the wellbore. Test Ram: A Variable Bore
Ram located in the lower most Ram Cavity with ram
block installed in inverted position to seal pressure from
the top and enable testing of the BOP Stack without
running a Test Tool.
Choke & Kill Lines & Valves Valves and pipes assembly enabling communication to
or from the well bore to the surface C&K manifold to
circulate well, control kicks or kill well. Choke & Kill
Lines & Valves on both LMRP & Stack.
Connectors Connectors at Wellhead and LMRP/BOP Stack and
Hydraulic Actuators
Autoshear System Autoshear trigger valve, SPM valve
ROV Intervention Interface Shuttle valve, piping
5
1.3 FMECA TEAM MEMBERS AND MEETING SCHEDULE
The analysis team for this study included personnel from three IPs, ABS, and ABS Consulting. The
IPs participating included one or more representatives from an OEM, drilling contractor, and
operator. These individuals provided knowledge of the design, engineering, operation, and
maintenance of the BOP being evaluated. Table 1-2 lists the functional positions for the IP personnel
who participated in this study.
Table 1-2: IP FMECA Team Members

IP Organization Position/Expertise
BOP OEM Engineering Manager, Drilling Products
Manager, Reliability Engineering/Drilling and Production
Electrical Engineering Manager, Drilling and Production
Sub Section Manager, Stacks, Mechanical Controls and
Risers
Drilling Contractor Director, Subsea Operation Manager
Operator Well Technology
In addition to the IP representatives, personnel from ABS and ABS Consulting participated in the
FMECA sessions. Specifically, ABS personnel provided knowledge of the overall BOP operations
and class society and regulatory requirements applicable to BOP design and operation.
ABS Consulting personnel facilitated and documented the FMECA study. Table 1-3 lists the ABS
and ABS Consulting personnel participating in this study.
Table 1-3: ABS and ABS Consulting FMECA Team Members

Name Organization Title Study Role
David Cherbonnier ABS Staff Consultant, Subsea Engineer
Corporate Offshore
Technology
Randy Montgomery ABS Consulting Senior Director, Integrity Project Technical
Management Lead
Farzin Nouri ABS Consulting Senior Risk and Reliability Workshop Facilitator
Engineer
Philip Howard ABS Consulting Lead Engineer Workshop Scribe
To prepare for the FMECA studies, ABS and ABS Consulting held a FMECA kickoff meeting with
the IPs on December 6 and 7, 2011. The purposes of the kickoff meeting were to discuss the FMECA
analysis approach and the analysis scope to help ensure that all participants have the same level of
understanding of the FMECA procedures.
The functional-level FMECA study was conducted by the analysis team during sessions held on
September 18 through 20, 2012. During this meeting, the analysis team members were provided an
introduction to FMECA methodology and procedures and then performed the functional-level
FMECA. The equipment-level FMECA was conducted during sessions held on October 1 through 5,
2012.
6
1.4 REPORT ORGANIZATION
Section 2 of this report provides an overview of the methodology used to analyze the BOP’s selected
functions and equipment to determine the critical failure modes and their effects. Section 3 discusses
the results of the effort. Appendix A contains the functional-level FMECA worksheets and
Appendix B contains the equipment-level FMECA worksheets.
7
8
2.0 ANALYSIS METHODOLOGY
In order to evaluate BOP MIT practices, reduce the risk of failures and improve the reliability of
BOP performance, it is essential to identify the BOP’s critical failure modes and their effects.
Therefore, ABS and ABS Consulting selected and employed both functional- and equipment-level
FMECA methodologies to evaluate BOP functions and identify specific subsystem and equipment
failures of interest as outlined in Section 1.2, Analysis Scope.
This analysis methodology was chosen because it provided a means to establish a relationship among
(1) BOP functions, (2) BOP equipment failures, and (3) BOP MIT practices by
 Identifying the potential effects resulting from deviations to BOP functions (i.e., functional
failures) and equipment-level failure modes causing the BOP functional failures.
 Identifying the potential functional failures resulting from BOP equipment failure modes and
specific equipment failures causing the BOP equipment failure modes.
 Linking specific equipment failures to BOP functional failures.
 Identifying and aligning the MIT activities (Indication / Protection / Maintenance) currently
provided for preventing specific equipment failures resulting in BOP functional failures and
their potential end effects.
 Risk-ranking the equipment-level failure modes.
2.1 ANALYSIS APPROACH

FMECA is an inductive reasoning approach that (1) considers how the functional failures of each
system function or the failure modes of each component could result in system performance
problems and (2) helps evaluate safeguards that are in place (including engineered protections &
monitoring systems, human actions, and maintenance activities) to prevent, detect or mitigate such
problems. The main focus of a FMECA is to establish the cause-and-effect relationship between
potential equipment failures, functional failures, and the end effect of those failures, and to evaluate
the criticality of the postulated functional failure/failure mode.
Figure 2-1 represents the general FMECA steps used in evaluating the BOP system. Specifically, this
study employed both functional- and equipment-level FMECA approaches (see Step 3) with the
explicit purpose of transitioning the functional-level FMECA to a more detailed level to better ensure
the alignment of MIT activities with specific equipment failures and link the specific equipment
failures with their potential impact of BOP performance via functional failures. This FMECA
approach is very similar to the approach employed in many classical reliability-centered maintenance
approaches, which have the overall objective of determining the optimal maintenance strategy for
preserving system functionality via detection and prevention of equipment failures.
9
Figure 2-1. General FMECA Approach
10
2.2 ANALYSIS PROCEDURES
This section summarizes the procedures and specific tools used in performing the functional- and
equipment-level FMECAs. In addition, the risk priority number approach that was used to risk rank
the functional failure effects and equipment failure mode pairs has been provided. More explanation
on the ranking method is given in Section 2.2.3.
2.2.1 Functional Level (Top-Down) FMECA

The functional-level FMECA was performed by analyzing each function and its associated functional
failures. The functional-level FMECA process is illustrated in Figure 2-2. In executing this
procedure, the following operating modes were applied:
 Normal Drilling
 Kick Control
 Emergency Operation (e.g., disconnect)
 Riding the Storm
In addition, the following are consequences of interest for identifying end effects of interest during
the functional-level FMECA:
 Safety Effects
o Inability to Control or Correct a Well Kick (or other BOP function)
o Potential Release of Hydrocarbon to the Atmosphere Resulting in Potential Fire,
Explosion, and/or Exposure to Toxic Materials Causing Injury or Worse
 Environmental Effects
o Inability to Control or Correct a Well Kick (or other BOP function)
o Potential Release of Hydrocarbons to the environment resulting in a Minor, Significant,
Small (<1,000 bbls), Medium (1,000 to 10,000 bbl.), or Large (>10,000 bbl.)
Spill/Atmospheric Release
 Significant Downtime
o Failures Requiring Pulling of the LMRP or BOP Stack
o Downtime Exceeding 5 Days
In evaluating potential end effects, the team evaluated the severities based on worst-case end effects
assuming that available safeguards do not prevent or mitigate the end effects. Therefore, the end
effects represent the potential severity and conservatively overstate the expected consequences.
11
Figure 2-2. Functional-level FMECA Procedure
Specifically during the functional-level FMECA, the analysis team evaluated 11 BOP functions and
48 associated functional failures. Table 2-1 list the functions and functional failures evaluated.
During the functional-level FMECA workshop, the analysis team evaluated each of the
above-mentioned functions and functional failures in detail by identifying (1) the potential end
effects resulting from the functional failures, (2) the equipment-level causes and failure modes
resulting in each potential functional failure, and (3) the safeguards used to prevent or detect the
potential functional failure and its associated equipment-level causes. These evaluations were
recorded in tabular format using the Enterprise LEADER software. The equipment-level causes and
failure modes were then studied in detail during the equipment-level FMECA workshop.
12
Table 2-1: Functions and Functional Failures
No. Function Functional Failure Modes
1 Close and seal on the drill pipe and allow Failure to close on drill pipe through annular(s)
circulation on demand Failure to close on drill pipe through pipe rams
Failure to seal or partial seal on drill pipe
through annular(s)
Failure to seal or partial seal on drill pipe
through pipe rams
Unintentional closing / opening
Failure to open/close fail-safe valves to seal
Closes too slowly
Loss of containment
2 Close and seal on open hole and allow Failure to close on open hole through blind-
volumetric well control operations on shear rams or annular
demand Unintentional closing / opening
Failure to open/close fail-safe valves
Closes too slowly
Loss of containment
3 Strip the drill string using the annular Failure to close annulars
BOP(s) Failure to maintain stripping pressure
Failure to seal
4 Hang-off the drill pipe on a ram BOP Failure of hang-off ram to close
and control the wellbore Failure to maintain closing pressure
Failure to maintain locking
5 Controlled Operation-Shear the drill pipe Failure to close
and seal the wellbore Failure to shear the drill pipe
Failure to seal the wellbore
Closes too slowly
Loss of containment
6 Emergency Operation-Auto shear- Shear Failure to arm
the drill pipe and seal the wellbore Failure to close
Failure to shear the drill pipe
Failure to seal the wellbore
Closes too slowly
Loss of containment
7 Emergency Operation: EDS - Disconnect Failure to receive EDS signal
from the stack Failure to disconnect the LMRP
Unintentional disconnect from riser
8 Controlled Operation - Disconnect the Failure to disconnect the LMRP
LMRP from the Lower BOP stack Unintentional disconnect of the LMRP
13
Table 2-1: Functions and Functional Failures (cont’d)
No. Function Functional Failure Modes
9 Circulate the well after drill pipe Failure to circulate
disconnect Failure to circulate at desired flow rate
Failure to open/close fail-safe valves
Failure to seal wellbore after drill pipe
disconnect
Loss of containment
10 Circulate across the BOP stack to Failure to circulate
remove trapped gas Failure to circulate at desired flow rate
Failure to open/close fail-safe valves to seal
Loss of containment
11 Connect BOP and LMRP at landing Inadequate BOP connection
Inadequate LMRP connection
2.2.2 Equipment Level (Bottom-Up) FMECA

The equipment-level FMECA was performed by analyzing each major component with its associated
sub-components using equipment-level failure modes. Figure 2-3 outlines the equipment-level
FMECA process.
The analysis team evaluated the 20 major equipment items and their associated sub-components
listed in Table 1-1.
To evaluate each equipment item, a list of the general failure modes was developed during the
FMECA kick-off meeting and is provided in Table 2-2. During the equipment-level FMECA, the
analysis team modified these general equipment failure modes to describe the means in which each
major component can fail.
14
Figure 2-3. FMECA Bottom-up Procedures
Table 2-2: General Equipment Failure Modes

Mechanical Failures Electrical/Electronic Failure
External leak/rupture Loss of, or degraded power
Internal leak Fails with no output signal/no
communication
Plugged Fails with low or high output signal
Mechanical failure (e.g., fracture, galling, fatigue) Erratic output
Corrosion/erosion Fails to respond to input
Wear/mechanical damage Processing error (e.g., calculation error,
sequence error)
Loss of function (general) Short
Loss of hydraulic power Loss of function (general)
15
Once a major component’s failure modes were identified, the analysis team evaluated each
equipment-level failure mode by:
1. Postulating on specific equipment causes resulting in the failure mode and

2. Then identifying the potential effects resulting from each failure mode.
The equipment-level effects were identified as BOP functional failures and then electronically linked
in Enterprise LEADER to establish the relationship between specific equipment-level failure modes
and BOP functions. Once these links were established, the analysis team identified any safeguards
that are currently in place to prevent or detect or mitigate the failure mode before the end effects
associated with the BOP functional failure are realized. Next, the analysis team identified specific
MIT practices currently employed to prevent or detect the specific equipment causes. These
evaluations, along with criticality rankings described below, were recorded in tabular format using
the Enterprise LEADER software.
2.2.3 Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking)

To provide a consistent means to evaluate the relative criticality of BOP subsystem/component
failures and to help judge the sufficiency of MIT activities performed to prevent and detect the
failures, a risk priority number ranking scheme based the following factors was employed:
 Frequency of Failure of the Major Equipment Failure Mode

 Level of Redundancy to Prevent Specific Failure from Resulting in Complete Loss of Safety
Critical Functions
 Ability to Detect and Prevent the Failure Mode via MIT Practices (Indication / Protection /
Maintenance column in Appendix B)
 Severity of End Effect for Each BOP Functional Failure
A Risk Priority Number (RPN) ranking for each functional failure associated with an equipment-
level failure mode was based on the product of the following three independent factors:
 Severity Rating – This rating assesses the severity of worst-case end effect for a given
functional failure. (Note: The functional failure end effects documented in the functional-
level FMECA were used to determine this rating assuming no redundancies are present.)
 Occurrence Rating – This rating assesses the likelihood of the failure mode resulting in the
functional failure and its stated end effect. This rating takes into consideration any safeguards
that are in place to detect, prevent or mitigate the failure mode from resulting in the
functional failure. These are the Protection (P) items in the Indication / Protection /
Maintenance column of Appendix B. The presence of redundant components and systems is
explicitly considered in this rating.
16
 Detection Rating – This rating assesses the likelihood of the current applicable inspection and
maintenance activities to detect the failure mode before it results in the functional failure.
These ratings are based on the Indication (I) and Maintenance (M) items from the Indication /
Protection / Maintenance column of Appendix B.
The severity, occurrence, and detection ratings are provided in Tables 2-3 through 2-5, respectively.
These ratings were then used to calculate a single RPN ranking for each functional failure effect and
equipment failure mode pair (i.e., RPN ranking for each functional failure associated with an
equipment-level failure mode) using the following equation:
RPN = Severity Rating X Occurrence Rating X Detection Rating
The individual RPN rankings provide a relative ranking of the risk associated with a given functional
failure effect-equipment failure mode pair. Thereby, providing a means to identify the most critical
equipment-level failure modes in overall BOP performance, as well as, identifying the more critical
failure modes associated with a specific BOP functional failure.
Table 2-3: Severity Ratings

Severity
Significance Personnel Environment Down Time
Rank
Does not affect BOP No impact No impact No downtime, repair can
1 functionality; no impact on be done while drilling
safety and environment. continues.
Does not affect BOP No impact No impact No downtime, repair can
functionality but needs to be be done at next
2
corrected; no impact on opportunity, drilling
safety and environment. continues.
Partial loss of BOP No impact No impact Downtime of less than a
3 function; no loss of well shift, stop drilling,
control. intervene and repair.
Partial loss of BOP No impact No impact Downtime between a
function; no loss of well shift and 24 hours, stop
4
control. drilling, intervene and
repair.
Partial loss of BOP primary No impact No impact Downtime between 1 and
function if not corrected 7 days - stop drilling,
5
immediately. intervene and repair
(surface only).
17
Table 2-3: Severity Ratings (cont’d)
Severity
Significance Personnel Environment Down Time
Rank
Partial loss of BOP primary Minor Minor Downtime between 8 and
function if not corrected Injury; no external 21 days - stop drilling,
immediately. recordable subsea leak intervene and repair
6
lost time (e.g., C&K (surface only).
connector
leak)
Loss of BOP primary Minor Significant Pulling LMRP only.
function. Injury; external
some lost subsea leak
7
time. (e.g., major
connector
leak)
Loss of BOP primary Serious <1000 BBL Pulling LMRP/BOP
function. Injury; stack.
8
significant
lost time.
Loss of BOP primary Single >1000BBL Shut down of operations;
function. Fatality; drilling stopped and
multiple major regulatory
9
serious implications; changes to
injuries. drilling schedule > 3
months.
Loss of BOP primary Multiple >10,000BBL Shut down of operations;
function. fatalities and severe drilling stopped and
and environmen- major regulatory
10
injuries. tal damage implications; total loss of
over a large asset.
area.
18
Table 2-4: Occurrence Ratings
Occurrence
Frequency/Rig Yr. Occurrence
Ratings
10 >50+ events/ rig yr. Once a week or more often
<50 events /rig yr. to 10 events /rig Less than once a week to once a month
9
yr.
8 <10 events /rig yr. to 4 events /rig yr. Less than once a month to once a quarter
7 <4 events /rig yr. to 2 events /yr. Less than once a quarter to twice a year
6 <2 events /rig yr. to 1 event/yr. Less than twice a year to once a year
<1 event /rig yr. to 1 events every 2 Less than once a year to once every 2
5
years years
<1 event every 2 years to 1 event Less than once every 2 years to once
4
every 5 years every 5 years
<1 event every 5 years to 1 event Less than once every 5 years to once
3
every 10 years every 10 years
<1 event every 10 years to 1 event Less than once every 10 years to 10%
2
every 100 years chance every 10 years of operation
<1 event every 100 years Less than 1% chance every 10 years of
1
operation
19
Table 2-5: Detection Ratings
Detection
Detection Likelihood of Detection
Rating
Almost Certain Very high probability of detection (>90% probability of
detection) by design controls (redundant or independent self-
1
diagnostic capability, independent alarms) will certainly
detect failures
Very High High probability of detection (50 to 90% of detection) by
design controls (single device self-diagnostic capability,
2
single alarms, visual monitoring, leak monitoring, loss of
fluid etc.) will certainly detect failures
High Probability of detection via weekly on-stream
3 tests/inspections will provide immediate detection of the
failure
Moderately high Probability of detection via monthly on-stream
failure
Moderate Probability of detection via quarterly on-stream
failure
Low Can only be detected during routine inspections/tests while
6
the BOP is pulled from the well
Very Low Can only be detected during major PMs while the BOP is
7-8
pulled from the well
Remote Can only be detected and/or corrected during major overhaul
9
or rebuilding-type activities
Absolute Uncertainty Currently no design controls or maintenance techniques in
10
place
20
3.0 FMECA RESULTS
This section summarizes the results of the FMECA analysis—specifically, the results of the
functional-level and equipment-level FMECAs which are provided in tabular format in
Appendices A and B, respectively. These appendices also include a description of the FMECA table
information.
In addition to the tabular results provided in the above-mentioned appendices, the following tables
provide a more detailed look at the most critical failure modes based on the RPN rankings. Each of
the following tables presents the results against a specific set of criteria described below. The
complete data from which these tables have been derived is provided in Appendices C and D, which
are essentially a reformatted presentation of Appendix B. In each of the following tables, the shaded
column indicates the sorting order.
Table 3-1 presents the top 15% of failure modes with the highest RPN score. RPN scores from the
FMECA range from 6–160, with the top 15% ranging from 120–160. Tables 3-1a and 3-1b present
the same data but are sorted differently; Table 3-1a is sorted by RPN and Table 3-1b is sorted by
Major Equipment/Subsystem. Table 3-1 represents what are considered to be the most critical failure
modes. It should be noted that each failure mode may be associated with multiple effects/functional
failures as shown in the last column of the tables. Table 3-1b suggests that failures of the - Choke &
Kill lines & valves, Surface Accumulators, Blind Shear Ram and Casing Shear Ram are the most
dominant equipment of concern.
Table 3-1a: Failure Modes with Highest RPN – Sorted by RPN

Major # of Effects
Severity Occurrence Detection RPN
Component/ Failure Mode (Functional
(S) (O) (D) (SxOxD)
Subsystem Failures)
Choke & Kill
Lines &
Plugged 10 4 4 160 4
Valves - BOP
Stack
Blind Shear
External
Ram - BOP 9 5 3 135 1
Leak/Rupture
Stack
Blind Shear
Mechanical
Ram - BOP 9 5 3 135 1
Failure
Stack
Blind Shear
Ram - BOP Wear 9 5 3 135 1
Stack
Casing Shear
External
Ram - BOP 9 5 3 135 1
Leak/Rupture
Stack
21
Table 3-1a: Failure Modes with Highest RPN – Sorted by RPN (cont’d)
Major # of Effects
(S) (O) (D) (SxOxD)
Subsystem Failures)
Casing Shear
Mechanical
Ram - BOP 9 5 3 135 1
Failure
Stack
Casing Shear
Ram - BOP Wear 9 5 3 135 1
Stack
Choke & Kill
Lines & External
9 5 3 135 1
Valves - BOP Leak/Rupture
Stack
Choke & Kill
Lines & Mechanical
9 5 3 135 1
Valves - BOP Failure
Stack
Pipe & Test
External
Rams - BOP 9 5 3 135 1
Leak/Rupture
Stack
Pipe & Test
Mechanical
Rams - BOP 9 5 3 135 1
Failure
Stack
Autoshear Mechanical
System - Failure 9 2 7 126 1
BOP Stack
Blue & Corrosion/Erosion
Yellow
Control
Systems -
9 2 7 126 1
Hydraulics -
Subsea
Control
Systems
Blue & Mechanical
Yellow Failure
Control
Systems -
9 2 7 126 1
Hydraulics -
Subsea
Control
Systems
9 2 7 126 1
BOP Stack Failure
22
Major # of Effects
(S) (O) (D) (SxOxD)
Subsystem Failures)
Hydraulic Corrosion/Erosion
Supply: Rigid
Conduit and
Manifold - 9 2 7 126 1
Subsea
Control
Systems
Hydraulic Mechanical
Supply: Rigid Failure
Conduit and
Manifold - 9 2 7 126 1
Subsea
Control
Systems
Accumulators
- Subsea External
10 2 6 120 2
Control Leak/Rupture
Systems
Accumulators
- Subsea
Internal Leak 10 2 6 120 2
Control
Systems
Accumulators
- Subsea Loss of Function
10 2 6 120 2
Control (general)
Systems
Accumulators
- Subsea Mechanical
10 2 6 120 2
Control Failure
Systems
Accumulators
- Subsea
Wear 10 2 6 120 2
Control
Systems
Autoshear
Mechanical
System - 10 2 6 120 2
Failure
BOP Stack
Blind Shear
External
Ram - BOP 10 2 6 120 4
Leak/Rupture
Stack
23
Major # of Effects
(S) (O) (D) (SxOxD)
Subsystem Failures)
Blind Shear
Ram - BOP Wear 10 2 6 120 4
Stack
Blind Shear
Mechanical
Ram - BOP 10 2 6 120 3
Failure
Stack
Blind Shear
Ram - BOP Corrosion/Erosion 10 2 6 120 2
Stack
Blind Shear
Ram - BOP Internal Leak 10 2 6 120 2
Stack
Blue &
Yellow
Control
Systems -
Corrosion/Erosion 10 2 6 120 2
Hydraulics -
Subsea
Control
Systems
Blue &
Yellow
Control
Systems - External
10 2 6 120 2
Hydraulics - Leak/Rupture
Subsea
Control
Systems
Blue &
Yellow
Control
Systems -
Internal Leak 10 2 6 120 2
Hydraulics -
Subsea
Control
Systems
Blue &
Yellow
Control
10 2 6 120 2
Subsea
Control
Systems
24
Major # of Effects
(S) (O) (D) (SxOxD)
Subsystem Failures)
Blue &
Yellow
Control
Systems -
Plugged 10 2 6 120 2
Hydraulics -
Subsea
Control
Systems
Table 3-1b: Failure Modes with Highest RPN – Sorted by Major Component/Subsystem
Major # of Effects
Subsystem Failures)
Subsea Control Leak/ 10 2 6 120 2
Systems Rupture
Accumulators -
Internal
Leak
Systems
Accumulators -
Mechani-
cal Failure
Systems
Accumulators -
Systems
Subsea Control function 10 2 6 120 2
Systems (general)
Autoshear System Mechani-
9 2 7 126 1
- BOP Stack cal Failure
Blind Shear Ram External
- BOP Stack Leak/ 9 5 3 135 1
Rupture
Blind Shear Ram Mechani-
9 5 3 135 1
- BOP Stack cal Failure
Blind Shear Ram
Wear 9 5 3 135 1
- BOP Stack
External
Blind Shear Ram
Leak/ 10 4 2 120 4
- BOP Stack
Rupture
Blind Shear Ram
Wear 10 4 2 120 4
- BOP Stack
25
(cont’d)
Major # of Effects
Subsystem Failures)
Blue & Yellow
Control Systems -
Mechani-
Hydraulics - 9 2 7 126 1
cal Failure
Subsea Control
Systems
Blue & Yellow
Control Systems -
Erosion/
Corrosion
Subsea Control
Systems
Blue & Yellow
Control Systems -
Hydraulics - Plugged 10 2 6 120 2
Subsea Control
Systems
Blue & Yellow
Control Systems -
Mechani-
cal Failure
Subsea Control
Systems
Blue & Yellow
Control Systems -
Corrosion/
Erosion
Subsea Control
Systems
Ram - BOP Stack Leak/ 9 5 3 135 1
Rupture
Casing Shear Mechani-
9 5 3 135 1
Ram - BOP Stack cal Failure
Casing Shear
Wear 9 5 3 135 1
Ram - BOP Stack
Choke & Kill
Erratic
Lines & Valves - 10 4 4 160 4
output
BOP Stack
Lines & Valves - Leak/ 9 5 3 135 1
BOP Stack Rupture
Choke & Kill
Mechani-
Lines & Valves - 9 5 3 135 1
cal Failure
BOP Stack
26
(cont’d)
Major # of Effects
Subsystem Failures)
Connectors - Mechani-
9 2 7 126 1
BOP Stack cal Failure
Hydraulic
Supply: Rigid
Conduit and Mechani-
9 2 7 126 1
Manifold - cal Failure
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and Erosion/
9 2 7 126 1
Manifold - Corrosion
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and External
10 2 6 120 2
Manifold - Leak
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and Internal
10 2 6 120 2
Manifold - Leak
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Plugged 10 2 6 120 2
Manifold -
Subsea Control
Systems
27
(cont’d)
Major # of Effects
Subsystem Failures)
Hydraulic
Supply: Rigid
Conduit and Mechani-
10 2 6 120 2
Manifold - cal Failure
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and Erosion/
10 2 6 120 2
Manifold - Corrosion
Subsea Control
Systems
Rams - BOP Leak/ 9 5 3 135 1
Stack Rupture
Pipe & Test
Mechani-
Rams - BOP 9 5 3 135 1
cal Failure
Stack
Table 3-2 shows the equipment failure modes which could lead to the worst potential end effects.
These are the failure modes with a severity ranking greater than or equal to 10. Severity results from
this FMECA range from 2 – 10.
Table 3-2: Failure Modes with Severity ≥ 10

Major # of Effects
Subsystem Failures)
Choke & Kill
Lines &
Plugged 10 4 4 160 4
Valves - BOP
Stack
HPU -
External
Surface
Leak / 10 4 4 160 1
Control
Rupture
Systems
Blind Shear
Corrosion/
Ram - BOP 10 2 6 120 2
Erosion
Stack
28
Table 3-2: Failure Modes with Severity ≥ 10 (cont’d)
Major # of Effects
Subsystem Failures)
Blue &
Yellow
Control
10 2 6 120 2
Subsea
Control
Systems
Casing Shear
Corrosion/
Ram - BOP 10 2 6 120 2
Erosion
Stack
Hydraulic
Supply: Rigid
Conduit and
Corrosion/
Manifold - 10 2 6 120 2
Erosion
Subsea
Control
Systems
Blue &
Yellow
Control
External
Systems -
Leak/ 10 2 6 120 2
Hydraulics -
Rupture
Subsea
Control
Systems
Accumulators
External
- Subsea
Leak/ 10 2 6 120 2
Control
Rupture
Systems
Ram - BOP Leak/ 10 2 6 120 2
Stack Rupture
Ram - BOP Leak/ 10 4 3 120 2
Stack Rupture
Ram - BOP Leak/ 10 2 6 120 2
Stack Rupture
Choke & Kill
External
Lines &
Leak/ 10 4 3 120 2
Valves - BOP
Rupture
Stack
29
Major # of Effects
Subsystem Failures)
Choke & Kill
External
Lines &
Leak/ 10 4 3 120 1
Valves - BOP
Rupture
Stack
Hydraulic
Supply: Rigid
Manifold - Leak/ 10 2 6 120 2
Subsea Rupture
Control
Systems
Accumulators
- Subsea Internal
10 2 6 120 2
Control Leak
Systems
Blind Shear
Internal
Ram - BOP 10 2 6 120 2
Leak
Stack
Blue &
Yellow
Control
Systems - Internal
10 2 6 120 2
Hydraulics - Leak
Subsea
Control
Systems
Casing Shear
Internal
Ram - BOP 10 2 6 120 2
Leak
Stack
Choke & Kill
Lines & Internal
10 4 3 120 1
Valves - BOP Leak
Stack
Hydraulic
Supply: Rigid
Conduit and
Manifold - Internal leak 10 2 6 120 1
Subsea
Control
Systems
Accumulators
Loss of
- Subsea
Function 10 2 6 120 2
Control
(general)
Systems
30
Major # of Effects
Subsystem Failures)
Hydraulic
Supply - Loss of
Surface Function 10 2 6 120 2
Control (general)
Systems
Accumulators
- Subsea Mechanical
10 2 6 120 2
Control Failure
Systems
Autoshear
Mechanical
System - BOP 10 2 6 120 2
Failure
Stack
Blind Shear
Mechanical
Ram - BOP 10 2 6 120 3
Failure
Stack
Blue &
Yellow
Control
10 2 6 120 2
Subsea
Control
Systems
Casing Shear
Mechanical
Ram - BOP 10 2 6 120 2
Failure
Stack
Casing Shear
Mechanical
Ram - BOP 10 4 3 120 2
Failure
Stack
Choke & Kill
Lines & Mechanical
10 4 3 120 2
Stack
Hydraulic
Supply: Rigid
Conduit and
Mechanical
Manifold - 10 2 6 120 2
Failure
Subsea
Control
Systems
31
3-2: Failure Modes with Severity ≥ 10 (cont’d)
Major # of Effects
Subsystem Failures)
Blue &
Yellow
Control
Systems -
Plugged 10 2 6 120 2
Hydraulics -
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Manifold - Plugged 10 2 6 120 2
Subsea
Control
Systems
Accumulators
- Subsea
Wear 10 2 6 120 2
Control
Systems
Blind Shear
Ram - BOP Wear 10 2 6 120 2
Stack
Blind Shear
Ram - BOP Wear 10 4 3 120 1
Stack
Blue &
Yellow
Control
10 2 6 120 1
Subsea
Control
Systems
Blue &
Yellow
Control
10 2 6 120 1
Subsea
Control
Systems
Casing Shear
Mechanical
Ram - BOP 10 2 6 120 2
Failure
Stack
32
3-2: Failure Modes with Severity ≥ 10 (cont’d)
Major # of Effects
Subsystem Failures)
Casing Shear
Mechanical
Ram - BOP 10 4 3 120 2
Failure
Stack
Choke & Kill
Lines & Mechanical
10 4 3 120 2
Stack
Hydraulic
Supply: Rigid
Conduit and
Mechanical
Manifold - 10 2 6 120 2
Failure
Subsea
Control
Systems
Casing Shear
Mechanical
Ram - BOP 10 4 3 120 2
Failure
Stack
Choke & Kill
Lines & Mechanical
10 4 3 120 2
Stack
Hydraulic
Supply: Rigid
Conduit and
Mechanical
Manifold - 10 2 6 120 2
Failure
Subsea
Control
Systems
Blue &
Yellow
Control
Systems -
Plugged 10 2 6 120 2
Hydraulics -
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
33
Major # of Effects
Subsystem Failures)
Accumulators
- Subsea
Wear 10 2 6 120 2
Control
Systems
Blind Shear
Ram - BOP Wear 10 2 6 120 2
Stack
Casing Shear
Ram - BOP Wear 10 2 6 120 4
Stack
Choke & Kill
Lines &
Wear 10 4 3 120 2
Valves - BOP
Stack
Choke & Kill
External
Lines &
Leak/ 10 3 3 90 1
Valves - BOP
Rupture
Stack
Choke & Kill
Lines & Internal
10 3 3 90 1
Valves - BOP Leak
Stack
HPU -
Surface Internal
10 3 3 90 5
Control Leak
Systems
HPU -
Surface
Plugged 10 3 3 90 4
Control
Systems
Choke & Kill
Lines &
Wear 10 3 3 90 4
Valves - BOP
Stack
Choke & Kill
External
Lines &
Leak/ 10 4 2 80 1
Valves - BOP
Rupture
Stack
Choke & Kill
Lines & Internal
10 4 2 80 1
Valves - BOP Leak
Stack
34
Major # of Effects
Subsystem Failures)
HPU -
Surface Mechanical
10 4 2 80 4
Control Failure
Systems
Choke & Kill
Lines &
Wear 10 4 2 80 1
Valves - BOP
Stack
Choke & Kill
External
Lines &
Leak/ 10 4 2 80 1
Valves - BOP
Rupture
Stack
HPU -
External
Surface
Leak/ 10 3 2 60 6
Control
Rupture
Systems
HPU -
Loss of
Surface
function 10 3 2 60 6
Control
(general)
Systems
Blue &
Yellow
Control
10 2 2 40 1
Subsea
Control
Systems
Blue &
Yellow
Control
External
Systems -
Leak / 10 2 2 40 2
Hydraulics -
Rupture
Subsea
Control
Systems
External
Annulars -
Leak/ 10 2 2 40 11
BOP Stack
Rupture
Ram - BOP Leak/ 10 2 2 40 3
Stack Rupture
35
Major # of Effects
Subsystem Failures)
Ram - BOP Leak/ 10 2 2 40 1
Stack Rupture
Choke & Kill
External
Lines &
Leak/ 10 2 2 40 1
Valves - BOP
Rupture
Stack
Hydraulic
Supply - External
Surface Leak/ 10 4 1 40 1
Control Rupture
Systems
Annulars - Internal
10 2 2 40 1
BOP Stack Leak
Blind Shear
Internal
Ram - BOP 10 2 2 40 1
Leak
Stack
Blue &
Yellow
Control
Systems - Internal
10 2 2 40 1
Hydraulics - Leak
Subsea
Control
Systems
Connectors - Internal
10 2 2 40 1
BOP Stack Leak
Hydraulic
Supply - Loss of
Control (general)
Systems
Annulars - Mechanical
10 2 2 40 1
BOP Stack Failure
Blind Shear
Mechanical
Ram - BOP 10 2 2 40 3
Failure
Stack
36
Major # of Effects
Subsystem Failures)
Blue &
Yellow
Control
10 2 2 40 1
Subsea
Control
Systems
Casing Shear
Mechanical
Ram - BOP 10 2 2 40 1
Failure
Stack
Blue &
Yellow
Control
Systems -
Plugged 10 2 2 40 1
Hydraulics -
Subsea
Control
Systems
Blind Shear
Ram - BOP Wear 10 2 2 40 3
Stack
Casing Shear
Ram - BOP Wear 10 2 2 40 1
Stack
Choke & Kill
Lines &
Wear 10 2 2 40 1
Valves - BOP
Stack
Blue &
Yellow
Control
External
Systems -
Leak / 10 3 1 30 1
Hydraulics -
Rupture
Subsea
Control
Systems
Autoshear External
System - BOP Leak/ 10 3 1 30 1
Stack Rupture
37
Major # of Effects
Subsystem Failures)
Choke & Kill
External
Lines &
Leak/ 10 3 1 30 2
Valves - BOP
Rupture
Stack
HPU -
External
Surface
Leak/ 10 3 1 30 1
Control
Rupture
Systems
Hydraulic
Supply: Rigid
Manifold - leak/ 10 3 1 30 2
Subsea Rupture
Control
Systems
Autoshear
Internal
System - BOP 10 3 1 30 1
Leak
Stack
Autoshear
Mechanical
System - BOP 10 3 1 30 1
Failure
Stack
Blue &
Yellow
Control
10 2 1 20 2
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Corrosion/
Manifold - 10 1 2 20 1
Erosion
Subsea
Control
Systems
Blue &
Yellow
Control
Systems - Erratic
10 2 1 20 3
Electrical - output
Subsea
Control
Systems
38
Major # of Effects
Subsystem Failures)
Control
Panels -
Erratic
Surface 10 2 1 20 3
output
Control
Systems
EDS - Subsea
Erratic
Control 10 2 1 20 2
output
Systems
MUX System
Erratic
- Surface
output 10 2 1 20 3
Control
(Network)
Systems
Blue &
Yellow
Control
External
Systems -
Leak / 10 2 1 20 2
Hydraulics -
Rupture
Subsea
Control
Systems
Accumulators
External
- Subsea
Leak/ 10 2 1 20 2
Control
Rupture
Systems
Choke & Kill
External
Lines &
Leak/ 10 2 1 20 1
Valves - BOP
Rupture
Stack
External
Connectors -
Leak/ 10 1 2 20 1
BOP Stack
Rupture
Fluid
Reservoir External
Unit - Surface Leak/ 10 1 2 20 1
Control Rupture
Systems
Hydraulic
Supply: Rigid
Conduit and
External
Manifold - 10 2 1 20 2
leak/rupture
Subsea
Control
Systems
39
Major # of Effects
Subsystem Failures)
Fails to
Control respond
Panels - (with no
Surface output 10 2 1 20 6
Control signal/com-
Systems munication
or to input)
EDS - Subsea Fails to
Control respond to 10 2 1 20 2
Systems input
MUX System
Fails to
- Surface
respond to 10 2 1 20 3
Control
input
Systems
Blue &
Yellow
Control Fails to
Systems - respond to
10 2 1 20 3
Electrical - input -
Subsea Electrical
Control
Systems
Blue &
Yellow
Control Fails with no
Systems - output
10 2 1 20 3
Electrical - signal/com-
Subsea munication
Control
Systems
Fails with no
EDS - Subsea
output
Control 10 2 1 20 2
signal/com-
Systems
munication
MUX System Fails with no
- Surface output
10 2 1 20 3
Control signal/com-
Systems munication
40
Major # of Effects
Subsystem Failures)
Secondary &
Fails with no
Emergency
output
Control
signal/com-
Systems - 10 2 1 20 3
munication
Surface
(Includes
Control
Short)
Systems
Accumulators
- Subsea Internal
10 2 1 20 3
Control Leak
Systems
Annulars - Internal
10 2 1 20 7
BOP Stack Leak
Blue &
Yellow
Control
Systems - Internal
10 2 1 20 3
Hydraulics - Leak
Subsea
Control
Systems
Choke & Kill
Lines & Internal
10 2 1 20 1
Valves - BOP Leak
Stack
10 2 1 20 1
BOP Stack Leak
Hydraulic
Supply: Rigid
Conduit and
Manifold - Internal leak 10 2 1 20 2
Subsea
Control
Systems
ROV
Intervention Loss of
10 1 2 20 1
Interface - Function
BOP Stack
41
Major # of Effects
Subsystem Failures)
Secondary &
Emergency
Control Loss of
Systems - function 10 2 1 20 3
Surface (general)
Control
Systems
Accumulators
Loss of
- Subsea
Function 10 2 1 20 3
Control
(general)
Systems
Blue &
Yellow
Control
Loss of
Systems -
Electrical -
(general)
Subsea
Control
Systems
Control
Panels - Loss of
Surface function 10 2 1 20 3
Control (general)
Systems
EDS - Subsea Loss of
Control function 10 2 1 20 2
Systems (general)
Fluid
Reservoir Loss of
Unit - Surface Function 10 1 2 20 1
Control (general)
Systems
Hydraulic
Supply - Loss of
Control (general)
Systems
MUX System
Loss of
- Surface
Control
(general)
Systems
42
Major # of Effects
Subsystem Failures)
Loss of
Power -
Power (UPS
Surface
Shuts down 10 2 1 20 3
Control
with power
Systems
degradation)
Secondary &
Emergency
Control Loss of, or
Systems - Degraded 10 2 1 20 3
Surface Power
Control
Systems
Blue &
Yellow
Control
Loss of, or
Systems -
Degraded 10 2 1 20 3
Electrical -
Power
Subsea
Control
Systems
Control
Panels - Loss of, or
Surface Degraded 10 2 1 20 3
Control Power
Systems
EDS - Subsea Loss of, or
Control Degraded 10 2 1 20 2
Systems Power
Accumulators
- Subsea Mechanical
10 1 2 20 2
Control Failure
Systems
Blue &
Yellow
Control
10 2 1 20 3
Subsea
Control
Systems
43
Major # of Effects
Subsystem Failures)
Fluid
Reservoir
Mechanical
Unit - Surface 10 1 2 20 1
Failure
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Mechanical
Manifold - 10 2 1 20 2
Failure
Subsea
Control
Systems
Fluid
Reservoir
Mechanical
Unit - Surface 10 1 2 20 1
Failure
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Mechanical
Manifold - 10 2 1 20 1
Failure
Subsea
Control
Systems
Fluid
Reservoir
Unit - Surface Plugged 10 1 2 20 1
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
EDS - Subsea
Processing
Control 10 2 1 20 1
error
Systems
Control
Panels -
Surface Short 10 2 1 20 3
Control
Systems
44
Major # of Effects
Subsystem Failures)
MUX System
- Surface
Short 10 2 1 20 3
Control
Systems
Accumulators
- Subsea
Wear 10 2 1 20 3
Control
Systems
Choke & Kill
Lines &
Wear 10 1 2 20 1
Valves - BOP
Stack
Power -
Surface Electrical
10 1 1 10 1
Control Short
Systems
Blue &
Yellow
Control
Systems - Erratic
10 1 1 10 1
Electrical - output
Subsea
Control
Systems
Control
Panels -
Erratic
Surface 10 1 1 10 1
output
Control
Systems
MUX System
Erratic
- Surface
output 10 1 1 10 2
Control
(Network)
Systems
MUX System
Fails to
- Surface
respond to 10 1 1 10 1
Control
input
Systems
45
Major # of Effects
Subsystem Failures)
Blue &
Yellow
Control Fails to
Systems - respond to
10 1 1 10 1
Electrical - input -
Subsea Electrical
Control
Systems
Blue &
Yellow
Control Fails with no
Systems - output
10 1 1 10 1
Electrical - signal/com-
Subsea munication
Control
Systems
MUX System Fails with no
- Surface output
10 1 1 10 1
Control signal/com-
Systems munication
Secondary &
Fails with no
Emergency
output
Control
signal/com-
Systems - 10 1 1 10 1
munication
Surface
(Includes
Control
Short)
Systems
Secondary &
Emergency
Control Loss of
Systems - function 10 1 1 10 1
Surface (general)
Control
Systems
Blue &
Yellow
Control
Loss of
Systems -
Electrical -
(general)
Subsea
Control
Systems
46
Major # of Effects
Subsystem Failures)
Control
Panels - Loss of
Surface function 10 1 1 10 1
Control (general)
Systems
Loss of
Power -
Power (UPS
Surface
Shuts down 10 1 1 10 1
Control
with power
Systems
degradation)
Secondary &
Emergency
Control Loss of, or
Systems - Degraded 10 1 1 10 1
Surface Power
Control
Systems
Blue &
Yellow
Control
Loss of, or
Systems -
Degraded 10 1 1 10 1
Electrical -
Power
Subsea
Control
Systems
Control
Panels - Loss of, or
Surface Degraded 10 1 1 10 1
Control Power
Systems
Control
Panels -
Surface Short 10 1 1 10 1
Control
Systems
MUX System
- Surface
Short 10 1 1 10 1
Control
Systems
Table 3-3 shows the equipment failure modes with an occurrence ranking greater than or equal to 5.
These are the most frequently occurring equipment failures. Occurrence results from this FMECA
range from 1–4. The Blind Shear Ram contributes to the most functional failures.
47
Table 3-3: Failure Modes with Occurrence ≥ 5
Major # of Effects
Subsystem Failures)
EDS - Subsea Ground
2 7 1 14 1
Control Systems Fault
Rams - BOP Leak/ 9 5 3 135 1
Stack Rupture
Pipe & Test
Mechanical
Rams - BOP 9 5 3 135 1
Failure
Stack
Lines & Valves - Leak/ 9 5 3 135 1
BOP Stack Rupture
Choke & Kill
Mechanical
Lines & Valves - 9 5 3 135 1
Failure
BOP Stack
Ram - BOP Leak/ 9 5 3 135 1
Stack Rupture
Casing Shear
Mechanical
Ram - BOP 9 5 3 135 1
Failure
Stack
Casing Shear
Ram - BOP Wear 9 5 3 135 1
Stack
External
Blind Shear Ram
Leak/ 9 5 3 135 1
- BOP Stack
Rupture
Blind Shear Ram Mechanical
9 5 3 135 1
- BOP Stack Failure
Blind Shear Ram
Wear 9 5 3 135 1
- BOP Stack
Casing Shear
Ram - BOP Wear 8 5 2 80 1
Stack
Casing Shear
Mechanical
Ram - BOP 8 5 2 80 1
Failure
Stack
External
Blind Shear Ram
Leak/ 8 5 2 80 1
- BOP Stack
Rupture
Blind Shear Ram Internal
8 5 2 80 1
- BOP Stack Leak
Blind Shear Ram Mechanical
8 5 2 80 1
- BOP Stack Failure
48
Table 3-3: Failure Modes with Occurrence ≥ 5 (cont’d)
Major # of Effects
Subsystem Failures)
Blind Shear Ram
Wear 8 5 2 80 1
- BOP Stack
External
Connectors -
Leak/ 2 5 3 30 1
BOP Stack
Rupture
Loss of
Connectors -
Function 2 5 3 30 1
BOP Stack
(general)
2 5 3 30 1
BOP Stack Failure
Table 3-4 shows the equipment failure modes with a detection ranking greater than or equal to 6,
which are the hardest to detect. This list helps identify the equipment-level failure modes for which
additional MIT activities may be needed. Detection results from this FMECA range from 1–10.
Hydraulic supply: Rigid Conduit and Manifold and Connectors have the worst detectability followed
by casing shear ram and surface hydraulic supply
Table 3-4: Failure Modes with Detection ≥ 6

Major # of Effects
Subsystem Failures)
Hydraulic
Supply: Rigid
Conduit and Corrosion/
9 2 7 126 1
Manifold - Erosion
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and Mechanical
9 2 7 126 1
Manifold - Failure
Subsea Control
Systems
9 2 7 126 1
BOP Stack Failure
Blue & Yellow
Control Systems
Corrosion/
- Hydraulics - 9 2 7 126 1
Erosion
Subsea Control
Systems
49
Table 3-4: Failure Modes with Detection ≥ 6 (cont’d)
Major # of Effects
Subsystem Failures)
Blue & Yellow
Control Systems
Mechanical
- Hydraulics - 9 2 7 126 1
Failure
Subsea Control
Systems
Autoshear
Mechanical
System - BOP 9 2 7 126 1
Failure
Stack
Hydraulic
Supply: Rigid
Conduit and Corrosion/
10 2 6 120 2
Manifold - Erosion
Subsea Control
Systems
Hydraulic
Supply: Rigid
External
Conduit and
leak/ 10 2 6 120 2
Manifold -
Rupture
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and Internal
10 2 6 120 2
Manifold - leak
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and Mechanical
10 2 6 120 2
Manifold - Failure
Subsea Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Plugged 10 2 6 120 2
Manifold -
Subsea Control
Systems
Hydraulic
Loss of
Supply -
Function 10 2 6 120 2
Surface Control
(general)
Systems
50
Major # of Effects
Subsystem Failures)
Casing Shear
Corrosion/
Ram - BOP 10 2 6 120 2
Erosion
Stack
Ram - BOP Leak/ 10 2 6 120 2
Stack Rupture
Casing Shear
Internal
Ram - BOP 10 2 6 120 2
Leak
Stack
Casing Shear
Mechanical
Ram - BOP 10 2 6 120 2
Failure
Stack
Casing Shear
Ram - BOP Wear 10 2 6 120 2
Stack
Blue & Yellow
Control Systems
Corrosion/
- Hydraulics - 10 2 6 120 2
Erosion
Subsea Control
Systems
Blue & Yellow
Control Systems External
- Hydraulics - Leak/ 10 2 6 120 2
Subsea Control Rupture
Systems
Blue & Yellow
Control Systems
Internal
- Hydraulics - 10 2 6 120 2
Leak
Subsea Control
Systems
Blue & Yellow
Control Systems
Mechanical
- Hydraulics - 10 2 6 120 2
Failure
Subsea Control
Systems
Blue & Yellow
Control Systems
- Hydraulics - Plugged 10 2 6 120 2
Subsea Control
Systems
Blind Shear
Corrosion/
Ram - BOP 10 2 6 120 2
Erosion
Stack
51
Major # of Effects
Subsystem Failures)
Ram - BOP Leak/ 10 2 6 120 2
Stack Rupture
Blind Shear
Internal
Ram - BOP 10 2 6 120 2
Leak
Stack
Blind Shear
Mechanical
Ram - BOP 10 2 6 120 2
Failure
Stack
Blind Shear
Ram - BOP Wear 10 2 6 120 2
Stack
Autoshear
Mechanical
System - BOP 10 2 6 120 2
Failure
Stack
Subsea Control Leak/Ruptu 10 2 6 120 2
Systems re
Accumulators -
Internal
Leak
Systems
Subsea Control Function 10 2 6 120 2
Systems (general)
Accumulators -
Mechanical
Failure
Systems
Accumulators -
Systems
9 1 6 54 2
BOP Stack Leak
- BOP Stack Rupture
Choke & Kill
Lines & Valves Wear 5 1 6 54 2
- BOP Stack
Table 3-5 shows the equipment failure modes with a severity ranking of 10, an occurrence ranking
greater than or equal to 4 and a detection ranking less than or equal to 5. These are the equipment
failures that occur most frequently and could result in the highest severity but are easy to detect.
52
Table 3-5: Failure Modes with S = 10, O ≥ 4, and D ≤ 5
Major # of Effects
Subsystem Failures)
Choke & Kill
Lines & Valves Plugged 10 4 4 160 4
- BOP Stack
Choke & Kill
Mechanical
Failure
- BOP Stack
Choke & Kill
Lines & Valves Wear 10 4 3 120 2
- BOP Stack
Casing Shear
Ram - BOP Wear 10 4 3 120 1
Stack
- BOP Stack Rupture
Choke & Kill
Internal
Leak
- BOP Stack
Ram - BOP Leak/ 10 4 3 120 2
Stack Rupture
Casing Shear
Mechanical
Ram - BOP 10 4 3 120 2
Failure
Stack
Blind Shear
Ram - BOP Wear 10 4 3 120 2
Stack
Blind Shear
Mechanical
Ram - BOP 10 4 3 120 1
Failure
Stack
Ram - BOP Leak/ 10 4 3 120 2
Stack Rupture
HPU - Surface
Mechanical
Control 10 4 2 80 2
Failure
Systems
53
Equipment failure modes with a severity ranking of 10, an occurrence ranking greater than or equal
to 3 and detection ranking greater than 5 are also of interest. These are the equipment failures that
occur most frequently and could result in the highest severity and are the hardest to detect. No
failures in the FMECA meet this criterion.
The effect of each equipment level failure is linked to a functional failure. Table 3-6 lists the top 25%
of effects/functional failures with the highest average RPN for all of the equipment failures
associated with that functional failure. External Leak - Loss of containment - Close and seal on the
drill pipe and allow circulation on demand (linked to 1.1.8.1) has the six worst average RPN scores.
Table 3-6: Functional Failures with Highest Average RPN

# of Cumulative Average
Effect
Occurrences FF RPN FF RPN
External Leak - Loss of containment - Close and seal on
the drill pipe and allow circulation on demand (linked to 14 1606 115
1.1.8.1)
Actuates Too Slowly on Demand - Closes too slowly -
Emergency Operation - Auto-Shear - Shear the drill pipe 4 457 114
and seal the wellbore (linked to 1.6.6.1)
Failure of Shear Ram to Seal On Demand - Failure to
seal the wellbore - Emergency Operation - Auto-Shear - 114
38 4340
Shear the drill pipe and seal the wellbore (linked to
1.6.4.1)
Failure to Maintain Sealing Pressure on Shear Ram -
Failure to seal the wellbore - Emergency Operation -
38 4340 114
Auto-Shear - Shear the drill pipe and seal the wellbore
(linked to 1.6.4.2)
Failure to Actuate Under Fail-safe Conditions - Failure
to open / close fail-safe valves - Close and seal on the
8 900 113
drill pipe and allow circulation on demand (linked to
1.1.6.1)
External Leak - Loss of containment - Circulate the well
13 1368 105
after drill pipe disconnect (linked to 1.9.5.1)
External Leak - Loss of containment - Circulate across
the BOP stack to remove trapped gas - (linked to 13 1288 99
1.10.4.1)
Inability to Operate C&K Valves as Needed - Failure to
circulate - Circulate across the BOP stack to remove 3 240 80
trapped gas (linked to 1.10.1.3)
Failure to Engage Lock on Hang-off Ram - Failure to
maintain locking - Hang-off the drill pipe on a ram BOP 6 480 80
and control the wellbore (linked to 1.4.3.1)
Failure to Provide Control Signal to Pipe Ram or C&K
Valves When Demanded - Failure to close on drill pipe
18 1296 72
through pipe rams - Close and seal on the drill pipe and
allow circulation on demand (linked to 1.1.2.1)
54
Table 3-6: Functional Failures with Highest Average RPN (cont’d)
Effect
Actuates Too Slowly on Demand - Closes too slowly -
Close and seal on the drill pipe and allow circulation on 25 1609 64
demand (linked to 1.1.7.1)
Failure to Adequately Seal under Fail-safe Condition -
Failure to open / close fail-safe valves to seal - Circulate
4 240 60
across the BOP stack to remove trapped gas (linked to
1.10.3.2)
Failure to Adequately Seal under Fail-safe Conditions -
Failure to open / close fail-safe valves to seal - Circulate 4 240 60
the well after drill pipe disconnect (linked to 1.9.3.2)
Table 3-7 lists the top 25% of effects/functional failures that are most frequently linked to equipment
failures. Failing to supply hydraulic fluid and pressure to annulars is by far the most frequently
occurring functional failure.
Table 3-7: Functional Failures with Greatest Occurrences Due to Equipment Failures
Effect
Failure to Supply Hydraulic Fluid & Pressure to
Annulars - Failure to close annulars - Strip the drill string 42 2668 56
using the annular BOP(s) (linked to 1.3.1.2)
Failure to Supply Hydraulic Fluid & Pressure to Shear
Ram - Failure to close - Emergency Operation - Auto-
47 1854 39
Shear - Shear the drill pipe and seal the wellbore (linked
to 1.6.2.1)
Failure to Supply Hydraulic Fluid & Pressure to Annular
& C&K Valves When Demanded - Failure to close on
42 1626 39
drill pipe through annular(s) - Close and seal on the drill
pipe and allow circulation on demand (linked to 1.1.1.2)
Failure to Supply Hydraulic Fluid & Pressure to
Annular/ Blind-Shear Ram or C&K Valves - Failure to
close on open hole through blind-shear rams or annular - 43 1028 24
Close and seal on open hole and allow volumetric well
control operations on demand (linked to 1.2.1.2)
Failure to Supply Hydraulic Fluid & Pressure to Hang-
off Ram - Failure of hang-off ram to close - Hang-off the
42 1493 36
drill pipe on a ram BOP and control the wellbore (linked
to 1.4.1.2)
Failure to Supply Hydraulic Fluid & Pressure to Shear
Ram - Failure to close - Controlled operation - Shear the 42 1170 28
drill pipe and seal the wellbore (linked to 1.5.1.2)
55
Table 3-7: Functional Failures with Greatest Occurrences Due to Equipment Failures (cont’d)
Effect
Failure to Supply Hydraulic Fluid & Pressure to Pipe
Ram or C&K Valves When Demanded - Failure to close
on drill pipe through pipe rams - Close and seal on the 39 1980 51
drill pipe and allow circulation on demand (linked to
1.1.2.2)
Failure to Supply Hydraulic Fluid & Pressure to C&K
Valves - Failure to seal wellbore - Circulate the well 39 636 16
after drill pipe disconnect (linked to 1.9.4.2)
Failure to Supply Hydraulic Fluid & Pressure to C&K
Valves - Failure to circulate - Circulate the well after 39 636 16
drill pipe disconnect (linked to 1.9.1.2)
Failure of Shear Ram to Seal On Demand - Failure to
seal the wellbore - Emergency Operation - Auto-Shear -
38 4340 114
Shear the drill pipe and seal the wellbore (linked to
1.6.4.1)
Failure to Maintain Sealing Pressure on Shear Ram -
Failure to seal the wellbore - Emergency Operation -
38 4340 114
Auto-Shear - Shear the drill pipe and seal the wellbore
(linked to 1.6.4.2)
Failure to Shear Pipe - Failure to shear the drill pipe -
Controlled operation - Shear the drill pipe and seal the 37 420 11
wellbore (linked to 1.5.2.1)
Failure to Shear Pipe - Failure to shear the drill pipe -
Emergency Operation - Auto-Shear - Shear the drill pipe 36 900 25
and seal the wellbore (linked to 1.6.3.2)
56
4.0 CONCLUSIONS
The initial assessment showed that based on the criticality ranking, the following equipment and their
failure modes were identified as the top 25% of the critical items contributing to the BOP’s potential
functional failure:
 Choke & Kill Lines & Valves - BOP Stack

 Blind Shear Ram - BOP Stack
 Casing Shear Ram - BOP Stack
 Pipe & Test Rams - BOP Stack
 Pipe & Test Rams - BOP Stack
 Autoshear System - BOP Stack
 Blue & Yellow Control Systems - Hydraulics - Subsea Control Systems
 Connectors - BOP Stack
 Hydraulic Supply: Rigid Conduit and Manifold - Subsea Control Systems
 Hydraulic Supply: Rigid Conduit and Manifold - Subsea Control Systems
 Accumulators - Subsea Control Systems
The top 10% of equipment by RPN, as discussed, are - Choke & Kill lines & valves, , Blind Shear
Ram and Casing Shear Ram.
The MIT data and the failure data provided by the drilling contractor and the OEM were reviewed
against the FMECA results. The findings are presented in Section 3 of this report.
This preliminary FMECA analysis and assessment report is submitted for review by the IPs. The
final report may bear the modifications suggested during the review process.
57
58
Appendix A – Functional-Level FMECA Tables
A-2
Appendix B – Equipment-Level FMECA Tables
B-2
Appendix C – All Data Sorted By RPN
C-2
APPENDIX A
FUNCTIONAL-LEVEL FMECA WORKSHEETS
2650788-DFMECA-2-D2
1- Functional level FMECA
Enterprise A1
LEADER
1- Close and seal on the drill pipe and allow
circulation on demand
Enterprise A2
LEADER
1.1.1 Functional Failure: Failure to close on drill pipe through annular(s) - Close and seal on the drill pipe and allow circulation on demand
Item Failure Mode Causes Indications/Protections/Maintenance End Effects
1 Failure to Provide Control Short - MUX System - Surface Control Systems Atypical current reading across solenoid coil Significant down time that impacts operation
Signal to Annular or C&K (linked to 2.1.3.7) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Valves When Demanded Loss of function (general) - MUX System - Flashing red screen on touch screen alerts to a resulting in spill with large impact
Surface Control Systems (linked to 2.1.3.8) communications failure Release of hydrocarbons to atmosphere
Fails with no output signal/communication - Blue Type (I, P or M): I potentially resulting in fire/explosion hazard with
& Yellow Control Systems - Electrical - Subsea No or low flow meter readings large impact
Control Systems (linked to 2.2.1.2) Type (I, P or M): I Down time, after well control issue is resolved,
Loss of Power (UPS Shuts down with power Pod mismatch & alarm to repair an individual C&K valve that cannot be
degradation) - Power - Surface Control Systems Type (I, P or M): I operated
(linked to 2.1.2.1) Visible effects, such as mud flow on rig floor, as
Electrical Short - Power - Surface Control an indication of failure to close annulars
Systems (linked to 2.1.2.5) Type (I, P or M): I
Erratic output (Network) - MUX System - Surface Redundant mechanical systems and components
Control Systems (linked to 2.1.3.4) Type (I, P or M): P
Fails to respond to input - MUX System - Surface Redundant touch screen, controllers, control
Control Systems (linked to 2.1.3.5) pods, cables, powers supplies, SEM exist
Fails to respond (with no output Type (I, P or M): P
signal/communication or to input) - Control Function test annular every 7 days
Panels - Surface Control Systems (linked to Type (I, P or M): M
2.1.5.2) Function tests between wells and upon latch-up
Erratic output - Control Panels - Surface Control Type (I, P or M): M
Systems (linked to 2.1.5.4)
Wiring harness fails
Loss of, or Degraded Power - Control Panels -
Surface Control Systems (linked to 2.1.5.1)
Fails with no output signal/communication - MUX
System - Surface Control Systems (linked to
2.1.3.2)
Fails to respond to input - Control Panels -
Short - Control Panels - Surface Control Systems
(linked to 2.1.5.7)
Erratic output - Blue & Yellow Control Systems -
Electrical - Subsea Control Systems (linked to
2.2.1.3)
Fails to respond to input - Electrical - Blue &
Yellow Control Systems - Electrical - Subsea
Control Systems (linked to 2.2.1.4)
Loss of function (general) - Blue & Yellow
Control Systems - Electrical - Subsea Control
Loss of function (general) - Control Panels -
Enterprise A3
LEADER

Loss of, or Degraded Power - Blue & Yellow
2 Failure to Supply Hydraulic Internal Leak - HPU - Surface Control Systems HPU pumps running constantly Significant down time that impacts operation
Fluid & Pressure to Annular (linked to 2.1.1.2) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
& C&K Valves When Internal Leak - Choke & Kill Lines & Valves - BOP There are manual indicators on valves that the resulting in spill with large impact
Demanded Stack (linked to 2.3.5.2) ROV can read Release of hydrocarbons to atmosphere
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): I potentially resulting in fire/explosion hazard with
to 2.1.1.3) Accumulators with stored hydraulic pressure large impact
Mechanical Failure - HPU - Surface Control energy act as backup Down time, after well control issue is resolved,
Systems (linked to 2.1.1.4) Type (I, P or M): P to repair an individual C&K valve that cannot be
Plugged - Fluid Reservoir Unit - Surface Control Design includes margin of safety (conduits work operated
Systems (linked to 2.1.7.3) at 5k psi, max @ 7.5k psi)
Type (I, P or M): P
Internal Leak - Blue & Yellow Control Systems -
Hydraulics - Subsea Control Systems (linked to Multiple annulars & rams
2.2.2.2) Type (I, P or M): P
Plugged - Choke & Kill Lines & Valves - BOP Redundant conduit lines exist, with the additional
Stack (linked to 2.3.5.3) ability to isolate the leaking line and cross-
connect via conduit manifold
Mechanical Failure - Blue & Yellow Control Type (I, P or M): P
Systems - Hydraulics - Subsea Control Systems
(linked to 2.2.2.4) Redundant pods provide the same functions
Type (I, P or M): P
Loss of Function - ROV Intervention Interface -
BOP Stack (linked to 2.3.8.3) Redundant pumping capability through three
100% capacity pumps
Loss of Function (general) - HPU - Surface Type (I, P or M): P
There are redundant hydraulic pressure
Loss of Function (general) - Hydraulic Supply - regulators
Surface Control Systems (linked to 2.1.4.7) Type (I, P or M): P
External Leak / Rupture - Blue & Yellow Control Controlled function tests ("soak test") between
Systems - Hydraulics - Subsea Control Systems wells
(linked to 2.2.2.1) Type (I, P or M): M
Plugged - Annulars - BOP Stack - (linked to Filters are replaced frequently as a preventive
2.3.1.3) measure
Internal Leak - Connectors - BOP Stack (linked Type (I, P or M): M
to 2.3.6.2) ROV inspection every 3 days
External Leak/Rupture - Surface Control Systems Type (I, P or M): M
- Accumulators - Surface (linked to 2.1.6.1) The systems/components involved have
Internal Leak - Surface Control Systems - maintenance programs and undergo regular
Accumulators - Surface (linked to 2.1.6.2) inspection and maintenance
Mechanical Failure - Surface Control Systems - Type (I, P or M): M
Accumulators - Surface (linked to 2.1.6.4) Weekly BOP function test
Wear - Surface Control Systems - Accumulators - Type (I, P or M): M
Surface (linked to 2.1.6.5)
Loss of Function (general) - Surface Control
Enterprise A4
LEADER

Systems - Accumulators - Surface (linked to
2.1.6.7)
Mechanical Failure - Fluid Reservoir Unit -
Loss of Function (general) - Fluid Reservoir Unit
- Surface Control Systems (linked to 2.1.7.7)
Plugged - Blue & Yellow Control Systems -
Hydraulics - Subsea Control Systems (linked to
2.2.2.3)
Corrosion/Erosion - Blue & Yellow Control
(linked to 2.2.2.6)
External Leak/Rupture - Accumulators - Subsea
Internal Leak - Accumulators - Subsea Control
Mechanical Failure - Accumulators - Subsea
Wear - Accumulators - Subsea Control Systems
(linked to 2.2.3.5)
Corrosion/Erosion - Hydraulic Supply: Rigid
Conduit and Manifold - Subsea Control Systems
(linked to 2.2.5.6)
Wear - Choke & Kill Lines & Valves - BOP Stack
(linked to 2.3.5.5)
External Leak/Rupture - Hydraulic Supply -
Mechanical Failure - Choke & Kill Lines & Valves -
BOP Stack (linked to 2.3.5.4)
Loss of Function (general) - Accumulators -
Subsea Control Systems (linked to 2.2.3.7)
Internal leak - Hydraulic Supply: Rigid Conduit
and Manifold - Subsea Control Systems (linked to
2.2.5.2)
Plugged - Hydraulic Supply: Rigid Conduit and
Manifold - Subsea Control Systems (linked to
2.2.5.3)
Wear - Fluid Reservoir Unit - Surface Control
Mechanical Failure - Hydraulic Supply: Rigid
(linked to 2.2.5.4)
External Leak/Rupture - Choke & Kill Lines &
Enterprise A5
LEADER

Valves - BOP Stack (linked to 2.3.5.1)
External Leak/Rupture - Fluid Reservoir Unit -
External Leak/Rupture - Annulars - BOP Stack
(linked to 2.3.1.1)
External Leak/Rupture - HPU - Surface Control
External Leak/Rupture - Connectors - BOP Stack
(linked to 2.3.6.1)
External leak/rupture - Hydraulic Supply: Rigid
(linked to 2.2.5.1)
Internal Leak - Annulars - BOP Stack (linked to
2.3.1.2)
3 Failure to Close Annular on External Leak/Rupture - Annulars - BOP Stack Hydraulic fluid flow is monitored via flow meters Significant down time that impacts operation
Demand (linked to 2.3.1.1) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Wellbore flow indicates failure to close resulting in spill with large impact
Type (I, P or M): I Release of hydrocarbons to atmosphere
There are multiple annulars, with redundant pipe potentially resulting in fire/explosion hazard with
rams as backup, to ensure closure large impact
Type (I, P or M): P Down time, after well control issue is resolved,
Maintenance/overhaul of annulars is performed to repair an individual C&K valve that cannot be
at the completion of every well operated
Type (I, P or M): M
4 Inability to Operate (an Internal Leak - Choke & Kill Lines & Valves - BOP Deadheading of hydraulic pumps Significant down time that impacts operations
individual) C&K Valves as Stack (linked to 2.3.5.2) Type (I, P or M): I
Needed Wear - Choke & Kill Lines & Valves - BOP Stack Increasing system hydraulic pressure
(linked to 2.3.5.5) Type (I, P or M): I
External Leak/Rupture - Choke & Kill Lines & Flow meter reading is monitored (volume and
Valves - BOP Stack (linked to 2.3.5.1) time required to actuate are known. Too high a
volume indicates a leak. Too long a time
indicates galling or leak.)
Type (I, P or M): I
Pressure test of chambers is conducted at end of
well
Type (I, P or M): M
Shell test using end of tail rod between wells, on
surface
Type (I, P or M): M
Weekly function test of stack and control valves
Enterprise A6
LEADER

Type (I, P or M): M
Wellbore test are conducted between wells and
every 14 days while drilling
Type (I, P or M): M
Enterprise A7
LEADER
1.1.2 Functional Failure: Failure to close on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation on demand
1 Failure to Provide Control Wiring harness fails C&K valves are redundant and have fail-safe Significant down time that impacts operation
Signal to Pipe Ram or C&K Electrical Short - Power - Surface Control design Release of hydrocarbons to air or sea potentially
Valves When Demanded Systems (linked to 2.1.2.5) Type (I, P or M): P resulting in spill with large impact
Erratic output (Network) - MUX System - Surface ROV intervention will enable closure of one of Release of hydrocarbons to atmosphere
Control Systems (linked to 2.1.3.4) the pipe rams potentially resulting in fire/explosion hazard with
Type (I, P or M): P large impact
Fails to respond to input - MUX System - Surface
Control Systems (linked to 2.1.3.5) There are multiple annulars, with redundant pipe Down time, after well control issue is resolved,
rams as backup, to ensure closure to repair an individual C&K valve that cannot be
Short - MUX System - Surface Control Systems Type (I, P or M): P
(linked to 2.1.3.7) operated
Loss of function (general) - MUX System -
Loss of Power (UPS Shuts down with power
degradation) - Power - Surface Control Systems
(linked to 2.1.2.1)
Fails to respond (with no output
signal/communication or to input) - Control
Panels - Surface Control Systems (linked to
2.1.5.2)
Erratic output - Control Panels - Surface Control
2.1.3.2)
(linked to 2.1.5.7)
Fails with no output signal/communication - Blue
& Yellow Control Systems - Electrical - Subsea
2.2.1.3)
Enterprise A8
LEADER

2 Failure to Supply Hydraulic Internal Leak - HPU - Surface Control Systems C&K valves are redundant and have fail-safe Significant down time that impacts operation
Fluid & Pressure to Pipe Ram (linked to 2.1.1.2) design Release of hydrocarbons to air or sea potentially
or C&K Valves When Plugged - HPU - Surface Control Systems (linked Type (I, P or M): P resulting in spill with large impact
Demanded to 2.1.1.3) ROV intervention will enable closure of one of Release of hydrocarbons to atmosphere
Mechanical Failure - HPU - Surface Control the pipe rams potentially resulting in fire/explosion hazard with
Systems (linked to 2.1.1.4) Type (I, P or M): P large impact
Internal Leak - Choke & Kill Lines & Valves - BOP There are multiple annulars, with redundant pipe Down time, after well control issue is resolved,
Stack (linked to 2.3.5.2) rams as backup, to ensure closure to repair an individual C&K valve that cannot be
Type (I, P or M): P operated
Plugged - Choke & Kill Lines & Valves - BOP
Stack (linked to 2.3.5.3)
Plugged - Annulars - BOP Stack - (linked to
2.3.1.3)
Loss of Function (general) - HPU - Surface
Mechanical Failure - Blue & Yellow Control
(linked to 2.2.2.4)
Internal Leak - Connectors - BOP Stack (linked
to 2.3.6.2)
Loss of Function (general) - Hydraulic Supply -
External Leak/Rupture - Surface Control Systems
- Accumulators - Surface (linked to 2.1.6.1)
Internal Leak - Surface Control Systems -
Accumulators - Surface (linked to 2.1.6.2)
Mechanical Failure - Surface Control Systems -
Wear - Surface Control Systems - Accumulators -
2.1.6.7)
Plugged - Fluid Reservoir Unit - Surface Control
2.2.2.3)
Enterprise A9
LEADER

(linked to 2.2.3.5)
2.2.5.2)
(linked to 2.2.5.6)
2.2.5.3)
(linked to 2.2.5.4)
(linked to 2.3.5.5)
External Leak / Rupture - Blue & Yellow Control
(linked to 2.2.2.1)
(linked to 2.3.6.1)
(linked to 2.2.5.1)
(linked to 2.3.1.1)
Enterprise A 10
LEADER

2.3.1.2)
3 Failure to Close Pipe Ram on Shaft seal leaks with higher wellbore pressure C&K valves are redundant and have fail-safe Significant down time that impacts operation
Demand than operating pressure to close side of piston design Release of hydrocarbons to air or sea potentially
Internal Leak - Connectors - BOP Stack (linked Type (I, P or M): P resulting in spill with large impact
to 2.3.6.2) ROV intervention will enable closure of one of Release of hydrocarbons to atmosphere
Wear - Choke & Kill Lines & Valves - BOP Stack the pipe rams potentially resulting in fire/explosion hazard with
(linked to 2.3.5.5) Type (I, P or M): P large impact
External Leak/Rupture - Choke & Kill Lines & There are multiple annulars, with redundant pipe Down time, after well control issue is resolved,
Valves - BOP Stack (linked to 2.3.5.1) rams as backup, to ensure closure to repair an individual C&K valve that cannot be
(linked to 2.3.1.1)
2.3.1.2)
4 Inability to Operate C&K Seal between head case and body fails Deadheading of hydraulic pumps Significant down time that impacts operations
Valves as Needed Internal Leak - Choke & Kill Lines & Valves - BOP Type (I, P or M): I
Stack (linked to 2.3.5.2) Flow meter reading is monitored (volume and
Wear - Choke & Kill Lines & Valves - BOP Stack time required to actuate are known. Too high a
(linked to 2.3.5.5) volume indicates a leak. Too long a time
indicates galling or leak.)
External Leak/Rupture - Choke & Kill Lines & Type (I, P or M): I
Increasing system hydraulic pressure
Type (I, P or M): I
well
Type (I, P or M): M
surface
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
5 Failure to Open Pipe Ram on Ram mechanism fails Hydraulic fluid flow meter reading(s) indicate Significant down time that impacts operations
Demand (as part of the well pipe ram position
control effort) Type (I, P or M): I
Increased drag on drill pipe indicates a closed or
partially closed ram
Type (I, P or M): I
Enterprise A 11
LEADER

Wellbore flow provides indication of pipe ram
position
Type (I, P or M): I
Annual inspection of ram foot
Type (I, P or M): M
Between well maintenance
Type (I, P or M): M
Weekly function test of pipe rams
Type (I, P or M): M
Enterprise A 12
LEADER
1.1.3 Functional Failure: Failure to seal or partial seal on drill pipe through annular(s) - Close and seal on the drill pipe and allow circulation on demand
1 Failure of Annular to Seal on Inadequate hydraulic operating pressure Wellbore flow provides indication of problem Some down time that impacts operation
Demand Mechanical Failure - Annulars - BOP Stack (linked Type (I, P or M): I Release of hydrocarbons to air or sea potentially
to 2.3.1.4) There are multiple annulars, with redundant pipe resulting in spill with small to medium impact
Wear - Annulars - BOP Stack (linked to 2.3.1.5) rams as backup, to ensure closure Release of hydrocarbons to atmosphere
Type (I, P or M): P potentially resulting in fire/explosion hazard with
Pressure test every 14 days small to medium impact
Type (I, P or M): M Down time, after well control issue is resolved,
Rebuild annulars between each well with the to repair an individual C&K valve that cannot be
following replacement sequence: new to lower, operated
existing lower to upper, and existing upper
removed
Type (I, P or M): M
2 Failure to Maintain Adequate Internal Leak - HPU - Surface Control Systems Check valves in rigid conduit help maintain Significant down time that impacts operation
Sealing Pressure on Annular (linked to 2.1.1.2) hydraulic pressure Release of hydrocarbons to air or sea potentially
Internal Leak - Fluid Reservoir Unit - Surface Type (I, P or M): P resulting in spill with large impact
Control Systems (linked to 2.1.7.2) Redundant pod provides backup in case of Release of hydrocarbons to atmosphere
Loss of Function (general) - Hydraulic Supply - functional failures in the active one potentially resulting in fire/explosion hazard with
Surface Control Systems (linked to 2.1.4.7) Type (I, P or M): P large impact
Mechanical Failure - Blue & Yellow Control There are redundant banks of accumulators Down time, after well control issue is resolved,
Systems - Hydraulics - Subsea Control Systems (surface and subsea). Each bank provides to repair an individual C&K valve that cannot be
(linked to 2.2.2.4) stored hydraulic supply and energy. operated
Type (I, P or M): P
Control Systems (linked to 2.2.3.1) Accumulators are tested weekly for proper
function
External Leak/Rupture - Hydraulic Supply - Type (I, P or M): M
Test connector/chamber check valves
Corrosion/Erosion - Hydraulic Supply: Rigid Type (I, P or M): M
(linked to 2.2.5.6)
(linked to 2.2.5.4)
(linked to 2.2.2.1)
(linked to 2.2.5.1)
3 Inability to Operate C&K Internal Leak - Choke & Kill Lines & Valves - BOP Deadheading of hydraulic pumps Significant down time that impacts operations
Valves as needed Stack (linked to 2.3.5.2) Type (I, P or M): I
Wear - Choke & Kill Lines & Valves - BOP Stack Flow meter reading is monitored (volume and
time required to actuate are known. Too high a
Enterprise A 13
LEADER
1.1.3 Functional Failure: Failure to seal or partial seal on drill pipe through annular(s) - Close and seal on the drill pipe and allow circulation on demand

(linked to 2.3.5.5) volume indicates a leak. Too long a time
External Leak/Rupture - Choke & Kill Lines & indicates galling or leak.)
Valves - BOP Stack (linked to 2.3.5.1) Type (I, P or M): I
Increasing system hydraulic pressure
Type (I, P or M): I
well
Type (I, P or M): M
surface
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Enterprise A 14
LEADER
1.1.4 Functional Failure: Failure to seal or partial seal on drill pipe through pipe rams - Close and seal on the drill pipe and allow circulation on demand
1 Failure of Pipe Ram to Seal Pipe and ram size mismatch Wellbore flow indicates failure to close Some down time that impacts operation
on Demand Mechanical damage Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Trash in the well (swarf, concrete, etc.) Dimensional inspection of seal plate and wear resulting in spill with small to medium impact
plate is performed regularly (frequency varies Release of hydrocarbons to atmosphere
Internal Leak - HPU - Surface Control Systems from between well inspection to annual
(linked to 2.1.1.2) potentially resulting in fire/explosion hazard with
inspection) small to medium impact
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): P
to 2.1.1.3) Down time, after well control issue is resolved,
There are multiple annulars, with redundant pipe to repair an individual C&K valve that cannot be
Mechanical Failure - HPU - Surface Control rams as backup, to ensure closure operated
Systems (linked to 2.1.1.4) Type (I, P or M): P
Internal Leak - Blue & Yellow Control Systems - Maintenance/overhaul of annulars is performed
Hydraulics - Subsea Control Systems (linked to at the completion of every well
2.2.2.2) Type (I, P or M): M
Loss of Function (general) - HPU - Surface Wellbore test are conducted between wells and
Control Systems (linked to 2.1.1.7) every 14 days while drilling
Loss of Function (general) - Hydraulic Supply - Type (I, P or M): M
2.1.6.7)
(linked to 2.2.2.6)
2.2.2.3)
(linked to 2.2.2.4)
Enterprise A 15
LEADER

(linked to 2.2.3.5)
2.2.5.2)
Internal Leak - Pipe & Test Rams - BOP Stack
(linked to 2.3.4.2)
2.2.5.3)
External Leak/Rupture - Pipe & Test Rams - BOP
(linked to 2.2.5.6)
Wear - Pipe & Test Rams - BOP Stack (linked to
2.3.4.5)
(linked to 2.2.2.1)
(linked to 2.2.5.4)
Corrosion/Erosion - Pipe & Test Rams - BOP
(linked to 2.2.5.1)
2 Failure to Maintain Adequate Seals on the chamber ring fail to allow the A multi position locking (MPL) mechanism offers Some down time that impacts operation
Sealing Pressure on Pipe transfer ring to move freely & doesn't allow the redundant and diverse means of backing-up Release of hydrocarbons to air or sea potentially
Ram springs to fully engage clutch ram/sealing function resulting in spill with small to medium impact
Wear on packers on ram blocks Type (I, P or M): P
Release of hydrocarbons to atmosphere
Motion compensator fails to prevent excessive Motion compensator for drill string helps to potentially resulting in fire/explosion hazard with
wear on ram blocks avoid excess wear on seals small to medium impact
Type (I, P or M): P
Internal Leak - HPU - Surface Control Systems Down time, after well control issue is resolved,
(linked to 2.1.1.2) Rams are periodically lock tested on surface to repair an individual C&K valve that cannot be
(without closing pressure) operated
Plugged - HPU - Surface Control Systems (linked
Enterprise A 16
LEADER

to 2.1.1.3) Type (I, P or M): M
Mechanical Failure - HPU - Surface Control Wellbore test are conducted between wells and
Systems (linked to 2.1.1.4) every 14 days while drilling
Loss of Function (general) - HPU - Surface Type (I, P or M): M
2.2.2.2)
(linked to 2.2.2.6)
2.1.6.7)
2.2.5.2)
(linked to 2.2.2.4)
(linked to 2.2.2.1)
Internal Leak - Fluid Reservoir Unit - Surface
(linked to 2.2.3.5)
Enterprise A 17
LEADER

2.2.2.3)
(linked to 2.2.5.4)
2.2.5.3)
(linked to 2.2.5.6)
(linked to 2.2.5.1)
3 Inability to Operate C&K Internal Leak - Choke & Kill Lines & Valves - BOP Deadheading of hydraulic pumps Significant down time that impacts operation
Valves as Needed Stack (linked to 2.3.5.2) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Wear - Choke & Kill Lines & Valves - BOP Stack Flow meter reading is monitored (volume and resulting in spill with large impact
(linked to 2.3.5.5) time required to actuate are known. Too high a Release of hydrocarbons to atmosphere
External Leak/Rupture - Choke & Kill Lines & volume indicates a leak. Too long a time potentially resulting in fire/explosion hazard with
Valves - BOP Stack (linked to 2.3.5.1) indicates galling or leak.) large impact
Type (I, P or M): I
Down time, after well control issue is resolved,
Increasing system hydraulic pressure to repair an individual C&K valve that cannot be
Type (I, P or M): I operated
well
Type (I, P or M): M
surface
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Enterprise A 18
LEADER
1.1.5 Functional Failure: Unintentional closing / opening - Close and seal on the drill pipe and allow circulation on demand
1 Unintentional Operation Fails with no output - Power - Surface Control The hydraulic system has built-in redundancy Significant down time that impacts operations
Systems (linked to 2.1.2.2) Type (I, P or M): P Potential to overpressure standpipe and/or
Loss of Function - Power - Surface Control There are multiple annulars, with redundant pipe manifold leading to hydrocarbon release, fire, or
Systems (linked to 2.1.2.6) rams as backup, to ensure closure explosion
Mechanical Failure - MUX System - Surface Type (I, P or M): P
Control Systems (linked to 2.1.3.9) Pressure test of chambers is conducted at end of
Corrosion/Erosion - Choke & Kill Lines & Valves - well
BOP Stack (linked to 2.3.5.6) Type (I, P or M): M
Erratic output (Erratic, Intermittent) - Power - Shell test using end of tail rod between wells, on
Surface Control Systems (linked to 2.1.2.3) surface
Type (I, P or M): M
Ground Faults - Power - Surface Control Systems
(linked to 2.1.2.7) Weekly function test of stack and control valves
Type (I, P or M): M
Short - MUX System - Surface Control Systems
(linked to 2.1.3.7) Wellbore test are conducted between wells and
Ground Fault - Blue & Yellow Control Systems - Type (I, P or M): M
2.2.1.6)
Internal Leak - Choke & Kill Lines & Valves - BOP
Electrical Short - Power - Surface Control
(linked to 2.1.2.1)
Loss of subsea transformer - Power - Surface
Erratic output (Network) - MUX System - Surface
2.1.3.2)
Enterprise A 19
LEADER
1.1.5 Functional Failure: Unintentional closing / opening - Close and seal on the drill pipe and allow circulation on demand

2.1.5.2)
(linked to 2.1.5.7)
2.2.1.3)
(linked to 2.3.5.5)
2 Unintentional Opening No scenarios resulting in unintentional opening

during 'Close and seal on the drill pipe and allow
circulation on demand'
Enterprise A 20
LEADER
1.1.6 Functional Failure: Failure to open / close fail-safe valves - Close and seal on the drill pipe and allow circulation on demand
1 Failure to Actuate Under Fail- Mechanical Failure - Connectors - BOP Stack Close manual valves at choke manifold on Significant down time that impacts operation
safe Conditions (linked to 2.3.6.4) surface Release of hydrocarbons to air or sea potentially
Corrosion/Erosion - Blue & Yellow Control Type (I, P or M): P resulting in spill with large impact
Systems - Hydraulics - Subsea Control Systems Redundant valves in series on stack Release of hydrocarbons to atmosphere
(linked to 2.2.2.6) Type (I, P or M): P potentially resulting in fire/explosion hazard with
Mechanical Failure - Autoshear System - BOP Valves close via hydraulic/or spring if hydraulic large impact
Stack (linked to 2.3.7.4) open pressure bleeds Down time, after well control issue is resolved,
Mechanical Failure - Blue & Yellow Control Type (I, P or M): P to repair an individual C&K valve that cannot be
Systems - Hydraulics - Subsea Control Systems Maintenance/overhaul of annulars is performed operated
(linked to 2.2.2.4) at the completion of every well. Between well
Mechanical Failure - Hydraulic Supply: Rigid maintenance - specifically tested for proper
Conduit and Manifold - Subsea Control Systems operation
(linked to 2.2.5.6)
(linked to 2.3.5.5)
2 Failure to Adequately Seal No scenarios resulting in failure to adequately

Under Fail-safe Conditions seal under fail-safe conditions during 'Close and
seal on the drill pipe and allow circulation on
demand'
Enterprise A 21
LEADER
1.1.7 Functional Failure: Closes too slowly - Close and seal on the drill pipe and allow circulation on demand
1 Actuates Too Slowly on Air in hydraulic system Hydraulic fluid flow meter Increased influx of hydrocarbons into Riser
Demand Plugged - HPU - Surface Control Systems (linked Type (I, P or M): I resulting in safety (fire/explosion) and/or
to 2.1.1.3) Wellbore flow environmental effects
Mechanical Failure - HPU - Surface Control Type (I, P or M): I Down time, after well control issue is resolved,
Systems (linked to 2.1.1.4) Redundant annulars with redundant pipe rams to repair an individual C&K valve that cannot be
Stack (linked to 2.3.5.3) Redundant controls
Control Systems (linked to 2.1.1.7) Maintenance/overhaul at end of every well for
Loss of Function (general) - Hydraulic Supply - annulars
Surface Control Systems (linked to 2.1.4.7) Type (I, P or M): M
(linked to 2.2.2.1)
2.1.6.7)
2.2.2.3)
(linked to 2.2.3.5)
Enterprise A 22
LEADER
1.1.7 Functional Failure: Closes too slowly - Close and seal on the drill pipe and allow circulation on demand

2.2.5.3)
(linked to 2.2.5.1)
Enterprise A 23
LEADER
1.1.8 Functional Failure: Loss of containment - Close and seal on the drill pipe and allow circulation on demand
1 External Leak Mechanical Failure - Blind Shear Ram - BOP Connectors tested with casing test & blind shear Potential for the release of significant amount of
Stack (linked to 2.3.2.4) ram test hydrocarbon to the environment
External Leak/Rupture - Casing Shear Ram - BOP Type (I, P or M): M Drilling mud spill to the environment
Stack (linked to 2.3.3.1) Pressure test every 14 days Potential for Fire/Explosion, with severity
External Leak/Rupture - Blind Shear Ram - BOP Type (I, P or M): M depending on location. (For example, if failed at
Stack (linked to 2.3.2.1) ROV inspection every 3 days choke manifold connection, large fire could
Mechanical Failure - Pipe & Test Rams - BOP Type (I, P or M): M result.)
Stack (linked to 2.3.4.4) If loss of containment is at wellhead connector,
Loss of Function (general) - Hydraulic Supply - it could result in a medium release to the
Surface Control Systems (linked to 2.1.4.7) environment due to limited mitigation options
Wear - Casing Shear Ram - BOP Stack (linked to
2.3.3.5)
Wear - Blind Shear Ram - BOP Stack (linked to
2.3.2.5)
Mechanical Failure - Casing Shear Ram - BOP
External Leak/Rupture - Pipe & Test Rams - BOP
(linked to 2.2.5.1)
(linked to 2.3.1.1)
2 Rupture Not credible causes resulting in rupture during

'Close and seal on the drill pipe and allow
circulation on demand'
Enterprise A 24
LEADER
2- Close and seal on open hole and allow volumetric
well control operations, on demand
Enterprise A 25
LEADER
1.2.1 Functional Failure: Failure to close on open hole through blind-shear rams or annular - Close and seal on open hole and allow volumetric well control operations on demand
1 Failure to Provide Control Wiring harness fails Atypical current across solenoid coil Significant down time that impacts operation
Signal to Annular / Blind- Loss of Power (UPS Shuts down with power Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Shear Ram or C&K Valves degradation) - Power - Surface Control Systems Communications failure via flashing red screen resulting in spill with large impact
When Demanded (linked to 2.1.2.1) on touch screen Release of hydrocarbons to atmosphere
Electrical Short - Power - Surface Control Type (I, P or M): I potentially resulting in fire/explosion hazard with
Systems (linked to 2.1.2.5) Mud on rig floor large impact
Erratic output (Network) - MUX System - Surface Type (I, P or M): I Down time, after well control issue is resolved,
Control Systems (linked to 2.1.3.4) No flow in flow meters to repair an individual C&K valve that cannot be
Short - MUX System - Surface Control Systems Type (I, P or M): I operated
(linked to 2.1.3.7) Pod mismatch & alarm
Fails with no output signal/communication - MUX Type (I, P or M): I
System - Surface Control Systems (linked to Redundant mechanicals
2.1.3.2) Type (I, P or M): P
Fails to respond to input - MUX System - Surface Redundant touch screen, controllers, control
Control Systems (linked to 2.1.3.5) pods, cables, powers supplies, SEM
Loss of function (general) - MUX System - Type (I, P or M): P
Surface Control Systems (linked to 2.1.3.8) Function test (or obtain waiver) blind shear ram
Loss of, or Degraded Power - Control Panels - every 7 days (used to be every 30 days, recent
Surface Control Systems (linked to 2.1.5.1) BSEE regulation change in last 6 months)
Type (I, P or M): M
signal/communication or to input) - Control Function tests between wells and upon latch-up
Panels - Surface Control Systems (linked to Type (I, P or M): M
2.1.5.2)
(linked to 2.1.5.7)
2.2.1.3)
Enterprise A 26
LEADER

Fluid & Pressure to Annular / (linked to 2.1.1.2) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Blind-Shear Ram or C&K Internal Leak - Blind Shear Ram - BOP Stack Manual indicators on valves that the ROV can resulting in spill with large impact
Valves (linked to 2.3.2.2) read Release of hydrocarbons to atmosphere
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): I potentially resulting in fire/explosion hazard with
to 2.1.1.3) Design margin/safety factors (conduits work at large impact
Mechanical Failure - HPU - Surface Control 5k, max @ 7.5k) Down time, after well control issue is resolved,
Plugged - Annulars - BOP Stack - (linked to Multiple annulars & rams operated
2.3.1.3) Type (I, P or M): P
Internal Leak - Choke & Kill Lines & Valves - BOP Multiple annulars capable of closing hole.
Stack (linked to 2.3.5.2) Additional rams are not an option without a drill
string
Plugged - Choke & Kill Lines & Valves - BOP Type (I, P or M): P
Multiple pumps (1 pump needed, 3 pumps
Loss of Function (general) - HPU - Surface present)
Internal Leak - Blue & Yellow Control Systems - Redundant conduit lines with ability to isolate
Hydraulics - Subsea Control Systems (linked to leaking line and cross-connect via conduit
2.2.2.2) manifold
External Leak/Rupture - Blind Shear Ram - BOP Type (I, P or M): P
Stack (linked to 2.3.2.1) Redundant functions between pods
Loss of Function (general) - Hydraulic Supply - Type (I, P or M): P
Surface Control Systems (linked to 2.1.4.7) Redundant regulators
Internal Leak - Connectors - BOP Stack (linked Type (I, P or M): P
to 2.3.6.2) Accumulators with stored energy
External Leak / Rupture - Blue & Yellow Control Type (I, P or M): P
Systems - Hydraulics - Subsea Control Systems Filter replacement frequency
External Leak/Rupture - Surface Control Systems Maintenance programs
- Accumulators - Surface (linked to 2.1.6.1) Type (I, P or M): M
Internal Leak - Surface Control Systems - ROV inspection every 3 days
Accumulators - Surface (linked to 2.1.6.2) Type (I, P or M): M
Mechanical Failure - Surface Control Systems - SOAK test between wells
Accumulators - Surface (linked to 2.1.6.4) Type (I, P or M): M
Wear - Surface Control Systems - Accumulators - Weekly BOP function test
Surface (linked to 2.1.6.5) Type (I, P or M): M
2.1.6.7)
Enterprise A 27
LEADER

(linked to 2.2.2.4)
(linked to 2.2.2.6)
2.2.2.3)
(linked to 2.2.3.5)
(linked to 2.2.5.4)
Mechanical Failure - Blind Shear Ram - BOP
2.3.2.5)
(linked to 2.2.5.6)
2.2.5.3)
(linked to 2.3.6.1)
Enterprise A 28
LEADER

(linked to 2.3.5.5)
(linked to 2.2.5.1)
2.3.1.2)
3 Failure to Close Annular / Internal Leak - Annulars - BOP Stack (linked to Hydraulic fluid flow meter Significant down time that impacts operation
Blind-Shear Ram on Demand 2.3.1.2) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Internal Leak - Blind Shear Ram - BOP Stack Wellbore flow resulting in spill with large impact
(linked to 2.3.2.2) Type (I, P or M): I Release of hydrocarbons to atmosphere
External Leak/Rupture - Blind Shear Ram - BOP Other pipe rams & annular potentially resulting in fire/explosion hazard with
Stack (linked to 2.3.2.1) Type (I, P or M): P large impact
Internal Leak - Connectors - BOP Stack (linked Redundant controls Down time, after well control issue is resolved,
to 2.3.6.2) Type (I, P or M): P to repair an individual C&K valve that cannot be
External Leak/Rupture - Annulars - BOP Stack Redundant annulars with redundant pipe rams operated
(linked to 2.3.1.1) Type (I, P or M): P
Wear - Blind Shear Ram - BOP Stack (linked to Redundancy with fail-safe valves
2.3.2.5) Type (I, P or M): P
Shaft seal leaks with higher wellbore pressure ROV intervention - will close 1 of the pipe rams
than operating pressure to close side of piston Type (I, P or M): P
Mechanical Failure - Blind Shear Ram - BOP The only redundancies in this case are 2
Stack (linked to 2.3.2.4) annulars and 1 blind shear ram. The other pipe
External Leak/Rupture - Choke & Kill Lines & rams are not usable without the drill string in
Valves - BOP Stack (linked to 2.3.5.1) place.
Type (I, P or M): P
(linked to 2.3.5.5) Maintenance/overhaul at end of every well for
annulars
Type (I, P or M): M
4 Failure of Annular / Blind- Incorrect annular seal (bag) based on drilling Wellbore flow Significant down time that impacts operation
Shear Ram to Seal on mud Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Demand Age/storage related failure of seal (UV & Heat) Dimensional inspection of seal plate and wear resulting in spill with large impact
Washout of seal plate (frequency varies from between well, to Release of hydrocarbons to atmosphere
annually) potentially resulting in fire/explosion hazard with
Internal Leak - HPU - Surface Control Systems Type (I, P or M): P
(linked to 2.1.1.2) large impact
Redundant annulars Down time, after well control issue is resolved,
Plugged - HPU - Surface Control Systems (linked
Enterprise A 29
LEADER

to 2.1.1.3) Type (I, P or M): P to repair an individual C&K valve that cannot be
External Leak/Rupture - HPU - Surface Control Redundant Rams operated
Mechanical Failure - HPU - Surface Control End of well maintenance
Systems (linked to 2.1.1.4) Type (I, P or M): M
Mechanical Failure - Annulars - BOP Stack - Fourteen day functional testing of blind shears
Loss of Function (general) - HPU - Surface Pressure test of annulars every 14 days
Control Systems (linked to 2.1.1.7) Type (I, P or M): M
Internal Leak - Blue & Yellow Control Systems - Rebuild annulars between each well with
Hydraulics - Subsea Control Systems (linked to replacement (New lower, lower to upper & upper
2.2.2.2) to junk)
Internal leak - Hydraulic Supply: Rigid Conduit Type (I, P or M): M
2.2.5.2)
External Leak/Rupture - Blind Shear Ram - BOP
(linked to 2.2.2.1)
2.1.6.7)
(linked to 2.2.2.4)
(linked to 2.2.2.6)
Enterprise A 30
LEADER

(linked to 2.2.5.4)
(linked to 2.3.1.1)
2.2.2.3)
(linked to 2.2.3.5)
2.3.2.5)
(linked to 2.2.5.6)
2.2.5.3)
(linked to 2.2.5.1)
2.3.1.2)
Wear - Annulars - BOP Stack (linked to 2.3.1.5)
5 Failure to Maintain Adequate Internal Leak - HPU - Surface Control Systems Wellbore flow Significant down time that impacts operation
Sealing Pressure on Annular (linked to 2.1.1.2) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
/ Blind-Shear Ram Plugged - HPU - Surface Control Systems (linked Dimensional inspection of seal plate and wear resulting in spill with large impact
to 2.1.1.3) plate (frequency varies from between well, to Release of hydrocarbons to atmosphere
External Leak/Rupture - HPU - Surface Control annually) potentially resulting in fire/explosion hazard with
Mechanical Failure - HPU - Surface Control Redundant annulars Down time, after well control issue is resolved,
External Leak/Rupture - Surface Control Systems Redundant Rams operated
- Accumulators - Surface (linked to 2.1.6.1) Type (I, P or M): P
End of well maintenance
Enterprise A 31
LEADER

Internal Leak - Surface Control Systems - Type (I, P or M): M
Accumulators - Surface (linked to 2.1.6.2) Fourteen day functional testing of blind shears
External Leak/Rupture - Blind Shear Ram - BOP Type (I, P or M): M
Stack (linked to 2.3.2.1) Pressure test of annulars every 14 days
External Leak / Rupture - Blue & Yellow Control Type (I, P or M): M
Systems - Hydraulics - Subsea Control Systems Rebuild annulars between each well with
(linked to 2.2.2.1) replacement (New lower, lower to upper & upper
Internal Leak - Blue & Yellow Control Systems - to junk)
Hydraulics - Subsea Control Systems (linked to Type (I, P or M): M
2.2.2.2)
2.2.5.2)
2.1.6.7)
(linked to 2.2.5.4)
Mechanical Failure - Annulars - BOP Stack -
(linked to 2.3.1.4)
Wear - Annulars - BOP Stack (linked to 2.3.1.5)
(linked to 2.2.2.4)
(linked to 2.2.2.6)
2.2.2.3)
(linked to 2.2.3.5)
Enterprise A 32
LEADER

Incorrect annular seal (bag) based on drilling
mud
Age/storage related failure of seal (UV & Heat)
Washout of seal
(linked to 2.2.5.6)
2.2.5.3)
2.3.2.5)
(linked to 2.2.5.1)
(linked to 2.3.1.1)
2.3.1.2)
Enterprise A 33
LEADER
6 Inability to Operate C&K Internal Leak - Choke & Kill Lines & Valves - BOP Deadheading of pump Significant down time that impacts operation
External Leak/Rupture - Choke & Kill Lines & Flow meter (volume to actuate is known, should resulting in spill with large impact
Valves - BOP Stack (linked to 2.3.5.1) go 0 to 0.7 to 0 in ~ 5 seconds) If too high = Release of hydrocarbons to atmosphere
Wear - Choke & Kill Lines & Valves - BOP Stack leak. If long time = galling or leak potentially resulting in fire/explosion hazard with
(linked to 2.3.5.5) Type (I, P or M): I large impact
Increasing pressure Down time, after well control issue is resolved,
Type (I, P or M): I to repair an individual C&K valve that cannot be
Pressure test chambers at end of well operated
Type (I, P or M): P
surface
Type (I, P or M): M
Weekly function test of stack
Type (I, P or M): M
Wellbore test between wells and 14 while subsea
Type (I, P or M): M
Enterprise A 34
LEADER
1.2.2 Functional Failure: Unintentional closing / opening - Close and seal on open hole and allow volumetric well control operations on demand
1 Unintentional Closing Fails with no output - Power - Surface Control Redundant BOPs Down time with potential impact on operation
Systems (linked to 2.1.2.2) Type (I, P or M): P Potential to overpressure standpipe and
Erratic output (Erratic, Intermittent) - Power - Redundancy in hydraulic system manifold, leading to gas migration and/or fire
Surface Control Systems (linked to 2.1.2.3) Type (I, P or M): P and/or explosion
Loss of Function - Power - Surface Control Standard pressure/functional testing
Systems (linked to 2.1.2.6) Type (I, P or M): M
Mechanical Failure - MUX System - Surface
Ground Faults - Power - Surface Control Systems
(linked to 2.1.2.7)
Electrical Short - Power - Surface Control
Loss of subsea transformer - Power - Surface
(linked to 2.1.2.1)
2.1.3.2)
(linked to 2.1.3.7)
Ground Fault - Blue & Yellow Control Systems -
2.2.1.6)
2.1.5.2)
Enterprise A 35
LEADER
1.2.2 Functional Failure: Unintentional closing / opening - Close and seal on open hole and allow volumetric well control operations on demand

(linked to 2.1.5.7)
2.2.1.3)
2 Unintentional Opening No credible causes resulting in unintentional

opening during 'Close and seal on open hole and
allow volumetric well control operations on
demand'
Enterprise A 36
LEADER
1.2.3 Functional Failure: Failure to open/close fail-safe valves - Close and seal on open hole and allow volumetric well control operations on demand
1 Failure to Actuate Under Fail- No credible causes resulting in a failure to

safe Conditions actuate under fail-safe conditions during 'Close
and seal on open hole and allow volumetric well
control operations on demand'
2 Failure to Adequately Seal No credible causes resulting in failure to

Under Fail-safe Conditions adequately seal under fail-safe conditions during
'Close and seal on open hole and allow
volumetric well control operations on demand'
Enterprise A 37
LEADER
1.2.4 Functional Failure: Closes too slowly - Close and seal on open hole and allow volumetric well control operations on demand
1 Actuates Too Slowly on No credible causes resulting in Actuates Too

Demand Slowly on Demand during 'Close and seal on
open hole and allow volumetric well control
operations on demand'
Enterprise A 38
LEADER
1.2.5 Functional Failure: Loss of containment - Close and seal on open hole and allow volumetric well control operations on demand
1 External Leak No credible causes resulting in an external leak

during 'Close and seal on open hole and allow
2 Rupture No credible causes resulting in a rupture during

'Close and seal on open hole and allow
Enterprise A 39
LEADER
3- Strip the drill string using the annular BOP(s)
Enterprise A 40
LEADER
1.3.1 Functional Failure: Failure to close annulars - Strip the drill string using the annular BOP(s)
1 Failure to Provide Control Electrical Short - Power - Surface Control Wellbore flow Significant down time that impacts operation
Signal to Annulars When Systems (linked to 2.1.2.5) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Demanded Loss of Power (UPS Shuts down with power From drillers chair/console it is two switches that resulting in spill with large impact
degradation) - Power - Surface Control Systems are both covered Release of hydrocarbons to atmosphere
(linked to 2.1.2.1) Type (I, P or M): P potentially resulting in fire/explosion hazard with
Erratic output (Network) - MUX System - Surface Redundant annulars large impact
Control Systems (linked to 2.1.3.4) Type (I, P or M): P Down time, after well control issue is resolved,
Fails with no output signal/communication - MUX Redundant Rams to repair an individual C&K valve that cannot be
System - Surface Control Systems (linked to Type (I, P or M): P operated
2.1.3.2) Two hand operation, Password, confirmation
Loss of, or Degraded Power - Control Panels - Type (I, P or M): P
Surface Control Systems (linked to 2.1.5.1) Pressure test every 14 days
Fails to respond to input - Electrical - Blue & Type (I, P or M): M
Yellow Control Systems - Electrical - Subsea Rebuild annulars between each well with
Control Systems (linked to 2.2.1.4) replacement (New lower, lower to upper & upper
Loss of function (general) - Blue & Yellow to junk)
Control Systems - Electrical - Subsea Control Type (I, P or M): M
(linked to 2.1.3.7)
2.1.5.2)
(linked to 2.1.5.7)
2.2.1.3)
Enterprise A 41
LEADER

Fluid & Pressure to Annulars (linked to 2.1.1.2) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Plugged - HPU - Surface Control Systems (linked Manual indicators on valves that the ROV can resulting in spill with large impact
to 2.1.1.3) read Release of hydrocarbons to atmosphere
External Leak/Rupture - HPU - Surface Control Type (I, P or M): I potentially resulting in fire/explosion hazard with
Systems (linked to 2.1.1.1) Accumulators with stored energy large impact
Mechanical Failure - HPU - Surface Control Type (I, P or M): P Down time, after well control issue is resolved,
Systems (linked to 2.1.1.4) Design margin/safety factors (conduits work at to repair an individual C&K valve that cannot be
Loss of Function (general) - HPU - Surface 5k, max @ 7.5k) operated
Plugged - Choke & Kill Lines & Valves - BOP Multiple annulars & rams
Stack (linked to 2.3.5.3) Type (I, P or M): P
Internal Leak - Choke & Kill Lines & Valves - BOP Multiple pumps (1 pump needed, 3 pumps
Stack (linked to 2.3.5.2) present)
Type (I, P or M): P
to 2.3.6.2) Redundant conduit lines with ability to isolate
leaking line and cross-connect via conduit
External Leak / Rupture - Blue & Yellow Control manifold
Systems - Hydraulics - Subsea Control Systems Type (I, P or M): P
(linked to 2.2.2.1)
Redundant functions between pods
Internal Leak - Blue & Yellow Control Systems - Type (I, P or M): P
2.2.2.2) Redundant regulators
Type (I, P or M): P
Surface Control Systems (linked to 2.1.4.7) Filter replacement frequency
Type (I, P or M): M
2.3.1.3) Maintenance programs
Type (I, P or M): M
Surface Control Systems (linked to 2.1.7.4) ROV inspection every 3 days
Type (I, P or M): M
and Manifold - Subsea Control Systems (linked to SOAK test between wells
2.2.5.2) Type (I, P or M): M
Internal Leak - Annulars - BOP Stack (linked to Weekly BOP function test
2.3.1.2) Type (I, P or M): M
(linked to 2.2.5.4)
(linked to 2.3.1.1)
Enterprise A 42
LEADER

2.1.6.7)
2.2.2.3)
(linked to 2.2.2.4)
(linked to 2.2.2.6)
(linked to 2.2.3.5)
(linked to 2.2.5.6)
(linked to 2.3.6.1)
2.2.5.3)
Enterprise A 43
LEADER

(linked to 2.2.5.1)
(linked to 2.3.5.5)
3 Failure to Close Annulars on External Leak/Rupture - Annulars - BOP Stack Hydraulic fluid flow meter Significant down time that impacts operation
Drill String on Demand (linked to 2.3.1.1) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Wellbore flow resulting in spill with large impact
Type (I, P or M): I Release of hydrocarbons to atmosphere
Redundant annulars with redundant pipe rams potentially resulting in fire/explosion hazard with
Type (I, P or M): P large impact
Redundant controls Down time, after well control issue is resolved,
Type (I, P or M): P to repair an individual C&K valve that cannot be
Maintenance/overhaul at end of every well for operated
annulars
Type (I, P or M): M
Enterprise A 44
LEADER
1.3.2 Functional Failure: Failure to maintain stripping pressure - Strip the drill string using the annular BOP(s)
1 Failure to Maintain Hydraulic Internal Leak - HPU - Surface Control Systems Flow (returns through riser) of well Significant down time that impacts operation
Fluid & Pressure to Annulars (linked to 2.1.1.2) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Loss of Function (general) - HPU - Surface Pressure readings on annular resulting in spill with large impact
Control Systems (linked to 2.1.1.7) Type (I, P or M): I Release of hydrocarbons to atmosphere
External Leak / Rupture - Blue & Yellow Control Accumulators potentially resulting in fire/explosion hazard with
Systems - Hydraulics - Subsea Control Systems Type (I, P or M): P large impact
(linked to 2.2.2.1) Check valves in rigid conduit Down time, after well control issue is resolved,
Internal Leak - Blue & Yellow Control Systems - Type (I, P or M): P to repair an individual C&K valve that cannot be
Hydraulics - Subsea Control Systems (linked to Second annular operated
2.2.2.2) Type (I, P or M): P
Internal Leak - Fluid Reservoir Unit - Surface Redundant pods
Internal leak - Hydraulic Supply: Rigid Conduit Test connector/chamber check valves
and Manifold - Subsea Control Systems (linked to Type (I, P or M): M
2.2.5.2)
Test performed every 14 days
Mechanical Failure - Hydraulic Supply: Rigid Type (I, P or M): M
(linked to 2.2.5.4) Weekly function test
Type (I, P or M): M
(linked to 2.2.2.6)
2.2.5.3)
(linked to 2.2.5.6)
(linked to 2.2.5.1)
Enterprise A 45
LEADER
1.3.3 Functional Failure: Failure to seal - Strip the drill string using the annular BOP(s)
1 Failure of Annulars to Seal on Incorrect annular seal (bag) based on drilling Wellbore flow Significant down time that impacts operation
Demand mud Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Inadequate operating pressure Ability to increase operating pressure resulting in spill with large impact
Mechanical Failure - Annulars - BOP Stack (linked Type (I, P or M): P Release of hydrocarbons to atmosphere
to 2.3.1.4) Redundant annulars potentially resulting in fire/explosion hazard with
Wear - Annulars - BOP Stack (linked to 2.3.1.5) Type (I, P or M): P large impact
External Leak/Rupture - Annulars - BOP Stack Redundant Rams Down time, after well control issue is resolved,
(linked to 2.3.1.1) Type (I, P or M): P to repair an individual C&K valve that cannot be
Pressure test every 14 days operated
Type (I, P or M): M
Rebuild annulars between each well with
replacement (New lower, lower to upper & upper
to junk)
Type (I, P or M): M
2 Failure to Maintain Sealing Incorrect annular seal (bag) based on drilling Wellbore flow Significant down time that impacts operation
Pressure on Annulars mud Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Mechanical Failure - Annulars - BOP Stack (linked Ability to increase operating pressure resulting in spill with large impact
to 2.3.1.4) Type (I, P or M): P Release of hydrocarbons to atmosphere
Inadequate operating pressure Redundant annulars potentially resulting in fire/explosion hazard with
Wear - Annulars - BOP Stack (linked to 2.3.1.5) Type (I, P or M): P large impact
External Leak/Rupture - Annulars - BOP Stack Rams are a back up and can be used to seal Down time, after well control issue is resolved,
(linked to 2.3.1.1) around drill pipe to repair an individual C&K valve that cannot be
Redundant Rams
Type (I, P or M): P
Pressure test every 14 days
Type (I, P or M): M
Rebuild annulars between each well with
replacement (New lower, lower to upper & upper
to junk)
Type (I, P or M): M
Enterprise A 46
LEADER
4- Hang-off the drill pipe on a ram BOP and control
the wellbore
Enterprise A 47
LEADER
1.4.1 Functional Failure: Failure of hang-off ram to close - Hang-off the drill pipe on a ram BOP and control the wellbore
1 Failure to Provide Control Wiring harness fails Redundancy of annular and redundant pipe rams Potential down time that can impact operation
Signal to Hang-off Ram Loss of Power (UPS Shuts down with power Type (I, P or M): P No well control issues identified for this condition
When Demanded degradation) - Power - Surface Control Systems Redundancy with fail-safe valves due to other available options
Electrical Short - Power - Surface Control ROV intervention - will close 1 of the pipe rams
2.1.3.2)
(linked to 2.1.3.7)
2.1.5.2)
(linked to 2.1.5.7)
2.2.1.3)
Enterprise A 48
LEADER

2 Failure to Supply Hydraulic Internal Leak - HPU - Surface Control Systems Redundancy of annular and redundant pipe rams Potential down time that can impact operation
Fluid & Pressure to Hang-off (linked to 2.1.1.2) Type (I, P or M): P No well control issues identified for this condition
Ram Plugged - HPU - Surface Control Systems (linked Redundancy with fail-safe valves due to other available options
to 2.1.1.3) Type (I, P or M): P
External Leak/Rupture - HPU - Surface Control ROV intervention - will close 1 of the pipe rams
Mechanical Failure - HPU - Surface Control
(linked to 2.2.2.1)
2.2.2.2)
2.2.5.2)
2.3.1.3)
to 2.3.6.2)
2.2.2.3)
Enterprise A 49
LEADER

2.1.6.7)
(linked to 2.2.2.4)
(linked to 2.2.2.6)
(linked to 2.2.5.4)
(linked to 2.2.3.5)
(linked to 2.2.5.6)
2.2.5.3)
(linked to 2.3.6.1)
(linked to 2.3.1.1)
Enterprise A 50
LEADER

(linked to 2.2.5.1)
(linked to 2.3.5.5)
2.3.1.2)
3 Failure to Close Hang-off Shaft seal leaks with higher wellbore pressure Other pipe rams & annular Potential down time that can impact operation
Ram on Demand than operating pressure to close side of piston Type (I, P or M): P No well control issues identified for this condition
Internal Leak - Annulars - BOP Stack (linked to Redundancy of annular and redundant pipe rams due to other available options
2.3.1.2) Type (I, P or M): P
Internal Leak - Connectors - BOP Stack (linked Redundancy with fail-safe valves
to 2.3.6.2) Type (I, P or M): P
External Leak/Rupture - Annulars - BOP Stack ROV intervention - will close 1 of the pipe rams
(linked to 2.3.5.5)
Enterprise A 51
LEADER
1.4.2 Functional Failure: Failure to maintain closing pressure - Hang-off the drill pipe on a ram BOP and control the wellbore
1 Failure to Maintain Closing Motion compensator fails to prevent excessive Motion compensator for drill string to avoid Potential down time/operational hit due to loss
Pressure on Hang-off Ram wear on ram blocks excess wear on seals of the drillpipe in the hole and having to pull the
Internal Leak - HPU - Surface Control Systems Type (I, P or M): P pipe
(linked to 2.1.1.2) MPL on rams
External Leak/Rupture - HPU - Surface Control Type (I, P or M): P
Systems (linked to 2.1.1.1) Multi position locking (MPL)
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): P
to 2.1.1.3) Redundant rams to hang-off
Mechanical Failure - HPU - Surface Control Type (I, P or M): P
Systems (linked to 2.1.1.4) Lock test on surface (without closing pressure)
Loss of Function (general) - HPU - Surface Type (I, P or M): M
Control Systems (linked to 2.1.1.7) Wellbore tests
Wear - Casing Shear Ram - BOP Stack (linked to Type (I, P or M): M
2.3.3.5)
Wear - Pipe & Test Rams - BOP Stack (linked to
2.3.4.5)
(linked to 2.2.2.1)
2.2.2.2)
2.2.5.2)
2.2.2.3)
2.1.6.7)
Enterprise A 52
LEADER
1.4.2 Functional Failure: Failure to maintain closing pressure - Hang-off the drill pipe on a ram BOP and control the wellbore

(linked to 2.2.2.4)
(linked to 2.2.2.6)
2.3.2.5)
(linked to 2.2.5.1)
(linked to 2.3.6.1)
Enterprise A 53
LEADER
1.4.3 Functional Failure: Failure to maintain locking - Hang-off the drill pipe on a ram BOP and control the wellbore
1 Failure to Engage Lock on Internal Leak - Blind Shear Ram - BOP Stack Pipe has dropped down the hole Potential down time/operational hit due to loss
Hang-off Ram (linked to 2.3.2.2) Type (I, P or M): I of the drillpipe in the hole and having to pull the
External Leak/Rupture - Blind Shear Ram - BOP Rams are periodically lock tested on surface pipe
Stack (linked to 2.3.2.1) (without closing pressure)
Wear - Casing Shear Ram - BOP Stack (linked to Type (I, P or M): M
2.3.3.5) Signature tests using low pressure (i.e., 50 psi)
Wear - Blind Shear Ram - BOP Stack (linked to to test ram drag between wells. Use hot-line to
2.3.2.5) ram to test pressure required to close ram.
Expectation is that pressure will stay low during
Mechanical Failure - Casing Shear Ram - BOP test, until rams are fully closed.
Stack (linked to 2.3.3.4) Type (I, P or M): M
Mechanical Failure - Blind Shear Ram - BOP Surface pressure tests on the ram
Type (I, P or M): M
Enterprise A 54
LEADER
5- Controlled operation - Shear the drill pipe and seal
the wellbore
Enterprise A 55
LEADER
1.5.1 Functional Failure: Failure to close - Controlled operation - Shear the drill pipe and seal the wellbore
1 Failure to Provide Control Wiring harness fails E/H backup Significant down time that impacts operation
Signal to Shear Ram When Loss of Power (UPS Shuts down with power Type (I, P or M): P Release of hydrocarbons to air or sea potentially
Demanded degradation) - Power - Surface Control Systems Redundancy of annular and redundant pipe rams resulting in spill with large impact
(linked to 2.1.2.1) Type (I, P or M): P Release of hydrocarbons to atmosphere
Electrical Short - Power - Surface Control Redundancy with fail-safe valves potentially resulting in fire/explosion hazard with
Fails to respond to input - Electrical - Blue & ROV intervention - will close 1 of the pipe rams Down time, after well control issue is resolved,
Yellow Control Systems - Electrical - Subsea Type (I, P or M): P to repair an individual C&K valve that cannot be
Control Systems (linked to 2.2.1.4) operated
2.1.3.2)
(linked to 2.1.3.7)
2.1.5.2)
(linked to 2.1.5.7)
2.2.1.3)
Enterprise A 56
LEADER

2 Failure to Supply Hydraulic Internal Leak - HPU - Surface Control Systems Redundancy of annular and redundant pipe rams Significant down time that impacts operation
Fluid & Pressure to Shear (linked to 2.1.1.2) Type (I, P or M): P Release of hydrocarbons to air or sea potentially
Ram Plugged - HPU - Surface Control Systems (linked Redundancy with fail-safe valves resulting in spill with large impact
Mechanical Failure - HPU - Surface Control ROV intervention - will close 1 of the pipe rams potentially resulting in fire/explosion hazard with
Loss of Function (general) - HPU - Surface Down time, after well control issue is resolved,
Control Systems (linked to 2.1.1.7) to repair an individual C&K valve that cannot be
Plugged - Choke & Kill Lines & Valves - BOP operated
(linked to 2.2.2.1)
2.2.2.2)
2.3.1.3)
2.3.1.2)
2.2.5.2)
2.2.2.3)
to 2.3.6.2)
(linked to 2.2.2.4)
Enterprise A 57
LEADER

2.1.6.7)
(linked to 2.2.2.6)
(linked to 2.2.5.4)
(linked to 2.2.3.5)
2.2.5.3)
(linked to 2.2.5.6)
(linked to 2.3.1.1)
(linked to 2.2.5.1)
Enterprise A 58
LEADER

(linked to 2.3.5.5)
(linked to 2.3.6.1)
Enterprise A 59
LEADER
1.5.2 Functional Failure: Failure to shear the drill pipe - Controlled operation - Shear the drill pipe and seal the wellbore
1 Failure to Shear Pipe Having incorrect space out/non-shearables Improper gallon count on hydraulics & flow Significant down time that impacts operation
across the rams meter Release of hydrocarbons to air or sea potentially
Internal Leak - HPU - Surface Control Systems Type (I, P or M): I resulting in spill with large impact
(linked to 2.1.1.2) No change in string weight (likely first indication) Release of hydrocarbons to atmosphere
External Leak/Rupture - HPU - Surface Control Type (I, P or M): I potentially resulting in fire/explosion hazard with
Systems (linked to 2.1.1.1) Wellbore flow large impact
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): I Down time, after well control issue is resolved,
to 2.1.1.3) All operators have been upgraded to 5k psi pipe to repair an individual C&K valve that cannot be
Mechanical Failure - HPU - Surface Control rams operated
Loss of Function (general) - HPU - Surface Open shear, move pipe and re-attempt shear
Corrosion/Erosion - Casing Shear Ram - BOP Other shear rams (priority would be casing
Stack (linked to 2.3.3.6) shears & then blind shear rams)
Type (I, P or M): P
Corrosion/Erosion - Blind Shear Ram - BOP Stack
(linked to 2.3.2.6) Planning of contingencies before putting non-
shearables down the hole
Internal Leak - Casing Shear Ram - BOP Stack Type (I, P or M): P
(linked to 2.3.3.2)
Rotate the drill pipe and pull (twist off pipe)
External Leak / Rupture - Blue & Yellow Control Type (I, P or M): P
(linked to 2.2.2.1) Annual inspection of shear rams and shear-ram
blocks & blades. Replace blades after shearing,
Loss of Function (general) - Hydraulic Supply - or every 5 years for full NDT and certification.
Internal Leak - Blue & Yellow Control Systems - Shear tests performed for variety of pipe
Hydraulics - Subsea Control Systems (linked to used/provided. Sent specimen with higher
2.2.2.2) elongation % for testing. Rental pipe requires
External Leak/Rupture - Surface Control Systems certification of properties and shearability.
- Accumulators - Surface (linked to 2.1.6.1) Subsea shearing tests were performed as
Internal Leak - Blind Shear Ram - BOP Stack validation, post-Macondo
External Leak/Rupture - Blind Shear Ram - BOP Tests performed to validate shearability of off-
Stack (linked to 2.3.2.1) centered pipe
Type (I, P or M): M
External Leak/Rupture - Casing Shear Ram - BOP
2.2.2.3)
Enterprise A 60
LEADER

2.2.5.2)
2.1.6.7)
(linked to 2.2.2.4)
(linked to 2.2.2.6)
(linked to 2.2.3.5)
(linked to 2.2.5.4)
2.3.3.5)
2.3.2.5)
2.2.5.3)
(linked to 2.2.5.6)
Enterprise A 61
LEADER

(linked to 2.2.5.1)
Enterprise A 62
LEADER
1.5.3 Functional Failure: Failure to seal the wellbore - Controlled operation - Shear the drill pipe and seal the wellbore
1 Failure of Shear Ram to Seal Shear seat not in correct location Improper gallon count on hydraulics & flow Significant down time that impacts operation
On Demand Obstruction of sealing surface meter Release of hydrocarbons to air or sea potentially
Type (I, P or M): I resulting in spill with large impact
Trash in the well (swarf, concrete, etc.)
No change in string weight (likely first indication) Release of hydrocarbons to atmosphere
Internal Leak - HPU - Surface Control Systems Type (I, P or M): I
(linked to 2.1.1.2) potentially resulting in fire/explosion hazard with
Wellbore flow large impact
External Leak/Rupture - HPU - Surface Control Type (I, P or M): I
Systems (linked to 2.1.1.1) Down time, after well control issue is resolved,
All operators have been upgraded to 5k psi pipe to repair an individual C&K valve that cannot be
Plugged - HPU - Surface Control Systems (linked rams operated
to 2.1.1.3) Type (I, P or M): P
Mechanical Failure - HPU - Surface Control Dimensional inspection of seal plate and wear
Systems (linked to 2.1.1.4) plate (frequency varies from between well, to
Loss of Function (general) - HPU - Surface annually)
External Leak/Rupture - Surface Control Systems Open shear, move pipe and re-attempt shear
Corrosion/Erosion - Blind Shear Ram - BOP Stack Other shear rams (priority would be casing
(linked to 2.3.2.6) shears & then blind shear rams)
Corrosion/Erosion - Casing Shear Ram - BOP Type (I, P or M): P
Stack (linked to 2.3.3.6) Planning of contingencies before putting non-
External Leak / Rupture - Blue & Yellow Control shearables down the hole
(linked to 2.2.2.1) Redundant pipe rams and annulars
Hydraulics - Subsea Control Systems (linked to Rotate the drill pipe and pull (twist off pipe)
2.2.2.2) Type (I, P or M): P
Loss of Function (general) - Hydraulic Supply - Annual inspection of shear rams and shear-ram
Surface Control Systems (linked to 2.1.4.7) blocks & blades. Replace blades after shearing,
Internal Leak - Blind Shear Ram - BOP Stack or every 5 years for full NDT and certification.
Having incorrect space out/non-shearables End of well maintenance
across the rams Type (I, P or M): M
Internal Leak - Casing Shear Ram - BOP Stack Fourteen day functional testing of blind shears
External Leak/Rupture - Hydraulic Supply - Shear tests performed for variety of pipe
Surface Control Systems (linked to 2.1.4.1) used/provided. Sent specimen with higher
elongation % for testing. Rental pipe requires
certification of properties and shearability.
Subsea shearing tests were performed as
2.2.2.3)
validation, post-Macondo
Tests performed to validate shearability of off-
2.2.5.2)
centered pipe
Type (I, P or M): M
Enterprise A 63
LEADER

2.1.6.7)
(linked to 2.2.2.4)
(linked to 2.2.2.6)
(linked to 2.2.5.4)
(linked to 2.2.3.5)
2.3.3.5)
2.2.5.3)
2.3.2.5)
Enterprise A 64
LEADER

(linked to 2.2.5.6)
(linked to 2.2.5.1)
2 Failure to Maintain Sealing Internal Leak - HPU - Surface Control Systems Motion compensator for drill string to avoid Significant down time that impacts operation
Pressure on Shear Ram (linked to 2.1.1.2) excess wear on seals Release of hydrocarbons to air or sea potentially
External Leak/Rupture - HPU - Surface Control Type (I, P or M): P resulting in spill with large impact
Systems (linked to 2.1.1.1) MPL Release of hydrocarbons to atmosphere
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): P potentially resulting in fire/explosion hazard with
to 2.1.1.3) Multiposition locking (MPL) large impact
Mechanical Failure - HPU - Surface Control Type (I, P or M): P Down time, after well control issue is resolved,
Systems (linked to 2.1.1.4) Lock test on surface (without closing pressure) to repair an individual C&K valve that cannot be
Loss of Function (general) - HPU - Surface Type (I, P or M): M operated
Control Systems (linked to 2.1.1.7) Wellbore tests
External Leak / Rupture - Blue & Yellow Control Type (I, P or M): M
(linked to 2.2.2.1)
2.2.2.2)
2.2.2.3)
2.2.5.2)
Motion compensator fails to prevent excessive
wear on ram blocks
Enterprise A 65
LEADER

(linked to 2.2.2.4)
2.1.6.7)
(linked to 2.2.2.6)
2.3.3.5)
2.3.2.5)
(linked to 2.2.5.1)
(linked to 2.3.6.1)
Enterprise A 66
LEADER
1.5.4 Functional Failure: Unintentional closing / opening - Controlled operation - Shear the drill pipe and seal the wellbore
1 Unintentional Closing Internal Leak - Autoshear System - BOP Stack No known single failure (i.e., arm solenoid then Significant down time that impacts operation
(linked to 2.3.7.2) fire solenoid) Release of hydrocarbons to air or sea potentially
External Leak/Rupture - Autoshear System - BOP Type (I, P or M): P resulting in spill with large impact
Stack (linked to 2.3.7.1) Weekly BOP function test Release of hydrocarbons to atmosphere
Mechanical Failure - Autoshear System - BOP Type (I, P or M): M potentially resulting in fire/explosion hazard with
Stack (linked to 2.3.7.4) large impact
Down time, after well control issue is resolved,
to repair an individual C&K valve that cannot be
operated
2 Unintentional Opening External Leak/Rupture - HPU - Surface Control Flow meter, if closely monitoring Significant down time that impacts operation
Systems (linked to 2.1.1.1) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Internal Leak - HPU - Surface Control Systems Procedural steps to check control system status resulting in spill with large impact
(linked to 2.1.1.2) of ram/valve location prior to latch back Release of hydrocarbons to atmosphere
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): P potentially resulting in fire/explosion hazard with
to 2.1.1.3) large impact
(linked to 2.2.2.1)
2.2.2.2)
2.2.2.3)
Enterprise A 67
LEADER
1.5.4 Functional Failure: Unintentional closing / opening - Controlled operation - Shear the drill pipe and seal the wellbore

2.1.6.7)
(linked to 2.2.2.4)
(linked to 2.2.2.6)
2.3.3.5)
2.3.2.5)
Enterprise A 68
LEADER
1.5.5 Functional Failure: Closes too slowly - Controlled operation - Shear the drill pipe and seal the wellbore
1 Actuates Too Slowly on Plugged - HPU - Surface Control Systems (linked Gallon count If drillpipe has not been sheared, and is still
Demand to 2.1.1.3) Type (I, P or M): I moving, joint could damage shear ram resulting
Plugged - Choke & Kill Lines & Valves - BOP Hydraulic flow meter in serious operational issues
Stack (linked to 2.3.5.3) Type (I, P or M): I Likelihood of additional influx of hydrocarbons
Plugged - Blue & Yellow Control Systems - String weight indicator into Riser resulting in severe
Hydraulics - Subsea Control Systems (linked to Type (I, P or M): I safety/environmental effects
2.2.2.3) High pressure close option Down time, after well control issue is resolved,
Plugged - Hydraulic Supply: Rigid Conduit and Type (I, P or M): P to repair an individual C&K valve that cannot be
Manifold - Subsea Control Systems (linked to operated
Weekly function tests
2.2.5.3) Type (I, P or M): M
Enterprise A 69
LEADER
1.5.6 Functional Failure: Loss of containment - Controlled operation - Shear the drill pipe and seal the wellbore
1 External Leak External Leak/Rupture - HPU - Surface Control Hydraulic fluid flow meter Likelihood of additional influx of hydrocarbons
Systems (linked to 2.1.1.1) Type (I, P or M): I into Riser resulting in severe
External Leak / Rupture - Blue & Yellow Control Wellbore flow safety/environmental effects
Systems - Hydraulics - Subsea Control Systems Type (I, P or M): I Down time, after well control issue is resolved,
(linked to 2.2.2.1) Redundant annulars with redundant pipe rams to repair an individual C&K valve that cannot be
External leak/rupture - Hydraulic Supply: Rigid Type (I, P or M): P operated
Conduit and Manifold - Subsea Control Systems Redundant controls
External Leak/Rupture - Choke & Kill Lines & ROV intervention
Valves - BOP Stack (linked to 2.3.5.1) Type (I, P or M): P
Maintenance/overhaul at end of every well for
annulars
Type (I, P or M): M
2 Rupture No credible causes resulting in rupture during Significant down time that impacts operation
'Controlled operation - Shear the drill pipe and Release of hydrocarbons to air or sea potentially
seal the wellbore' resulting in spill with large impact
Enterprise A 70
LEADER
6- Emergency Operation: Auto-Shear - Shear the drill
pipe and seal the wellbore
Enterprise A 71
LEADER
1.6.1 Functional Failure: Failure to Arm - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore
1 Failure to Provide Control Loss of, or Degraded Power - Secondary & No electrical feedback (pod mismatch) that the Down time/operational impact as this action is
Signal Emergency Control Systems - Surface Control solenoid operated completed after landing BOP. If re-arming fails,
Systems (linked to 2.1.8.1) Type (I, P or M): I operations will stop and the cause(s)
Loss of Power (UPS Shuts down with power Redundant touch screen, controllers, control investigated
degradation) - Power - Surface Control Systems pods, cables, powers supplies, SEM exist
Electrical Short - Power - Surface Control ROV has the ability to arm the system subsea
Fails to respond to input - Electrical - Blue & Autoshear is rebuilt every year
Yellow Control Systems - Electrical - Subsea Type (I, P or M): M
Control Systems (linked to 2.2.1.4) Subsea testing occurs once the BOP is latched-
Loss of function (general) - Blue & Yellow up
Control Systems - Electrical - Subsea Control Type (I, P or M): M
Systems (linked to 2.2.1.7) Surface testing between every well
Wiring harness fails Type (I, P or M): M
2.1.3.2)
(linked to 2.1.3.7)
2.1.5.2)
Fails with no output signal/communication
(Includes Short) - Secondary & Emergency
Control Systems - Surface Control Systems
(linked to 2.1.8.2)
(linked to 2.1.5.7)
Enterprise A 72
LEADER
1.6.1 Functional Failure: Failure to Arm - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore

Loss of function (general) - Secondary &
Emergency Control Systems - Surface Control
2.2.1.3)
Enterprise A 73
LEADER
1.6.2 Functional Failure: Failure to close - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore
1 Failure to Supply Hydraulic External Leak/Rupture - HPU - Surface Control Redundancy of annular and redundant pipe rams Significant down time that impacts operation
Fluid & Pressure to Shear Systems (linked to 2.1.1.1) Type (I, P or M): P Release of hydrocarbons to air or sea potentially
Ram Internal Leak - HPU - Surface Control Systems Redundancy with fail-safe valves resulting in spill with large impact
(linked to 2.1.1.2) Type (I, P or M): P Release of hydrocarbons to atmosphere
Plugged - HPU - Surface Control Systems (linked ROV intervention - will close 1 of the pipe rams potentially resulting in fire/explosion hazard with
to 2.1.1.3) Type (I, P or M): P large impact
Mechanical Failure - HPU - Surface Control Down time, after well control issue is resolved,
Systems (linked to 2.1.1.4) to repair an individual C&K valve that cannot be
Loss of Function (general) - HPU - Surface operated
(linked to 2.2.2.1)
2.2.2.2)
Internal Leak - Blind Shear Ram - BOP Stack
(linked to 2.3.2.2)
Internal Leak - Casing Shear Ram - BOP Stack
(linked to 2.3.3.2)
External Leak/Rupture - Autoshear System - BOP
to 2.3.6.2)
2.2.2.3)
2.2.5.2)
Enterprise A 74
LEADER

(linked to 2.2.2.4)
2.3.3.5)
2.1.6.7)
(linked to 2.2.2.6)
(linked to 2.2.3.5)
(linked to 2.2.5.4)
Internal Leak - Autoshear System - BOP Stack
(linked to 2.3.7.2)
Enterprise A 75
LEADER

2.2.5.3)
(linked to 2.2.5.6)
2.3.2.5)
(linked to 2.2.5.1)
(linked to 2.3.5.5)
(linked to 2.3.6.1)
2 Failure to initiate autoshear Internal Leak - HPU - Surface Control Systems If ROV is present, pressure decrease in Significant down time that impacts operation
sequence (linked to 2.1.1.2) accumulator will be evident Release of hydrocarbons to air or sea potentially
External Leak/Rupture - Surface Control Systems Type (I, P or M): I resulting in spill with large impact
- Accumulators - Surface (linked to 2.1.6.1) If testing, indicators exist on surface (MUX Release of hydrocarbons to atmosphere
Internal Leak - Surface Control Systems - alarms) potentially resulting in fire/explosion hazard with
Accumulators - Surface (linked to 2.1.6.2) Type (I, P or M): I large impact
Wear - Surface Control Systems - Accumulators - ROV can arm and close the rams subsea Down time, after well control issue is resolved,
Surface (linked to 2.1.6.5) Type (I, P or M): P to repair an individual C&K valve that cannot be
External Leak / Rupture - Blue & Yellow Control Testing of system between wells on surface operated
Systems - Hydraulics - Subsea Control Systems Type (I, P or M): M
(linked to 2.2.2.1) Testing of system once latched-up
Loss of Function (general) - Surface Control Type (I, P or M): M
2.1.6.7)
2.2.2.2)
Enterprise A 76
LEADER

2.2.5.2)
(linked to 2.2.2.4)
(linked to 2.2.2.6)
(linked to 2.2.3.5)
(linked to 2.2.5.4)
(linked to 2.3.7.2)
Mechanical Failure - Autoshear System - BOP
2.2.5.3)
(linked to 2.2.5.6)
(linked to 2.2.5.1)
Enterprise A 77
LEADER
1.6.3 Functional Failure: Failure to shear the drill pipe - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore
1 Failure to Supply Hydraulic Non-shearable in the way Deadheading of pump Significant down time that impacts operation
Fluid & Pressure to Shear External Leak/Rupture - HPU - Surface Control Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Ram Systems (linked to 2.1.1.1) Flow meter (volume to actuate is known, should resulting in spill with large impact
Plugged - HPU - Surface Control Systems (linked go 0 to 0.7 to 0 in ~ 5 seconds) If too high = Release of hydrocarbons to atmosphere
to 2.1.1.3) leak. If long time = galling or leak potentially resulting in fire/explosion hazard with
Type (I, P or M): I large impact
Systems (linked to 2.1.1.4) Increasing pressure Down time, after well control issue is resolved,
Control Systems (linked to 2.1.1.7) Pressure test chambers at end of well operated
Type (I, P or M): M
Systems - Hydraulics - Subsea Control Systems Shell test using end of tail rod between wells, on
(linked to 2.2.2.1) surface
Type (I, P or M): M
Surface Control Systems (linked to 2.1.4.7) Weekly function test of stack
Type (I, P or M): M
Stack (linked to 2.3.5.3) Wellbore test between wells and 14 while subsea
Type (I, P or M): M
2.2.2.3)
2.1.6.7)
(linked to 2.2.3.5)
(linked to 2.3.7.2)
Enterprise A 78
LEADER

2.2.5.3)
(linked to 2.2.5.1)
2 Failure to Shear Pipe Having incorrect space out/non-shearables Improper gallon count on hydraulics & flow Significant down time that impacts operation
across the rams meter Release of hydrocarbons to air or sea potentially
External Leak/Rupture - HPU - Surface Control Type (I, P or M): I resulting in spill with large impact
Systems (linked to 2.1.1.1) No change in string weight (likely first indication) Release of hydrocarbons to atmosphere
Internal Leak - HPU - Surface Control Systems Type (I, P or M): I potentially resulting in fire/explosion hazard with
(linked to 2.1.1.2) Wellbore flow large impact
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): I Down time, after well control issue is resolved,
to 2.1.1.3) All operators have been upgraded to 5k psi pipe to repair an individual C&K valve that cannot be
Mechanical Failure - HPU - Surface Control rams operated
Loss of Function (general) - HPU - Surface Other shear rams (priority would be casing
Control Systems (linked to 2.1.1.7) shears & then blind shear rams)
Type (I, P or M): P
Systems - Hydraulics - Subsea Control Systems Open shear, move pipe and re-attempt shear
Corrosion/Erosion - Casing Shear Ram - BOP Planning of contingencies before putting non-
Stack (linked to 2.3.3.6) shearables down the hole
Type (I, P or M): P
(linked to 2.3.2.6) Annual inspection of shear rams and shear-ram
blocks & blades. Replace blades after shearing,
Loss of Function (general) - Hydraulic Supply - or every 5 years for full NDT and certification.
Internal Leak - Blue & Yellow Control Systems - Tests performed to validate shearability of off-
Hydraulics - Subsea Control Systems (linked to centered pipe
2.2.2.2) Type (I, P or M): M
Enterprise A 79
LEADER

Shear tests performed for variety of pipe
Internal Leak - Blind Shear Ram - BOP Stack used/provided. Sent specimen with higher
(linked to 2.3.2.2) elongation % for testing. Rental pipe requires
certification of properties and shearability.
External Leak/Rupture - Hydraulic Supply - Subsea shearing tests were performed as
Surface Control Systems (linked to 2.1.4.1) validation, post-Macondo
Plugged - Blue & Yellow Control Systems - Type (I, P or M): M
2.2.2.3)
2.2.5.2)
(linked to 2.3.3.2)
(linked to 2.2.2.4)
2.1.6.7)
(linked to 2.2.2.6)
2.3.3.5)
(linked to 2.2.3.5)
Enterprise A 80
LEADER

2.2.5.3)
(linked to 2.2.5.6)
(linked to 2.2.5.1)
Enterprise A 81
LEADER
1.6.4 Functional Failure: Failure to seal the wellbore - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore
1 Failure of Shear Ram to Seal External Leak/Rupture - HPU - Surface Control ROV confirmation if present Significant down time that impacts operation, if
On Demand Systems (linked to 2.1.1.1) Type (I, P or M): I still latched to rig
Internal Leak - HPU - Surface Control Systems Maintenance and testing program on BOP and Release of hydrocarbons to air or sea potentially
(linked to 2.1.1.2) autoshear functionality previously listed resulting in spill with large impact, if still latched
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): M to rig
to 2.1.1.3) Release of hydrocarbons to atmosphere
Mechanical Failure - HPU - Surface Control potentially resulting in fire/explosion hazard with
Systems (linked to 2.1.1.4) large impact, if still latched to rig
Loss of Function (general) - HPU - Surface Down time, after well control issue is resolved,
operated, if still latched to rig
Shear seat not in correct location
Release of hydrocarbons to air or sea potentially
Obstruction of sealing surface resulting in spill with large impact
Trash in the well (swarf, concrete, etc.) Significant down time that impacts operation, if
Having incorrect space out/non-shearables unlatched from the rig
across the rams
(linked to 2.2.2.1)
2.2.2.2)
(linked to 2.3.2.6)
(linked to 2.3.2.2)
Corrosion/Erosion - Casing Shear Ram - BOP
2.2.2.3)
2.2.5.2)
Enterprise A 82
LEADER

(linked to 2.3.3.2)
(linked to 2.2.2.4)
2.1.6.7)
(linked to 2.2.2.6)
(linked to 2.2.5.4)
(linked to 2.2.3.5)
2.3.3.5)
2.2.5.3)
2.3.2.5)
Enterprise A 83
LEADER

(linked to 2.2.5.1)
(linked to 2.2.5.6)
2 Failure to Maintain Sealing External Leak/Rupture - HPU - Surface Control ROV confirmation if present Significant down time that impacts operation, if
Pressure on Shear Ram Systems (linked to 2.1.1.1) Type (I, P or M): I still latched to rig
Internal Leak - HPU - Surface Control Systems MPL Release of hydrocarbons to air or sea potentially
(linked to 2.1.1.2) Type (I, P or M): P resulting in spill with large impact, if still latched
Plugged - HPU - Surface Control Systems (linked Remaining accumulator pressure to rig
Mechanical Failure - HPU - Surface Control Maintenance and testing program on BOP and potentially resulting in fire/explosion hazard with
Systems (linked to 2.1.1.4) autoshear functionality previously listed large impact, if still latched to rig
Loss of Function (general) - HPU - Surface Type (I, P or M): M Down time, after well control issue is resolved,
Systems - Hydraulics - Subsea Control Systems Release of hydrocarbons to air or sea potentially
(linked to 2.2.2.1) resulting in spill with large impact
Corrosion/Erosion - Blind Shear Ram - BOP Stack Significant down time that impacts operation, if
(linked to 2.3.2.6) unlatched from the rig
Shear seat not in correct location
Obstruction of sealing surface
2.2.2.2)
Trash in the well (swarf, concrete, etc.)
Having incorrect space out/non-shearables
across the rams
2.2.2.3)
(linked to 2.3.2.2)
Corrosion/Erosion - Casing Shear Ram - BOP
Enterprise A 84
LEADER

(linked to 2.3.3.2)
(linked to 2.2.2.4)
2.2.5.2)
2.1.6.7)
(linked to 2.2.2.6)
(linked to 2.2.5.4)
2.3.3.5)
(linked to 2.2.3.5)
Enterprise A 85
LEADER

2.2.5.3)
2.3.2.5)
(linked to 2.2.5.1)
(linked to 2.2.5.6)
Enterprise A 86
LEADER
1.6.5 Functional Failure: Unintentional closing / opening - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore
1 Unintentional Closing Autoshear system activates/shears when If latched, stack accumulator pressure alarm Significant down time that impacts operation, if
intentionally disarmed Type (I, P or M): I still latched to rig
Loss of Function (general) - Autoshear System - If latched, annulars MAY still be an option Release of hydrocarbons to air or sea potentially
BOP Stack (linked to 2.3.7.7) Type (I, P or M): P resulting in spill with large impact, if still latched
Corrosion/Erosion - Autoshear System - BOP Specific arm/disarm procedures from OEM to rig
Stack (linked to 2.3.7.6) Type (I, P or M): P Release of hydrocarbons to atmosphere
Autoshear is rebuilt every year potentially resulting in fire/explosion hazard with
Type (I, P or M): M large impact, if still latched to rig
Autoshear surface testing to ensure it will fire Down time, after well control issue is resolved,
when conditions are met & also to ensure it will to repair an individual C&K valve that cannot be
not fire unless all proper conditions are met prior operated, if still latched to rig
to firing Release of hydrocarbons to air or sea potentially
Type (I, P or M): M resulting in spill with large impact
Significant down time that impacts operation, if
unlatched from the rig
2 Unintentional Opening If not properly closed & blocked, system will Flow meter, if closely monitoring Significant down time that impacts operation
return to last known state (what the control Type (I, P or M): I Release of hydrocarbons to air or sea potentially
system thinks it was), which could be open, Procedural steps to check control system status resulting in spill with large impact
when reconnecting to BOP of ram/valve location prior to latch back Release of hydrocarbons to atmosphere
External Leak/Rupture - HPU - Surface Control Type (I, P or M): P potentially resulting in fire/explosion hazard with
Systems (linked to 2.1.1.1) large impact
Internal Leak - HPU - Surface Control Systems Down time, after well control issue is resolved,
(linked to 2.1.1.2) to repair an individual C&K valve that cannot be
Plugged - HPU - Surface Control Systems (linked operated
to 2.1.1.3)
(linked to 2.2.2.1)
Plugged - Surface Control Systems -
2.2.2.2)
Enterprise A 87
LEADER
1.6.5 Functional Failure: Unintentional closing / opening - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore

2.2.2.3)
(linked to 2.2.2.4)
2.1.6.7)
(linked to 2.2.2.6)
2.3.3.5)
2.3.2.5)
Enterprise A 88
LEADER
1.6.6 Functional Failure: Closes too slowly - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore
1 Actuates Too Slowly on Air in hydraulic system Autoshear maintenance and testing program If drillpipe has not been sheared, and is still
Demand Plugged - HPU - Surface Control Systems (linked Type (I, P or M): M moving, joint could damage shear ram resulting
to 2.1.1.3) in serious operational issues
Plugged - Choke & Kill Lines & Valves - BOP Likelihood of additional influx of hydrocarbons
Stack (linked to 2.3.5.3) into Riser resulting in severe
safety/environmental effects
Hydraulics - Subsea Control Systems (linked to Down time, after well control issue is resolved,
2.2.2.3) to repair an individual C&K valve that cannot be
operated
2.2.5.3)
Enterprise A 89
LEADER
1.6.7 Functional Failure: Loss of containment - Emergency Operation - Auto-Shear - Shear the drill pipe and seal the wellbore
1 External Leak External Leak/Rupture - HPU - Surface Control ROV Intervention Significant down time that impacts operation, if
Systems (linked to 2.1.1.1) Type (I, P or M): P still latched to rig
External Leak / Rupture - Blue & Yellow Control BOP maintenance and testing programs Release of hydrocarbons to air or sea potentially
Systems - Hydraulics - Subsea Control Systems previously stated resulting in spill with large impact, if still latched
(linked to 2.2.2.1) Type (I, P or M): M to rig
External leak/rupture - Hydraulic Supply: Rigid Release of hydrocarbons to atmosphere
Conduit and Manifold - Subsea Control Systems potentially resulting in fire/explosion hazard with
(linked to 2.2.5.1) large impact, if still latched to rig
External Leak/Rupture - Choke & Kill Lines & Down time, after well control issue is resolved,
Valves - BOP Stack (linked to 2.3.5.1) to repair an individual C&K valve that cannot be
Release of hydrocarbons to air or sea potentially
resulting in spill with large impact
Significant down time that impacts operation, if
unlatched from the rig
2 Rupture Snagging the BOP when pulling away and LMRP & BOP High-angle release design Significant down time that impacts operation
damaging the wellhead Type (I, P or M): P Release of hydrocarbons to air or sea potentially
Riser recoil devices resulting in spill with large impact
Type (I, P or M): P
Enterprise A 90
LEADER
7- Emergency Operation: EDS - Disconnect from the
stack
Enterprise A 91
LEADER
1.7.1 Functional Failure: Failure to receive EDS signal - Emergency Operation: EDS - Disconnect from the stack
1 Failure to provide control Erratic output - Blue & Yellow Control Systems - Atypical current across solenoid coil Severe operational problems, including
signal, when demanded Electrical - Subsea Control Systems (linked to Type (I, P or M): I equipment damage
2.2.1.3) Communications failure via flashing red screen Environmental impact includes filling riser with
Loss of Power (UPS Shuts down with power on touch screen mud, if stack is pulled over and well head is
degradation) - Power - Surface Control Systems Type (I, P or M): I damaged
(linked to 2.1.2.1) Mud on rig floor Potential injuries on rig due to number of actions
Electrical Short - Power - Surface Control Type (I, P or M): I automatically occurring on the rig floor, moon
Systems (linked to 2.1.2.5) No LMRP separate signal pool, riser tensioners, as a result of EDS
Erratic output (Network) - MUX System - Surface Type (I, P or M): I actuation
Control Systems (linked to 2.1.3.4) No flow in flow meters
Fails to respond to input - MUX System - Surface Type (I, P or M): I
Control Systems (linked to 2.1.3.5) Pod mismatch & alarm
Fails to respond (with no output Type (I, P or M): I
signal/communication or to input) - Control Redundant mechanicals
Panels - Surface Control Systems (linked to Type (I, P or M): P
2.1.5.2)
Redundant touch screen, controllers, control
Loss of, or Degraded Power - Secondary & pods, cables, powers supplies, SEM
Emergency Control Systems - Surface Control Type (I, P or M): P
Between well surface (4 dry fires from different
Processing error - EDS - Subsea Control Systems stations, SEMs, Pods. Live fire from driller's pod)
Processing error - Blue & Yellow Control Systems Function test annular every 7 days
- Electrical - Subsea Control Systems (linked to Type (I, P or M): M
2.2.1.5)
Function tests between wells and upon latch-up
Erratic output - Control Panels - Surface Control Type (I, P or M): M
Live subsea on commissioning and every 5 years
Fails to respond to input - Electrical - Blue & (per pending API S53)
Yellow Control Systems - Electrical - Subsea Type (I, P or M): M
(linked to 2.1.5.7)
Erratic output - EDS - Subsea Control Systems
(linked to 2.2.4.3)
2.1.3.2)
Enterprise A 92
LEADER
1.7.1 Functional Failure: Failure to receive EDS signal - Emergency Operation: EDS - Disconnect from the stack

Fails with no output signal/communication -
Subsea Control Systems - EDS (linked to 2.2.4.2)
Ground Fault - EDS - Subsea Control Systems
(linked to 2.2.4.6)
(linked to 2.1.3.7)
Loss of, or Degraded Power - EDS - Subsea
(linked to 2.1.8.2)
Fails to respond to input - EDS - Subsea Control
Loss of function (general) - EDS - Subsea Control
Enterprise A 93
LEADER
1.7.2 Functional Failure: Failure to disconnect the LMRP - Emergency Operation: EDS - Disconnect from the stack
1 Failure to Provide Disconnect Wiring harness fails Communications failure via flashing red screen Severe operational problems, including
Signal (automatically) Loss of, or Degraded Power - Secondary & on touch screen equipment damage
Emergency Control Systems - Surface Control Type (I, P or M): I Environmental impact includes filling riser with
Systems (linked to 2.1.8.1) Pod mismatch and alarm mud, if stack is pulled over and well head is
Erratic output - EDS - Subsea Control Systems Type (I, P or M): I damaged
(linked to 2.2.4.3) E/H Backup Potential injuries on rig due to number of actions
Loss of Power (UPS Shuts down with power Type (I, P or M): P automatically occurring on the rig floor, moon
degradation) - Power - Surface Control Systems Plugs in well pool, riser tensioners, as a result of EDS
(linked to 2.1.2.1) Type (I, P or M): P actuation
Electrical Short - Power - Surface Control Redundant mechanicals
Fails to respond to input - Electrical - Blue & Redundant touch screen, controllers, control
Yellow Control Systems - Electrical - Subsea pods, cables, powers supplies, SEM
Loss of function (general) - Blue & Yellow ROV Intervention
Control Systems - Electrical - Subsea Control Type (I, P or M): P
Systems (linked to 2.2.1.7) Pulling BOP
Fails with no output signal/communication - MUX Type (I, P or M): M
2.1.3.2)
(linked to 2.1.3.7)
2.1.5.2)
(linked to 2.1.8.2)
Enterprise A 94
LEADER

(linked to 2.1.5.7)
2.2.1.3)
2 Failure LMRP / BOP to Wear - Connectors - BOP Stack (linked to No LMRP separation indication from LMRP Severe operational problems, including
Connect or Disengage 2.3.6.5) Type (I, P or M): I equipment damage
Mechanical Failure - Connectors - BOP Stack Surge/retry unlatch option is only possible by Environmental impact includes filling riser with
(linked to 2.3.6.4) swapping pods/SEMs mud, if stack is pulled over and well head is
Loss of Function (general) - Connectors - BOP Type (I, P or M): I damaged
Stack (linked to 2.3.6.7) Weight on hook Potential injuries on rig due to number of actions
Corrosion/Erosion - Connectors - BOP Stack Type (I, P or M): I automatically occurring on the rig floor, moon
(linked to 2.3.6.6) Surge with greater pressure pool, riser tensioners, as a result of EDS
Type (I, P or M): P actuation
to 2.3.6.2) Between well maintenance (clean, grease,
External Leak/Rupture - Connectors - BOP Stack inspect, pressure, & minimum unlock pressure
(linked to 2.3.6.1) test)
Type (I, P or M): M
Five year inspection of connectors
Type (I, P or M): M
Wellbore test every 14 days
Type (I, P or M): M
Enterprise A 95
LEADER
3 Failure of Hydraulic Fluid to External Leak/Rupture - HPU - Surface Control Manual indicators on valves that the ROV can Severe operational problems, including
disconnect Systems (linked to 2.1.1.1) read equipment damage
Internal Leak - HPU - Surface Control Systems Type (I, P or M): I Environmental impact includes filling riser with
(linked to 2.1.1.2) HPU pumps running constantly mud, if stack is pulled over and well head is
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): I damaged
to 2.1.1.3) Multiple pumps (1 pump needed, 3 pumps Potential injuries on rig due to number of actions
Mechanical Failure - HPU - Surface Control present) automatically occurring on the rig floor, moon
Systems (linked to 2.1.1.4) Type (I, P or M): P pool, riser tensioners, as a result of EDS
Accumulators with stored energy actuation
External Leak / Rupture - Blue & Yellow Control Design margin/safety factors (conduits work at
Systems - Hydraulics - Subsea Control Systems 5k, max @ 7.5k)
Internal Leak - Blue & Yellow Control Systems - Multiple annulars & rams
Hydraulics - Subsea Control Systems (linked to Type (I, P or M): P
2.2.2.2) Redundant conduit lines with ability to isolate
Internal Leak - Choke & Kill Lines & Valves - BOP leaking line and cross-connect via conduit
Stack (linked to 2.3.5.2) manifold
Type (I, P or M): P
Stack (linked to 2.3.5.3) Redundant functions between pods
Type (I, P or M): P
Type (I, P or M): P
Hydraulics - Subsea Control Systems (linked to Filter replacement frequency
2.2.2.3) Type (I, P or M): M
Internal Leak - Blind Shear Ram - BOP Stack Maintenance programs
Internal Leak - Casing Shear Ram - BOP Stack ROV inspection every 3 days
External Leak/Rupture - Hydraulic Supply - SOAK test between wells
Loss of Function (general) - Hydraulic Supply - Weekly BOP function test
(linked to 2.2.2.4)
2.2.5.2)
to 2.3.6.2)
Enterprise A 96
LEADER

(linked to 2.2.2.6)
(linked to 2.2.5.4)
2.1.6.7)
(linked to 2.2.3.5)
2.2.5.3)
Enterprise A 97
LEADER

(linked to 2.2.5.1)
(linked to 2.2.5.6)
2.3.2.5)
2.3.3.5)
(linked to 2.3.5.5)
(linked to 2.3.6.1)
4 Moves too slowly to External Leak/Rupture - HPU - Surface Control HPU pumps running constantly Severe operational problems, including
disconnect Systems (linked to 2.1.1.1) Type (I, P or M): I equipment damage
Plugged - HPU - Surface Control Systems (linked Manual indicators on valves that the ROV can Environmental impact includes filling riser with
to 2.1.1.3) read mud, if stack is pulled over and well head is
Mechanical Failure - HPU - Surface Control Type (I, P or M): I damaged
Systems (linked to 2.1.1.4) Accumulators with stored energy Potential injuries on rig due to number of actions
Loss of Function (general) - HPU - Surface Type (I, P or M): P automatically occurring on the rig floor, moon
Control Systems (linked to 2.1.1.7) Design margin/safety factors (conduits work at pool, riser tensioners, as a result of EDS
5k, max @ 7.5k) actuation
External Leak / Rupture - Blue & Yellow Control E/H backup
(linked to 2.2.2.1) Pod/SEM redundancy
Internal Leak - Surface Control Systems - Type (I, P or M): P
Accumulators - Surface (linked to 2.1.6.2) Multiple annulars & rams
Mechanical Failure - Surface Control Systems - Type (I, P or M): P
Accumulators - Surface (linked to 2.1.6.4) Multiple pumps (1 pump needed, 3 pumps
Wear - Surface Control Systems - Accumulators - present)
Surface (linked to 2.1.6.5) Type (I, P or M): P
Enterprise A 98
LEADER

Loss of Function (general) - Surface Control Possibility to use stack accumulator (ruin 5k stab
Systems - Accumulators - Surface (linked to though)
2.1.6.7) Type (I, P or M): P
Plugged - Choke & Kill Lines & Valves - BOP Redundant conduit lines with ability to isolate
Stack (linked to 2.3.5.3) leaking line and cross-connect via conduit
Plugged - Blue & Yellow Control Systems - manifold
2.2.2.3) Redundant functions between pods
External Leak/Rupture - Hydraulic Supply - Type (I, P or M): P
Loss of Function (general) - Hydraulic Supply - Type (I, P or M): P
Surface Control Systems (linked to 2.1.4.7) ROV intervention
External Leak/Rupture - Accumulators - Subsea Type (I, P or M): P
Control Systems (linked to 2.2.3.1) Filter replacement frequency
Internal Leak - Accumulators - Subsea Control Type (I, P or M): M
Systems (linked to 2.2.3.2) Maintenance programs
Mechanical Failure - Accumulators - Subsea Type (I, P or M): M
Control Systems (linked to 2.2.3.4) ROV inspection every 3 days
Plugged - Fluid Reservoir Unit - Surface Control Type (I, P or M): M
Systems (linked to 2.1.7.3) SOAK test between wells
Wear - Accumulators - Subsea Control Systems Type (I, P or M): M
(linked to 2.2.3.5) Weekly BOP function test
Loss of Function (general) - Accumulators - Type (I, P or M): M
(linked to 2.2.5.1)
2.2.5.3)
Enterprise A 99
LEADER
1.7.3 Functional Failure: Unintentional disconnect of the riser - Emergency Operation: EDS - Disconnect from the stack
1 Spurious Automatic EDS No credible causes resulting in spurious Visual indicators of it happening (mud volumes, Severe operational problems, including
Signal automatic disconnect signal during 'Emergency tensioners...) equipment damage
Operation: EDS - Disconnect from the stack' Type (I, P or M): I Environmental impact includes filling riser with
Weight indicator changes mud, if stack is pulled over and well head is
Type (I, P or M): I damaged
Implementation of latest Engineering Bulletin
Type (I, P or M): P
2 Unintentional Manual No credible causes resulting in Unintentional From drillers chair/console it is two switches that
Disconnect Signal Manual Disconnect Signal during 'Emergency are both covered
Operation: EDS - Disconnect from the stack' Type (I, P or M): P
Two hand operation, Password, confirmation
Type (I, P or M): P
Enterprise A 100
LEADER
8- Controlled Operation - Disconnect the LMRP from
the Lower BOP stack
Enterprise A 101
LEADER
1.8.1 Functional Failure: Failure to disconnect the LMRP - Controlled Operation - Disconnect the LMRP from the Lower BOP stack
1 Failure to Provide Disconnect Wiring harness fails Atypical current across solenoid coil Significant down time that impacts operation
Signal (automatically or Loss of, or Degraded Power - Secondary & Type (I, P or M): I
manually) Emergency Control Systems - Surface Control Communications failure via flashing red screen
Systems (linked to 2.1.8.1) on touch screen
Loss of Power (UPS Shuts down with power Type (I, P or M): I
degradation) - Power - Surface Control Systems No flow in flow meters
Electrical Short - Power - Surface Control Pod mismatch & alarm
Fails to respond to input - Electrical - Blue & E/H Backup
Yellow Control Systems - Electrical - Subsea Type (I, P or M): P
Control Systems (linked to 2.2.1.4) Plugs in well
Loss of function (general) - Blue & Yellow Type (I, P or M): P
Control Systems - Electrical - Subsea Control Redundant mechanicals
Fails with no output signal/communication - MUX Redundant touch screen, controllers, control
System - Surface Control Systems (linked to pods, cables, powers supplies, SEM
2.1.3.2) Type (I, P or M): P
Erratic output (Network) - MUX System - Surface ROV Intervention
Short - MUX System - Surface Control Systems Function tests between wells and upon latch-up
Loss of, or Degraded Power - Control Panels - Pulling BOP
Erratic output - EDS - Subsea Control Systems
(linked to 2.2.4.3)
2.1.5.2)
(linked to 2.1.8.2)
Enterprise A 102
LEADER

(linked to 2.1.5.7)
2.2.1.3)
2 Failure of LMRP / BOP Wear - Connectors - BOP Stack (linked to No LMRP separation indication from LMRP Significant down time that impacts operation
Connector to Disengage 2.3.6.5) Type (I, P or M): I Potential Safety issue whose impact depends on
Mechanical Failure - Connectors - BOP Stack ROV observation the cause for the disconnect, for example due to
(linked to 2.3.6.4) Type (I, P or M): I impending weather hazard
Corrosion/Erosion - Connectors - BOP Stack Weight on hook
Internal Leak - Connectors - BOP Stack (linked Pull BOP with LMRP
to 2.3.6.2) Type (I, P or M): P
External Leak/Rupture - Connectors - BOP Stack Surge with greater pressure
Between well maintenance (clean, grease,
inspect, pressure, & minimum unlock pressure
test)
Type (I, P or M): M
Five year inspection of latch mechanism
Type (I, P or M): M
Wellbore test every 14 days
Type (I, P or M): M
Enterprise A 103
LEADER
3 Failure of Hydraulic Fluid to External Leak/Rupture - HPU - Surface Control HPU pumps running constantly Significant down time that impacts operation
Disconnect Systems (linked to 2.1.1.1) Type (I, P or M): I Potential Safety issue whose impact depends on
Internal Leak - HPU - Surface Control Systems Manual indicators on valves that the ROV can the cause for the disconnect, for example due to
(linked to 2.1.1.2) read impending weather hazard
Plugged - HPU - Surface Control Systems (linked Type (I, P or M): I
to 2.1.1.3) Accumulators with stored energy
Mechanical Failure - HPU - Surface Control Type (I, P or M): P
Systems (linked to 2.1.1.4) Design margin/safety factors (conduits work at
Loss of Function (general) - HPU - Surface 5k, max @ 7.5k)
External Leak / Rupture - Blue & Yellow Control E/H backup
(linked to 2.2.2.1) Multiple annulars & rams
Hydraulics - Subsea Control Systems (linked to Multiple pumps (1 pump needed, 3 pumps
2.2.2.2) present)
Internal Leak - Choke & Kill Lines & Valves - BOP Type (I, P or M): P
Stack (linked to 2.3.5.2) Pull entire stack
Plugged - Blue & Yellow Control Systems - Type (I, P or M): P
Hydraulics - Subsea Control Systems (linked to Possibility to use stack accumulator (ruin 5k stab
2.2.2.3) though)
Internal Leak - Blind Shear Ram - BOP Stack Type (I, P or M): P
(linked to 2.3.2.2) Redundant conduit lines with ability to isolate
External Leak/Rupture - Hydraulic Supply - leaking line and cross-connect via conduit
Surface Control Systems (linked to 2.1.4.1) manifold
Type (I, P or M): P
Surface Control Systems (linked to 2.1.7.4) Redundant functions between pods
Type (I, P or M): P
Systems - Hydraulics - Subsea Control Systems Redundant regulators
Internal Leak - Casing Shear Ram - BOP Stack ROV intervention
Plugged - Choke & Kill Lines & Valves - BOP Filter replacement frequency
Internal leak - Hydraulic Supply: Rigid Conduit Maintenance programs
2.2.5.2) ROV inspection every 3 days
Corrosion/Erosion - Blue & Yellow Control Type (I, P or M): M
Systems - Hydraulics - Subsea Control Systems SOAK test between wells
External Leak/Rupture - Casing Shear Ram - BOP Weekly BOP function test
Enterprise A 104
LEADER

(linked to 2.2.5.4)
2.1.6.7)
(linked to 2.2.3.5)
to 2.3.6.2)
(linked to 2.2.5.1)
2.2.5.3)
Enterprise A 105
LEADER

(linked to 2.2.5.6)
2.3.2.5)
(linked to 2.3.5.5)
(linked to 2.3.6.1)
2.3.3.5)
4 Moves too slowly to External Leak/Rupture - HPU - Surface Control E/H Backup No effects of interest as long as the connector
disconnect Systems (linked to 2.1.1.1) Type (I, P or M): I unlocks and disconnects
Plugged - HPU - Surface Control Systems (linked ROV Intervention
to 2.1.1.3) Type (I, P or M): I
(linked to 2.2.2.1)
2.1.6.7)
Enterprise A 106
LEADER

2.2.2.3)
(linked to 2.2.3.5)
(linked to 2.3.7.2)
(linked to 2.2.5.1)
2.2.5.3)
Enterprise A 107
LEADER
1.8.2 Functional Failure: Unintentional disconnect of the LMRP Controlled Operation - Disconnect the LMRP from the Lower BOP stack
1 Spurious Automatic No credible causes resulting in spurious Implementation of latest Engineering Bulletin Significant down time that impacts operation
Disconnect Signal automatic disconnect signal during 'Disconnect Type (I, P or M): P Environmental impact in the form of mud release
the LMRP from the Lower BOP stack'
2 Unintentional Manual No credible causes resulting in Unintentional From drillers chair/console it is two switches that
Disconnect Signal Manual Disconnect Signal during 'Disconnect the are both covered
LMRP from the Lower BOP Stack' Type (I, P or M): P
Two hand operation, Password, confirmation
Type (I, P or M): P
Enterprise A 108
LEADER
9- Circulate the well after drill pipe disconnect
Enterprise A 109
LEADER
1.9.1 Functional Failure: Failure to circulate - Circulate the well after drill pipe disconnect
1 Failure to Provide Control Wiring harness fails Communications failure via flashing red screen Significant down time that impacts operation
Signal to C&K Valves when Loss of Power (UPS Shuts down with power on touch screen
Demanded degradation) - Power - Surface Control Systems Type (I, P or M): I
(linked to 2.1.2.1) Atypical current across solenoid coil
Electrical Short - Power - Surface Control Type (I, P or M): I
Systems (linked to 2.1.2.5) No flow in flow meters
Fails to respond to input - Electrical - Blue & Type (I, P or M): I
Yellow Control Systems - Electrical - Subsea Pod mismatch & alarm
Control Systems (linked to 2.2.1.4) Type (I, P or M): I
Loss of function (general) - Blue & Yellow Multiple (4) inlets below the blind shear rams for
Control Systems - Electrical - Subsea Control circulation if one is lost
Fails with no output signal/communication - MUX Redundant mechanicals
System - Surface Control Systems (linked to Type (I, P or M): P
2.1.3.2) Redundant touch screen, controllers, control
Erratic output (Network) - MUX System - Surface pods, cables, powers supplies, SEM
Loss of, or Degraded Power - Secondary & Function tests between wells and upon latch-up
Emergency Control Systems - Surface Control Type (I, P or M): M
(linked to 2.1.3.7)
2.1.5.2)
(linked to 2.1.8.2)
(linked to 2.1.5.7)
Enterprise A 110
LEADER

2.2.1.3)
2 Failure to Supply Hydraulic External Leak/Rupture - HPU - Surface Control HPU pumps running constantly Significant down time that impacts operation
Fluid & Pressure to C&K Systems (linked to 2.1.1.1) Type (I, P or M): I
Valves Internal Leak - HPU - Surface Control Systems Deadhead pumps / rupture disc rupture on pump
Plugged - HPU - Surface Control Systems (linked Manual indicators on valves that the ROV can
to 2.1.1.3) read
Mechanical Failure - HPU - Surface Control Type (I, P or M): I
Systems (linked to 2.1.1.4) Redundant conduit lines with ability to isolate
Loss of Function (general) - HPU - Surface leaking line and cross-connect via conduit
Control Systems (linked to 2.1.1.7) manifold
Type (I, P or M): P
Systems - Hydraulics - Subsea Control Systems Multiple annulars & rams
Internal Leak - Blue & Yellow Control Systems - Redundant functions between pods
2.2.2.2) Multiple pumps (1 pump needed, 3 pumps
Internal Leak - Choke & Kill Lines & Valves - BOP present)
Plugged - Blue & Yellow Control Systems - Accumulators with stored energy
2.2.2.3) Design margin/safety factors (conduits work at
Mechanical Failure - Fluid Reservoir Unit - 5k, max @ 7.5k)
Surface Control Systems (linked to 2.1.7.4) Type (I, P or M): P
Mechanical Failure - Blue & Yellow Control Redundant regulators
(linked to 2.2.2.4) ROV inspection every 3 days
and Manifold - Subsea Control Systems (linked to Filter replacement frequency
2.2.5.2) Type (I, P or M): M
Corrosion/Erosion - Blue & Yellow Control Maintenance programs
Enterprise A 111
LEADER

Systems - Hydraulics - Subsea Control Systems Type (I, P or M): M
(linked to 2.2.2.6) Weekly BOP function test
Surface Control Systems (linked to 2.1.4.1) SOAK test between wells
External Leak/Rupture - Accumulators - Subsea Type (I, P or M): M
(linked to 2.2.5.4)
(linked to 2.2.3.5)
2.1.6.7)
(linked to 2.2.5.1)
2.2.5.3)
to 2.3.6.2)
Enterprise A 112
LEADER

(linked to 2.2.5.6)
(linked to 2.3.6.1)
(linked to 2.3.5.5)
Valves as Needed Stack (linked to 2.3.5.2) Type (I, P or M): I
External Leak/Rupture - Choke & Kill Lines & Flow meter (volume to actuate is known, should
Valves - BOP Stack (linked to 2.3.5.1) go 0 to 0.7 to 0 in ~ 5 seconds) If too high =
Wear - Choke & Kill Lines & Valves - BOP Stack leak. If long time = galling or leak
Increasing pressure
Type (I, P or M): I
Same pressure readings from BOP bore
indicators same as from C&K lines once open
Type (I, P or M): I
Pressure test chambers at end of well
Type (I, P or M): M
surface
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Enterprise A 113
LEADER
1.9.2 Functional Failure: Failure to circulate the well at the desired flow rate - Circulate the well after drill pipe disconnect
1 Degraded Flow Pressure Fail-safe valves fail to open completely Higher circulating pressure/ lower flow rates Significant down time that impacts operation
Large diameter tools in the well that cause Type (I, P or M): I
increase in differential pressure and forced to Circulate through the C&K valves daily
pump at slower rate Type (I, P or M): M
Flush C&K valves 2x daily
Type (I, P or M): M
2 Restricted Flow Path No credible causes resulting in restricted flow

path during 'circulate the well after drill pipe
disconnect'
Enterprise A 114
LEADER
1.9.3 Functional Failure: Failure to open / close fail-safe valves to seal - Circulate the well after drill pipe disconnect
1 Failure to Actuate under Fail- Broken springs = it will not close without Continued flow/return to the surface Significant down time that impacts operation
safe Conditions hydraulic assistance Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Mechanical interference (debris, galling) Redundant/2 valves resulting in spill with large impact
Wellbore pressure above the closing pressure Type (I, P or M): P Release of hydrocarbons to atmosphere
Maintenance & testing between each well potentially resulting in fire/explosion hazard with
Type (I, P or M): M large impact
2 Failure to Adequately Seal Internal Leak - Annulars - BOP Stack (linked to Continued flow/return to the surface Significant down time that impacts operation
under Fail-safe Conditions 2.3.1.2) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Internal Leak - Choke & Kill Lines & Valves - BOP Redundant/2 valves resulting in spill with large impact
External Leak/Rupture - Annulars - BOP Stack Maintenance & testing between each well potentially resulting in fire/explosion hazard with
(linked to 2.3.1.1) Type (I, P or M): M large impact
(linked to 2.3.5.5)
Enterprise A 115
LEADER
1.9.4 Functional Failure: Failure to seal wellbore - Circulate the well after drill pipe disconnect
1 Failure to Provide Control Loss of Power (UPS Shuts down with power Atypical current across solenoid coil Significant down time that impacts operation
Signal to C&K Valves when degradation) - Power - Surface Control Systems Type (I, P or M): I
Demanded (linked to 2.1.2.1) Communications failure via flashing red screen
Electrical Short - Power - Surface Control on touch screen
Erratic output - Blue & Yellow Control Systems - No flow in flow meters
Electrical - Subsea Control Systems (linked to Type (I, P or M): I
2.2.1.3) Pod mismatch & alarm
Fails to respond to input - Electrical - Blue & Type (I, P or M): I
Yellow Control Systems - Electrical - Subsea Multiple (4) inlets below the blind shear rams for
Control Systems (linked to 2.2.1.4) circulation if one is lost
Loss of function (general) - Blue & Yellow Type (I, P or M): P
Control Systems - Electrical - Subsea Control Redundant mechanicals
Wiring harness fails Redundant touch screen, controllers, control
Fails with no output signal/communication - MUX pods, cables, powers supplies, SEM
Erratic output (Network) - MUX System - Surface Type (I, P or M): M
(linked to 2.1.3.7)
Loss of, or Degraded Power - Secondary &
2.1.5.2)
(linked to 2.1.8.2)
Enterprise A 116
LEADER

(linked to 2.1.5.7)
2 Failure to Supply Hydraulic External Leak/Rupture - HPU - Surface Control Deadhead pumps / rupture disc rupture on pump Significant down time that impacts operation
Fluid & Pressure to C&K Systems (linked to 2.1.1.1) Type (I, P or M): I
Valves Internal Leak - HPU - Surface Control Systems HPU pumps running constantly
Plugged - HPU - Surface Control Systems (linked Manual indicators on valves that the ROV can
to 2.1.1.3) read
Mechanical Failure - HPU - Surface Control Type (I, P or M): I
Systems (linked to 2.1.1.4) Accumulators with stored energy
Control Systems (linked to 2.1.1.7) Design margin/safety factors (conduits work at
External Leak / Rupture - Blue & Yellow Control 5k, max @ 7.5k)
2.2.2.2) present)
Hydraulics - Subsea Control Systems (linked to Redundant conduit lines with ability to isolate
2.2.2.3) leaking line and cross-connect via conduit
Internal Leak - Choke & Kill Lines & Valves - BOP manifold
Mechanical Failure - Blue & Yellow Control Redundant functions between pods
(linked to 2.2.2.4) Redundant regulators
Corrosion/Erosion - Blue & Yellow Control Type (I, P or M): P
Systems - Hydraulics - Subsea Control Systems Filter replacement frequency
Internal leak - Hydraulic Supply: Rigid Conduit ROV inspection every 3 days
Enterprise A 117
LEADER

Surface Control Systems (linked to 2.1.4.1) Weekly BOP function test
Control Systems (linked to 2.2.3.1) SOAK test between wells
(linked to 2.2.3.5)
(linked to 2.2.5.4)
2.1.6.7)
(linked to 2.2.5.1)
2.2.5.3)
Enterprise A 118
LEADER

(linked to 2.2.5.6)
(linked to 2.3.5.5)
(linked to 2.3.6.1)
to 2.3.6.2)
Valves as Needed Stack (linked to 2.3.5.2) Type (I, P or M): I
External Leak/Rupture - Choke & Kill Lines & Flow meter (volume to actuate is known, should
Valves - BOP Stack (linked to 2.3.5.1) go 0 to 0.7 to 0 in ~ 5 seconds) If too high =
Wear - Choke & Kill Lines & Valves - BOP Stack leak. If long time = galling or leak
Increasing pressure
Type (I, P or M): I
Same pressure readings from BOP bore
Type (I, P or M): I
Type (I, P or M): M
surface
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Enterprise A 119
LEADER
1.9.5 Functional Failure: Loss of containment - Circulate the well after drill pipe disconnect
1 External Leak C&K connector spool fails (washout in bends) Potential isolation of leak depending on location Environmental impact in the form of drilling mud
Vibration on surface (rig floor) choke manifold - Type (I, P or M): P spilled into the ocean
bolts backed out Connectors tested with casing test & blind shear Release of hydrocarbons to air or sea, potentially
External Leak/Rupture - Casing Shear Ram - BOP ram test resulting in spill with large impact
Stack (linked to 2.3.3.1) Type (I, P or M): M Release of hydrocarbons to atmosphere
External Leak/Rupture - Hydraulic Supply - Pressure test every 14 days potentially resulting in fire or explosion (large
Surface Control Systems (linked to 2.1.4.1) Type (I, P or M): M fire if the failure is at the choke manifold
ROV inspection every 3 days connection)
(linked to 2.2.5.1)
2.2.5.3)
2.3.2.5)
2.3.3.5)
(linked to 2.3.5.5)
2 Rupture No credible causes resulting in rupture during

'Circulate the well after drill pipe disconnect'
Enterprise A 120
LEADER
10- Circulate across the BOP stack to remove
trapped gas
Enterprise A 121
LEADER
1.10.1 Functional Failure: Failure to circulate - Circulate across the BOP stack to remove trapped gas
1 Failure to Provide Control Loss of Power (UPS Shuts down with power Atypical current across solenoid coil Significant down time that impacts operation
Signal to C&K Valves when degradation) - Power - Surface Control Systems Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Demanded (linked to 2.1.2.1) Communications failure via flashing red screen resulting in spill with large impact
Electrical Short - Power - Surface Control on touch screen Release of hydrocarbons to atmosphere
Systems (linked to 2.1.2.5) Type (I, P or M): I potentially resulting in fire/explosion hazard with
Wiring harness fails No flow in flow meters large impact
Erratic output - Blue & Yellow Control Systems - Type (I, P or M): I Down time, after well control issue is resolved,
Electrical - Subsea Control Systems (linked to Pod mismatch & alarm to repair an individual C&K valve that cannot be
2.2.1.3) Type (I, P or M): I operated
Fails to respond to input - Electrical - Blue & Multiple (4) inlets below the blind shear rams for
Yellow Control Systems - Electrical - Subsea circulation if one is lost
Loss of function (general) - Blue & Yellow Redundant mechanicals
Control Systems - Electrical - Subsea Control Type (I, P or M): P
Systems (linked to 2.2.1.7) Redundant touch screen, controllers, control
Fails with no output signal/communication - MUX pods, cables, powers supplies, SEM
Erratic output (Network) - MUX System - Surface Type (I, P or M): M
Loss of, or Degraded Power - Secondary &
(linked to 2.1.3.7)
2.1.5.2)
(linked to 2.1.8.2)
Enterprise A 122
LEADER

(linked to 2.1.5.7)
2 Failure to Supply Hydraulic External Leak/Rupture - HPU - Surface Control Deadhead pumps / rupture disc rupture on pump Significant down time that impacts operation
Fluid & Pressure to C&K Systems (linked to 2.1.1.1) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Valves Internal Leak - HPU - Surface Control Systems HPU pumps running constantly resulting in spill with large impact
(linked to 2.1.1.2) Type (I, P or M): I Release of hydrocarbons to atmosphere
Plugged - HPU - Surface Control Systems (linked Manual indicators on valves that the ROV can potentially resulting in fire/explosion hazard with
to 2.1.1.3) read large impact
Mechanical Failure - HPU - Surface Control Type (I, P or M): I Down time, after well control issue is resolved,
Systems (linked to 2.1.1.4) Accumulators with stored energy to repair an individual C&K valve that cannot be
Loss of Function (general) - HPU - Surface Type (I, P or M): P operated
Control Systems (linked to 2.1.1.7) Design margin/safety factors (conduits work at
External Leak / Rupture - Blue & Yellow Control 5k, max @ 7.5k)
2.2.2.2) present)
Hydraulics - Subsea Control Systems (linked to Redundant conduit lines with ability to isolate
2.2.2.3) leaking line and cross-connect via conduit
Mechanical Failure - Blue & Yellow Control manifold
(linked to 2.2.2.4) Redundant functions between pods
Corrosion/Erosion - Blue & Yellow Control Type (I, P or M): P
Systems - Hydraulics - Subsea Control Systems Redundant regulators
Internal leak - Hydraulic Supply: Rigid Conduit Filter replacement frequency
Control Systems (linked to 2.2.3.1) ROV inspection every 3 days
Enterprise A 123
LEADER

Internal Leak - Choke & Kill Lines & Valves - BOP Type (I, P or M): M
Stack (linked to 2.3.5.2) SOAK test between wells
Surface Control Systems (linked to 2.1.4.1) Weekly BOP function test
(linked to 2.2.3.5)
(linked to 2.2.5.4)
(linked to 2.2.5.1)
2.1.6.7)
Enterprise A 124
LEADER

2.2.5.3)
(linked to 2.2.5.6)
(linked to 2.3.5.5)
(linked to 2.3.6.1)
to 2.3.6.2)
External Leak/Rupture - Choke & Kill Lines & Flow meter (volume to actuate is known, should resulting in spill with large impact
Valves - BOP Stack (linked to 2.3.5.1) go 0 to 0.7 to 0 in ~ 5 seconds) If too high = Release of hydrocarbons to atmosphere
Wear - Choke & Kill Lines & Valves - BOP Stack leak. If long time = galling or leak potentially resulting in fire/explosion hazard with
(linked to 2.3.5.5) Type (I, P or M): I large impact
Increasing pressure Down time, after well control issue is resolved,
Same pressure readings from BOP bore operated
Type (I, P or M): I
Type (I, P or M): M
surface
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Enterprise A 125
LEADER
1.10.2 Functional Failure: Failure to circulate at desired flow rate - Circulate across the BOP stack to remove trapped gas
1 Degraded Flow Pressure Fail-safe valves fail to open completely Higher circulating pressure/ lower flow rates Significant down time that impacts operation
Large diameter tools in the well that cause Type (I, P or M): I
increase in differential pressure and forced to Circulate through the C&K valves daily
pump at slower rate Type (I, P or M): M
Flush C&K valves 2x daily
Type (I, P or M): M
2 Restricted Flow Path No credible cause resulting in restricted flow

path during 'Circulate across the BOP stack to
remove trapped gas'
Enterprise A 126
LEADER
1.10.3 Functional Failure: Failure to open / close fail-safe valves to seal - Circulate across the BOP stack to remove trapped gas
1 Failure to Actuate under Fail- Broken springs = it will not close without Continued flow/return to the surface Significant down time that impacts operation
safe Conditions hydraulic assistance Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Mechanical interference (debris, galling) Redundant/2 valves resulting in spill with large impact
Wellbore pressure above the closing pressure Type (I, P or M): P Release of hydrocarbons to atmosphere
Maintenance & testing between each well potentially resulting in fire/explosion hazard with
Type (I, P or M): M large impact
2 Failure to Adequately Seal External Leak/Rupture - Annulars - BOP Stack Continued flow/return to the surface Significant down time that impacts operation
under Fail-safe Condition (linked to 2.3.1.1) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Internal Leak - Choke & Kill Lines & Valves - BOP Redundant/2 valves resulting in spill with large impact
Wear - Choke & Kill Lines & Valves - BOP Stack Maintenance & testing between each well potentially resulting in fire/explosion hazard with
(linked to 2.3.5.5) Type (I, P or M): M large impact
2.3.1.2)
Enterprise A 127
LEADER
1.10.4 Functional Failure: Loss of containment - Circulate across the BOP stack to remove trapped gas -
1 External Leak C&K connector spool fails (washout in bends) Potential isolation of leak depending on location Environmental impact in the form of drilling mud
Vibration on surface (rig floor) choke manifold - Type (I, P or M): P spilled into the ocean
bolts backed out Connectors tested with casing test & blind shear Release of hydrocarbons to air or sea, potentially
External Leak/Rupture - Pipe & Test Rams - BOP ram test resulting in spill with large impact
Stack (linked to 2.3.4.1) Type (I, P or M): M Release of hydrocarbons to atmosphere
External Leak/Rupture - Annulars - BOP Stack Pressure test every 14 days potentially resulting in fire or explosion (large
(linked to 2.3.1.1) Type (I, P or M): M fire if the failure is at the choke manifold
ROV inspection every 3 days connection)
2.3.2.5)
2.3.3.5)
(linked to 2.3.5.5)
2 Rupture No credible causes resulting in rupture during

'Circulate across the BOP stack to remove
trapped gas'
Enterprise A 128
LEADER
11- Connect BOP and LMRP at Landing
Enterprise A 129
LEADER
1.11.1 Functional Failure: Inadequate BOP Connection - Connect BOP and LMRP at Landing
1 Failure of Wellhead Poor wellhead surface (not cleaned) Flow meter There is only potential operational impact/delay,
Connector to Properly Lock Damaged seal areas or gaskets Type (I, P or M): I as the well is secure prior to landing BOP under
and Seal Overpull (pull on BOP/wellhead to ensure this scenario.
(linked to 2.3.6.1) connection)
Type (I, P or M): I
Loss of Function (general) - Connectors - BOP
Stack (linked to 2.3.6.7) Place resilient (metal gasket with elastomeric
component) seal on wellhead and/or BOP
Mechanical Failure - Connectors - BOP Stack Type (I, P or M): P
(linked to 2.3.6.4)
Clean wellhead mating surface with ROV prior to
landing
Type (I, P or M): M
New metal gasket for each landing
Type (I, P or M): M
ROV
Type (I, P or M): M
Test the BOP using a test plug in the wellhead to
the maximum pressure the BOP will be tested
Type (I, P or M): M
2 Failure of Connector Integrity Differential pressure between wellbore and sea Lock indicator If the well has been secured prior to landing
External Leak/Rupture - Connectors - BOP Stack Type (I, P or M): I BOP, there is only potential operational
(linked to 2.3.6.1) Loss of mud volume in trip tank impact/delay.
Poor wellhead surface (not cleaned) Type (I, P or M): I If the well has not been secured previously,
POCV there is potential for spill to the environment.
Damaged seal areas or gaskets
Type (I, P or M): I
Mechanical Failure - Connectors - BOP Stack
(linked to 2.3.6.4) Between well clean, grease, inspect
Type (I, P or M): M
Loss of Function (general) - Connectors - BOP
Stack (linked to 2.3.6.7) Chamber test (i.e. wellbore test)
Type (I, P or M): M
Five year inspection of latch
Type (I, P or M): M
Minimum unlock pressure on surface
Type (I, P or M): M
New gaskets
Type (I, P or M): M
Pressure test every 14 days (if no test ram,
connector is tested)
Type (I, P or M): M
Required ROV inspection every 3 day, however
ROV is subsea more often
Type (I, P or M): M
Tested on surface and subsea
Type (I, P or M): M
Enterprise A 130
LEADER
1.11.2 Functional Failure: Inadequate LMRP Connection - Connect BOP and LMRP at Landing
1 Failure of LMRP Connector to Open C&K lines can pull seals off Flow meter There is only potential operational impact/delay,
Properly Lock and Seal Incorrect alignment Type (I, P or M): I as the well is secure prior to landing BOP under
(auxiliary connections) Key slots this scenario.
(linked to 2.3.6.1) Type (I, P or M): I NOTE: Other connections being made between
Overpull LMRP and BOP include main connection, C&K
Poor wellhead surface (not cleaned) lines, 5k stab, pob wedges to lower stack.
Type (I, P or M): I
Pressure tests
Mechanical Failure - Connectors - BOP Stack Type (I, P or M): M
(linked to 2.3.6.4)
ROV inspection of connection & frame
Loss of Function (general) - Connectors - BOP Type (I, P or M): M
2 Failure of Connector Integrity External Leak/Rupture - Connectors - BOP Stack Flow meter Significant down time that impacts operation
(linked to 2.3.6.1) Type (I, P or M): I Release of hydrocarbons to air or sea potentially
Open C&K lines can pull seals off Key slots resulting in spill with large impact
Incorrect alignment Type (I, P or M): I
Poor wellhead surface (not cleaned) Lock indicator
Type (I, P or M): I
Loss of mud volume in trip tank
Mechanical Failure - Connectors - BOP Stack Type (I, P or M): I
(linked to 2.3.6.4)
Overpull
Loss of Function (general) - Connectors - BOP Type (I, P or M): I
POCV
Type (I, P or M): I
Required ROV inspection every 3 day, however
ROV is subsea more often
Type (I, P or M): I
Between well clean, grease, inspect
Type (I, P or M): M
Chamber test
Type (I, P or M): M
Five year inspection of latch
Type (I, P or M): M
Minimum unlock pressure on surface
Type (I, P or M): M
New gaskets
Type (I, P or M): M
Pressure test every 14 days (if no test ram,
connector is tested)
Type (I, P or M): M
ROV inspection of connection & frame
Type (I, P or M): M
Enterprise A 131
LEADER
1.11.2 Functional Failure: Inadequate LMRP Connection - Connect BOP and LMRP at Landing

Type (I, P or M): M
Enterprise A 132
LEADER
APPENDIX B
EQUIPMENT-LEVEL FMECA WORKSHEETS
2650788-DFMECA-2-D2
2- Equipment level FMECA
Enterprise B-3
LEADER
1- Surface Control Systems
Enterprise B-4
LEADER
2.1.1 Equipment: HPU - Surface Control Systems HPU, including three HPU pumps and associated piping and regulators
Item Failure Causes Indications/Protections/Main Effects Severity Occurrence Detection Risk

Mode tenance Ratings Ratings Ratings Priority
Numbers
1 External Pump leaks Frequent cycling of pumps on/off Additional wear on pumps due to 1 1 1
Leak/ Valve leaks Type (I, P or M): I more frequent pump cycling
Rupture Low pressure alarms (system would not be run to this
Connections/flanges leak point, pump isolated and removed
Type (I, P or M): I
Piping fails from service/problem corrected)
Visual indication by presence of [Local Effects]
Valve fails (ball, check, needle, fluid on rig
relief) Type (I, P or M): I
Seal/joint leaks Isolate problematic pump and
continue operations with
remaining pumps
Type (I, P or M): P
Located in climate controlled HPU
room out of weather
Type (I, P or M): P
Daily inspection/walk through of
HPU room/system
Type (I, P or M): M
Pumps on OEM-based
maintenance schedule
Type (I, P or M): M
Strainers checked on regular basis
(weekly)
Type (I, P or M): M
Surface draw down, before BOP
deployment, after latch-up, every
6 months subsea
Type (I, P or M): M
System pump-up capacity tested
between wells (30 minutes for
single pump, 15 minutes for
complete system)
Type (I, P or M): M
Continuous pumps running [Local 1 1 1

Effects]
Increased time to return to system 1 1 1

pressure [Local Effects]
Truncate pipe on surface, 1 1 1

preventing fluid supply to
accumulators [Local Effects]
Failure to Supply Hydraulic Fluid & 8 3 2 48

Pressure to Annular & C&K Valves
Enterprise B-5
LEADER

Numbers
When Demanded - Failure to close
and seal on the drill pipe and
allow circulation on demand due
to failure to close on drill pipe
through annular(s) (1.1) (linked to
1.1.1.2)

on drill pipe through annular(s) -
Close and seal on the drill pipe
and allow circulation on demand
(linked to 1.1.1.2)

Pressure to Pipe Ram or C&K
Valves When Demanded - Failure
to close on drill pipe through pipe
rams - Close and seal on the drill
pipe and allow circulation on
Failure of Pipe Ram to Seal on 9 3 2 54

Demand - Failure to seal or partial
seal on drill pipe through pipe
Failure to Maintain Adequate 9 3 2 54

Sealing Pressure on Pipe Ram -
Failure to seal or partial seal on
drill pipe through pipe rams -
(linked to 1.1.4.2)
Actuates Too Slowly on Demand - 9 3 2 54

Closes too slowly - Close and seal
on the drill pipe and allow
circulation on demand (linked to
1.1.7.1)

Pressure to Annular / Blind-Shear
Ram or C&K Valves - Failure to
close on open hole through blind-
shear rams or annular - Close and
Enterprise B-6
LEADER

Numbers
seal on open hole and allow
volumetric well control operations
on demand (linked to 1.2.1.2)
Failure of Annular / Blind-Shear 9 3 2 54

Ram to Seal on Demand - Failure
to close on open hole through
blind-shear rams or annular -
Close and seal on open hole and
allow volumetric well control
operations on demand (linked to
1.2.1.4)

Sealing Pressure on Annular /
Blind-Shear Ram - Failure to close
on open hole through blind-shear
rams or annular - Close and seal
on open hole and allow volumetric
well control operations on demand
(linked to 1.2.1.5)

Pressure to Annulars - Failure to
close annulars - Strip the drill
string using the annular BOP(s)
(linked to 1.3.1.2)

Pressure to Hang-off Ram - Failure
of hang-off ram to close - Hang-
off the drill pipe on a ram BOP
and control the wellbore (linked to
1.4.1.2)
Failure to Maintain Closing 8 3 2 48

Pressure on Hang-off Ram -
Failure to maintain closing
pressure - Hang-off the drill pipe
on a ram BOP and control the
Failure to Shear Pipe - Failure to 6 3 2 36

shear the drill pipe - Controlled
operation - Shear the drill pipe
and seal the wellbore (linked to
1.5.2.1)
Enterprise B-7
LEADER

Numbers
Failure of Shear Ram to Seal On 6 3 2 36

Demand - Failure to seal the
wellbore - Controlled operation -
Shear the drill pipe and seal the
Failure to Maintain Sealing 6 3 2 36

Pressure on Shear Ram - Failure
to seal the wellbore - Controlled
1.5.3.2)
Unintentional Opening - 6 3 2 36
Unintentional closing / opening -
Controlled operation - Shear the
drill pipe and seal the wellbore
(linked to 1.5.4.2)
External Leak - Loss of 10 3 1 30

containment - Controlled
1.5.6.1)

Pressure to Shear Ram - Failure to
close - Emergency Operation -
Auto-Shear - Shear the drill pipe
1.6.2.1)

shear the drill pipe - Emergency
Operation - Auto-Shear - Shear
the drill pipe and seal the wellbore
(linked to 1.6.3.1)

(linked to 1.6.3.2)
Enterprise B-8
LEADER

Numbers

wellbore - Emergency Operation -
1.6.4.1)

to seal the wellbore - Emergency
(linked to 1.6.4.2)
Emergency Operation - Auto-
Shear - Shear the drill pipe and
seal the wellbore (linked to
1.6.5.2)

containment - Emergency
(linked to 1.6.7.1)
Failure of Hydraulic Fluid to 9 3 2 54

disconnect - Failure to disconnect
the LMRP - Emergency Operation:
EDS - Disconnect from the stack
(linked to 1.7.2.3)
Moves too slowly to disconnect - 9 3 2 54

Failure to disconnect the LMRP -
Emergency Operation: EDS -
Disconnect from the stack (linked
to 1.7.2.4)

Disconnect - Failure to disconnect
the LMRP - Controlled Operation -
Disconnect the LMRP from the
Lower BOP stack (linked to
1.8.1.3)

Controlled Operation - Disconnect
Enterprise B-9
LEADER

Numbers
the LMRP from the Lower BOP
stack (linked to 1.8.1.4)

Pressure to C&K Valves - Failure
to circulate - Circulate the well
after drill pipe disconnect (linked
to 1.9.1.2)

to seal wellbore - Circulate the
well after drill pipe disconnect
(linked to 1.9.4.2)

to circulate - Circulate across the
BOP stack to remove trapped gas
(linked to 1.10.1.2)

close - Controlled operation -
2 Internal Pump degrades (internal leak) - Potentially notice on drawdown Increased time to return to system 1 1 1
Leak Wear of metal to metal seals test pressure [Local Effects]
Check valve leaks Type (I, P or M): I
Relief valve leaks Pressure fluctuation
Type (I, P or M): I
SPM valve vents
Time to return to system pressure
Pilot valve leaks (surface SPM Type (I, P or M): I
valve control)
Redundancy in system that minor
Regulator leaks leakage would have minimal effect
Closed isolation valves (ball on system
valves) Type (I, P or M): P
Regulator fails
Valve fails (ball, check, needle,
relief)
Trigger valve (SPM valve) does
not open

Enterprise B-10
LEADER

Numbers
(linked to 1.1.1.2)


Sealing Pressure on Annular -
drill pipe through annular(s) -
(linked to 1.1.3.2)


(linked to 1.1.4.2)


Enterprise B-11
LEADER

Numbers
1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)
Failure to Maintain Hydraulic Fluid 9 3 3 81

& Pressure to Annulars - Failure to
maintain stripping pressure - Strip
the drill string using the annular
BOP(s) (linked to 1.3.2.1)

1.4.1.2)



Enterprise B-12
LEADER

Numbers
1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)
Failure to initiate autoshear 10 3 3 90

sequence - Failure to close -
1.6.2.2)

(linked to 1.6.3.2)

1.6.4.1)
Enterprise B-13
LEADER

Numbers

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)

(linked to 1.9.4.2)

3 Plugged Contamination/filtering Differential pressure monitors on Cavitation in pump [Local Effects] 1 1 1

Filter media plugs filter housing (Alarmed)
Type (I, P or M): I
Strainer basket plugs
Enterprise B-14
LEADER

Numbers
Organic fouling Fluid properties to prevent organic
Restriction in system (filter, hose, growth
ID of fitting) Type (I, P or M): P
Mix system filtration
Type (I, P or M): P
Mix system recirculation to
prevent precipitation
Type (I, P or M): P
Redundant flow paths
Type (I, P or M): P
Relief valves in system
Type (I, P or M): P
HPU fluid sampling (daily)/analysis
(monthly)
Type (I, P or M): M
Filters are replaced between wells
Type (I, P or M): M
Regular cleaning of strainers,
remove & rinse (weekly)
Type (I, P or M): M
Increased HP-side pressure [Local 1 1 1

Effects]

(linked to 1.1.1.2)


Enterprise B-15
LEADER

Numbers

(linked to 1.1.4.2)

1.1.7.1)


1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)
Enterprise B-16
LEADER

Numbers

1.4.1.2)



1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)
Enterprise B-17
LEADER

Numbers

Closes too slowly - Controlled
1.5.5.1)

1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

Closes too slowly - Emergency
Enterprise B-18
LEADER

Numbers
(linked to 1.6.6.1)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

Enterprise B-19
LEADER

Numbers
4 Mechanical Valve fails Alarms SPM valve failure can lead to loss 1 1 1
Failure Rods fail Type (I, P or M): I of hydraulic supply to stack [Local
Audible indication Effects]
Belt fails
Type (I, P or M): I
Motor fails
External Leak
Pipe works fails Type (I, P or M): I
Pump fails Insufficient pressure
Pump fails due to wear Type (I, P or M): I
Pump running continuously
Type (I, P or M): I
Second/Third HPU pumps trip
when not expected
Type (I, P or M): I
Type (I, P or M): P
System pressure not achieved 1 1 1

(increase time to achieve system
pressure) [Local Effects]

(linked to 1.1.1.2)



Enterprise B-20
LEADER

Numbers
(linked to 1.1.4.2)

1.1.7.1)


1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)
Enterprise B-21
LEADER

Numbers

1.4.1.2)



1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

Enterprise B-22
LEADER

Numbers
1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

to 1.7.2.4)
Enterprise B-23
LEADER

Numbers

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

5 Wear No credible causes resulting in

wear of the HPU - Surface Control
Systems
6 Corrosion/Er No credible causes resulting in Fluid sampling/testing

osion corrosion/erosion of the HPU - Type (I, P or M): M
Surface Control Systems Pipe wall thickness testing
Type (I, P or M): M
Stainless steel piping
Type (I, P or M): P
7 Loss of Pump fails due to wear Alarms Additional wear on pumps due to 1 1 1
Function Regulator fails Type (I, P or M): I more frequent pump cycling
(general) Audible indication (system would not be run to this
Pump leaks point, pump isolated and removed
Type (I, P or M): I
Valve leaks from service/problem corrected)
Differential pressure monitors on [Local Effects]
Connections/flanges leak filter housing (Alarmed)
Enterprise B-24
LEADER

Numbers
Piping fails Type (I, P or M): I
Relief valve leaks External Leak
SPM valve vents Type (I, P or M): I
Pilot valve leaks (surface SPM Frequent cycling of pumps on/off
valve control) Type (I, P or M): I
Check valve leaks Insufficient pressure
Type (I, P or M): I
Pump leaks (internal) - wear of
metal to metal seals Low pressure alarms
Type (I, P or M): I
Regulator leaks
Potentially notice on drawdown
Closed isolation valves (ball test
valves) Type (I, P or M): I
Filter media plugs Pressure fluctuation
Strainer baskets plug Type (I, P or M): I
Organic fouling Pump running continuously
Valve fails Type (I, P or M): I
Rods break Second/Third HPU pumps trip
when not expected
Belt fails
Type (I, P or M): I
Motor fails
Time to return to system pressure
Valve fails (ball, check, needle, Type (I, P or M): I
relief)
Visual indication by presence of
Trigger valve (SPM valve) does fluid on rig
not open Type (I, P or M): I
Seal/joint leaks Fluid properties to prevent organic
growth
Type (I, P or M): P
Isolate problematic pump and
continue operations with
remaining pumps
Type (I, P or M): P
Located in climate controlled HPU
room out of weather
Type (I, P or M): P
Mix system filtration
Type (I, P or M): P
Mix system recirculation to
prevent precipitation
Type (I, P or M): P
Redundancy in system that minor
leakage would have minimal effect
on system
Enterprise B-25
LEADER

Numbers
Type (I, P or M): P
Type (I, P or M): P
Relief valves in system
Type (I, P or M): P
Daily inspection/walk through of
HPU room/system
Type (I, P or M): M
Filters are replaced between wells
Type (I, P or M): M
HPU fluid sampling (daily)/analysis
(monthly)
Type (I, P or M): M
Pumps on OEM-based
Type (I, P or M): M
Regular cleaning of strainers,
remove & rinse (weekly)
Type (I, P or M): M
(weekly)
Type (I, P or M): M
complete system)
Type (I, P or M): M
Surface drawdown, before BOP
6 months subsea
Type (I, P or M): M
Cavitation in pump [Local Effects] 1 1 1

Effects]
Increased HP-side pressure [Local 1 1 1

Effects]

pressure [Local Effects]
Enterprise B-26
LEADER

Numbers
SPM valve failure can lead to loss 1 1 1

of hydraulic supply to stack [Local
Effects]
System pressure not achieved 1 1 1

(increase time to achieve system
pressure) [Local Effects]
Truncate pipe on surface, 1 1 1

preventing fluid supply to
accumulators [Local Effects]

(linked to 1.1.1.2)



(linked to 1.1.4.2)

1.1.7.1)
Enterprise B-27
LEADER

Numbers


1.2.1.4)

(linked to 1.3.1.2)


1.4.1.2)

Enterprise B-28
LEADER

Numbers


1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

(linked to 1.6.3.1)
Enterprise B-29
LEADER

Numbers

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)

Enterprise B-30
LEADER

Numbers

to 1.9.1.2)

(linked to 1.9.4.2)


(linked to 1.2.1.5)
Enterprise B-31
LEADER
2.1.2 Equipment: Power - Surface Control Systems Power including Blue & Yellow Power Distribution Panels, Power Isolation J-box; Blue & Yellow
UPSs, Blue & Yellow Subsea Transformers, and yellow and blue distribution panels, umbilical J-
box; and connections to associated cabinets and equipment (e.g., MUX, control panels)

Numbers
1 Loss of Distribution panel fails Substantial alarms/notifications A UPS is a tertiary redundancy 1 1 1

Power (UPS Transformer (in UPS and in Type (I, P or M): I with a second UPS and rig power.
Shuts down subsea power control system) fails E/H Backup [Local Effects]
with power Type (I, P or M): P
degradation) UPS fails
Power cable fails Second UPS
Type (I, P or M): P
Breaker fails
Batteries are replaced on a regular
UPS Battery fails (only a problem basis (3 years, design life = 8
if power is also lost) years, recommend replace every 4
Electronics fail to 6 years)
Loss of Power Type (I, P or M): M
Daily, the UPS runs a battery test.
Type (I, P or M): M
Rig does test between well to
ensure UPSs will continue to run
and support panels for 2 hour
period
Type (I, P or M): M
Input/output transformers are 1 1 1

single points of failure for the
UPS. [Local Effects]
Inverter feeds battery and load. 1 1 1

Loss of Inverter switches system
to battery power. Auto switch to
direct pass-through. Manual
switch if autoswitch fails. [Local
Effects]
Lose a piece of UPS but not have 1 1 1

power loss (battery, converter,
rectifier). [Local Effects]
Loss of redundancy. [Local 1 1 1

Effects]
Per API 16D, as long as 1 UPS is 1 1 1

fully functional, full redundancy
exists. [Local Effects]
UPSs are collocated in the same 1 1 1

room with both UPSs, CCUs, PDPs,
and E/H backup. [Local Effects]
Enterprise B-32
LEADER

Numbers
Failure to Provide Control Signal to 9 2 1 18

Annular or C&K Valves When
Demanded - Failure to close on
(linked to 1.1.1.1)

Pipe Ram or C&K Valves When
(linked to 1.1.2.1)
Unintentional Operation - 6 2 4 48
(linked to 1.1.5.1)

Annular / Blind-Shear Ram or C&K
1.2.1.1)
Unintentional Closing - 6 2 3 36
1.2.2.1)

Annulars When Demanded -
Failure to close annulars - Strip
Enterprise B-33
LEADER

Numbers

Hang-off Ram When Demanded -
Failure of hang-off ram to close -
Hang-off the drill pipe on a ram
BOP and control the wellbore
(linked to 1.4.1.1)

Shear Ram When Demanded -
Failure to close - Controlled
1.5.1.1)
Failure to Provide Control Signal - 10 2 1 20

Failure to Arm - Emergency
(linked to 1.6.1.1)
Failure to provide control signal, 10 2 1 20

when demanded - Failure to
receive EDS signal prevents
disconnecting from stack during
emergency operation when using
the EDS (1.7) (linked to 1.7.1.1)
Failure to Provide Disconnect 10 2 1 20

Signal (automatically) - Failure to
disconnect the LMRP - Emergency
Operation: EDS - Disconnect from
the stack (linked to 1.7.2.1)

Signal (automatically or manually)
- Failure to disconnect the LMRP -

C&K Valves when Demanded -
Failure to circulate - Circulate the
(linked to 1.9.1.1)
Enterprise B-34
LEADER

Numbers

Failure to seal wellbore - Circulate
the well after drill pipe disconnect
(linked to 1.9.4.1)

Failure to circulate - Circulate
across the BOP stack to remove
2 Fails with no Cable fails Alarms in all panels If no redundant power source 1 1 1
output PDP Source select switch (One for Type (I, P or M): I exists, no alarms will be indicated
each Blue & Yellow Pod) fails Loss of Pod power for that side (no power). [Local Effects]
Breaker fails Type (I, P or M): I
Electronics fail Redundant UPS and other power
supplies
Type (I, P or M): P
Quarterly electrical system
maintenance (visually inspect,
tighten connections,
rust/corrosion, general condition,
transformer condition, clean with
vacuum/low pressure air)
Type (I, P or M): M


Loss of intverter switches system
to battery power. Autoswitch to
Effects]

rectifier). UPS automatically switch
to reserve line. [Local Effects]
Loss of redundancy [Local Effects] 1 1 1
Enterprise B-35
LEADER

Numbers

UPS is a tertiary redundancy with 1 1 1

a second UPS and rig power.
[Local Effects]

(linked to 1.1.5.1)
1.2.2.1)
3 Erratic Loose connections Quarterly electrical system Arcing/Sparking [Local Effects] 1 1 1

output Electronics fail maintenance (visually inspect,
(Erratic, tighten connections,
Intermittent) rust/corrosion, general condition,
Type (I, P or M): M
Panels that go on and off [Local 1 1 1

Effects]
(linked to 1.1.5.1)
Enterprise B-36
LEADER

Numbers
1.2.2.1)
4 Fails to No credible causes resulting in

Respond to fails to respond of the Power -
Input Surface Control Systems
5 Electrical Cabling fails Coordinated overcurrent A UPS is a tertiary redundancy 1 1 1

Short Mechanical component (i.e., protection system with a second UPS and rig power.
selector switch) fails in a panel Type (I, P or M): P [Local Effects]
Connector fails Redundancy in power distribution
system/paths
Connector fails due to grounding Type (I, P or M): P
Electronics fail Quarterly electrical system
Type (I, P or M): M
If no redundant power source 1 1 1

exists, no alarms will be indicated
(no power). [Local Effects]


Loss of inverter switches system
Effects]

Loss of redundancy. [Local 1 1 1
Enterprise B-37
LEADER

Numbers
Effects]



(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
Enterprise B-38
LEADER

Numbers
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)


Enterprise B-39
LEADER

Numbers


(linked to 1.9.1.1)

(linked to 1.9.4.1)

6 Loss of Cable fails Alarms in all panels If no redundant power source 1 1 1

Function PDP Source select switch (One for Type (I, P or M): I exists, no alarms will be indicated
each Blue & Yellow Pod) fails Loss of Pod power for that side (no power). [Local Effects]
Breaker fails Type (I, P or M): I
Electronics fail Redundant UPS and other power
supplies
Type (I, P or M): P
Type (I, P or M): M

Enterprise B-40
LEADER

Numbers

Effects]

Loss of redundancy [Local 1 1 1

Effects]


[Local Effects]

(linked to 1.1.5.1)
1.2.2.1)
Enterprise B-41
LEADER

Numbers
7 Ground Cable/wiring fails due to pinching Ground Fault alarm Alarm indicating ground fault 1 1 1
Faults Water ingress (subsea) Type (I, P or M): I (floats). Second alarm indicated
Quarterly electrical system circuit failure. [Local Effects]
Electronics fail
Type (I, P or M): M
(linked to 1.1.5.1)
1.2.2.1)
8 Loss of Transformer fails due to electrical Alarms (pod mismatch, pod Loss of pod corresponding to lost 1 1 1
subsea short circuit communications loss) subsea transformer [Local Effects]
transformer Transformer fails due to Type (I, P or M): I
mechanical damage Redundant pod with own subsea
Transformer fails due to loose transformer
connection Type (I, P or M): P
Electronics fail Quarterly electrical system
Type (I, P or M): M
(linked to 1.1.5.1)
Enterprise B-42
LEADER

Numbers
1.2.2.1)
Enterprise B-43
LEADER
2.1.3 Equipment: MUX System - Surface Control Systems MUX System, including Central Control Unit with process array, blue & yellow processor array,
and associate equipment and cabinets; MUX cable reels and MUX cables (to connections with
Blue & Yellow Pods)

Numbers
1 Loss of, or No causes identified resulting in

Degraded Loss of, or Degraded Power of the
Power MUX System - Surface Control
Systems
2 Fails with no Media converter fails Communications alarms (serial Network outage (worst case is 1 1 1
output Cable fails and network) to/from CCU) [Local Effects]
signal/comm Type (I, P or M): I
unication Connection breaks
Pod mismatch if a command is
Software fails due to attempted
issues/anomalies/bugs Type (I, P or M): I
Network fails Multiple networks
Network switch fails Type (I, P or M): P
RS-485 communications cards fail Multiple operating stations (i.e.,
Loss of network communications can operate Pod commands from
CCU directly)
Board in any of the components
Type (I, P or M): P
fails (Driller's panel, CCU, Pod)
Multiple pods
Electronics fail
Type (I, P or M): P
Pod comms have 4 paths to each
(each pod has 2 SEMs, each CCU
communicates with both SEMs in
both pods)
Type (I, P or M): P
Redundancies within systems
Type (I, P or M): P
Type (I, P or M): M
Weekly functional testing -
Alternate panels for test execution
Type (I, P or M): M
NOTE: Network Failures could be 1 1 1

local (to one node, more typical)
or more global (network 1) [Local
Effects]
Serial communications outage 1 1 1

Enterprise B-44
LEADER
Blue & Yellow Pods)

Numbers
(worst case is pod
communications) [Local Effects]

(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)


1.2.1.1)
Enterprise B-45
LEADER
Blue & Yellow Pods)

Numbers
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)


Enterprise B-46
LEADER
Blue & Yellow Pods)

Numbers

(linked to 1.9.1.1)

(linked to 1.9.4.1)

3 Fails with No credible causes resulting in

low or high fails with low or high output of the
output MUX System - Surface Control
Systems
4 Erratic Connections fails (e.g., loose) Processor load alarm Communications loss [Local 1 1 1
output Network storm Type (I, P or M): I Effects]
(Network) Closed system (controlled access)
Electronics (device) fail
- Rig initiated RSN limited to GE
Loss of network communications access to data logger, which can
Electronics fails THEN be routed into QNX.
Physical connection must be made
on rig by ethernet cable.
Type (I, P or M): P
Redundant networks
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
Enterprise B-47
LEADER
Blue & Yellow Pods)

Numbers
Processor loading (slowed 1 1 1

network) [Local Effects]

(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)
Enterprise B-48
LEADER
Blue & Yellow Pods)

Numbers


(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)



Enterprise B-49
LEADER
Blue & Yellow Pods)

Numbers

(linked to 1.9.1.1)

(linked to 1.9.4.1)

5 Fails to Cable fails Substantial alarms/notifications Communications loss [Local 1 1 1

respond to Connection breaks Type (I, P or M): I Effects]
input E/H Backup
Software fails due to
issues/anomalies/bugs Type (I, P or M): P
Network fails Multiple networks
Type (I, P or M): P
Network switch fails
Multiple operating stations (i.e.,
RS-485 communications cards fail can operate Pod commands from
Media converter fails CCU directly)
Connections fail (e.g., loose) Type (I, P or M): P
Network storm Multiple pods
Type (I, P or M): P
UPS fails
Type (I, P or M): P
Distribution panel fails
Second UPS
Transformer (in UPS and in Type (I, P or M): P
subsea power control system) fails
Batteries are replaced on a regular
Power cable fails basis (3 years, design life = 8
Breaker fails years, recommend replace every 4
to 6 years)
UPS battery fails (only a problem
Type (I, P or M): M
if power is also lost)
Daily, the UPS runs a battery test.
Loss of network communications
Type (I, P or M): M
(each pod has 2 SEMs, each CCU
Enterprise B-50
LEADER
Blue & Yellow Pods)

Numbers
Electronics fails communicates with both SEMs in
both pods)
Type (I, P or M): P
Rig does test between well to
ensure UPSs will continue to run
and support panels for 2 hour
period
Type (I, P or M): M
Communications alarms (serial
and network)
Type (I, P or M): I
Pod mismatch if a command is
attempted
Type (I, P or M): I
Processor load alarm
Type (I, P or M): I
Closed system (controlled access)
- Rig initiated RSN limited to GE
access to data logger, which can
THEN be routed into QNX.
Physical connection must be made
on rig by ethernet cable.
Type (I, P or M): P
Redundant networks
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M


Enterprise B-51
LEADER
Blue & Yellow Pods)

Numbers
Effects]

Network outage (worst case is 1 1 1

to/from CCU) [Local Effects]

Effects]
Processor loading (slowed 1 1 1

network) [Local Effects]
Per API 16D, as long as 1 UPS is 1 1 1 1

Serial communications outage 1 1 1 1

(worst case is pod
UPS is a tertiary redundancy with 1 1 1 1

[Local Effects]
UPSs are collocated in the same 1 1 1 1



Enterprise B-52
LEADER
Blue & Yellow Pods)

Numbers
(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)

Enterprise B-53
LEADER
Blue & Yellow Pods)

Numbers

(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)



(linked to 1.9.1.1)

(linked to 1.9.4.1)

Enterprise B-54
LEADER
Blue & Yellow Pods)

Numbers
6 Processing Not applicable for this definition of

error "MUX System"
7 Short MUX Cable fails due to damage Communications alarms (serial Network outage (worst case is 1 1 1
Cable fails and network) to/from CCU) [Local Effects]
Type (I, P or M): I
Software fails due to
issues/anomalies/bugs Pod mismatch if a command is
attempted
Network fails Type (I, P or M): I
Network switch fails Multiple networks
RS-485 communications cards fail Type (I, P or M): P
Media converter fails Multiple operating stations (i.e.,
Connection fails (e.g. Broken) can operate Pod commands from
CCU directly)
MUX cable fails due to a short
Type (I, P or M): P
Multiple pods
Board in any of the components Type (I, P or M): P
Electronics fail (each pod has 2 SEMs, each CCU
communicates with both SEMs in
both pods)
Type (I, P or M): P
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M

Effects]
Enterprise B-55
LEADER
Blue & Yellow Pods)

Numbers

(worst case is pod

(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)

Enterprise B-56
LEADER
Blue & Yellow Pods)

Numbers

(linked to 1.4.1.1)

(linked to 1.6.1.1)

1.5.1.1)



Enterprise B-57
LEADER
Blue & Yellow Pods)

Numbers

(linked to 1.9.1.1)

(linked to 1.9.4.1)

8 Loss of Slip ring fails Alarms Network outage (worst case is 1 1 1

function MUX cable fails Type (I, P or M): I to/from CCU) [Local Effects]
(general) Redundancy
J-box fails
Type (I, P or M): P
Cables fail
Between well maintenance on
Connection fails (e.g., loose) MUX cable
Software fails due to Type (I, P or M): M
issues/anomalies/bugs Between well testing on all
Network fails systems/redundancies
Network switch fails Type (I, P or M): M
RS-485 communications cards fail Testing (functional, and subsea
testing)
Media converter fails
Type (I, P or M): M
Network storm
UPS fails
Transformer (in UPS and in
subsea power control system) fails
Power cable fails
Breaker fails
UPS Battery fails (only a problem
if power is also lost)
Enterprise B-58
LEADER
Blue & Yellow Pods)

Numbers
Electronics fails

Effects]

(worst case is pod

(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
Enterprise B-59
LEADER
Blue & Yellow Pods)

Numbers
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)


Enterprise B-60
LEADER
Blue & Yellow Pods)

Numbers


(linked to 1.9.1.1)

(linked to 1.9.4.1)

9 Mechanical Cable fails due to damage MUX cable reels are Network outage (worst case is 1 1 1
Failure Cable fails due to reel damage operated/checked and greased to/from CCU) [Local Effects]
weekly
Slip ring fails due to damage Type (I, P or M): M
Electronics fail Subsea engineer visually inspects
as part of daily walkthrough
Type (I, P or M): M
Redundant MUX cable deployment
systems (1 for each pod)
Type (I, P or M): P

Effects]

(worst case is pod
Enterprise B-61
LEADER
Blue & Yellow Pods)

Numbers
(linked to 1.1.5.1)
1.2.2.1)
Enterprise B-62
LEADER
2.1.4 Equipment: Hydraulic Supply - Surface Control Systems Hydraulic Supply including blue & yellow hotline reels, hotline hoses (to connection at Blue &
Yellow Pods) and rigid conduit (to connection with subsea accumulator system).

Numbers
1 External Rigid pipe hydraulic lines (drape Frequent cycling of pumps on/off Additional wear on pumps due to 1 1 1
Leak/Ruptur hoses in moon pool) fail Type (I, P or M): I more frequent pump cycling
e Elastomer seals in conduit lines on Low pressure alarms (system would not be run to this
riser fail Type (I, P or M): I point, pump isolated and removed
from service/problem corrected)
Moon Pool drape hoses - Flexible ROV inspection of riser/BOP every [Local Effects]
(API 7k) fails 3 days
Hydraulic line ruptures (rigid pipe) Type (I, P or M): I
Drape hose fails in moon pool Visual indication by presence of
fluid on rig/in water by
Seal/joint leaks personnel/ROV if sufficient
Seal fails on riser where stab is for amount exists
choke/kill Type (I, P or M): I
Flex hose inspection/testing
annually
Type (I, P or M): M
complete system)
Type (I, P or M): M

Effects]

pressure (only if rupture exists
with continuous loss of fluid)
[Local Effects]

(linked to 1.1.1.2)

Enterprise B-63
LEADER

Numbers

(linked to 1.1.3.2)


(linked to 1.1.4.2)

1.1.7.1)

containment - Close and seal on
the drill pipe and allow circulation


Enterprise B-64
LEADER

Numbers
1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)



1.5.2.1)

Enterprise B-65
LEADER

Numbers

1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

Enterprise B-66
LEADER

Numbers
(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)
Enterprise B-67
LEADER

Numbers

containment - Circulate the well
to 1.9.5.1)


containment - Circulate across the
- (linked to 1.10.4.1)
2 Internal No credible cause resulting in an

Leak internal leak of Hydraulic Supply -
Surface Control Systems
3 Plugged No credible causes resulting in

plugging of the Hydraulic Supply -
4 Mechanical No credible causes resulting in

Failure Mechanical Failure of the
Hydraulic Supply - Surface Control
Systems

wear of the Hydraulic Supply -
6 Corrosion/Er No credible causes resulting in

osion corrosion/erosion of the Hydraulic
Supply - Surface Control Systems
7 Loss of Rigid pipe hydraulic lines fails Frequent cycling of pumps on/off Additional wear on pumps due to 1 1 1
Function Elastomer seals in conduit lines on Type (I, P or M): I more frequent pump cycling
(general) riser fail Low pressure alarms (system would not be run to this
Type (I, P or M): I point, pump isolated and removed
Moon Pool drape hoses - Flexible from service/problem corrected)
(API 7k) fails ROV inspection of riser/BOP every [Local Effects]
Hydraulic line ruptures (rigid pipe) 3 days
Type (I, P or M): I
Seal fails on riser where stab is for
choke/kill Visual indication by presence of
fluid on rig/in water by
personnel/ROV if sufficient
Enterprise B-68
LEADER

Numbers
amount exists
Type (I, P or M): I
Flex hose inspection/testing
annually
Type (I, P or M): M
complete system)
Type (I, P or M): M

Effects]

pressure (only if rupture exists
with continuous loss of fluid)
[Local Effects]

(linked to 1.1.1.2)


(linked to 1.1.3.2)

Enterprise B-69
LEADER

Numbers

(linked to 1.1.4.2)

1.1.7.1)



1.2.1.4)

Enterprise B-70
LEADER

Numbers
(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)



1.5.2.1)


1.5.3.2)
Enterprise B-71
LEADER

Numbers
(linked to 1.5.4.2)

1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)
Enterprise B-72
LEADER

Numbers

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

to 1.9.5.1)

Enterprise B-73
LEADER

Numbers

- (linked to 1.10.4.1)
Enterprise B-74
LEADER
2.1.5 Equipment: Control Panels - Surface Control Systems Control Panels including drillers panel with system controller and tool pushers panel with
system controller

Numbers
1 Loss of, or Power isolation J-box in driller's Redundant displays Loss of a CCU (CCU required in 1 1 1
Degraded panel (monitors purge Type (I, P or M): P this configuration due to setup
Power process/condition in panel) fails Redundant nodes (computers) and only way to communicated to
Power source fails Type (I, P or M): P pod control) [Local Effects]
Transformer(s) fails Redundant power supplies within
Connection fails the panels
Type (I, P or M): P
AC Transfer switch fails
Two independent and redundant
Loss of Power driller's panels where operations
Electronics fail could continue in the event of the
loss of one train
Type (I, P or M): P
Type (I, P or M): M
Loss of Driller's Panel (higher 1 1 1

temperature due to other factors,
loss of rig air, opened panel door,
etc.) [Local Effects]
Loss of Tool Pusher's Panel (per 1 1 1

API only 2 panels are required,
however its failure will result in
down time and reporting to BSEE)
[Local Effects]

(linked to 1.1.1.1)
Enterprise B-75
LEADER
system controller

Numbers

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)


(linked to 1.4.1.1)

Enterprise B-76
LEADER
system controller

Numbers
1.5.1.1)

(linked to 1.6.1.1)




(linked to 1.9.1.1)

(linked to 1.9.4.1)

Enterprise B-77
LEADER
system controller

Numbers
2 Fails to Touch screen (no input to node) Alarms Loss of a CCU [Local Effects] 1 1 1
respond fails Type (I, P or M): I
(with no Network fails Visual indication
output Type (I, P or M): I
signal/comm Software fails due to
unication or issues/anomalies/bugs Redundant panels/stations
to input) Computer fails Type (I, P or M): P
I/O board fails Redundant screens
Type (I, P or M): P
Loss of Touch Screen
Quarterly maintenance
Loss of network communications Type (I, P or M): M
Electronics fail
Loss of Driller's Panel [Local 1 1 1

Effects]
Loss of Tool Pusher's Panel [Local 1 1 1

Effects]

(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

Enterprise B-78
LEADER
system controller

Numbers
1.2.1.1)
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)


Enterprise B-79
LEADER
system controller

Numbers


(linked to 1.9.1.1)

(linked to 1.9.4.1)

3 Fails with No credible causes resulting in

low or high fails with low or high output of the
output Control Panels - Surface Control
Systems
4 Erratic Floating electronics (digital I/O Design change/EB to correct issue No effect as the issue should be 1 1 1
output components) fails Type (I, P or M): P fixed as a result of implementing
Connections fail (e.g., loose) Rig disconnect from BOP the EB. [Local Effects]
Network storm Type (I, P or M): P
I/O board fails
Electronics fails

Enterprise B-80
LEADER
system controller

Numbers
(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)


Enterprise B-81
LEADER
system controller

Numbers
(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)




(linked to 1.9.1.1)

(linked to 1.9.4.1)
Enterprise B-82
LEADER
system controller

Numbers

5 Fails to Touch screen fails Alarms Failure to Provide Control Signal to 9 2 1 18

respond to Cable fails Type (I, P or M): I Annular or C&K Valves When
input Visual indication Demanded - Failure to close on
Connection fails (e.g., drill pipe through annular(s) -
loose/broken) Type (I, P or M): I
Software fails due to Redundant panels/stations and allow circulation on demand
issues/anomalies/bugs Type (I, P or M): P (linked to 1.1.1.1)
Network fails Redundant screens
Type (I, P or M): P
Network switch fails
RS-485 communications cards fail Type (I, P or M): M
Media converter fails
Network storm
UPS fails
Transformers fail (in UPS and in
subsea power control system)
Power cable fails
Breakers fail
UPS Battery fail (only a problem if
power is also lost)
Loss of Power
Electronics fail

(linked to 1.1.2.1)
Enterprise B-83
LEADER
system controller

Numbers
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)
Enterprise B-84
LEADER
system controller

Numbers

(linked to 1.6.1.1)




(linked to 1.9.1.1)

(linked to 1.9.4.1)

6 Processing Software fails due to anomalies

error (not addressed)
7 Short Cabling fails Coordinated overcurrent If no redundant power source 1 1 1
Enterprise B-85
LEADER
system controller

Numbers
Mechanical component (i.e., protection system exists, no alarms will be indicated
selector switch) fails in a panel Type (I, P or M): P (no power). [Local Effects]
Connectors fail Redundancy in power distribution
Connector fails system/paths
Type (I, P or M): P
Electronics fail
Type (I, P or M): M


Effects]



[Local Effects]

Enterprise B-86
LEADER
system controller

Numbers


(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)
Enterprise B-87
LEADER
system controller

Numbers

(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)



(linked to 1.9.1.1)
Enterprise B-88
LEADER
system controller

Numbers

(linked to 1.9.4.1)

8 Loss of Touch screen fails (no input to Alarms Loss of a CCU [Local Effects] 1 1 1
function node) Type (I, P or M): I
(general) Network fails Visual indication
Software fails due to Type (I, P or M): I
issues/anomalies/bugs Redundant panels/stations
Computer fails Type (I, P or M): P
I/O board fails Redundant screens
Type (I, P or M): P
Electronics fail Type (I, P or M): M
Loss of Driller's Panel [Local 1 1 1

Effects]
Loss of Tool Pusher's Panel [Local 1 1 1

Effects]

(linked to 1.1.1.1)

(linked to 1.1.2.1)
Enterprise B-89
LEADER
system controller

Numbers
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)
Enterprise B-90
LEADER
system controller

Numbers




(linked to 1.9.1.1)

(linked to 1.9.4.1)

Enterprise B-91
LEADER
2.1.6 Equipment: Accumulators - Surface - Surface Control Systems Accumulators - Surface including one 300 gal., 5K rack; one 180 gal 5K accumulator rack and

Numbers
1 External Valve fails (manifold isolation and Hydraulic fluid on rig Per regulation, cannot continue 1 1 1
Leak/Ruptur block & bleed) Type (I, P or M): I operations without surface
e Piping flange seal leaks Low accumulator pressure alarms accumulators (discontinue
Type (I, P or M): I operations until restored) [Local
Piping fails Effects]
Pressure gauge fails Subsea Engineer daily
walkthrough of room (collocated
Gas charging valves fail HPU, FRU, & accumulators)
Accumulator bottles fails Type (I, P or M): I
Accumulator gas valve leaks Unanticipated cycling of
Accumulator fails due to HPU/Pumps running
insufficient charge Type (I, P or M): I
Accumulator fails due to All pipework is secured/protected
insufficient fluid/pressure to Type (I, P or M): P
complete full/tight closure Isolate accumulator banks from
system and apply pressure to
system directly from HPU pumps
Type (I, P or M): P
Isolation valves
Type (I, P or M): P
Stack-mounted accumulator
bottles
Type (I, P or M): P
System is located inside, away
from elements
Type (I, P or M): P
Draw down tests between wells
Type (I, P or M): M
Five year wall thickness tests
Type (I, P or M): M
Precharge pressure test
Type (I, P or M): M

(linked to 1.1.1.2)

Enterprise B-92
LEADER

Numbers


(linked to 1.1.4.2)

1.1.7.1)


1.2.1.4)

Enterprise B-93
LEADER

Numbers
(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)



1.5.2.1)

Enterprise B-94
LEADER

Numbers

1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)
Enterprise B-95
LEADER

Numbers

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

Enterprise B-96
LEADER

Numbers
(linked to 1.9.4.2)

2 Internal Accumulator bottle bladder fails Delta in draw down test end Insufficient usable volume in 1 1 1
Leak from fatigue, or precharge is too pressure system (if unable to complete
low. Type (I, P or M): I EDS) [Local Effects]
Accumulator bladder fails 60 surface accumulator bottles
Accumulator fails due to Type (I, P or M): P
insufficient charge Precharge testing
Accumulator fails due to Type (I, P or M): M
insufficient fluid/pressure to
complete full/tight closure

(linked to 1.1.1.2)



Enterprise B-97
LEADER

Numbers
(linked to 1.1.4.2)

1.1.7.1)


1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)
Enterprise B-98
LEADER

Numbers

1.4.1.2)



1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

Enterprise B-99
LEADER

Numbers
1.6.2.1)

1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

Enterprise B-100
LEADER

Numbers
(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

3 Plugged Debris Unintentional Opening - 10 3 2 60

1.6.5.2)
Enterprise B-101
LEADER

Numbers
4 Mechanical Loss of precharge in a single Delta in draw down test end Insufficient usable volume in 1 1 1
Failure bottle when bladder and poppet pressure system (if unable to complete
fail Type (I, P or M): I EDS) [Local Effects]
Accumulator bladder fails Sixty surface accumulator bottles

(linked to 1.1.1.2)



(linked to 1.1.4.2)

1.1.7.1)

Enterprise B-102
LEADER

Numbers

1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)


Enterprise B-103
LEADER

Numbers

1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.3.2)
Enterprise B-104
LEADER

Numbers

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


Enterprise B-105
LEADER

Numbers
to 1.9.1.2)

(linked to 1.9.4.2)

5 Wear Ball valve fails due to wear Between well draw down test Down time/System isolation [Local 1 1 1
Accumulator bladder fails due to Type (I, P or M): M Effects]
wear Precharge pressure test
Poppet fails due to wear Type (I, P or M): M
Gas charging valves fail
Accumulator bladder fails
Accumulator gas valve leaks
Accumulators fails due to
insufficient charge
Accumulator fails due to

(linked to 1.1.1.2)

Enterprise B-106
LEADER

Numbers


(linked to 1.1.4.2)

1.1.7.1)


1.2.1.4)

(linked to 1.2.1.5)
Enterprise B-107
LEADER

Numbers

(linked to 1.3.1.2)

1.4.1.2)



1.5.2.1)


1.5.3.2)
Enterprise B-108
LEADER

Numbers
(linked to 1.5.4.2)

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
Enterprise B-109
LEADER

Numbers
1.6.5.2)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

Enterprise B-110
LEADER

Numbers

osion corrosion/erosion of the
Accumulators - Surface - Surface
Control Systems
7 Loss of Accumulator bladder fails Hydraulic fluid on rig Down time/System isolation [Local 1 1 1
Function Accumulator gas valve leaks Type (I, P or M): I Effects]
(general) Low accumulator pressure alarms
Valve fails (manifold isolation and
block & bleed) Type (I, P or M): I
Flange seal fails Subsea Engineer daily
Piping fails HPU, FRU, & accumulators)
Pressure gauges fail Type (I, P or M): I
Gas charging valves fail Unanticipated cycling of
Accumulator bottles fail HPU/Pumps running
Type (I, P or M): I
Accumulator bottle bladder fails
from fatigue, or precharge is too All pipework is secured/protected
low. Type (I, P or M): P
Loss of precharge in a single Isolate accumulator banks from
bottle when bladder and poppet system and apply pressure to
fail system directly from HPU pumps
Type (I, P or M): P
Ball valve fails due to wear
Isolation valves
Accumulator bladder fails due to
Type (I, P or M): P
wear
Sixty surface accumulator bottles
Poppet fails due to wear
Type (I, P or M): P
Accumulators fail due to
insufficient charge
bottles
from elements
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
Precharge pressure test
Type (I, P or M): M
Insufficient usable volume in 1 1 1

system (if unable to complete
EDS) [Local Effects]
Enterprise B-111
LEADER

Numbers
Per regulation, cannot continue 1 1 1

operations without surface
accumulators (discontinue
operations until restored) [Local
Effects]

(linked to 1.1.1.2)



(linked to 1.1.4.2)

1.1.7.1)

Enterprise B-112
LEADER

Numbers

1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)

Enterprise B-113
LEADER

Numbers


1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

1.6.2.2)

Enterprise B-114
LEADER

Numbers
(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

to 1.7.2.4)
Enterprise B-115
LEADER

Numbers

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

Enterprise B-116
LEADER
2.1.7 Equipment: Fluid Reservoir Unit - Surface Control Systems Fluid Reservoir Unit, including 650 gal. glycol, 550 gal concentrate, and 1350 gal mixed fluid
reservoirs; glycol, concentrate, and mixed fluid pumps; and associated piping,

Numbers
1 External Reservoir/tank leaks Low level alarms in tanks Inadequate fluid supply to HPU 1 1 1
Leak/Ruptur Pump leaks Type (I, P or M): I [Local Effects]
e Visual indication of fluid
Valve leaks (ball, check, needle)
Type (I, P or M): I
Connections/flanges leak
Periodic maintenance of hydraulic
Piping fails accumulator system (weekly,
Pneumatic equipment unit (PNEU) monthly, quarterly). Some
fails due to standard hard pipe specific to FRU.
PNEU failures Type (I, P or M): M
Tank drain ball valves leaks
Incoming air lubrication valve (LP-
1) leaks
relief)
Seal/joint leaks
Incorrect mix ratios if leak occurs 1 1 1

between concentrate/water tank
and mix tank [Local Effects]

(linked to 1.1.1.2)


1.1.7.1)

Enterprise B-117
LEADER

Numbers

(linked to 1.3.1.2)

1.4.1.2)


1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

Enterprise B-118
LEADER

Numbers
(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

2 Internal Pump relief valves leak Incorrect fluid composition Incorrect indication of 1 1 1
Leak Pump fails (i.e., internal leak) due Type (I, P or M): I concentration levels [Local Effects]
to wear of metal to metal seals Overflow of mix tank
Regulator leaks Type (I, P or M): I
Closed isolation valves (ball Hydraulic fluid sampled daily,
valves) tested monthly
Type (I, P or M): M
Flow control valve from Potable
Enterprise B-119
LEADER

Numbers
water (FC1-1) leaks
Regulator fails

(linked to 1.1.3.2)

(linked to 1.1.4.2)

3 Plugged Incoming air filter failsdue to Differential pressure on Inadequate fluid supply to HPU 1 1 1
plugging recirculation pump [Local Effects]
Potable water filter (FL5-1) fails Type (I, P or M): I
due to plugging Incorrect mix ratios
Concentrate Supply Filters fail due Type (I, P or M): I
to plugging Low level on mixed reservoir
Recirculation pump filter fails due Type (I, P or M): I
to plugging Pressurize/collapse tanks
Tank ventilation filters fails due to Type (I, P or M): I
plugging (i.e., FL8-1,2) Filters replaced between wells
Contamination/filtering Type (I, P or M): M
Filters/strainers fail due to Sample fluid daily, test monthly
plugging Type (I, P or M): M
Strainers cleaned weekly
Type (I, P or M): M

Enterprise B-120
LEADER

Numbers

(linked to 1.1.1.2)


1.1.7.1)


(linked to 1.3.1.2)

1.4.1.2)

Enterprise B-121
LEADER

Numbers

1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)
Enterprise B-122
LEADER

Numbers

(linked to 1.9.4.2)

4 Mechanical Pump fails Differential pressure on Reduced mixing efficiency [Local 1 1 1

Failure Check valve fails due to loss of recirculation pump Effects]
(CV3-9) Pneumatic Equipment Type (I, P or M): I
Unit (PNEU) Supply Incorrect mix ratios
Ball valve fails Type (I, P or M): I
Level switch fails Low level on mixed reservoir
Type (I, P or M): I
relief) Reduced mixing efficiency
Type (I, P or M): I
Sample fluid daily, test monthly
Type (I, P or M): M

(linked to 1.1.1.2)


Enterprise B-123
LEADER

Numbers

(linked to 1.3.1.2)

1.4.1.2)


1.6.2.1)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)
Enterprise B-124
LEADER

Numbers

(linked to 1.9.4.2)

5 Wear Fluid Reservoir Unit fails due to Audible indication of pump wear Reduced mixing efficiency [Local 1 1 1
insufficient air lubrication Type (I, P or M): I Effects]
Pump fails due to internal wear Incorrect fluid mixing
Type (I, P or M): I
Quarterly pump oil change,
cleaned, inspected
Type (I, P or M): M
Weekly pump efficiency test
Type (I, P or M): M

(linked to 1.1.1.2)

osion corrosion/erosion of the Fluid
Reservoir Unit - Surface Control
Systems
7 Loss of Regulator fails Audible indication of pump wear Inadequate fluid supply to HPU 1 1 1
Function Reservoir/tank leaks Type (I, P or M): I [Local Effects]
(general) Differential pressure on
Pump leaks
recirculation pump
Valve leaks (ball, check, needle) Type (I, P or M): I
Connections/flanges leak Incorrect fluid composition
Piping fails Type (I, P or M): I
Pneumatic Equipment Unit (PNEU) Incorrect mix ratios/fluid mixing
fails due to loss of air supply Type (I, P or M): I
Tank drain ball valves leaks Low level alarm on mixed
Enterprise B-125
LEADER

Numbers
Incoming air lubrication valve (LP- reservoir
1) leaks Type (I, P or M): I
Pump relief valves leak Low level alarms in tanks
Pump fails (internal leak) due to Type (I, P or M): I
wear of metal to metal seals Overflow of mix tank
Closed isolation valves (ball Pressurize/collapse tanks
valves) Type (I, P or M): I
Flow control valve from Potable Reduced mixing efficiency
water (FC1-1) fails Type (I, P or M): I
Filters/strainers fail due to Visual indication of fluid
plugging Type (I, P or M): I
Incoming air filter fails due to Filters replaced between well
plugging Type (I, P or M): M
Potable water filter (FL5-1) fail Hydraulic fluid sampled daily,
due to plugging tested monthly
Type (I, P or M): M
Concentrate Supply Filters fail due
to plugging Periodic maintenance of hydraulic
accumulator system (weekly,
Recirculation pump filter fails due monthly, quarterly). Some
to plugging specific to FRU.
Tank ventilation filters fail due to Type (I, P or M): M
plugging (i.e., FL8-1,2) Quarterly pump oil change,
Pump fails cleaned, inspected
Check valve fails due to loss of Type (I, P or M): M
(CV3-9) Pneumatic Equipment Sample fluid daily, test monthly
Unit (PNEU) Supply Type (I, P or M): M
Ball valve fails Strainers cleaned weekly
Level switch fails Type (I, P or M): M
Fluid Reservoir Unit fails due to Weekly pump efficiency test
insufficient air lubrication Type (I, P or M): M
Pump fails due to internal wear
relief)
Seal/joint leaks
Incorrect indication of 1 1 1
concentration levels [Local Effects]

Enterprise B-126
LEADER

Numbers
Reduced mixing efficiency [Local 1 1 1

Effects]

(linked to 1.1.1.2)

(linked to 1.1.3.2)

(linked to 1.1.4.2)

1.1.7.1)


Enterprise B-127
LEADER

Numbers
(linked to 1.3.1.2)


1.4.1.2)


1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.7.2.3)

to 1.7.2.4)
Enterprise B-128
LEADER

Numbers
1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

Enterprise B-129
LEADER
2.1.8 Equipment: Secondary & Emergency Control Systems - Surface Control Systems Secondary & Emergency Control Systems including associated MUX Control System equipment
& Surface ERA

Numbers
1 Loss of, or UPS fails (own, separate UPS UPS does own self-diagnostic EH backup system would not 1 1 1
Degraded failure) testing, however it is NOT function (All other primary and
Power Cable/connection fails (EH panel is connected to main control system secondary means of
located next to EH UPS) and user would have to be in communications with well and well
room to know UPS has a failure control have been defeated prior
Loss of Power Type (I, P or M): I to EH attempt). EH backup would
Can directly connect generator primarily be used in a well control
power to EH system situation, not station keeping
Type (I, P or M): P where EDS would/could be used
[Local Effects]
Deadman or autoshear (assuming
it is armed)
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
ROV intervention
Type (I, P or M): P
EH backup is function tested
between wells only
Type (I, P or M): M
Quarterly maintenance for
electrical
Type (I, P or M): M

(linked to 1.6.1.1)



Enterprise B-130
LEADER
& Surface ERA

Numbers

(linked to 1.9.1.1)

(linked to 1.9.4.1)

2 Fails with no Electrical power fails UPS does own self-diagnostic EH backup system would not 1 1 1
output Internal panel fails (electrical or testing, however it is NOT function (All other primary and
signal/comm mechanical) connected to main control system secondary means of
unication and user would have to be in communications with well and well
(Includes MUX cable fails room to know UPS has a failure control have been defeated prior
Short) MUX cable fails due to a short Type (I, P or M): I to EH attempt). EH backup would
Can directly connect generator primarily be used in a well control
power to EH system situation, not station keeping
Type (I, P or M): P where EDS would/could be used
[Local Effects]
it is armed)
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
ROV intervention
Type (I, P or M): P
EH backup is function tested
between wells only
Type (I, P or M): M
electrical
Type (I, P or M): M
Enterprise B-131
LEADER
& Surface ERA

Numbers

(linked to 1.6.1.1)




(linked to 1.9.1.1)

(linked to 1.9.4.1)

3 Loss of UPS fails (own, separate UPS UPS does own self-diagnostic EH backup system would not 1 1 1
function failure) testing, however it is NOT function (All other primary and
(general) Cable/connection fails (EH panel is connected to main control system secondary means of
and user would have to be in communications with well and well
Enterprise B-132
LEADER
& Surface ERA

Numbers
located next to EH UPS) room to know UPS has a failure control have been defeated prior
Electrical power fails Type (I, P or M): I to EH attempt). EH backup would
EH backup is function tested primarily be used in a well control
Internal panel fails (electrical or situation, not station keeping
mechanical) between wells only
Type (I, P or M): M where EDS would/could be used
MUX cable fails [Local Effects]
MUX cable fails due to a short electrical
Type (I, P or M): M
Can directly connect generator
power to EH system
Type (I, P or M): P
it is armed)
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
ROV intervention
Type (I, P or M): P

(linked to 1.6.1.1)



Enterprise B-133
LEADER
& Surface ERA

Numbers

(linked to 1.9.1.1)

(linked to 1.9.4.1)

Enterprise B-134
LEADER
2- Subsea Control Systems
Enterprise B-135
LEADER
2.2.1 Equipment: Blue & Yellow Control Systems - Electrical - Subsea Control Systems Blue & Yellow Control Systems including MUX control, MUX POD power & communication,
hydraulic connections within the pod, E/H section (hydraulics, power, communication, SEM
interface, pressure, temperature, and water sensors, transformer, pod cabling, solenoid
boards, solenoids.

Numbers
1 Loss of, or MUX cable fails Alarms - Loss of a power supply Degraded control of the pod 1 1 1
Degraded Transformer fails Type (I, P or M): I (Degraded Power) [Local Effects]
Power Failure of individual functions of a
Power supply fails
controller do NOT necessarily
Loss of Power due to water constitute a failure or loss of the
ingress controller or pod's SEM
Subsea connector fails Type (I, P or M): P
MUX cable fails due to a short Redundant pod
Loss of Power Redundant within the pod (with
the exception of a connector
Connector fails due to mechanical
failure). Multiple power supplies,
issues
transformers, controllers in each
Electronics fail pod.
Type (I, P or M): P
Between well surface testing
Type (I, P or M): M
Weekly BOP function tests
Type (I, P or M): M
Loss of control of the pod 1 1 1

(Assumes Loss of power) [Local
Effects]

(linked to 1.1.1.1)

(linked to 1.1.2.1)
Enterprise B-136
LEADER
boards, solenoids.

Numbers
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)
Enterprise B-137
LEADER
boards, solenoids.

Numbers




(linked to 1.9.1.1)

(linked to 1.9.4.1)

2 Fails with no Controller A/B fails Alarms on solenoids, controllers, Controller failure [Local Effects] 1 1 1
output Controller A/B communications fail I/Os
signal/comm Type (I, P or M): I
unication SEM fails/communications fail
Pod mismatch alarms
I/O board fails Type (I, P or M): I
Solenoid driver board fails For solenoid failure - Annual
Solenoid fails to fire signature tests, constantly
Enterprise B-138
LEADER
boards, solenoids.

Numbers
Solenoid fails monitored
Electronics fail One complete set of solenoid
control boards per controller
Type (I, P or M): P
ROV intervention for critical
operations
Type (I, P or M): P
Two controllers per pod
Type (I, P or M): P
Two pods
Type (I, P or M): P
Type (I, P or M): M
Weekly BOP function testing
Type (I, P or M): M
Pod Failure [Local Effects] 1 1 1

(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

Enterprise B-139
LEADER
boards, solenoids.

Numbers
1.2.1.1)
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)

receive EDS signal - Emergency
Enterprise B-140
LEADER
boards, solenoids.

Numbers



(linked to 1.9.1.1)

(linked to 1.9.4.1)

3 Erratic Solenoid fails due to bad Alarms (Solenoid monitoring) Loss of a single function in a pod 1 1 1
output connection in solenoid circuit Type (I, P or M): I [Local Effects]
Control system fails due to Pod mismatch & alarm
pinched wire Type (I, P or M): I
Control system fails due to Voltage monitoring Alarms
hydrostatic pressure on some Type (I, P or M): I
connectors Redundant controllers
Connector fails due to mechanical Redundant pods
issues Type (I, P or M): P
Electronics fail Between well testing
Type (I, P or M): M
Enterprise B-141
LEADER
boards, solenoids.

Numbers
Type (I, P or M): M

(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)

Enterprise B-142
LEADER
boards, solenoids.

Numbers

(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)




Enterprise B-143
LEADER
boards, solenoids.

Numbers
(linked to 1.9.1.1)

(linked to 1.9.4.1)

4 Fails to Controller A/B fails Alarms on solenoids, controllers, Controller failure [Local Effects] 1 1 1
respond to Controller A/B communications fail I/Os
input - Type (I, P or M): I
Electrical SEM fails/communications fail
For solenoid failure - Annual
Solenoid driver board fails signature tests, constantly
Solenoid fails to fire monitored
Solenoid fails Type (I, P or M): I
I/O board fails Pod mismatch alarms
Type (I, P or M): I
Electronics fail
One complete set of solenoid
Type (I, P or M): P
operations
Type (I, P or M): P
Type (I, P or M): P
Two pods
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
Pod Failure [Local Effects] 1 1 1

Enterprise B-144
LEADER
boards, solenoids.

Numbers
(linked to 1.1.1.1)

(linked to 1.1.2.1)
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)


Enterprise B-145
LEADER
boards, solenoids.

Numbers
(linked to 1.4.1.1)

1.5.1.1)

(linked to 1.6.1.1)




(linked to 1.9.1.1)

Enterprise B-146
LEADER
boards, solenoids.

Numbers
(linked to 1.9.4.1)

5 Processing SEM/Controller Lockup = loss of a Alarms on solenoids, controllers, Loss of a single controller within a 1 1 1
error controller I/Os pod [Local Effects]
Type (I, P or M): I
signature tests, constantly
monitored
Type (I, P or M): I
Pod mismatch alarms
Type (I, P or M): I
Type (I, P or M): P
operations
Type (I, P or M): P
Type (I, P or M): P
Two pods
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M

6 Ground Control system fails due to water Alarms - Monitoring systems Alarm [Local Effects] 1 1 1
Fault ingress Type (I, P or M): I
Control system fails due to wiring Loss of function
damage Type (I, P or M): I
Enterprise B-147
LEADER
boards, solenoids.

Numbers
Electronics fail Redundant Pods
Type (I, P or M): P
(linked to 1.1.5.1)
1.2.2.1)
7 Loss of MUX cable fails Alarms (Solenoid monitoring) Controller failure [Local Effects] 1 1 1
function Transformer fails Type (I, P or M): I
(general) Alarms - Loss of a power supply
Power supply fails
Type (I, P or M): I
Control system fails due to water
ingress Alarms on solenoids, controllers,
I/Os
Subsea connector fails Type (I, P or M): I
Controller A/B fails For solenoid failure - Annual
Controller A/B communications fail signature tests, constantly
SEM fails/communications fail monitored
Type (I, P or M): I
I/O board fails
Pod mismatch alarms
Solenoid driver board fails
Type (I, P or M): I
Solenoid fails to fire
Voltage monitoring Alarms
Solenoid circuit fails due to bad Type (I, P or M): I
connection
Failure of individual functions of a
Control system fails due to controller does NOT necessarily
pinched wire constitute a failure or loss of the
Control system fails due to controller or pod's SEM
Hydrostatic pressure on some Type (I, P or M): P
connectors One complete set of solenoid
Solenoid fails control boards per controller
Type (I, P or M): P
Redundant pods
Connector fails due to grounding
Type (I, P or M): P
Loss of Power
Redundant within the pod (with
Enterprise B-148
LEADER
boards, solenoids.

Numbers
I/O board fails the exception of a connector
Connector fails due to mechanical failure). Multiple power supplies,
issues transformers, controllers in each
pod.
Electronics fail Type (I, P or M): P
operations
Type (I, P or M): P
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
Between well testing
Type (I, P or M): M
Degraded control of the pod 1 1 1

(Degraded Power) [Local Effects]

Effects]
Loss of a single function in a pod 1 1 1

[Local Effects]
Pod Failure [Local Effects] 1 1 1 1

(linked to 1.1.1.1)

(linked to 1.1.2.1)
Enterprise B-149
LEADER
boards, solenoids.

Numbers
(linked to 1.1.5.1)

1.2.1.1)
1.2.2.1)


(linked to 1.4.1.1)

1.5.1.1)

Enterprise B-150
LEADER
boards, solenoids.

Numbers
(linked to 1.6.1.1)




(linked to 1.9.1.1)

(linked to 1.9.4.1)

8 Fails to send
hydraulic
pilot signal
Enterprise B-151
LEADER
2.2.2 Equipment: Blue & Yellow Control Systems - Hydraulics - Subsea Control Systems Blue & Yellow Control Systems - Lower Valve Section including regulators and SPM valves

Numbers
1 External Pipe, tubing, valve fails Low pressure alarms Loss of a function [Local Effects] 1 1 1
Leak / Fittings & Seals (pipe, valve, flow Type (I, P or M): I
Rupture meter etc.) leak Pumps running and pump run
Shear seal valve leaks lights
Type (I, P or M): I
SPM valve leaks
Pressure transducers/transmitters
Shuttle valve leaks Type (I, P or M): I
Schrader valve leaks Surface and subsea flow meters
Packer seal leaks Type (I, P or M): I
Hydraulic cylinder leaks Cross connection valve between
Accumulator leaks yellow/blue supply and
yellow/blue pods
Relief valve leaks
Type (I, P or M): P
Regulator leaks
Redundant pod & pod supply
Check valve leaks Type (I, P or M): P
Accumulator fails due to ROV intervention
insufficient charge Type (I, P or M): P
Pod tubing fails/leaks Between well Soak test and stump
Pod regulator fails test
Type (I, P or M): M
SPM Spool valve fails
Weekly functions tests
Shear seal valve fails
Type (I, P or M): M
Hydraulic line ruptures (rigid pipe)
Every 6 years complete teardown
Shuttle valve fails (doesn't and rebuild including static seals
transition/move, stuck, leaks) Type (I, P or M): M
Check valve fails Visual inspection between wells
Regulator fails Type (I, P or M): M
Trigger valve (SPM valve) fails to Pod rotation every 2 years (1 year
open in shop as spare, 2 years on stack,
then rebuild valves)
Control system fails due to
Type (I, P or M): M
insufficient charge
ROV inspection every 3 days
Type (I, P or M): M
complete full/tight closure Regulators are rebuilt every year
Type (I, P or M): M
SPMs rebuilt every 3 years
Type (I, P or M): M
Loss of Pod [Local Effects] 1 1 1
Partial loss of manifold functions 1 1 1
Enterprise B-152
LEADER

Numbers
[Local Effects]

(linked to 1.1.1.2)


(linked to 1.1.3.2)


(linked to 1.1.4.2)

1.1.7.1)

Enterprise B-153
LEADER

Numbers

1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)


1.4.1.2)

Enterprise B-154
LEADER

Numbers


1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

1.5.6.1)

1.6.2.1)

Enterprise B-155
LEADER

Numbers
1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.6.7.1)

(linked to 1.7.2.3)
Enterprise B-156
LEADER

Numbers

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

2 Internal Check valves leak in all regulator Cannot adjust pilot (pilot piston Loss of a function [Local Effects] 1 1 1
Leak circuits (i.e., upper annular seal leak)
pressure increase)...(new Type (I, P or M): I
drawings have dual checks) Low pressure alarms
Valve leaks Type (I, P or M): I
Accumulators fail due to bladder Manifold pressure monitoring
rupture Type (I, P or M): I
Regulator pilot piston seal leaks Pressure transducers/transmitters
All check valves leak Type (I, P or M): I
Check valve 11 leaks Pumps running (flow meters)
Enterprise B-157
LEADER

Numbers
Pod regulator fails Type (I, P or M): I
Check valve fails Pumps running and pump run
Accumulator bladder fails lights
Type (I, P or M): I
insufficient charge Surface and subsea flow meters
Type (I, P or M): I
insufficient fluid/pressure to Cross connection valve between
complete full/tight closure yellow/blue supply and
yellow/blue pods
Type (I, P or M): P
Dual check valves on regulator
manifolds (not shown on current
drawings, but is on Rev. H)
Type (I, P or M): P
Type (I, P or M): P
ROV intervention
Type (I, P or M): P
Between well Soak & Stump tests
Type (I, P or M): M
Every 6 years complete teardown
and rebuild including static seals
Type (I, P or M): M
Pod rotation every 2 years (1 year
in shop as spare, 2 years on stack,
Type (I, P or M): M
Regulators are rebuilt every year
Type (I, P or M): M
Type (I, P or M): M
SPMs rebuild every 3 years
Type (I, P or M): M
Weekly Function test
Type (I, P or M): M
Visual inspection between wells
Type (I, P or M): M

[Local Effects]
Enterprise B-158
LEADER

Numbers

(linked to 1.1.1.2)


(linked to 1.1.4.2)


1.2.1.4)

Enterprise B-159
LEADER

Numbers
(linked to 1.2.1.5)

(linked to 1.3.1.2)


1.4.1.2)



1.5.2.1)


Enterprise B-160
LEADER

Numbers
1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
Enterprise B-161
LEADER

Numbers
1.6.5.2)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)

(linked to 1.9.4.2)

3 Plugged Filter fails due to plugging Duration of function tests Loss of a function [Local Effects] 1 1 1
Plugged/restricted flow solenoid (comparison between)
Type (I, P or M): I
Bladder fails due to restriction in
lines Fluid recirculated in FRU tank,
fluid consumption ~1k gal per
Control system failure due to week
filters being bypassed (fluid not Type (I, P or M): I
being filtered before valves)
Gallon counts / Flow meters
Control system fails due to Type (I, P or M): I
overlubrication of conduit
Automatic bypass on filters
Organic fouling Type (I, P or M): P
Contamination/filtering Multiple filters in system between
Control system fails due to FRU to pod
clogged/plugged path (Includes Type (I, P or M): P
Enterprise B-162
LEADER

Numbers
filter, piping, tubing, etc.) Redundant pods
Control system fails due to Type (I, P or M): P
restriction in system (filter, hose, Fluid sampled daily, tested
ID of fitting) monthly
Type (I, P or M): M
Rigid conduit flushed after landing
LMRP, after running riser
Type (I, P or M): M
Standard Between well & Weekly
tests/maintenance (soak, stump,
function)
Type (I, P or M): M

[Local Effects]
Slow response, on demand [Local 1 1 1

Effects]

(linked to 1.1.1.2)



Enterprise B-163
LEADER

Numbers
(linked to 1.1.4.2)

1.1.7.1)


1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

Enterprise B-164
LEADER

Numbers
1.4.1.2)



1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

1.5.5.1)

Enterprise B-165
LEADER

Numbers
1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.6.6.1)

(linked to 1.7.2.3)
Enterprise B-166
LEADER

Numbers

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

4 Mechanical Hydraulic lines clogged due to Low pressure alarms Loss of a function [Local Effects] 1 1 1
Failure particulate Type (I, P or M): I
Regulator (metal-metal) fails Pressure transducers/transmitters
Shear seals (cups, scoring in Type (I, P or M): I
metal-metal) fail Pumps running and pump run
Accumulator bladders fail lights
Type (I, P or M): I
SPM valve seat or spring fails
Surface and subsea flow meters
SPM valve springs fail due to Type (I, P or M): I
hydrogen embrittlement
(environmentally stressed Cross connection valve between
Enterprise B-167
LEADER

Numbers
corrosion) yellow/blue supply and
Shuttle valve stuck yellow/blue pods
Type (I, P or M): P
Shuttle valve fails to
transition/move Redundant pod & pod supply
Type (I, P or M): P
Shear seal valve fails due to
malfunctions ROV intervention
Type (I, P or M): P
Shear seal valve stuck
System design (material selection)
SPM Spool valve fails for environment and reliability
Pod regulator fails Type (I, P or M): P
Contamination/filtering Weekly functions tests
Accumulator bladder fails Type (I, P or M): M
Regulator fails Between well Soak test and stump
test
Springs fail
Type (I, P or M): M
Control system fails due to debris
in system
Type (I, P or M): M
Valve fails due to binding greater
than spring force (=stuck)
Type (I, P or M): M
hydraulic lock (=stuck)
Valve fails open so hydraulic then rebuild valves)
pressure doesn't bleed off Type (I, P or M): M
(=stuck)
Trigger valve spring fails
Valve seat fails (assumed trigger
valve)
insufficient charge

[Local Effects]

Enterprise B-168
LEADER

Numbers
(linked to 1.1.1.2)


(linked to 1.1.3.2)


(linked to 1.1.4.2)
Failure to Actuate Under Fail-safe 9 2 7 126

Conditions - Failure to open /
close fail-safe valves - Close and
seal on the drill pipe and allow
1.1.6.1)

Enterprise B-169
LEADER

Numbers

1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)



Enterprise B-170
LEADER

Numbers
1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.2)

1.6.4.1)
Enterprise B-171
LEADER

Numbers
(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)

(linked to 1.9.4.2)

5 Wear Not an issue, as components are

often swapped before wear
becomes a threat/problem. Other
relevant causes captured in
2.2.2.4 - Mechanical Failure
Enterprise B-172
LEADER

Numbers
6 Corrosion/Er SPM Spool valve fails Low pressure alarms Loss of a function [Local Effects] 1 1 1
osion SPM valve seat or spring fails Type (I, P or M): I
SPM valve springs fail due to Pumps running and pump run
hydrogen embrittlement lights
(environmentally stressed Type (I, P or M): I
corrosion) Pressure transducers/transmitters
Springs fail Type (I, P or M): I
Trigger valve spring fails Surface and subsea flow meters
Type (I, P or M): I
valve) Cross connection valve between
yellow/blue supply and
yellow/blue pods
Type (I, P or M): P
Type (I, P or M): P
ROV intervention
Type (I, P or M): P
for environment and reliability
Type (I, P or M): P
Type (I, P or M): M
Between well Soak test and stump
test
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M

[Local Effects]

Enterprise B-173
LEADER

Numbers
(linked to 1.1.1.2)


(linked to 1.1.4.2)

1.1.6.1)


1.2.1.4)

Enterprise B-174
LEADER

Numbers
(linked to 1.2.1.5)

(linked to 1.3.1.2)


1.4.1.2)



1.5.2.1)


Enterprise B-175
LEADER

Numbers
1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
Enterprise B-176
LEADER

Numbers
1.6.5.2)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)

(linked to 1.9.4.2)

7 Loss of Not considered further as potential

Function causes have been reviewed under
(general) 2.2.2.1 through 2.2.2.6.
Enterprise B-177
LEADER
2.2.3 Equipment: Accumulators - Subsea Control Systems Accumulators - Subsea including associated hydraulic piping and connections such as MUX pod
and rigid conduit connections

Numbers
1 External Accumulator gas valve leaks Hydraulic fluid on rig Per regulation, cannot continue 1 1 1
Leak/Ruptur Valve fails (manifold isolation and Type (I, P or M): I operations without surface
e block & bleed) Low accumulator pressure alarms accumulators (discontinue
Type (I, P or M): I operations until restored) [Local
Flange seal leaks Effects]
Piping fails Subsea Engineer daily
Pressure gauges fail HPU, FRU, & accumulators)
Gas charging valves fail Type (I, P or M): I
Accumulator bottles leak Unanticipated cycling of
Accumulators fail due to HPU/Pumps running
insufficient charge Type (I, P or M): I
Accumulators fail due to All pipework is secured/protected
insufficient fluid/pressure to Type (I, P or M): P
complete full/tight closure Isolate accumulator banks from
system and apply pressure to
system directly from HPU pumps
Type (I, P or M): P
Isolation valves
Type (I, P or M): P
bottles
Type (I, P or M): P
from elements
Type (I, P or M): P
Type (I, P or M): M
5 year wall thickness tests
Type (I, P or M): M
precharge pressure test
Type (I, P or M): M

(linked to 1.1.1.2)

Enterprise B-178
LEADER

Numbers

(linked to 1.1.3.2)


(linked to 1.1.4.2)

1.1.7.1)


Enterprise B-179
LEADER

Numbers
1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)


1.4.1.2)


1.5.2.1)

Enterprise B-180
LEADER

Numbers

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)
Enterprise B-181
LEADER

Numbers

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

2 Internal Accumulator bladder fails Delta in draw down test end Insufficient usable volume in 1 1 1
Leak Accumulator bottle bladder fails pressure system (if unable to complete
due to fatigue, or precharge is too Type (I, P or M): I EDS) [Local Effects]
low. Sixty surface accumulator bottles
Accumulators fail due to Type (I, P or M): P
insufficient charge Precharge testing
Accumulators fail due to Type (I, P or M): M
Enterprise B-182
LEADER

Numbers

(linked to 1.1.1.2)



(linked to 1.1.4.2)

1.1.7.1)

Enterprise B-183
LEADER

Numbers
1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)


1.5.2.1)

Enterprise B-184
LEADER

Numbers

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)
Enterprise B-185
LEADER

Numbers

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)


plugging of the Accumulators -
Subsea Control Systems
4 Mechanical Accumulator bladder fails Delta in draw down test end Insufficient usable volume in 1 1 1
Failure Loss of precharge in a single pressure system (if unable to complete
bottle when bladder and poppet Type (I, P or M): I EDS) [Local Effects]
fail Sixty surface accumulator bottles
Accumulators fail due to Type (I, P or M): P
insufficient fluid/pressure to Precharge testing
Enterprise B-186
LEADER

Numbers
complete full/tight closure Type (I, P or M): M

(linked to 1.1.1.2)



(linked to 1.1.4.2)

1.1.7.1)

Enterprise B-187
LEADER

Numbers

1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)


1.5.2.1)

Enterprise B-188
LEADER

Numbers

1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)

to 1.7.2.4)
Enterprise B-189
LEADER

Numbers

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

5 Wear Accumulator bladder fails Between well draw down test Down time/System isolation [Local 1 1 1
Accumulator gas valve leaks Type (I, P or M): M Effects]
Ball valve fails due to wear Precharge pressure test
Type (I, P or M): M
Accumulator bladder fails due to
wear
Poppet fails due to wear
Gas charging valve fails due to
wear
insufficient charge
Enterprise B-190
LEADER

Numbers

(linked to 1.1.1.2)



(linked to 1.1.4.2)

1.1.7.1)

Enterprise B-191
LEADER

Numbers
1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)


1.5.2.1)

Enterprise B-192
LEADER

Numbers

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)
Enterprise B-193
LEADER

Numbers

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)


osion corrosion/erosion of the
Accumulators - Subsea Control
Systems
7 Loss of Accumulator bladder fails Hydraulic fluid on rig Down time/System isolation [Local 1 1 1
Function Accumulator gas valve leaks Type (I, P or M): I Effects]
(general) Low accumulator pressure alarms
Valve fails (manifold isolation and
block & bleed) Type (I, P or M): I
Flange seal fails Subsea Engineer daily
Enterprise B-194
LEADER

Numbers
Piping fails walkthrough of room (collocated
Pressure gauge fails HPU, FRU, & accumulators)
Type (I, P or M): I
Gas charging valves fail
Unanticipated cycling of
Accumulator bottles fails HPU/Pumps running
Accumulator bottle bladder fails Type (I, P or M): I
due to fatigue, or precharge is too All pipework is secured/protected
low. Type (I, P or M): P
Loss of precharge in a single Isolate accumulator banks from
bottle when bladder and poppet system and apply pressure to
fail system directly from HPU pumps
Ball valve fails due to wear Type (I, P or M): P
Accumulator bladder fails due to Isolation valves
wear Type (I, P or M): P
Poppet fails due to wear Sixty surface accumulator bottles
Accumulators fails due to Type (I, P or M): P
insufficient fluid/pressure to Stack-mounted accumulator
complete full/tight closure bottles
Accumulators fails due to Type (I, P or M): P
insufficient charge System is located inside, away
from elements
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
precharge pressure test
Type (I, P or M): M
Insufficient usable volume in 1 1 1

system (if unable to complete
EDS) [Local Effects]
Per regulation, cannot continue 1 1 1

operations without surface
accumulators (discontinue
operations until restored) [Local
Effects]

Enterprise B-195
LEADER

Numbers
(linked to 1.1.1.2)



(linked to 1.1.4.2)

1.1.7.1)


Enterprise B-196
LEADER

Numbers
1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)


1.5.2.1)


1.6.2.1)
Enterprise B-197
LEADER

Numbers

1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)

to 1.7.2.4)

Enterprise B-198
LEADER

Numbers
1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

Enterprise B-199
LEADER
2.2.4 Equipment: EDS - Subsea Control Systems Secondary and Emergency Disconnect System - Subsea including POD angle sensor,
inclinometer, acoustic, and deadman

Numbers
1 Loss of, or Control system fails due to water Alarms - Loss of a power supply Degraded control of the pod 1 1 1
Degraded ingress Type (I, P or M): I (Degraded Power) [Local Effects]
Power Subsea connector fails Drill string weight
MUX cable fails Type (I, P or M): I
Transformer fails LMRP separation indication
Type (I, P or M): I
Power supply fails
Redundant pod
MUX cable fails due to a short Type (I, P or M): P
Connector fails due to grounding Failure of individual functions of a
Loss of Power controller do NOT necessarily
Connector fails due to mechanical constitute a failure or loss of the
issues controller or pod's SEM
Type (I, P or M): P
Redundant within the pod (with
failure). Multiple power supplies,
transformers, controllers in each
pod.
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M

Effects]
Unable to complete the EDS [Local 1 1 1

Effects]



Enterprise B-200
LEADER

Numbers
2 Fails with no Controller A/B fails Alarms on solenoids, controllers, Loss of control of the pod 1 1 1
output Controller A/B communications fail I/Os (Assumes Loss of power) [Local
signal/comm Type (I, P or M): I Effects]
unication SEM fails/communications fail
I/O board fails signature tests, constantly
Solenoid driver board fails monitored
Solenoid fails to fire Type (I, P or M): I
Solenoid fails Pod mismatch alarms
Type (I, P or M): I
I/O board fails
One complete sets of solenoid
Type (I, P or M): P
operations
Type (I, P or M): P
Type (I, P or M): P
Two pods
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M

Effects]


Enterprise B-201
LEADER

Numbers

3 Erratic Solenoid fails due to bad Alarms (Solenoid monitoring) Degraded control of the pod 1 1 1
output connection in circuit Type (I, P or M): I (Degraded Power) [Local Effects]
Control system fails due to Pod mismatch & alarm
pinched wire Type (I, P or M): I
Control system fails due to Voltage monitoring Alarms
hydrostatic pressure on some Type (I, P or M): I
connectors Redundant pods
Redundant controllers
Type (I, P or M): P
Between well testing
Type (I, P or M): M
Type (I, P or M): M

Effects]

Effects]
Unintentional initiation of EDS was 1 1 1

a failure mode corrected by EB.
[Local Effects]


Enterprise B-202
LEADER

Numbers

4 Fails to Controller A/B fails Alarms on solenoids, controllers, Degraded control of the pod 1 1 1
respond to Controller A/B communications fail I/Os (Degraded Power) [Local Effects]
input Type (I, P or M): I
SEM fails/communications fail
I/O board fails signature tests, constantly
Solenoid driver board fails monitored
Solenoid fails to fire Type (I, P or M): I
Solenoid fails Pod mismatch alarms
Type (I, P or M): I
I/O board fails
Type (I, P or M): P
operations
Type (I, P or M): P
Type (I, P or M): P
Two pods
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M

Effects]

Effects]

Enterprise B-203
LEADER

Numbers


5 Processing SEM/Controller Lockup = loss of a Alarms on solenoids, controllers, Degraded control of the pod 1 1 1
error controller I/Os (Degraded Power) [Local Effects]
Type (I, P or M): I
signature tests, constantly
monitored
Type (I, P or M): I
Pod mismatch alarms
Type (I, P or M): I
Type (I, P or M): P
operations
Type (I, P or M): P
Type (I, P or M): P
Two pods
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M

Effects]

Effects]
Enterprise B-204
LEADER

Numbers

6 Ground Control system fails due to water Alarms - Monitoring systems Alarm [Local Effects] 1 1 1
Fault ingress Type (I, P or M): I
Control system fails due to Loss of function
damaged wiring Type (I, P or M): I
Redundant Pods
Type (I, P or M): P

7 Loss of Transformer fails Alarms (Solenoid monitoring done Degraded control of the pod 1 1 1
function Power supply fails continuously) (Degraded Power) [Local Effects]
(general) Type (I, P or M): I
Control system fails due to water
ingress Alarms - Loss of a power supply
Type (I, P or M): I
Subsea connector fails
Alarms on solenoids (see No. 19,
Controller A/B fails below), controllers, I/Os
Controller A/B communications fail Type (I, P or M): I
SEM failure/communications fail Drill string weight
Solenoid driver board fails LMRP separation indication
Type (I, P or M): I
Solenoid fails to fire
Pod mismatch alarms
Solenoid fails due to bad
Type (I, P or M): I
connection in circuit
Voltage monitoring Alarms
Type (I, P or M): I
pinched wire
hydrostatic pressure on some
Type (I, P or M): P
connectors
Two pods
SEM/Controller Lockup = loss of a
Type (I, P or M): P
controller
Redundancy within a pod (with
Solenoid fails
MUX cable fails due to a short failure). Multiple power supplies,
Enterprise B-205
LEADER

Numbers
Connector fails due to grounding transformers, controllers (2) in
Loss of Power each pod.
Type (I, P or M): P
I/O board fails
Connector fails due to mechanical operations
issues Type (I, P or M): P
Failure of individual functions of a
controller does NOT necessarily
constitute a failure or loss of the
controller or pod's SEM
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
signature tests
Type (I, P or M): M

Effects]

Effects]



Enterprise B-206
LEADER
2.2.5 Equipment: Hydraulic Supply: Rigid Conduit and Manifold - Subsea Control Systems

Numbers
1 External Pipe, tubing, valve fails Low pressure alarms Loss of Pod Supply [Local Effects] 1 1 1
leak/rupture Fittings & Seals (pipe, valve, flow Type (I, P or M): I
meter etc.) fail Pumps running and pump run
SPM valve leaks lights
Type (I, P or M): I
Shuttle valve leaks
Hydraulic cylinder leaks Type (I, P or M): I
Relief valve fails/leaks Surface and subsea flow meters
Check valve leaks Cross connection valve between
Schrader valve leaks yellow/blue supply and
yellow/blue pods
5k hot stabs fails
Type (I, P or M): P
Hydraulic line ruptures (rigid pipe)
LMRP accumulators
SPM Spool valve fails Type (I, P or M): P
Pod tubing fails/leaks Redundant pods
Pod regulator fails Type (I, P or M): P
Check valve fails Redundant pod supply
Type (I, P or M): P
Shuttle valve fails (doesn't
transition/move, stuck, leaks) Stack accumulators & valve from
supply to accumulators typically
Regulator fails
closed
Trigger valve (SPM valve) does Type (I, P or M): P
not open
ROV intervention
Type (I, P or M): M
insufficient charge
test
Leak of LMRP (set = LMRP Type (I, P or M): M
failures)
All stack-mounted controls rebuilt
LMRP valve fails (manifold annually (including piping,
isolation and block & bleed) regulators, check, ball, and SPM
LMRP flange seal fails valves etc.)
Type (I, P or M): M
LMRP pressure gauges fails
LMRP gas charging valves fail
Type (I, P or M): M
LMRP accumulator bottles fail
LMRP accumulator gas valve leaks Type (I, P or M): M
LMRP accumulators fail due to Filters replaced between wells
Enterprise B-207
LEADER

Numbers
insufficient charge Type (I, P or M): M
LMRP accumulators fail due to
Loss of Stack Supply [Local 1 1 1

Effects]

(linked to 1.1.1.2)


(linked to 1.1.3.2)


(linked to 1.1.4.2)

Enterprise B-208
LEADER

Numbers
1.1.7.1)



1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

Enterprise B-209
LEADER

Numbers
1.4.1.2)



1.5.2.1)


1.5.3.2)

1.5.6.1)

Enterprise B-210
LEADER

Numbers
1.6.2.1)

1.6.2.2)

(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.6.7.1)

(linked to 1.7.2.3)
Enterprise B-211
LEADER

Numbers
to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)

to 1.9.5.1)

2 Internal leak Valve leaks Manifold pressure Loss of redundancy (pull LMRP) 1 1 1
Accumulators (bladder rupture) Type (I, P or M): I [Local Effects]
fails Pumps running (flow meters)
Rigid conduit pilot operated check Type (I, P or M): I
valves leak ROV intervention
Rigid conduit crossover SPM leak Type (I, P or M): P
LMRP accumulator charge SPM All stack-mounted controls rebuilt
Enterprise B-212
LEADER

Numbers
leaks annually (including piping,
Accumulators fail due to regulators, check, ball, and SPM
insufficient fluid/pressure to valves etc.)
complete full/tight closure Type (I, P or M): M
Accumulators fail due to Between well Soak & Stump tests
insufficient charge Type (I, P or M): M
LMRP (set = LMRP failures) leaks Weekly Function test
Type (I, P or M): M
Slower response times for LMRP 1 1 1

Functions [Local Effects]

(linked to 1.1.1.2)



(linked to 1.1.4.2)

Enterprise B-213
LEADER

Numbers
1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)


1.4.1.2)



Enterprise B-214
LEADER

Numbers
1.5.2.1)


1.5.3.2)

1.6.2.1)

1.6.2.2)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
Enterprise B-215
LEADER

Numbers

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)

(linked to 1.9.4.2)

3 Plugged Filter fails due to plugging Fluid recirculated in FRU tank, Loss of Pod [Local Effects] 1 1 1
Bladder fails due to restriction in fluid consumption ~1k gal per
lines week
Type (I, P or M): I
Subsea Control System fails due to
filters bypassed (fluid not being Gallon counts / Flow meters
filtered before valves) Type (I, P or M): I
Subsea Control System fails due to Automatic bypass on filters
overlubrication of conduit Type (I, P or M): P
Organic fouling Multiple filters in system between
FRU to pod
Contamination/filtering Type (I, P or M): P
Subsea Control System fails due to Redundant pods and conduits
clogged/plugged path (includes Type (I, P or M): P
filter, piping, tubing, etc.)
Fluid sampled daily, tested
Subsea Control System fails due to monthly
restriction in system (filter, hose,
Enterprise B-216
LEADER

Numbers
ID of fitting) Type (I, P or M): M
Rigid conduit flushed after landing
LMRP, after running riser
Type (I, P or M): M
Standard Between well & Weekly
tests/maintenance (soak, stump,
function)
Type (I, P or M): M
Time of function tests
Type (I, P or M): M
Loss of Stack Supply [Local 1 1 1

Effects]
Loss of redundancy (LMRP) [Local 1 1 1

Effects]
Slow response, on demand [Local 1 1 1

Effects]

(linked to 1.1.1.2)



Enterprise B-217
LEADER

Numbers
(linked to 1.1.4.2)

1.1.7.1)


1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)

Enterprise B-218
LEADER

Numbers
1.4.1.2)


1.5.2.1)


1.5.5.1)

1.6.2.1)

1.6.2.2)

Enterprise B-219
LEADER

Numbers
(linked to 1.6.3.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.6.6.1)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)

Enterprise B-220
LEADER

Numbers

to 1.9.1.2)

(linked to 1.9.4.2)

to 1.9.5.1)

4 Mechanical Hydraulic lines clogged due to Low pressure alarms Loss of a function [Local Effects] 1 1 1
Failure particulates Type (I, P or M): I
Regulator (metal-metal) fails Pumps running and pump run
Accumulator bladders fail lights
Type (I, P or M): I
SPM seat or spring fails
SPM springs fails due to hydrogen Type (I, P or M): I
embrittlement (environmentally
stressed corrosion) Surface and subsea flow meters
Type (I, P or M): I
Regulator fails
Cross connection valve between
Shuttle valve fails stuck yellow/blue supply and
Shuttle valve fails to yellow/blue pods
transition/move Type (I, P or M): P
SPM Spool valve fails Design and material selection
Accumulator bladder fails Type (I, P or M): P
Contamination/filtering Redundant pod supply
Type (I, P or M): P
Springs fail
ROV intervention
Valve fails in stuck position due to
Type (I, P or M): P
Enterprise B-221
LEADER

Numbers
binding greater than spring force Weekly functions tests
Subsea Control System fails due to Type (I, P or M): M
debris in system Between well Soak test and stump
Subsea Control System fails due to test
hydraulic lock (=stuck) Type (I, P or M): M
Valve fails open when hydraulic Visual inspection between wells
pressure doesn't bleed off Type (I, P or M): M
(=stuck) ROV inspection every 3 days
Trigger valve spring fails Type (I, P or M): M
Valve seat fails (assumed trigger SPM valves rebuilt annually
valve) Type (I, P or M): M
Insufficient accumulator All stack-mounted controls rebuilt
fluid/pressure to complete annually (including piping,
full/tight closure regulators, check, ball, and SPM
valves etc.)
Accumulators are not sufficiently Type (I, P or M): M
charged

[Local Effects]

(linked to 1.1.1.2)


(linked to 1.1.3.2)
Enterprise B-222
LEADER

Numbers


(linked to 1.1.4.2)

1.1.6.1)


1.2.1.4)

(linked to 1.2.1.5)
Enterprise B-223
LEADER

Numbers

(linked to 1.3.1.2)


1.4.1.2)


1.5.2.1)


1.6.2.1)

Enterprise B-224
LEADER

Numbers
1.6.2.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)

(linked to 1.9.4.2)


wear of the Hydraulic Supply:
Enterprise B-225
LEADER

Numbers
Rigid Conduit and Manifold -
Subsea Control Systems
6 Corrosion/Er SPM valve seat or spring fails Low pressure alarms Loss of a function [Local Effects] 1 1 1
osion SPM valve springs fails due to Type (I, P or M): I
hydrogen embrittlement Pumps running and pump run
(environmentally stressed lights
corrosion) Type (I, P or M): I
SPM Spool valve fails Pressure transducers/transmitters
Springs fail Type (I, P or M): I
Trigger valve spring fails Surface and subsea flow meters
Type (I, P or M): I
valve) Cross connection valve between
yellow/blue supply and
yellow/blue pods
Type (I, P or M): P
Type (I, P or M): P
ROV intervention
Type (I, P or M): P
for environment and reliability
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
test
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M

[Local Effects]

Enterprise B-226
LEADER

Numbers
(linked to 1.1.1.2)


(linked to 1.1.3.2)


(linked to 1.1.4.2)

1.1.6.1)

Enterprise B-227
LEADER

Numbers

1.2.1.4)

(linked to 1.2.1.5)

(linked to 1.3.1.2)


1.4.1.2)


Enterprise B-228
LEADER

Numbers
1.5.2.1)


1.6.2.1)

1.6.2.2)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)
Enterprise B-229
LEADER

Numbers

1.8.1.3)

to 1.9.1.2)

(linked to 1.9.4.2)

7 Loss of Not considered further as potential

Function causes have been reviewed under
(general) 2.2.5.1 through 2.2.5.5.
Enterprise B-230
LEADER
3- BOP Stack
Enterprise B-231
LEADER
2.3.1 Equipment: Annulars - BOP Stack Annulars including both lower and upper annulars, associated shuttle valves, and hydraulic
supply to/from SPM valves including SPM valve connections

Numbers
1 External BB Gasket connections (top to flex Pressure loss in hydraulic system Control fluid leakage to 1 1 1
Leak/Ruptur joint, bottom to connector, blind Type (I, P or M): I environment [Local Effects]
e flanges and gas bleed) fail HPU pumps running
Head seal leaks to top chamber Type (I, P or M): I
head, exit through check valve. - Mud loss
Wellbore to environment Type (I, P or M): I
Upper packer (bag, annular For Asset/Personnel protection,
element) fails - Wellbore leakage leakage to environment as a
to riser protection
Lower piston seals fail - Wellbore Type (I, P or M): P
to closed side of operating system Redundant annulars and rams to
(control fluid) control pressure
Lower piston seals fail - Hydraulic Type (I, P or M): P
to wellbore Redundant pods
Chamber head seals fail, control Type (I, P or M): P
open fluid/pressure to Hydraulic system testing - Surface
environment and subsea
Shuttle valve leaks Type (I, P or M): M
Piping connections fail ROV inspection every 3 days
Seals fail due bad seal areas, Type (I, P or M): M
swarf, dimensional [mismatch] Weekly function testing
Scoring Type (I, P or M): M
Wear Wellbore testing
Type (I, P or M): M
Key seating
Soak and stump tests between
Shuttle valve fails (doesn't wells
Seal damage Undergoes annual annular
Wear seal damage/deformation at replacement for PM (based on
top and wedges annular piston calendar date from installation,
(larger tools) regardless of service time).
Piston seal leaks Industry practice is TYPICALLY
replacement between wells
Gasket fails between stack
Type (I, P or M): M
components (Wellhead to Stack to
LMRP to Riser) When an annular is opened, all
seals are replaced before return to
Swarf (metal cuttings from the
service
well)
Type (I, P or M): M
Wear on annular seal (bag)
5 year inspection of BOP
Dimensional discrepancy between Type (I, P or M): M
ram block and cavity (wear)
Enterprise B-232
LEADER

Numbers
Control fluid leakage to wellbore 1 1 1

[Local Effects]
Wellbore fluid leakage to 1 1 1

environment (caught seal failures
in surface testing prior to
deployment, occurrence decreased
if cap to test upper head seal on
surface) [Local Effects]
Wellbore fluid leakage to controls 1 1 1

[Local Effects]
Failure to Close Annular / Blind- 10 2 2 40

Shear Ram on Demand - Failure to
Failure to Close Annulars on Drill 8 2 2 32

String on Demand - Failure to
(linked to 1.3.1.3)
Failure of Annulars to Seal on 8 2 2 32

Demand - Failure to seal - Strip

Pressure on Annulars - Failure to
seal - Strip the drill string using
the annular BOP(s) (linked to
1.3.3.2)
Failure to Close Annular on 10 2 2 40

Demand - Failure to close on drill
pipe through annular(s) - Close
allow circulation on demand
(linked to 1.1.1.3)

Enterprise B-233
LEADER

Numbers
(linked to 1.1.1.2)

Failure to Close Pipe Ram on 10 2 2 40

pipe through pipe rams - Close
(linked to 1.1.2.3)


1.2.1.4)

(linked to 1.2.1.5)

Enterprise B-234
LEADER

Numbers
(linked to 1.3.1.2)

1.4.1.2)
Failure to Close Hang-off Ram on 10 2 2 40

Demand - Failure of hang-off ram
to close - Hang-off the drill pipe

Failure to Adequately Seal under 10 2 2 40

Fail-safe Conditions - Failure to
open / close fail-safe valves to
seal - Circulate the well after drill
pipe disconnect (linked to 1.9.3.2)

Fail-safe Condition - Failure to
seal - Circulate across the BOP
stack to remove trapped gas

- (linked to 1.10.4.1)
2 Internal Piston seal fails Flow meter Degraded function of annular 1 1 1

Leak Dimensional wear Type (I, P or M): I (Depending on severity of leak, on
HPU pumps running open side of seal, operations could
Swarf continue after approval from
Type (I, P or M): I
Scoring BSEE. Leak on close side is loss of
Pressure loss in hydraulic system function of annular) [Local Effects]
Shuttle valve fails (doesn't Type (I, P or M): I
transition/move, stuck, leaks)
Chamber test to full working
Wear seal damage/deformation at pressure (3k) and operating
top and wedges annular piston
Enterprise B-235
LEADER

Numbers
(larger tools) pressure (1.5k) performed
Piston seal leaks annually per PM, or after annular
has been opened
Swarf (metal cuttings from the Type (I, P or M): P
well)
Redundant annulars and rams
Trash in the well (swarf, Type (I, P or M): P
concrete, etc.)
Redundant pods
Type (I, P or M): P
Hydraulic system testing - Surface
and subsea
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
Weekly function testing
Type (I, P or M): M
Undergoes annual annular
replacement for PM (based on
calendar date from installation,
regardless of service time).
Industry practice is TYPICALLY
Type (I, P or M): M
When an annular is opened, all
service
Type (I, P or M): M
Type (I, P or M): M
5 year rebuild on shuttle valves
Type (I, P or M): M
Loss of function of annular 1 1 1

(Severity 9 if during well control
without redundancies, 7 if not
during well control) [Local Effects]

Enterprise B-236
LEADER

Numbers

(linked to 1.1.1.2)


(linked to 1.1.2.3)


1.2.1.4)

Enterprise B-237
LEADER

Numbers
(linked to 1.2.1.5)

(linked to 1.3.1.2)

1.4.1.2)




3 Plugged Contamination/filtering Failure to Supply Hydraulic Fluid & 8 3 2 36

Enterprise B-238
LEADER

Numbers
(linked to 1.1.1.2)



(linked to 1.3.1.2)

1.4.1.2)

4 Mechanical Seal fails due to washout Redundant annulars and rams to Loss of function of annular 1 1 1
Failure Packer/bag fails control pressure (Severity 9 if during well control
Type (I, P or M): P without redundancies, 7 if not
Galling between piston and body during well control) [Local Effects]
Redundant pods
Galling between piston and sleeve Type (I, P or M): P
Packer erosion due to wellbore Hydraulic system testing - Surface
flow and subsea
Enterprise B-239
LEADER

Numbers
Incorrect annular seal (bag) for Type (I, P or M): M
drilling mud being used, resulting Soak and stump tests between
in premature failure wells
Wear on annular seal (bag); Type (I, P or M): M
[assumed same as "packer"] Five year inspection of BOP
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Type (I, P or M): M
When an annular is opened, all
service
Type (I, P or M): M
Type (I, P or M): M
Inspection of wear plates when
annular is open. Wear plates
replaced on 5 overhaul
Type (I, P or M): M
Running of Drift Tool through
wellbore after performance of
weekly function tests
Type (I, P or M): M
Failure of Annular to Seal on 9 2 2 36

seal on drill pipe through
annular(s) - Close and seal on the
drill pipe and allow circulation on

Enterprise B-240
LEADER

Numbers
1.2.1.4)

(linked to 1.2.1.5)


1.3.3.2)
5 Wear Seal fails due to age/storage Increased operating pressure Degraded function of annular (still 1 1 1
related issue (UV & heat) necessary to close element works but requires higher
Packer/bag fails due to wear from Type (I, P or M): I operating pressure or more cycles
operations (accelerated during Presence of rubber from annular before successful closure) [Local
stripping) in "Gumbo box" Effects]
Lower piston seal fails - Wellbore Type (I, P or M): I
to closed side of operating system Chamber test to full working
(control fluid) pressure (3k) and operating
Seal fails due to wear on annular pressure (1.5k) performed
seal (bag); [assumed same as annually per PM, or after annular
"packer"] has been opened
Type (I, P or M): P
Redundant annulars and rams to
control pressure
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Five year dimensional inspection
Type (I, P or M): M
and subsea
Type (I, P or M): M
Enterprise B-241
LEADER

Numbers
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
Loss of function of annular 1 1 1

during well control) [Local Effects]

1.3.3.2)
Failure of Annular to Seal on 9 2 1 36


1.2.1.4)

Enterprise B-242
LEADER

Numbers
(linked to 1.2.1.5)

6 Erosion/Corr No additional causes identified

osion resulting in erosion/corrosion of
the Annulars - BOP Stack
7 Loss of No additional causes identified

Function beyond those reviewed in
(general) Annulars - BOP Stack - External
Leak/Rupture - Failure of lower
piston seals - Hydraulic to
wellbore (2.3.1.1-5)
Enterprise B-243
LEADER
2.3.2 Equipment: Blind Shear Ram - BOP Stack Blind Shear Ram including associated shuttle valves, and hydraulic supply to/from SPM valves
including SPM valve connections

Numbers
1 External Clutch plate and bearing fails HPU pumps running Control fluid leakage to 1 1 1
Leak/Ruptur Spring fails to hold clutch plates Type (I, P or M): I environment [Local Effects]
e together/locked Pressure loss in hydraulic system
Seals on the chamber ring fail to Type (I, P or M): I
allow the transfer ring to move Mud loss
freely & doesn't allow the springs Type (I, P or M): I
to fully engage clutch For Asset/Personnel protection,
MPL assembly fails due to leakage to environment as a
mechanical issues protection
Anti-rotation pin fails due to Type (I, P or M): P
shearing off Redundant pods
BX Gasket connections (top and Type (I, P or M): P
bottom and side-outs) fail Redundant annulars and rams to
Scoring control pressure
Type (I, P or M): P
Dimensional wear
Chamber test completed at 5k and
Key seating operated at 1500 psi
Bonnet door seals fail Type (I, P or M): P
Rod packer seal fails ROV inspection every 3 days
Top seal plate fails Type (I, P or M): M
Fluid hinge seal assembly fails Wellbore testing
Type (I, P or M): M
Damage from shearing
MPL fails
and subsea
Operating cylinder seal leaks Type (I, P or M): M
Ram block seals fail Routine function testing
Shuttle valve leaks (Requirement is weekly however
exception from BSEE requested if
Piping connections fails
pipe is across shears at test time)
Seal damage (Elastomer) - Ram Type (I, P or M): M
block or BOP seal plate
Shuttle valve fails (doesn't wells
Damaged hinge seals fail 5 year inspection and
Cylinder seal fails maintenance of BOP
Type (I, P or M): M
Bonnet fails on doors
Between Wells - Replace all
seals/rubber goods on ram blocks
Type (I, P or M): M
LMRP to Riser)
Annual - Dimensional checks,
Elastomer damage on blind shear
chamber testing, MPL signature
Enterprise B-244
LEADER

Numbers
ram testing (predictive), MPL bearings
Dimensional issues replaced, NDT on ram blocks,
connecting rods, and blades.
Type (I, P or M): M
Overhauling nuts replaced every 2
years
Type (I, P or M): M
Clutch plate replaced every 3
years
Type (I, P or M): M
Unable to shear tubular [Local 1 1 1

Effects]

environment [Local Effects]




1.2.1.4)
Enterprise B-245
LEADER

Numbers

(linked to 1.2.1.5)
Failure to Engage Lock on Hang- 8 5 2 80

off Ram - Failure to maintain
locking - Hang-off the drill pipe on
a ram BOP and control the

1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)
Enterprise B-246
LEADER

Numbers

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.5.1)

Enterprise B-247
LEADER

Numbers
- (linked to 1.10.4.1)
2 Internal Rod piston seals fail HPU pumps running Control fluid leakage to 1 1 1
Leak Dimensional wear Type (I, P or M): I environment [Local Effects]
Scoring Flow meter
Type (I, P or M): I
Shuttle valve fails
Pressure loss in hydraulic system
Transfer piston seals fail Type (I, P or M): I
Dimensional discrepancy between Chamber test completed at 5k and
ram block and cavity (wear) operated at 1500 psi
Shuttle valve fails (doesn't Type (I, P or M): P
transition/move, stuck, leaks) Redundant annulars and rams
Piston seal leaks Type (I, P or M): P
Dimensional issues Redundant pods
Type (I, P or M): P
and subsea
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Routine function testing
(Requirement is weekly however
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M
Enterprise B-248
LEADER

Numbers
years
Type (I, P or M): M
testing (predictive), MPL bearings
replaced, NDT on ram blocks,
Type (I, P or M): M
Degraded function of ram 1 1 1

(Depending on severity of leak, on
open side of seal, operations could
continue after approval from
BSEE. Leak on close side is loss of
function of ram) [Local Effects]
Loss of function of ram (Severity 9 1 1 1

if during well control without
redundancies, 8 if not during well
control) [Local Effects]




Enterprise B-249
LEADER

Numbers
1.5.2.1)


1.6.2.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)

1.8.1.3)
Enterprise B-250
LEADER

Numbers

plugging of the Blind Shear Ram -
BOP Stack
4 Mechanical Off center loading Mud loss Loss of function of ram (Severity 9 1 1 1
Failure MPL assembly (springs, etc.) fails Type (I, P or M): I if during well control without
Pressure loss in hydraulic system redundancies, 8 if not during well
Contaminated fluid control) [Local Effects]
Type (I, P or M): I
Galling
MPL seizure operated at 1500 psi
Shear blade fails Type (I, P or M): P
Shear blade bolt fails Redundant annulars and rams
Bonnet fails on doors Type (I, P or M): P
Ram foot/button breaking off, Redundant pods
separating ram block from stem Type (I, P or M): P
MPL fails to release when needed Hydraulic system testing - Surface
(=MPL seizure) and subsea
Type (I, P or M): M
Off-centered pipe
Clutch plate and bearing fails
Type (I, P or M): M
Spring fails to hold clutch plates
together/locked
wells
Seals on the chamber ring fail to Type (I, P or M): M
allow the transfer ring to move
Wellbore testing
freely & doesn't allow the springs
Type (I, P or M): M
to fully engage clutch
MPL assembly fails due to
Type (I, P or M): M
mechanical issues
Anti-rotation pin fails due to
Type (I, P or M): M
shearing off
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M
Thrust plate replaced every 3
Enterprise B-251
LEADER

Numbers
years
Type (I, P or M): M
Type (I, P or M): M
Blades replaced after a shear
Type (I, P or M): M




1.2.1.4)

Enterprise B-252
LEADER

Numbers
(linked to 1.2.1.5)


1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

(linked to 1.6.3.2)

1.6.4.1)
Enterprise B-253
LEADER

Numbers

(linked to 1.6.4.2)
1.6.5.2)

to 1.9.5.1)
5 Wear Wear on packers on ram blocks Mud loss Control fluid leakage to 1 1 1
Operation/use of ram Type (I, P or M): I environment [Local Effects]
Dirty fluid Pressure loss in hydraulic system
Type (I, P or M): I
Off center loading
MPL assembly (springs, etc.) fails operated at 1500 psi
Contaminated fluid Type (I, P or M): P
Galling Redundant annulars and rams
MPL fails to release when needed Type (I, P or M): P
(=MPL seizure) Redundant pods
Shear blade fails Type (I, P or M): P
Shear blade bolt fails Hydraulic system testing - Surface
and subsea
Type (I, P or M): M
Dimensional wear
Scoring Type (I, P or M): M
Shuttle valve fails Soak and stump tests between
Rod piston seals fail wells
Type (I, P or M): M
Transfer piston seals fail
Ram foot/button breaking off,
Type (I, P or M): M
separating ram block from stem
Wellbore testing
Seal damage (Elastomer) - Ram
Type (I, P or M): M
Ram blocks fail due to wear
Enterprise B-254
LEADER

Numbers
BX Gasket connections (top and Type (I, P or M): M
bottom and side-outs) fail Routine function testing
Ram block seals fail (Requirement is weekly however
Piping connections fail exception from BSEE requested if
Key seating Type (I, P or M): M
Bonnet door seals fail Between Wells - Replace all
Rod packer seal fails seals/rubber goods on ram blocks
Top seal plate fails Type (I, P or M): M
Fluid hinge seal assembly fails Overhauling nuts replaced every 2
years
Damage from shearing
Type (I, P or M): M
Operating cylinder seal leaks
Shuttle valve fails (doesn't years
Piston seal leaks Annual - Dimensional checks,
Damaged hinge seals fails chamber testing, MPL signature
Cylinder seal fails
MPL fails to release when needed connecting rods, and blades.
(=MPL seizure) Type (I, P or M): M
Bonnet fails on doors Blades replaced after a shear
Gasket fails between stack Type (I, P or M): M
LMRP to Riser)
Elastomer damage on blind shear
ram
Dimensional issues
Off-centered pipe
together/locked
Seals on the chamber ring fail to
not allowing the transfer ring to
move freely & doesn't allow the
springs to fully engage clutch
mechanical issues
shearing off
Enterprise B-255
LEADER

Numbers

BSEE.) [Local Effects]






1.2.1.4)

Enterprise B-256
LEADER

Numbers
(linked to 1.2.1.5)



1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

Enterprise B-257
LEADER

Numbers
1.6.2.1)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.5.1)

- (linked to 1.10.4.1)
6 Corrosion/Er Mud flow Appropriate material selection Control fluid leakage to 1 1 1
Enterprise B-258
LEADER

Numbers
osion (rubber goods) for operating environment [Local Effects]
environment
Type (I, P or M): P
operated at 1500 psi
Type (I, P or M): P
Enhanced coatings and inlays in
some areas
Type (I, P or M): P
Protection/compatibility studies
between rubber goods and various
drilling fluids
Type (I, P or M): P
BOP rinsed as soon as it is pulled
from water
Type (I, P or M): M
and subsea
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M
Enterprise B-259
LEADER

Numbers
years
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M




1.5.2.1)


(linked to 1.6.3.2)

Enterprise B-260
LEADER

Numbers
1.6.4.1)

(linked to 1.6.4.2)
7 Loss of No additional causes beyond those

Function reviewed in Blind Shear RAM -
(general) BOP Stack External Leak/Rupture -
Dimensional wear (2.3.2.1 - 6)
Enterprise B-261
LEADER
2.3.3 Equipment: Casing Shear Ram - BOP Stack Shear Ram associated shuttle valves, and hydraulic supply to/from SPM valves including SPM
valve connections

Numbers
1 External BX Gasket connections (top and Pressure loss in hydraulic system Control fluid leakage to 1 1 1
Leak/Ruptur bottom and side-outs) leak Type (I, P or M): I environment [Local Effects]
e Shuttle valve leak HPU pumps running
Piping connections fail Type (I, P or M): I
Key seating Mud loss
Type (I, P or M): I
Bonnet door seals fail
Rod packer seal fails operated at 1500 psi
Fluid hinge seal assembly fails Type (I, P or M): P
Damage from shearing For Asset/Personnel protection,
MPL fails leakage to environment as a
protection
Type (I, P or M): P
Redundant pods
Shuttle valve fails (doesn't Type (I, P or M): P
Damaged hinge seals fail control pressure - this is the only
Cylinder seal fails casing shear ram
Type (I, P or M): P
seals/rubber goods on door
interface
LMRP to Riser)
Type (I, P or M): M
Five year inspection and
together/locked
maintenance of BOP
Seals on the chamber ring fail to Type (I, P or M): M
and subsea
Type (I, P or M): M
mechanical issues
wells
Anti-rotation pin fails due to Type (I, P or M): M
shearing off
Type (I, P or M): M
Type (I, P or M): M
Wellbore testing - Wellbore
containing components above
Enterprise B-262
LEADER
valve connections

Numbers
casing shear rams
Type (I, P or M): M
years
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M

Unable to shear tubular [Local 1 1 1

Effects]


1.5.2.1)


1.5.3.2)
Enterprise B-263
LEADER
valve connections

Numbers
(linked to 1.5.4.2)

1.6.2.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

(linked to 1.7.2.3)

Enterprise B-264
LEADER
valve connections

Numbers
1.8.1.3)

to 1.9.5.1)

- (linked to 1.10.4.1)
2 Internal Dimensional wear Pressure loss in hydraulic system Control fluid leakage to 1 1 1
Leak Scoring Type (I, P or M): I environment [Local Effects]
Shuttle valve fails HPU pumps running
Type (I, P or M): I
Rod piston seals fail
Transfer piston seals fail operated at 1500 psi
Dimensional discrepancy between Type (I, P or M): P
ram block and cavity (wear) Redundant annulars and rams to
Shuttle valve fails (doesn't control pressure - this is the only
transition/move, stuck, leaks) casing shear ram
Piston seal leaks Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Flow meter
Type (I, P or M): M
Five year rebuild on shuttle valves
Type (I, P or M): M
and subsea
Type (I, P or M): M
Enterprise B-265
LEADER
valve connections

Numbers
Type (I, P or M): M
wells
Type (I, P or M): M
maintenance of BOP
Type (I, P or M): M
years
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M



1.5.2.1)


Enterprise B-266
LEADER
valve connections

Numbers
1.6.2.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

(linked to 1.7.2.3)

1.8.1.3)

plugging of the Casing Shear Ram
- BOP Stack
4 Mechanical Off center loading Pressure loss in hydraulic system Degraded function of ram (MPL 1 1 1
Failure MPL Assembly fails (springs, Type (I, P or M): I fails to keep ram closed, but does
retaining plate, etc.) Mud loss not prevent ram from closing with
Type (I, P or M): I full pressure) [Local Effects]
Contaminated fluid
Enterprise B-267
LEADER
valve connections

Numbers
Wear in overhauling nut to the tail Chamber test completed at 5k and
screw - MPL operated at 1500 psi
Galling Type (I, P or M): P
MPL seizure Redundant annulars and rams
Type (I, P or M): P
Shear blade fails
Redundant pods
Shear blade bolt fails Type (I, P or M): P
Bonnet fails on doors Blades replaced after a shear
Ram foot/button breaking off, Type (I, P or M): M
separating ram block from stem Five year inspection of BOP
MPL fails to release when needed Type (I, P or M): M
(=MPL seizure) Hydraulic system testing - Surface
Off-centered pipe and subsea
Clutch plate and bearing fails Type (I, P or M): M
Spring fails to hold clutch plates Routine function testing
together/locked (Requirement is weekly however
Type (I, P or M): M
to fully engage clutch Wellbore testing
Type (I, P or M): M
MPL assembly due to mechanical
issues Weekly function testing
Type (I, P or M): M
shearing off Between Wells - Replace all
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
years
Type (I, P or M): M
Type (I, P or M): M
Enterprise B-268
LEADER
valve connections

Numbers
years
Type (I, P or M): M




1.5.2.1)


1.5.3.2)
(linked to 1.5.4.2)

Enterprise B-269
LEADER
valve connections

Numbers
(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)

to 1.9.5.1)

- (linked to 1.10.4.1)
5 Wear BX Gasket connections (top and Pressure loss in hydraulic system Control fluid leakage to 1 1 1
bottom and side-outs) fail Type (I, P or M): I environment [Local Effects]
Operation/use of ram Mud loss
Dirty fluid Type (I, P or M): I
Wear on packers on ram blocks Chamber test completed at 5k and
Wear of ram blocks Type (I, P or M): P
Piping connections fail Redundant pods
Key seating Type (I, P or M): P
Bonnet door seals fail Redundant annulars and rams
Rod packer seal fails Type (I, P or M): P
Fluid hinge seal assembly fails Between Wells - Replace all
Enterprise B-270
LEADER
valve connections

Numbers
Damage from shearing Type (I, P or M): M
MPL fails Blades replaced after a shear
Operating cylinder seal leaks Type (I, P or M): M
Dimensional wear Five year inspection of BOP
Type (I, P or M): M
Scoring
Shuttle valve fails (Requirement is weekly however
Rod piston seals fail exception from BSEE requested if
Transfer piston seals fail pipe is across shears at test time)
Type (I, P or M): M
Off center loading
Contaminated fluid
Type (I, P or M): M
Galling
Wellbore testing
MPL fails to release when needed Type (I, P or M): M
(=MPL seizure)
Shear blade fails Type (I, P or M): M
Shear blade bolt fails Hydraulic system testing - Surface
Bonnet fails on doors and subsea
Type (I, P or M): M
Wear in overhauling nut to the tail
screw - MPL Soak and stump tests between
wells
Type (I, P or M): M
Piston seal leaks
years
Cylinder seal fails Type (I, P or M): M
MPL fails to release when needed Annual - Dimensional checks,
(=MPL seizure) chamber testing, MPL signature
Bonnet fails on doors testing (predictive), MPL bearings
Type (I, P or M): M
LMRP to Riser)
Off-centered pipe
years
Clutch plate and bearing fails Type (I, P or M): M
together/locked
Enterprise B-271
LEADER
valve connections

Numbers
mechanical issues
shearing off







1.5.2.1)

Enterprise B-272
LEADER
valve connections

Numbers

1.5.3.2)
(linked to 1.5.4.2)

1.6.2.1)

(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)
1.6.5.2)
Enterprise B-273
LEADER
valve connections

Numbers

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.5.1)

- (linked to 1.10.4.1)
6 Corrosion/Er Mud flow Appropriate material selection Control fluid leakage to 1 1 1

osion (rubber goods/metals) for environment [Local Effects]
operating environment...shear
blade corrodes, but is inspected
for such
Type (I, P or M): P
Type (I, P or M): P
some areas
Type (I, P or M): P
Type (I, P or M): M
BOP rinsed as soon as they are
pulled from water
Type (I, P or M): M
Five year inspection of BOP
Type (I, P or M): M
Enterprise B-274
LEADER
valve connections

Numbers
Type (I, P or M): M
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
and subsea
Type (I, P or M): M
wells
Type (I, P or M): M
years
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M



Enterprise B-275
LEADER
valve connections

Numbers

1.5.2.1)


(linked to 1.6.3.2)

1.6.4.1)

(linked to 1.6.4.2)

Function resulting in Loss of Function of the
(general) Casing Shear Ram - BOP Stack
Enterprise B-276
LEADER
2.3.4 Equipment: Pipe & Test Rams - BOP Stack Pipe & Test Rams including associated shuttle valves, and hydraulic supply to/from SPM valves

Numbers
1 External Damage from closure on a tool Pressure loss in hydraulic system Control fluid leakage to 1 1 1
Leak/Ruptur joint Type (I, P or M): I environment [Local Effects]
e Operating cylinder seal leaks HPU pumps running
BX Gasket connections (top and Type (I, P or M): I
bottom and side-outs) fail Mud loss
Ram block seals fail Type (I, P or M): I
Shuttle valve leaks Chamber test completed at 5k and
Piping connections fail Type (I, P or M): P
Scoring For Asset/Personnel protection,
Dimensional wear leakage to environment as a
Key seating protection
Type (I, P or M): P
Bonnet door seals fail
Rod packer seal fails
control pressure - this is the only
Top & Bottom seal plates fail casing shear ram
Fluid hinge seal assembly fails Type (I, P or M): P
Damage from hanging off Redundant pods
Type (I, P or M): P
MPL fails
Seal damage (Elastomer) - Ram
Shuttle valve fails (doesn't replaced, NDT on ram blocks,
transition/move, stuck, leaks) connecting rods.
Damaged hinge seals fail Type (I, P or M): M
Cylinder seal fails Between Wells - Replace all
Type (I, P or M): M
years
LMRP to Riser)
Type (I, P or M): M
maintenance of BOP
Type (I, P or M): M
and subsea
Type (I, P or M): M
years
Type (I, P or M): M
Enterprise B-277
LEADER

Numbers
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
Wellbore testing - Wellbore
containing components above
casing shear rams
Type (I, P or M): M
Unable to close and seal on pipe, 1 1 1

on demand [Local Effects]
Unable to maintain seal with pipe 1 1 1

ram [Local Effects]




- (linked to 1.10.4.1)
2 Internal Dimensional wear Pressure loss in hydraulic system Control fluid leakage to 1 1 1
Leak Scoring Type (I, P or M): I environment [Local Effects]
Shuttle valve fails HPU pumps running
Type (I, P or M): I
Rod piston seals fail
Redundant pods
Transfer piston seals fail Type (I, P or M): P
Dimensional discrepancy between
Enterprise B-278
LEADER

Numbers
ram block and cavity (wear) Redundant annulars and rams to
Shuttle valve fails (doesn't control pressure - this is the only
transition/move, stuck, leaks) casing shear ram
Type (I, P or M): P
Piston seal leaks
Type (I, P or M): P
Type (I, P or M): M
Flow meter
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
and subsea
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
5 year inspection and
maintenance of BOP
Type (I, P or M): M
years
Type (I, P or M): M
connecting rods.
Type (I, P or M): M
Enterprise B-279
LEADER

Numbers
years
Type (I, P or M): M




plugging of the Pipe & Test Rams
- BOP Stack
4 Mechanical Off center loading Pressure loss in hydraulic system Loss of function of ram (Severity 9 1 1 1
Failure MPL assembly (springs, etc.) fails Type (I, P or M): I if during well control without
Mud loss redundancies, 8 if not during well
Contaminated fluid control) [Local Effects]
Type (I, P or M): I
Galling
MPL fails to release when needed operated at 1500 psi
(=MPL seizure) Type (I, P or M): P
Bonnet door fails Pipe guides to assist pipe to
MPL fails to release when needed center of rams
(=MPL seizure) Type (I, P or M): P
Bonnet fails on doors Redundant annulars and rams
Off-centered pipe Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): M
Per PM, seals are replaced
annually. However, typically
replaced between wells.
Enterprise B-280
LEADER

Numbers
Type (I, P or M): M
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
and subsea
Type (I, P or M): M
wells
Type (I, P or M): M
years
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M

5 Wear Test ram seal plate fails due to Pressure loss in hydraulic system Control fluid leakage to 1 1 1
exposure to cuttings (more likely Type (I, P or M): I environment [Local Effects]
seen in longer wells) Mud loss
Operation/use of ram Type (I, P or M): I
Enterprise B-281
LEADER

Numbers
Dirty fluid Chamber test completed at 5k and
Seal damage (Elastomer) - Ram operated at 1500 psi
block or BOP seal plate Type (I, P or M): P
Wear of ram blocks Pipe guides to assist pipe to
center of rams
Wear on packers on ram blocks Type (I, P or M): P
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
and subsea
Type (I, P or M): M
wells
Type (I, P or M): M
years
Type (I, P or M): M
Enterprise B-282
LEADER

Numbers
Type (I, P or M): M
years
Type (I, P or M): M

Loss of function of pipe ram 1 1 1

during well control). Test ram
severity is up to a 4 to 5, water
depth dependent, as a test plug
has to be run for pressure tests.
[Local Effects]



6 Corrosion/Er Mud flow Pressure loss in hydraulic system Control fluid leakage to 1 1 1
osion Type (I, P or M): I environment [Local Effects]
Mud loss
Type (I, P or M): I
Appropriate material selection
(rubber goods/metals) for
operating environment.
Enterprise B-283
LEADER

Numbers
Type (I, P or M): P
BOP rinsed as soon as they are
pulled from water
Type (I, P or M): P
Type (I, P or M): P
some areas
Type (I, P or M): P
Pipe guides to assist pipe to
center of rams
Type (I, P or M): P
Protection/compatibility studies
between rubber goods and various
drilling fluids
Type (I, P or M): P
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Enterprise B-284
LEADER

Numbers
and subsea
Type (I, P or M): M
wells
Type (I, P or M): M
years
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M
Unable to close and seal on pipe, 1 1 1

on demand [Local Effects]
Unable to maintain seal with pipe 1 1 1

ram [Local Effects]


7 Loss of No additional causes beyond those

Function reviewed in Pipe & Test RAMS
(general) External Leak/Rupture -
Dimensional wear (2.3.4.1-6)
Enterprise B-285
LEADER
2.3.5 Equipment: Choke & Kill Lines & Valves - BOP Stack Choke & Kill Lines & Valves on both LMRP & Stack including associated shuttle valves, and
hydraulic supply to/from SPM valves including SPM valve connections

Numbers
1 External BX Gasket connections (top and Control system fluid counts/flow Control fluid leakage to 1 1 1
Leak/Ruptur bottom and side-outs) fail meter environment [Local Effects]
e Grease fitting leaks Type (I, P or M): I
Shuttle valve leaks Pressure loss in hydraulic system
Type (I, P or M): I
Piping connections fail
HPU pumps running
Scoring Type (I, P or M): I
Dimensional wear Mud loss
Bonnet seals fail Type (I, P or M): I
Stem packing seals fail Chamber test completed at 3k and
Operating cylinder seal leaks operated at 1500 psi
Type (I, P or M): P
transition/move, stuck, leaks) For Asset/Personnel protection,
leakage to environment as a
Stem packing fails
protection
Cylinder seal fails Type (I, P or M): P
Bonnet fails on doors Redundant annulars and rams
Gasket fails between stack Type (I, P or M): P
components (Wellhead to Stack to Redundant pods
LMRP to Riser) Type (I, P or M): P
Bleeding off choke & kill valves fail Redundant C&K valves
to safe close with loss of Type (I, P or M): P
hydraulics
and subsea
Type (I, P or M): M
Between wells - grease
Type (I, P or M): M
C&K valves are cycled & flushed
2x daily
Type (I, P or M): M
maintenance of C&K valves
Type (I, P or M): M
Replace all seals/rubber goods
Type (I, P or M): M
(Requirement is weekly)
Type (I, P or M): M
Type (I, P or M): M
Enterprise B-286
LEADER

Numbers
wells
Type (I, P or M): M
Testing is done in accordance with
OEM to cover stem packing and
bonnet gasket connections.
Between wells, body/shell test.
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M

environment - Lower kill valve
[Local Effects]

environment - 'Other' C&K valves
[Local Effects]

(linked to 1.1.1.2)
Inability to Operate (an individual) 7 3 2 42

C&K Valves as Needed - Failure to
close on drill pipe through


(linked to 1.1.2.3)
Enterprise B-287
LEADER

Numbers
Inability to Operate C&K Valves as 7 3 2 42

Needed - Failure to close on drill
(linked to 1.1.2.4)

needed - Failure to seal or partial

Needed - Failure to seal or partial
(linked to 1.1.5.1)



Enterprise B-288
LEADER

Numbers

Needed - Failure to close on open
hole through blind-shear rams or
annular - Close and seal on open
hole and allow volumetric well
control operations on demand
(linked to 1.2.1.6)

(linked to 1.3.1.2)

1.4.1.2)



1.5.6.1)

1.6.2.1)
Enterprise B-289
LEADER

Numbers

(linked to 1.6.7.1)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)

Needed - Failure to circulate -
Circulate the well after drill pipe
disconnect (linked to 1.9.1.3)

(linked to 1.9.4.2)

Needed - Failure to seal wellbore -

to 1.9.5.1)

Enterprise B-290
LEADER

Numbers

Circulate across the BOP stack to
remove trapped gas (linked to
1.10.1.3)

- (linked to 1.10.4.1)
2 Internal Dimensional wear - Operator Control system fluid counts/flow Control fluid leakage to 1 1 1
Leak failure meter environment [Local Effects]
Scoring - Operator Type (I, P or M): I
Shuttle valve fails Flow meter
Type (I, P or M): I
Rod piston seals - Operator fails
HPU pumps running
Gate & seat leaks Type (I, P or M): I
Shuttle valve fails (doesn't Pressure loss in hydraulic system
transition/move, stuck, leaks) Type (I, P or M): I
Piston seal fails Chamber test completed at 3k and
Seal seat fails due to defects operated at 1500 psi
Bleeding off choke & kill valves Type (I, P or M): P
fails to safe close with loss of Fail-safe close operation of valve
hydraulics due to spring closure
Type (I, P or M): P
Multiple entry points of C&K into
Stack
Type (I, P or M): P
Redundant C&K valves
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): P
Type (I, P or M): M
Type (I, P or M): M
Enterprise B-291
LEADER

Numbers
Five year inspection of C&K valves
Type (I, P or M): M
and subsea
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
2x daily
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Test fail-safe closing spring -
when BOP is pulled and during
between well surface wellbore
testing
Type (I, P or M): M
Test upstream and downstream
seat to ensure redundancy within
each valve - Between well &
subsea
Type (I, P or M): M
Leak of lower kill valves [Local 1 1 1

Effects]
Leak of 'other' kill valves [Local 1 1 1

Effects]
Loss of function of lower Kill 1 1 1

valves [Local Effects]
Loss of function of 'other' kill 1 1 1
Enterprise B-292
LEADER

Numbers

(linked to 1.1.1.2)



(linked to 1.1.2.4)


Enterprise B-293
LEADER

Numbers
(linked to 1.1.5.1)


(linked to 1.2.1.6)

(linked to 1.3.1.2)

1.4.1.2)


1.6.2.1)
Enterprise B-294
LEADER

Numbers
(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)



(linked to 1.9.4.2)



Enterprise B-295
LEADER

Numbers
1.10.1.3)


- (linked to 1.10.4.1)
3 Plugged Barite settling in lines Control system fluid counts/flow Loss of function of lower Kill 1 1 1
Swarf & other contaminants in meter valves [Local Effects]
mud Type (I, P or M): I
Contamination/filtering Increased pressure in C&K lines
when drilling pumping fluid down
Clogged/plugged path (Includes the lines
filter, piping, tubing, etc.) Type (I, P or M): I
Trash in the well (swarf, Multiple entry points of C&K into
concrete, etc.) Stack
Restriction in system (filter, hose, Type (I, P or M): P
ID of fitting) C&K valves are cycled & flushed
Bleeding off choke & kill valves fail 2x daily
to safe close with loss of Type (I, P or M): M
hydraulics Routine function testing
Type (I, P or M): M


(linked to 1.1.1.2)

Enterprise B-296
LEADER

Numbers
(linked to 1.1.5.1)

1.1.7.1)


(linked to 1.3.1.2)

1.4.1.2)


Enterprise B-297
LEADER

Numbers
1.5.5.1)

1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.6.6.1)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)

Enterprise B-298
LEADER

Numbers

to 1.9.1.2)

(linked to 1.9.4.2)

4 Mechanical Interface between operator and Control system fluid counts/flow Loss of function of lower Kill 1 1 1
Failure gate (design change meter valves [Local Effects]
implemented) fails Type (I, P or M): I
Springs break Pressure loss in hydraulic system
Contaminated fluid - swarf Type (I, P or M): I
Galling HPU pumps running
Type (I, P or M): I
Bonnet fails
Mud loss
Contamination/filtering Type (I, P or M): I
Springs fail Chamber test completed at 3k and
Bonnet fails on doors operated at 1500 psi
Trash in the well (swarf, Type (I, P or M): P
concrete, etc.) Redundant annulars and rams
Bleeding off choke & kill valves fail Type (I, P or M): P
to safe close with loss of Redundant C&K valves
hydraulics Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): M
2x daily
Type (I, P or M): M
Enterprise B-299
LEADER

Numbers
Type (I, P or M): M
and subsea
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Type (I, P or M): M


(linked to 1.1.1.2)

(linked to 1.1.5.1)
Enterprise B-300
LEADER

Numbers

1.1.6.1)

1.1.7.1)



(linked to 1.3.1.2)

1.4.1.2)


Enterprise B-301
LEADER

Numbers
1.6.2.1)

(linked to 1.6.3.1)

(linked to 1.7.2.3)

to 1.7.2.4)

1.8.1.3)


to 1.9.1.2)

(linked to 1.9.4.2)
Enterprise B-302
LEADER

Numbers

to 1.9.5.1)


- (linked to 1.10.4.1)
5 Wear BX Gasket connections (top and Control system fluid counts/flow Leak of lower kill valves [Local 1 1 1
bottom and side-outs) fail meter Effects]
Operation/use of valve Type (I, P or M): I
Dirty fluid HPU pumps running
Type (I, P or M): I
Bonnet fails
Mud loss
Interface between operator and Type (I, P or M): I
gate (design change
implemented) fails Pressure loss in hydraulic system
Type (I, P or M): I
Springs break
Shuttle valve leaks externally operated at 1500 psi
Piping connections fail Type (I, P or M): P
Scoring Redundant pods
Dimensional wear Type (I, P or M): P
Bonnet seals fail Redundant C&K valves
Type (I, P or M): P
Stem packing seals fail
Type (I, P or M): P
Grease fitting leaks
Dimensional wear - Operator fails Type (I, P or M): M
Scoring - Operator C&K valves are cycled & flushed
Shuttle valve leaks internally 2x daily
Type (I, P or M): M
Rod piston seals - Operator fails
Gate & seat leaks
Barite settling in lines Type (I, P or M): M
Swarf & other contaminants in Hydraulic system testing - Surface
Enterprise B-303
LEADER

Numbers
mud and subsea
Contaminated fluid - swarf Type (I, P or M): M
Galling Replace all seals/rubber goods
Type (I, P or M): M
transition/move, stuck, leaks) Routine function testing
Piston seal fails Type (I, P or M): M
Stem packing fails Soak and stump tests between
Cylinder seal fails wells
Springs fail Type (I, P or M): M
Bonnet fails on doors Testing is done in accordance with
LMRP to Riser)
Type (I, P or M): M
Seal seat fails due to defects
Wellbore testing
Trash in the well (swarf, Type (I, P or M): M
concrete, etc.)
Bleeding off choke & kill valves fail
to safe close with loss of
hydraulics

Effects]
Loss of function of lower Kill 1 1 1



(linked to 1.1.1.2)

Enterprise B-304
LEADER

Numbers


(linked to 1.1.2.3)

(linked to 1.1.2.4)


(linked to 1.1.5.1)

Enterprise B-305
LEADER

Numbers
1.1.6.1)



(linked to 1.2.1.6)

(linked to 1.3.1.2)

1.4.1.2)


Enterprise B-306
LEADER

Numbers

1.6.2.1)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)



(linked to 1.9.4.2)
Enterprise B-307
LEADER

Numbers

to 1.9.5.1)


1.10.1.3)


- (linked to 1.10.4.1)
6 Corrosion/Er Mud flow Control system fluid counts/flow Leak of lower kill valves [Local 1 1 1
osion Bleeding off choke & kill valves fail meter Effects]
to safe close with loss of Type (I, P or M): I
hydraulics Pressure loss in hydraulic system
Type (I, P or M): I
HPU pumps running
Type (I, P or M): I
Mud loss
Type (I, P or M): I
Type (I, P or M): P
Enterprise B-308
LEADER

Numbers
Type (I, P or M): P
Redundant C&K valves
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): M
2x daily
Type (I, P or M): M
Type (I, P or M): M
and subsea
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
wells
Type (I, P or M): M
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M

Effects]

environment - Lower kill valve
[Local Effects]

environment - 'Other' C&K valves
[Local Effects]
Enterprise B-309
LEADER

Numbers
(linked to 1.1.5.1)

Function beyond those reviewed in Choke &
(general) Kill Lines & Valves - BOP Stack -
External Leak/Rupture - Bonnet
seals failure (2.3.5.1-6)
Enterprise B-310
LEADER
2.3.6 Equipment: Connectors - BOP Stack Connectors at Wellhead and LMRP/BOP Stack; and Hydraulic Stabs including associated
shuttle valves, and hydraulic supply to/from SPM valves including SPM valve connections

Numbers
1 External BX connection to the BOP fails Flow meter Control fluid leakage to 1 1 1
Leak/Ruptur VX connection to well head fails Type (I, P or M): I environment [Local Effects]
e HPU pumps running
AX connection on BOP mandrel
fails - LMRP to BOP Type (I, P or M): I
Hydraulic connections fails Lock indicator
Type (I, P or M): I
Pilot Operated check valves fails
Shuttle valve fails Type (I, P or M): I
Hydraulic piping fails Key slots
Ball valve for POCV fails Type (I, P or M): I
Shuttle valve fails (doesn't Pressure loss in hydraulic system
Damaged LMRP connector face POCV
Leak of LMRP (set = LMRP Type (I, P or M): I
failures) Chamber test completed at 3k and
Type (I, P or M): P
For Asset/Personnel protection,
leakage to environment as a
protection
Type (I, P or M): P
Maintain latch-lock pressure 100%
of time during operation
Type (I, P or M): P
Minimum differential pressure
required on surface of transfer
plate to unlock BOP
Type (I, P or M): P
ROV intervention
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Redundant unlock circuits
Type (I, P or M): P
VGX-2 gaskets with higher
external pressure rating
Type (I, P or M): P
and subsea
Type (I, P or M): M
Wellbore testing
Enterprise B-311
LEADER

Numbers
Type (I, P or M): M
wells
Type (I, P or M): M
maintenance of BOP
Type (I, P or M): M
Overpull test on the BOP after
landing
Type (I, P or M): M
Overpull on LMRP after each time
it is reconnected
Type (I, P or M): M
New gaskets are used for each
connection
Type (I, P or M): M
ROV cleans connectors directly
prior to connection
Type (I, P or M): M
Between well - OEM
recommendation, backdraft,
unlock pressure testing...
Type (I, P or M): M
Test the BOP using a test plug in
the wellhead to the maximum
pressure the BOP will be tested
Type (I, P or M): M
Required ROV inspection every 3
day, however ROV is subsea more
often
Type (I, P or M): M
Pressure test every 14 days (if no
test ram, connector is tested)
Type (I, P or M): M
Between well clean, grease,
inspect
Type (I, P or M): M
ROV inspection of connection &
frame
Type (I, P or M): M
Inability to latch/unlatch, on 1 1 1
Enterprise B-312
LEADER

Numbers
demand [Local Effects]


(linked to 1.1.1.2)



(linked to 1.3.1.2)

1.4.1.2)

Enterprise B-313
LEADER

Numbers


1.5.3.2)

1.6.2.1)
Failure LMRP / BOP to Connect or 9 3 2 54

Disengage - Failure to disconnect
(linked to 1.7.2.2)

(linked to 1.7.2.3)
Failure of LMRP / BOP Connector 8 3 2 48

to Disengage - Failure to
disconnect the LMRP - Controlled
Operation - Disconnect the LMRP
from the Lower BOP stack (linked
to 1.8.1.2)

1.8.1.3)
Enterprise B-314
LEADER

Numbers

to 1.9.1.2)

(linked to 1.9.4.2)

Failure of Wellhead Connector to 2 5 3 30

Properly Lock and Seal -
Inadequate BOP Connection -
Connect BOP and LMRP at
Landing (linked to 1.11.1.1)
Failure of Connector Integrity - 6 2 2 24

Failure of LMRP Connector to 6 2 2 24

Properly Lock and Seal (auxiliary
connections) - Inadequate LMRP
Connection - Connect BOP and
LMRP at Landing (linked to
1.11.2.1)

Inadequate LMRP Connection -
2 Internal Shuttle valve fails Control system fluid counts/flow Inability to latch/unlatch, on 1 1 1
Leak Piston seal fails meter demand [Local Effects]
Type (I, P or M): I
Check valve leaks
HPU pumps running
Check valve fails Type (I, P or M): I
Shuttle valve fails (doesn't Lock indicator
Enterprise B-315
LEADER

Numbers
Cylinder seal fails Key slots
Piston seal leaks Type (I, P or M): I
Type (I, P or M): I
Overpull (pull on BOP/wellhead to
ensure connection)
Type (I, P or M): I
POCV
Type (I, P or M): I
Type (I, P or M): I
Alloy selection in corrosion prone
areas
Type (I, P or M): P
Type (I, P or M): P
plate to unlock BOP
Type (I, P or M): P
Place resilient (metal gasket with
elastomeric component) seal on
wellhead and/or BOP
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
inspect
Type (I, P or M): M
Clean wellhead mating surface
with ROV prior to landing
Type (I, P or M): M
Five year inspection & rebuild of
connectors
Type (I, P or M): M
Type (I, P or M): M
and subsea
Enterprise B-316
LEADER

Numbers
Type (I, P or M): M
Type (I, P or M): M
Replace all gaskets/seals between
each connection
Type (I, P or M): M
often
Type (I, P or M): M
Type (I, P or M): M
frame
Type (I, P or M): M
wells
Type (I, P or M): M
Type (I, P or M): M
Unable to maintain lock pressure 1 1 1

in hydraulic system (assuming
BSEE does not approve exception)
[Local Effects]

(linked to 1.1.1.2)

Enterprise B-317
LEADER

Numbers

(linked to 1.1.2.3)



(linked to 1.3.1.2)

1.4.1.2)


Enterprise B-318
LEADER

Numbers

1.6.2.1)

(linked to 1.7.2.2)

(linked to 1.7.2.3)

to 1.8.1.2)

1.8.1.3)

to 1.9.1.2)

(linked to 1.9.4.2)
Enterprise B-319
LEADER

Numbers


plugging of the Connectors - BOP
Stack
4 Mechanical Galling between piston and body Flow meter Inability to latch/unlatch, on 1 1 6
Failure Scoring or galling between piston Type (I, P or M): I demand [Local Effects]
and fingers Key slots
Breakdown in everslick connection Type (I, P or M): I
Debris in the piston Lock indicator
Type (I, P or M): I
Contaminated fluid
Connector fails due to mechanical Type (I, P or M): I
issues
Overpull (pull on BOP/wellhead to
Debris in system ensure connection)
Type (I, P or M): I
POCV
Type (I, P or M): I
Alloy selection in corrosion prone
areas
Type (I, P or M): P
Type (I, P or M): P
plate to unlock BOP
Type (I, P or M): P
Place resilient (metal gasket with
elastomeric component) seal on
wellhead and/or BOP
Type (I, P or M): P
inspect
Type (I, P or M): M
Between well connector
maintenance
Enterprise B-320
LEADER

Numbers
Type (I, P or M): M
Control fluid management -
Filtered, clean fluid
Type (I, P or M): M
Type (I, P or M): M
Five year inspection & rebuild of
connectors
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
each connection
Type (I, P or M): M
often
Type (I, P or M): M
wells
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
frame
Type (I, P or M): M
Unable to maintain lock pressure 1 1 1

in hydraulic system (assuming
BSEE does not approve exception)
[Local Effects]

Enterprise B-321
LEADER

Numbers
1.1.6.1)

(linked to 1.7.2.2)

to 1.8.1.2)



1.11.2.1)

5 Wear Breakdown of everslick coating Control system fluid counts/flow Inability to latch/unlatch, on 1 1 1
(surface treatments) meter demand [Local Effects]
Type (I, P or M): I
Flow meter
Type (I, P or M): I
HPU pumps running
Type (I, P or M): I
Enterprise B-322
LEADER

Numbers
Key slots
Type (I, P or M): I
Lock indicator
Type (I, P or M): I
Type (I, P or M): I
POCV
Type (I, P or M): I
Type (I, P or M): I
Type (I, P or M): P
plate to unlock BOP
Type (I, P or M): P
Pipe guides to assist pipe to
center of rams
Type (I, P or M): P
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): P
maintenance of BOP
Type (I, P or M): M
and subsea
Type (I, P or M): M
it is reconnected
Type (I, P or M): M
landing to ensure connection
Type (I, P or M): M
Enterprise B-323
LEADER

Numbers
often
Type (I, P or M): M
prior to connection
Type (I, P or M): M
wells
Type (I, P or M): M
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M
Between well - OEM
Type (I, P or M): M
Type (I, P or M): M
inspect
Type (I, P or M): M
frame
Type (I, P or M): M
Type (I, P or M): M
each connection
Type (I, P or M): M
Type (I, P or M): M
5 year inspection & rebuild of
connectors
Type (I, P or M): M
Type (I, P or M): M
Enterprise B-324
LEADER

Numbers
maintenance
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
years
Type (I, P or M): M
Type (I, P or M): M
and subsea
Type (I, P or M): M
years
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Enterprise B-325
LEADER

Numbers
Type (I, P or M): M
wells
Type (I, P or M): M
Type (I, P or M): M
Wellbore testing
Type (I, P or M): M

(linked to 1.7.2.2)

to 1.8.1.2)
6 Corrosion/Er Corrosive/erosive environment Control system fluid counts/flow Control fluid leakage to 1 1 1
osion meter environment [Local Effects]
Type (I, P or M): I
Flow meter
Type (I, P or M): I
HPU pumps running
Type (I, P or M): I
Key slots
Type (I, P or M): I
Lock indicator
Type (I, P or M): I
Type (I, P or M): I
POCV
Type (I, P or M): I
Type (I, P or M): I
Cathodic protection (anodes)
Type (I, P or M): P
Material coatings (paint)
Enterprise B-326
LEADER

Numbers
Type (I, P or M): P
Material/Alloy selection in
corrosion prone areas
Type (I, P or M): P
plate to unlock BOP
Type (I, P or M): P
Redundant pods
Type (I, P or M): P
Type (I, P or M): P
Type (I, P or M): P
Wellbore testing
Type (I, P or M): M
and subsea
Type (I, P or M): M
wells
Type (I, P or M): M
maintenance of BOP
Type (I, P or M): M
landing to ensure connection
Type (I, P or M): M
it is re-connected
Type (I, P or M): M
prior to connection
Type (I, P or M): M
Between well - OEM
Type (I, P or M): M
Enterprise B-327
LEADER

Numbers
Type (I, P or M): M
often
Type (I, P or M): M
Type (I, P or M): M
inspect
Type (I, P or M): M
frame
Type (I, P or M): M
Type (I, P or M): M
each connection
Type (I, P or M): M
Type (I, P or M): M
5 year inspection & rebuild of
connectors
Type (I, P or M): M
Type (I, P or M): M
maintenance
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Type (I, P or M): M
Enterprise B-328
LEADER

Numbers

(linked to 1.7.2.2)

to 1.8.1.2)
7 Loss of Hydrates Glycol injection ports Inability to latch/unlatch, on 1 1 1

Function Connector fails due to mechanical Type (I, P or M): P demand [Local Effects]
(general) issues Hydrate seals
Type (I, P or M): P
ROV injects glycol on weekly basis
Type (I, P or M): M
Type (I, P or M): M

(linked to 1.7.2.2)



1.11.2.1)
Enterprise B-329
LEADER

Numbers

Enterprise B-330
LEADER
2.3.7 Equipment: Autoshear System - BOP Stack Autoshear System including shear ram, autoshear arming, autoshear valve, and associated
hydraulic connections

Numbers
1 External Piping connections fail Accumulator pressure Fails to activate/shut-in well [Local 1 1 1
Leak/Ruptur SPM valve seals fail monitoring/read-back Effects]
e Type (I, P or M): I
SPM - Pilot system leak past
piston HPU pumps running
Type (I, P or M): I
SPM - Spool/Seat damage
Initial latch up on wellhead
Shuttle valve fails Type (I, P or M): I
Trigger valve fails due to loss of Pressure loss in hydraulic system
pilot pressure Type (I, P or M): I
Shuttle valve fails (doesn't Mud loss
Autoshear trigger valve fails Visual
SPM (Autoshear will activate, as Type (I, P or M): I
designed) fails due to loss of pilot Annual rebuild
signal to controls Type (I, P or M): M
Trigger valve (SPM valve) fails to Function test between well
open Type (I, P or M): M
Valve seat fails (assumed trigger ROV inspection every 3 days
valve) Type (I, P or M): M
Unplanned activation [Local 1 1 1

Effects]
(linked to 1.5.4.1)

1.6.2.1)

1.6.2.2)

Enterprise B-331
LEADER

Numbers
(linked to 1.6.3.1)

1.8.1.3)

2 Internal Trigger valve leaks (past Accumulator pressure Unplanned activation [Local 1 1 1
Leak spool/seat), when closed & armed monitoring/read-back Effects]
would send pressure to ram Type (I, P or M): I
POCV fails - would vent arm signal Drill string weight
Autoshear trigger valve fails Type (I, P or M): I
Trigger valve (SPM valve) fails to Flow meter
open Type (I, P or M): I
HPU pumps running
Type (I, P or M): I
Initial latch up on wellhead
Type (I, P or M): I
Type (I, P or M): I
Annual valve rebuild
Type (I, P or M): M
Function test between well
Type (I, P or M): M
(linked to 1.5.4.1)

Enterprise B-332
LEADER

Numbers
1.6.2.1)

1.6.2.2)

(linked to 1.6.3.1)


plugging of the Autoshear System
- BOP Stack
4 Mechanical Particulate in hydraulic lines Accumulator pressure Fails to activate/shut-in well [Local 1 1 1
Failure Accumulator bladders fail monitoring/read-back Effects]
Type (I, P or M): I
SPM seat or spring fails
Drill string weight
SPM springs fails due to hydrogen Type (I, P or M): I
embrittlement (environmentally
stressed corrosion) Initial latch up on wellhead
Type (I, P or M): I
Shear seals (cups, scoring in
metal-metal) - If failed, would Pilot signal to trigger &
affect the pilot signal for trigger arm/disarm valve sent from both
valve...If system is armed and pods
pilot lost, could activate. Pilot Type (I, P or M): I
signal is sent from both pods Function test between well
simultaneously. Type (I, P or M): P
Springs fail Annual valve rebuild
SPM (Autoshear will activate, as Type (I, P or M): M
designed) fails due to loss of plot ROV intervention
control signals Type (I, P or M): M
Enterprise B-333
LEADER

Numbers
Autoshear trigger valve fails
Trigger valve spring fails
valve)
insufficient charge

Effects]

1.1.6.1)
(linked to 1.5.4.1)

1.6.2.2)

1.6.4.1)

(linked to 1.6.4.2)
Enterprise B-334
LEADER

Numbers
5 Wear Friction Change out components before 1 1 1

wear occurs [Local Effects]
6 Corrosion/Er Corrosion/Erosion Fails to activate/shut-in well [Local 1 1 1

osion Effects]

Effects]
1.6.5.1)
7 Loss of No additional causes identified Unintentional Closing - 5 2 1 10

Function beyond those reviewed in Unintentional closing / opening -
(general) Autoshear System - BOP Stack - Emergency Operation - Auto-
External Leak/Rupture - SPM - Shear - Shear the drill pipe and
Spool/Seat damage (2.3.7.1-4) seal the wellbore (linked to
Autoshear arm valve fails so that it 1.6.5.1)
retains the arm signal but the
electrical signal indicates the
system is disarmed
Enterprise B-335
LEADER
2.3.8 Equipment: ROV Intervention Interface - BOP Stack

Numbers
1 Internal Shuttle valve fails - ROV pressure Frequent cycling of pumps Unable to perform 1 1 1
Leak applied elsewhere Type (I, P or M): I desired/designed function, where
Low pressure alarms ROV is called upon as a backup
Type (I, P or M): I measure. [Local Effects]
ROV will not be able to build
pressure in system
Type (I, P or M): I
fluid on rig
Type (I, P or M): I
Daily inspection/walkthrough of
HPU room/system
Type (I, P or M): M
Pumps on OEM-based
Type (I, P or M): M
ROV intervention system tested
between wells, on surface
Type (I, P or M): M
subsea on latch-up
Type (I, P or M): M
complete system)
Type (I, P or M): M
(weekly)
Type (I, P or M): M
6 months subsea
Type (I, P or M): M
2 External Shuttle valve fails - ROV pressure Frequent cycling of pumps Unable to perform 1 1 1
Leak applied elsewhere Type (I, P or M): I desired/designed function, where
Poor seal between receptacle and Low pressure alarms ROV is called upon as a backup
ROV hot stab Type (I, P or M): I measure. [Local Effects]
Function connector (hard pipe, or ROV unable to build pressure in
hose depending on function) fails system/function
Type (I, P or M): I
Seals located on ROV hot stab
Enterprise B-336
LEADER

Numbers
Type (I, P or M): I
fluid on rig
Type (I, P or M): I
Daily inspection/walkthrough of
HPU room/system
Type (I, P or M): M
between wells, on surface
Type (I, P or M): M
subsea on latch-up
Type (I, P or M): M
complete system)
Type (I, P or M): M
6 months subsea
Type (I, P or M): M
(weekly)
Type (I, P or M): M
Pumps on OEM-based
Type (I, P or M): M
3 Loss of Shuttle valve fails to Failure to Supply Hydraulic Fluid & 8 3 2 36

Function transition/move Pressure to Annular & C&K Valves
(linked to 1.1.1.2)

Enterprise B-337
LEADER

Numbers

(linked to 1.3.1.2)

1.4.1.2)


1.6.2.1)

(linked to 1.7.2.3)

1.8.1.3)

to 1.9.1.2)

Enterprise B-338
LEADER

Numbers
(linked to 1.9.4.2)

Enterprise B-339
LEADER
APPENDIX C (sorted by RPN)
Risk
Sorting Item Severity Occurrence Detection Priority
Index Index EXF2 Failure Mode Effects Ratings Ratings Ratings Numbers
Failure to Supply Hydraulic Fluid & Pressure to Annular & C&K
HPU - Surface
External Leak/ Valves When Demanded - Failure to close and seal on the drill
11 2.1.1.1 Control 8 3 2 48
Rupture pipe and allow circulation on demand due to failure to close on
Systems
drill pipe through annular(s) (1.1) (linked to 1.1.1.2)
HPU - Surface
External Leak/ Valves When Demanded - Failure to close on drill pipe through
12 2.1.1.1 Control 8 3 2 48
Rupture annular(s) - Close and seal on the drill pipe and allow circulation
Systems
Failure to Supply Hydraulic Fluid & Pressure to Pipe Ram or C&K
HPU - Surface
13 2.1.1.1 Control 8 3 2 48
Rupture pipe rams - Close and seal on the drill pipe and allow circulation
Systems
HPU - Surface Failure of Pipe Ram to Seal on Demand - Failure to seal or partial
External Leak/
14 2.1.1.1 Control seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Rupture
Systems pipe and allow circulation on demand (linked to 1.1.4.1)
Failure to Maintain Adequate Sealing Pressure on Pipe Ram -
HPU - Surface
External Leak/ Failure to seal or partial seal on drill pipe through pipe rams -
15 2.1.1.1 Control 9 3 2 54
Rupture Close and seal on the drill pipe and allow circulation on demand
Systems
(linked to 1.1.4.2)
HPU - Surface Actuates Too Slowly on Demand - Closes too slowly - Close and
External Leak/
16 2.1.1.1 Control seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Rupture
Systems 1.1.7.1)
Failure to Supply Hydraulic Fluid & Pressure to Annular / Blind-
HPU - Surface Shear Ram or C&K Valves - Failure to close on open hole through
External Leak/
17 2.1.1.1 Control blind-shear rams or annular - Close and seal on open hole and 9 3 2 54
Rupture
Systems allow volumetric well control operations on demand (linked to
1.2.1.2)
Failure of Annular / Blind-Shear Ram to Seal on Demand - Failure
HPU - Surface
External Leak/ to close on open hole through blind-shear rams or annular - Close
18 2.1.1.1 Control 9 3 2 54
Rupture and seal on open hole and allow volumetric well control
Systems
operations on demand (linked to 1.2.1.4)
Failure to Maintain Adequate Sealing Pressure on Annular / Blind-
HPU - Surface
External Leak/ Shear Ram - Failure to close on open hole through blind-shear
19 2.1.1.1 Control 9 3 2 54
Rupture rams or annular - Close and seal on open hole and allow
Systems
volumetric well control operations on demand (linked to 1.2.1.5)
HPU - Surface Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure
External Leak/
20 2.1.1.1 Control to close annulars - Strip the drill string using the annular BOP(s) 8 3 2 48
Rupture
HPU - Surface Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram -
External Leak/
21 2.1.1.1 Control Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 3 2 48
Rupture
Systems BOP and control the wellbore (linked to 1.4.1.2)
2650788-DFMECA-2-D2 C-1
Risk
HPU - Surface Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
External Leak/
22 2.1.1.1 Control maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 3 2 48
Rupture
Systems and control the wellbore (linked to 1.4.2.1)
HPU - Surface Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
External Leak/
23 2.1.1.1 Control operation - Shear the drill pipe and seal the wellbore (linked to 6 3 2 36
Rupture
Systems 1.5.2.1)
HPU - Surface Failure of Shear Ram to Seal On Demand - Failure to seal the
External Leak/
24 2.1.1.1 Control wellbore - Controlled operation - Shear the drill pipe and seal the 6 3 2 36
Rupture
Systems wellbore (linked to 1.5.3.1)
HPU - Surface Failure to Maintain Sealing Pressure on Shear Ram - Failure to
External Leak/
25 2.1.1.1 Control seal the wellbore - Controlled operation - Shear the drill pipe and 6 3 2 36
Rupture
Systems seal the wellbore (linked to 1.5.3.2)
HPU - Surface Unintentional Opening - Unintentional closing / opening -
External Leak/
26 2.1.1.1 Control Controlled operation - Shear the drill pipe and seal the wellbore 6 3 2 36
Rupture
HPU - Surface
External Leak/ External Leak - Loss of containment - Controlled operation -
27 2.1.1.1 Control 10 3 1 30
Rupture Shear the drill pipe and seal the wellbore (linked to 1.5.6.1)
Systems
HPU - Surface Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak/
28 2.1.1.1 Control Failure to close - Emergency Operation - Auto-Shear - Shear the 9 3 2 54
Rupture
Systems drill pipe and seal the wellbore (linked to 1.6.2.1)
External Leak/
29 2.1.1.1 Control Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Rupture
Systems - Shear the drill pipe and seal the wellbore (linked to 1.6.3.1)
HPU - Surface Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
External Leak/
30 2.1.1.1 Control Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 3 2 54
Rupture
External Leak/
31 2.1.1.1 Control wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 3 2 60
Rupture
Systems pipe and seal the wellbore (linked to 1.6.4.1)
External Leak/
32 2.1.1.1 Control seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 3 2 60
Rupture
External Leak/
33 2.1.1.1 Control Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 2 60
Rupture
Systems the wellbore (linked to 1.6.5.2)
HPU - Surface External Leak - Loss of containment - Emergency Operation -
External Leak/
34 2.1.1.1 Control Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 10 3 2 60
Rupture
Systems 1.6.7.1)
HPU - Surface Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
External Leak/
35 2.1.1.1 Control LMRP - Emergency Operation: EDS - Disconnect from the stack 9 3 2 54
Rupture
2650788-DFMECA-2-D2 C-2
Risk
HPU - Surface Moves too slowly to disconnect - Failure to disconnect the LMRP -
External Leak/
36 2.1.1.1 Control Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Rupture
Systems 1.7.2.4)
HPU - Surface Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak/
37 2.1.1.1 Control LMRP - Controlled Operation - Disconnect the LMRP from the 7 3 2 42
Rupture
Systems Lower BOP stack (linked to 1.8.1.3)
HPU - Surface Moves too slowly to disconnect - Failure to disconnect the LMRP
External Leak/
38 2.1.1.1 Control - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Rupture
Systems BOP stack (linked to 1.8.1.4)
HPU - Surface Failure to Supply Hydraulic Fluid & Pressure to C&K Valves -
External Leak/
39 2.1.1.1 Control Failure to circulate - Circulate the well after drill pipe disconnect 6 3 2 36
Rupture
External Leak/
40 2.1.1.1 Control Failure to seal wellbore - Circulate the well after drill pipe 6 3 2 36
Rupture
Systems disconnect (linked to 1.9.4.2)
External Leak/
41 2.1.1.1 Control Failure to circulate - Circulate across the BOP stack to remove 10 3 2 60
Rupture
Systems trapped gas (linked to 1.10.1.2)
External Leak/
42 2.1.1.1 Control Failure to close - Controlled operation - Shear the drill pipe and 10 3 2 60
Rupture
HPU - Surface
Valves When Demanded - Failure to close on drill pipe through
44 2.1.1.2 Control Internal Leak 8 3 3 72
annular(s) - Close and seal on the drill pipe and allow circulation
Systems
HPU - Surface
pipe rams - Close and seal on the drill pipe and allow circulation
Systems
Failure to Maintain Adequate Sealing Pressure on Annular -
HPU - Surface
Failure to seal or partial seal on drill pipe through annular(s) -
Close and seal on the drill pipe and allow circulation on demand
Systems
(linked to 1.1.3.2)
47 2.1.1.2 Control Internal Leak seal on drill pipe through pipe rams - Close and seal on the drill 9 3 3 81
HPU - Surface
Failure to seal or partial seal on drill pipe through pipe rams -
Systems
(linked to 1.1.4.2)
2650788-DFMECA-2-D2 C-3
Risk
49 2.1.1.2 Control Internal Leak blind-shear rams or annular - Close and seal on open hole and 9 3 3 81
1.2.1.2)
HPU - Surface
to close on open hole through blind-shear rams or annular - Close
and seal on open hole and allow volumetric well control
Systems
HPU - Surface
Shear Ram - Failure to close on open hole through blind-shear
rams or annular - Close and seal on open hole and allow
Systems
52 2.1.1.2 Control Internal Leak to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
HPU - Surface Failure to Maintain Hydraulic Fluid & Pressure to Annulars -
53 2.1.1.2 Control Internal Leak Failure to maintain stripping pressure - Strip the drill string using 9 3 3 81
Systems the annular BOP(s) (linked to 1.3.2.1)
54 2.1.1.2 Control Internal Leak Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 3 3 81
55 2.1.1.2 Control Internal Leak maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 3 3 72
56 2.1.1.2 Control Internal Leak Failure to close - Controlled operation - Shear the drill pipe and 6 3 3 54
57 2.1.1.2 Control Internal Leak operation - Shear the drill pipe and seal the wellbore (linked to 6 3 3 54
Systems 1.5.2.1)
58 2.1.1.2 Control Internal Leak wellbore - Controlled operation - Shear the drill pipe and seal the 6 3 3 54
59 2.1.1.2 Control Internal Leak seal the wellbore - Controlled operation - Shear the drill pipe and 6 3 3 54
60 2.1.1.2 Control Internal Leak Controlled operation - Shear the drill pipe and seal the wellbore 6 3 3 54
2650788-DFMECA-2-D2 C-4
Risk
61 2.1.1.2 Control Internal Leak Failure to close - Emergency Operation - Auto-Shear - Shear the 9 3 3 81
HPU - Surface Failure to initiate autoshear sequence - Failure to close -
62 2.1.1.2 Control Internal Leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 3 90
63 2.1.1.2 Control Internal Leak Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 3 3 81
64 2.1.1.2 Control Internal Leak wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 3 3 90
65 2.1.1.2 Control Internal Leak seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 3 3 90
66 2.1.1.2 Control Internal Leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 3 90
67 2.1.1.2 Control Internal Leak LMRP - Emergency Operation: EDS - Disconnect from the stack 9 3 3 90
68 2.1.1.2 Control Internal Leak LMRP - Controlled Operation - Disconnect the LMRP from the 7 3 3 63
69 2.1.1.2 Control Internal Leak Failure to circulate - Circulate the well after drill pipe disconnect 6 3 3 54
70 2.1.1.2 Control Internal Leak Failure to seal wellbore - Circulate the well after drill pipe 6 3 3 54
71 2.1.1.2 Control Internal Leak Failure to circulate - Circulate across the BOP stack to remove 10 3 3 90
HPU - Surface
74 2.1.1.3 Control Plugged 8 3 3 72
Systems
HPU - Surface
Systems
2650788-DFMECA-2-D2 C-5
Risk
76 2.1.1.3 Control Plugged seal on drill pipe through pipe rams - Close and seal on the drill 9 3 3 81
HPU - Surface
Systems
(linked to 1.1.4.2)
78 2.1.1.3 Control Plugged seal on the drill pipe and allow circulation on demand (linked to 9 3 3 81
Systems 1.1.7.1)
79 2.1.1.3 Control Plugged blind-shear rams or annular - Close and seal on open hole and 9 3 3 81
1.2.1.2)
HPU - Surface
Systems
HPU - Surface
Systems
82 2.1.1.3 Control Plugged to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
83 2.1.1.3 Control Plugged Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 3 3 72
84 2.1.1.3 Control Plugged maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 3 3 72
85 2.1.1.3 Control Plugged Failure to close - Controlled operation - Shear the drill pipe and 6 3 3 72
86 2.1.1.3 Control Plugged operation - Shear the drill pipe and seal the wellbore (linked to 6 3 3 54
Systems 1.5.2.1)
87 2.1.1.3 Control Plugged wellbore - Controlled operation - Shear the drill pipe and seal the 6 3 3 54
2650788-DFMECA-2-D2 C-6
Risk
88 2.1.1.3 Control Plugged seal the wellbore - Controlled operation - Shear the drill pipe and 6 3 3 54
89 2.1.1.3 Control Plugged Controlled operation - Shear the drill pipe and seal the wellbore 6 3 3 54
HPU - Surface Actuates Too Slowly on Demand - Closes too slowly - Controlled
90 2.1.1.3 Control Plugged operation - Shear the drill pipe and seal the wellbore (linked to 8 3 3 72
Systems 1.5.5.1)
91 2.1.1.3 Control Plugged Failure to close - Emergency Operation - Auto-Shear - Shear the 9 3 3 81
92 2.1.1.3 Control Plugged Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 3 81
93 2.1.1.3 Control Plugged Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 3 3 81
94 2.1.1.3 Control Plugged wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 3 3 90
95 2.1.1.3 Control Plugged seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 3 3 90
96 2.1.1.3 Control Plugged Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 3 90
HPU - Surface Actuates Too Slowly on Demand - Closes too slowly - Emergency
97 2.1.1.3 Control Plugged Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 3 3 81
98 2.1.1.3 Control Plugged LMRP - Emergency Operation: EDS - Disconnect from the stack 9 3 3 81
99 2.1.1.3 Control Plugged Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 3 81
Systems 1.7.2.4)
100 2.1.1.3 Control Plugged LMRP - Controlled Operation - Disconnect the LMRP from the 7 3 3 63
101 2.1.1.3 Control Plugged Controlled Operation - Disconnect the LMRP from the Lower BOP 9 3 3 81
Systems stack (linked to 1.8.1.4)
2650788-DFMECA-2-D2 C-7
Risk
102 2.1.1.3 Control Plugged Failure to circulate - Circulate the well after drill pipe disconnect 6 3 3 54
103 2.1.1.3 Control Plugged Failure to seal wellbore - Circulate the well after drill pipe 6 3 3 54
104 2.1.1.3 Control Plugged Failure to circulate - Circulate across the BOP stack to remove 10 3 3 90
HPU - Surface
107 2.1.1.4 Control Mechanical Failure 8 4 2 64
Systems
HPU - Surface
Systems
109 2.1.1.4 Control Mechanical Failure seal on drill pipe through pipe rams - Close and seal on the drill 9 4 2 72
HPU - Surface
Systems
(linked to 1.1.4.2)
111 2.1.1.4 Control Mechanical Failure seal on the drill pipe and allow circulation on demand (linked to 9 4 2 72
Systems 1.1.7.1)
112 2.1.1.4 Control Mechanical Failure blind-shear rams or annular - Close and seal on open hole and 9 4 2 72
1.2.1.2)
HPU - Surface
Systems
HPU - Surface
Systems
115 2.1.1.4 Control Mechanical Failure to close annulars - Strip the drill string using the annular BOP(s) 8 4 2 64
2650788-DFMECA-2-D2 C-8
Risk
116 2.1.1.4 Control Mechanical Failure Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 4 2 64
117 2.1.1.4 Control Mechanical Failure maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 4 2 64
118 2.1.1.4 Control Mechanical Failure Failure to close - Controlled operation - Shear the drill pipe and 6 4 2 48
119 2.1.1.4 Control Mechanical Failure operation - Shear the drill pipe and seal the wellbore (linked to 6 4 2 48
Systems 1.5.2.1)
120 2.1.1.4 Control Mechanical Failure wellbore - Controlled operation - Shear the drill pipe and seal the 6 4 2 48
121 2.1.1.4 Control Mechanical Failure seal the wellbore - Controlled operation - Shear the drill pipe and 6 4 2 48
122 2.1.1.4 Control Mechanical Failure Controlled operation - Shear the drill pipe and seal the wellbore 6 4 2 48
123 2.1.1.4 Control Mechanical Failure Failure to close - Emergency Operation - Auto-Shear - Shear the 9 4 2 72
124 2.1.1.4 Control Mechanical Failure Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 4 2 72
125 2.1.1.4 Control Mechanical Failure Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 4 2 72
126 2.1.1.4 Control Mechanical Failure wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 4 2 80
127 2.1.1.4 Control Mechanical Failure seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 4 2 80
128 2.1.1.4 Control Mechanical Failure Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 4 2 80
129 2.1.1.4 Control Mechanical Failure LMRP - Emergency Operation: EDS - Disconnect from the stack 9 4 2 72
2650788-DFMECA-2-D2 C-9
Risk
130 2.1.1.4 Control Mechanical Failure Emergency Operation: EDS - Disconnect from the stack (linked to 9 4 2 72
Systems 1.7.2.4)
131 2.1.1.4 Control Mechanical Failure LMRP - Controlled Operation - Disconnect the LMRP from the 7 4 2 56
132 2.1.1.4 Control Mechanical Failure - Controlled Operation - Disconnect the LMRP from the Lower 9 4 2 72
133 2.1.1.4 Control Mechanical Failure Failure to circulate - Circulate the well after drill pipe disconnect 6 4 2 48
134 2.1.1.4 Control Mechanical Failure Failure to seal wellbore - Circulate the well after drill pipe 6 4 2 48
135 2.1.1.4 Control Mechanical Failure Failure to circulate - Circulate across the BOP stack to remove 10 4 2 80
HPU - Surface
Loss of Function Valves When Demanded - Failure to close on drill pipe through
146 2.1.1.7 Control 8 3 2 48
(general) annular(s) - Close and seal on the drill pipe and allow circulation
Systems
HPU - Surface
147 2.1.1.7 Control 8 3 2 48
(general) pipe rams - Close and seal on the drill pipe and allow circulation
Systems
Loss of Function
148 2.1.1.7 Control seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
(general)
HPU - Surface
Loss of Function Failure to seal or partial seal on drill pipe through pipe rams -
149 2.1.1.7 Control 9 3 2 54
(general) Close and seal on the drill pipe and allow circulation on demand
Systems
(linked to 1.1.4.2)
Loss of Function
150 2.1.1.7 Control seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
(general)
Systems 1.1.7.1)
Loss of Function
151 2.1.1.7 Control blind-shear rams or annular - Close and seal on open hole and 9 3 2 54
(general)
1.2.1.2)
2650788-DFMECA-2-D2 C-10
Risk
HPU - Surface
Loss of Function to close on open hole through blind-shear rams or annular - Close
152 2.1.1.7 Control 9 3 2 54
(general) and seal on open hole and allow volumetric well control
Systems
Loss of Function
153 2.1.1.7 Control to close annulars - Strip the drill string using the annular BOP(s) 8 3 2 48
(general)
HPU - Surface Failure to Maintain Hydraulic Fluid & Pressure to Annulars -
Loss of Function
154 2.1.1.7 Control Failure to maintain stripping pressure - Strip the drill string using 8 3 2 48
(general)
Systems the annular BOP(s) (linked to 1.3.2.1)
Loss of Function
155 2.1.1.7 Control Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 3 2 48
(general)
Loss of Function
156 2.1.1.7 Control maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 3 2 48
(general)
Loss of Function
157 2.1.1.7 Control Failure to close - Controlled operation - Shear the drill pipe and 6 3 2 36
(general)
Loss of Function
158 2.1.1.7 Control operation - Shear the drill pipe and seal the wellbore (linked to 6 3 2 36
(general)
Systems 1.5.2.1)
Loss of Function
159 2.1.1.7 Control wellbore - Controlled operation - Shear the drill pipe and seal the 6 3 2 36
(general)
Loss of Function
160 2.1.1.7 Control seal the wellbore - Controlled operation - Shear the drill pipe and 6 3 2 36
(general)
Loss of Function
161 2.1.1.7 Control Controlled operation - Shear the drill pipe and seal the wellbore 6 3 2 36
(general)
Loss of Function
162 2.1.1.7 Control Failure to close - Emergency Operation - Auto-Shear - Shear the 9 3 2 54
(general)
Loss of Function
163 2.1.1.7 Control Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
(general)
Loss of Function
164 2.1.1.7 Control Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 3 2 54
(general)
2650788-DFMECA-2-D2 C-11
Risk
Loss of Function
165 2.1.1.7 Control wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 3 2 60
(general)
Loss of Function
166 2.1.1.7 Control seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 3 2 60
(general)
Loss of Function
167 2.1.1.7 Control Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 2 60
(general)
Loss of Function
168 2.1.1.7 Control LMRP - Emergency Operation: EDS - Disconnect from the stack 9 3 2 54
(general)
Loss of Function
169 2.1.1.7 Control Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
(general)
Systems 1.7.2.4)
Loss of Function
170 2.1.1.7 Control LMRP - Controlled Operation - Disconnect the LMRP from the 7 3 2 42
(general)
Loss of Function
171 2.1.1.7 Control - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
(general)
Loss of Function
172 2.1.1.7 Control Failure to circulate - Circulate the well after drill pipe disconnect 6 3 2 36
(general)
Loss of Function
173 2.1.1.7 Control Failure to seal wellbore - Circulate the well after drill pipe 6 3 2 36
(general)
Loss of Function
174 2.1.1.7 Control Failure to circulate - Circulate across the BOP stack to remove 10 3 2 60
(general)
HPU - Surface
Loss of Function Shear Ram - Failure to close on open hole through blind-shear
175 2.1.1.7 Control 10 3 2 60
(general) rams or annular - Close and seal on open hole and allow
Systems
Power - Failure to Provide Control Signal to Annular or C&K Valves When
Loss of Power (UPS
Surface Demanded - Failure to close on drill pipe through annular(s) -
186 2.1.2.1 Shuts down with 9 2 1 18
Control Close and seal on the drill pipe and allow circulation on demand
power degradation)
Power - Failure to Provide Control Signal to Pipe Ram or C&K Valves
Loss of Power (UPS
Surface When Demanded - Failure to close on drill pipe through pipe rams
187 2.1.2.1 Shuts down with 9 2 4 72
Control - Close and seal on the drill pipe and allow circulation on demand
power degradation)
2650788-DFMECA-2-D2 C-12
Risk
Power -
Loss of Power (UPS Unintentional Operation - Unintentional closing / opening - Close
Surface
188 2.1.2.1 Shuts down with and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
power degradation) to 1.1.5.1)
Systems
Failure to Provide Control Signal to Annular / Blind-Shear Ram or
Power -
Loss of Power (UPS C&K Valves When Demanded - Failure to close on open hole
Surface
189 2.1.2.1 Shuts down with through blind-shear rams or annular - Close and seal on open 9 2 1 18
Control
power degradation) hole and allow volumetric well control operations on demand
Systems
(linked to 1.2.1.1)
Power -
Loss of Power (UPS Unintentional Closing - Unintentional closing / opening - Close
Surface
190 2.1.2.1 Shuts down with and seal on open hole and allow volumetric well control 6 2 3 36
Control
power degradation) operations on demand (linked to 1.2.2.1)
Systems
Power -
Loss of Power (UPS Failure to Provide Control Signal to Annulars When Demanded -
Surface
191 2.1.2.1 Shuts down with Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Control
power degradation) BOP(s) (linked to 1.3.1.1)
Systems
Power -
Loss of Power (UPS Failure to Provide Control Signal to Hang-off Ram When
Surface
192 2.1.2.1 Shuts down with Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Control
power degradation) pipe on a ram BOP and control the wellbore (linked to 1.4.1.1)
Systems
Power -
Loss of Power (UPS Failure to Provide Control Signal to Shear Ram When Demanded
Surface
193 2.1.2.1 Shuts down with - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Control
power degradation) seal the wellbore (linked to 1.5.1.1)
Systems
Power -
Loss of Power (UPS Failure to Provide Control Signal - Failure to Arm - Emergency
Surface
194 2.1.2.1 Shuts down with Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Control
power degradation) (linked to 1.6.1.1)
Systems
Power -
Loss of Power (UPS Failure to provide control signal, when demanded - Failure to
Surface
195 2.1.2.1 Shuts down with receive EDS signal prevents disconnecting from stack during 10 2 1 20
Control
power degradation) emergency operation when using the EDS (1.7) (linked to 1.7.1.1)
Systems
Power -
Loss of Power (UPS Failure to Provide Disconnect Signal (automatically) - Failure to
Surface
196 2.1.2.1 Shuts down with disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Control
power degradation) from the stack (linked to 1.7.2.1)
Systems
Power - Failure to Provide Disconnect Signal (automatically or manually) -
Loss of Power (UPS
Surface Failure to disconnect the LMRP - Controlled Operation -
197 2.1.2.1 Shuts down with 9 2 1 18
Control Disconnect the LMRP from the Lower BOP stack (linked to
power degradation)
Systems 1.8.1.1)
Power -
Loss of Power (UPS Failure to Provide Control Signal to C&K Valves when Demanded
Surface
198 2.1.2.1 Shuts down with - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Control
power degradation) (linked to 1.9.1.1)
Systems
2650788-DFMECA-2-D2 C-13
Risk
Power -
Surface
199 2.1.2.1 Shuts down with - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Control
power degradation) disconnect (linked to 1.9.4.1)
Systems
Power -
Surface
200 2.1.2.1 Shuts down with - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Control
power degradation) trapped gas (linked to 1.10.1.1)
Systems
Power -
Unintentional Operation - Unintentional closing / opening - Close
Surface
209 2.1.2.2 Fails with no output and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
to 1.1.5.1)
Systems
Power -
Unintentional Closing - Unintentional closing / opening - Close
Surface
210 2.1.2.2 Fails with no output and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
Power -
Surface Erratic output
213 2.1.2.3 and seal on the drill pipe and allow circulation on demand (linked 3 2 1 6
Control (Erratic, Intermittent)
to 1.1.5.1)
Systems
Power -
214 2.1.2.3 and seal on open hole and allow volumetric well control 3 2 1 6
Control (Erratic, Intermittent)
Systems
Power - Failure to Provide Control Signal to Annular or C&K Valves When
224 2.1.2.5 Electrical Short 9 2 1 18
Power - Failure to Provide Control Signal to Pipe Ram or C&K Valves
Power -
Surface
226 2.1.2.5 Electrical Short and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
to 1.1.5.1)
Systems
Power -
C&K Valves When Demanded - Failure to close on open hole
Surface
227 2.1.2.5 Electrical Short through blind-shear rams or annular - Close and seal on open 9 2 1 18
Control
hole and allow volumetric well control operations on demand
Systems
(linked to 1.2.1.1)
Power -
Surface
228 2.1.2.5 Electrical Short and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
2650788-DFMECA-2-D2 C-14
Risk
Power -
Failure to Provide Control Signal to Annulars When Demanded -
Surface
229 2.1.2.5 Electrical Short Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Control
Systems
Power -
Failure to Provide Control Signal to Hang-off Ram When
Surface
230 2.1.2.5 Electrical Short Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Control
pipe on a ram BOP and control the wellbore (linked to 1.4.1.1)
Systems
Power -
Failure to Provide Control Signal to Shear Ram When Demanded
Surface
231 2.1.2.5 Electrical Short - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Control
seal the wellbore (linked to 1.5.1.1)
Systems
Power -
Failure to Provide Control Signal - Failure to Arm - Emergency
Surface
232 2.1.2.5 Electrical Short Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Control
(linked to 1.6.1.1)
Systems
Power -
Failure to provide control signal, when demanded - Failure to
Surface
233 2.1.2.5 Electrical Short receive EDS signal prevents disconnecting from stack during 10 2 1 20
Control
emergency operation when using the EDS (1.7) (linked to 1.7.1.1)
Systems
Power -
Failure to Provide Disconnect Signal (automatically) - Failure to
Surface
234 2.1.2.5 Electrical Short disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Control
from the stack (linked to 1.7.2.1)
Systems
Power - Failure to Provide Disconnect Signal (automatically or manually) -
Systems 1.8.1.1)
Power -
Failure to Provide Control Signal to C&K Valves when Demanded
Surface
236 2.1.2.5 Electrical Short - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Control
(linked to 1.9.1.1)
Systems
Power -
Surface
237 2.1.2.5 Electrical Short - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Control
Systems
Power -
Surface
238 2.1.2.5 Electrical Short - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Control
Systems
Power -
Surface
247 2.1.2.6 Loss of Function and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
to 1.1.5.1)
Systems
2650788-DFMECA-2-D2 C-15
Risk
Power -
Surface
248 2.1.2.6 Loss of Function and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
Power -
Surface
250 2.1.2.7 Ground Faults and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
to 1.1.5.1)
Systems
Power -
Surface
251 2.1.2.7 Ground Faults and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
Power -
Surface Loss of subsea
Control transformer
to 1.1.5.1)
Systems
Power -
Surface Loss of subsea
Control transformer
Systems
MUX System - Failure to Provide Control Signal to Annular or C&K Valves When
Fails with no output
262 2.1.3.2 signal/ 9 2 1 18
communication
MUX System - Failure to Provide Control Signal to Pipe Ram or C&K Valves
263 2.1.3.2 signal/ 9 2 4 72
communication
MUX System -
Fails with no output Unintentional Operation - Unintentional closing / opening - Close
Surface
264 2.1.3.2 signal/ and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
communication to 1.1.5.1)
Systems
MUX System -
Fails with no output Failure to provide control signal, when demanded - Failure to
Surface
265 2.1.3.2 signal/ receive EDS signal prevents disconnecting from stack during 10 2 1 20
Control
communication emergency operation when using the EDS (1.7) (linked to 1.7.1.1)
Systems
MUX System -
Fails with no output C&K Valves When Demanded - Failure to close on open hole
Surface
266 2.1.3.2 signal/ through blind-shear rams or annular - Close and seal on open 9 2 1 18
Control
communication hole and allow volumetric well control operations on demand
Systems
(linked to 1.2.1.1)
MUX System -
Fails with no output Unintentional Closing - Unintentional closing / opening - Close
Surface
267 2.1.3.2 signal/ and seal on open hole and allow volumetric well control 6 2 3 36
Control
communication operations on demand (linked to 1.2.2.1)
Systems
2650788-DFMECA-2-D2 C-16
Risk
MUX System -
Fails with no output Failure to Provide Control Signal to Annulars When Demanded -
Surface
268 2.1.3.2 signal/ Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Control
communication BOP(s) (linked to 1.3.1.1)
Systems
MUX System -
Fails with no output Failure to Provide Control Signal to Hang-off Ram When
Surface
269 2.1.3.2 signal/ Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Control
communication pipe on a ram BOP and control the wellbore (linked to 1.4.1.1)
Systems
MUX System -
Fails with no output Failure to Provide Control Signal to Shear Ram When Demanded
Surface
270 2.1.3.2 signal/ - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Control
communication seal the wellbore (linked to 1.5.1.1)
Systems
MUX System -
Fails with no output Failure to Provide Control Signal - Failure to Arm - Emergency
Surface
271 2.1.3.2 signal/ Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Control
communication (linked to 1.6.1.1)
Systems
MUX System -
Fails with no output Failure to Provide Disconnect Signal (automatically) - Failure to
Surface
272 2.1.3.2 signal/ disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Control
communication from the stack (linked to 1.7.2.1)
Systems
MUX System - Failure to Provide Disconnect Signal (automatically or manually) -
273 2.1.3.2 signal/ 9 2 1 18
communication
Systems 1.8.1.1)
MUX System -
Fails with no output Failure to Provide Control Signal to C&K Valves when Demanded
Surface
274 2.1.3.2 signal/ - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Control
communication (linked to 1.9.1.1)
Systems
MUX System -
Surface
275 2.1.3.2 signal/ - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Control
communication disconnect (linked to 1.9.4.1)
Systems
MUX System -
Surface
276 2.1.3.2 signal/ - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Control
communication trapped gas (linked to 1.10.1.1)
Systems
Surface Erratic output Demanded - Failure to close on drill pipe through annular(s) -
280 2.1.3.4 9 2 1 18
Control (Network) Close and seal on the drill pipe and allow circulation on demand
Surface Erratic output When Demanded - Failure to close on drill pipe through pipe rams
281 2.1.3.4 9 2 4 72
Control (Network) - Close and seal on the drill pipe and allow circulation on demand
2650788-DFMECA-2-D2 C-17
Risk
MUX System -
Control (Network)
to 1.1.5.1)
Systems
MUX System -
283 2.1.3.4 through blind-shear rams or annular - Close and seal on open 9 2 1 18
Control (Network)
Systems
(linked to 1.2.1.1)
MUX System -
Control (Network)
Systems
MUX System -
285 2.1.3.4 Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Control (Network)
Systems
MUX System -
286 2.1.3.4 Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Control (Network)
Systems
MUX System -
287 2.1.3.4 - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Control (Network)
Systems
MUX System -
288 2.1.3.4 Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Control (Network)
(linked to 1.6.1.1)
Systems
MUX System -
289 2.1.3.4 receive EDS signal prevents disconnecting from stack during 10 2 1 20
Control (Network)
Systems
MUX System -
290 2.1.3.4 disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Control (Network)
Systems
Surface Erratic output Failure to disconnect the LMRP - Controlled Operation -
291 2.1.3.4 9 2 1 18
Control (Network) Disconnect the LMRP from the Lower BOP stack (linked to
Systems 1.8.1.1)
MUX System -
292 2.1.3.4 - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Control (Network)
(linked to 1.9.1.1)
Systems
2650788-DFMECA-2-D2 C-18
Risk
MUX System -
293 2.1.3.4 - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Control (Network)
Systems
MUX System -
294 2.1.3.4 - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Control (Network)
Systems
MUX System -
Surface Fails to respond to
Control input
Systems
Surface Fails to respond to Demanded - Failure to close on drill pipe through annular(s) -
308 2.1.3.5 9 2 1 18
Control input Close and seal on the drill pipe and allow circulation on demand
Surface Fails to respond to When Demanded - Failure to close on drill pipe through pipe rams
309 2.1.3.5 9 2 4 72
Control input - Close and seal on the drill pipe and allow circulation on demand
MUX System -
Control input
to 1.1.5.1)
Systems
MUX System -
Control input
Systems
(linked to 1.2.1.1)
MUX System -
Control input
Systems
MUX System -
Control input
Systems
MUX System -
Control input
Systems
MUX System -
Control input
Systems
2650788-DFMECA-2-D2 C-19
Risk
MUX System -
Control input
(linked to 1.6.1.1)
Systems
MUX System -
Control input
Systems
Surface Fails to respond to Failure to disconnect the LMRP - Controlled Operation -
318 2.1.3.5 9 2 1 18
Control input Disconnect the LMRP from the Lower BOP stack (linked to
Systems 1.8.1.1)
MUX System -
Control input
(linked to 1.9.1.1)
Systems
MUX System -
Control input
Systems
MUX System -
Control input
Systems
326 2.1.3.7 Short 9 2 1 18
327 2.1.3.7 Short 9 2 4 72
MUX System -
Surface
328 2.1.3.7 Short and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
to 1.1.5.1)
Systems
MUX System -
Surface
329 2.1.3.7 Short through blind-shear rams or annular - Close and seal on open 9 2 1 18
Control
Systems
(linked to 1.2.1.1)
MUX System -
Surface
330 2.1.3.7 Short and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
2650788-DFMECA-2-D2 C-20
Risk
MUX System -
Surface
331 2.1.3.7 Short Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Control
Systems
MUX System -
Surface
332 2.1.3.7 Short Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Control
Systems
MUX System -
Surface
333 2.1.3.7 Short Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Control
(linked to 1.6.1.1)
Systems
MUX System -
Surface
334 2.1.3.7 Short - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Control
Systems
MUX System -
Surface
335 2.1.3.7 Short receive EDS signal prevents disconnecting from stack during 10 2 1 20
Control
Systems
MUX System -
Surface
336 2.1.3.7 Short disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Control
Systems
337 2.1.3.7 Short 9 2 1 18
Systems 1.8.1.1)
MUX System -
Surface
338 2.1.3.7 Short - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Control
(linked to 1.9.1.1)
Systems
MUX System -
Surface
339 2.1.3.7 Short - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Control
Systems
MUX System -
Surface
340 2.1.3.7 Short - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Control
Systems
Surface Loss of function Demanded - Failure to close on drill pipe through annular(s) -
344 2.1.3.8 9 2 1 18
Control (general) Close and seal on the drill pipe and allow circulation on demand
2650788-DFMECA-2-D2 C-21
Risk
Surface Loss of function When Demanded - Failure to close on drill pipe through pipe rams
345 2.1.3.8 9 2 4 72
Control (general) - Close and seal on the drill pipe and allow circulation on demand
MUX System -
Surface Loss of function
Control (general)
to 1.1.5.1)
Systems
MUX System -
Control (general)
Systems
(linked to 1.2.1.1)
MUX System -
Control (general)
Systems
MUX System -
Control (general)
Systems
MUX System -
Control (general)
Systems
MUX System -
Control (general)
Systems
MUX System -
Control (general)
(linked to 1.6.1.1)
Systems
MUX System -
Control (general)
Systems
MUX System -
Control (general)
Systems
Surface Loss of function Failure to disconnect the LMRP - Controlled Operation -
355 2.1.3.8 9 2 1 18
Control (general) Disconnect the LMRP from the Lower BOP stack (linked to
Systems 1.8.1.1)
2650788-DFMECA-2-D2 C-22
Risk
MUX System -
Control (general)
(linked to 1.9.1.1)
Systems
MUX System -
Control (general)
Systems
MUX System -
Control (general)
Systems
MUX System -
Surface
362 2.1.3.9 Mechanical Failure and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
to 1.1.5.1)
Systems
MUX System -
Surface
363 2.1.3.9 Mechanical Failure and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
Hydraulic
Supply -
370 2.1.4.1 Surface 8 3 2 36
Control
Systems
Hydraulic
Supply -
371 2.1.4.1 Surface 8 2 3 48
Control
Systems
Hydraulic
Supply -
External Leak/ Failure to seal or partial seal on drill pipe through annular(s) -
372 2.1.4.1 Surface 9 2 3 54
Control
(linked to 1.1.3.2)
Systems
Hydraulic
Supply - Failure of Pipe Ram to Seal on Demand - Failure to seal or partial
External Leak/
373 2.1.4.1 Surface seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Rupture
Control pipe and allow circulation on demand (linked to 1.1.4.1)
Systems
Hydraulic
Supply -
374 2.1.4.1 Surface 9 2 3 54
Control
(linked to 1.1.4.2)
Systems
2650788-DFMECA-2-D2 C-23
Risk
Hydraulic
Supply - Actuates Too Slowly on Demand - Closes too slowly - Close and
External Leak/
375 2.1.4.1 Surface seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Rupture
Control 1.1.7.1)
Systems
Hydraulic
Supply -
External Leak/ External Leak - Loss of containment - Close and seal on the drill
376 2.1.4.1 Surface 8 3 3 72
Rupture pipe and allow circulation on demand (linked to 1.1.8.1)
Control
Systems
Hydraulic Failure to Supply Hydraulic Fluid & Pressure to Annular / Blind-
Supply - Shear Ram or C&K Valves - Failure to close on open hole through
External Leak/
377 2.1.4.1 Surface blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Rupture
Control allow volumetric well control operations on demand (linked to
Systems 1.2.1.2)
Hydraulic
Supply -
378 2.1.4.1 Surface 9 1 2 18
Control
Systems
Hydraulic
Supply -
379 2.1.4.1 Surface 9 1 2 18
Control
Systems
Hydraulic
Supply - Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure
External Leak/
380 2.1.4.1 Surface to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Rupture
Control (linked to 1.3.1.2)
Systems
Hydraulic
Supply - Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram -
External Leak/
381 2.1.4.1 Surface Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Rupture
Control BOP and control the wellbore (linked to 1.4.1.2)
Systems
Hydraulic
Supply - Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
External Leak/
382 2.1.4.1 Surface maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Rupture
Control and control the wellbore (linked to 1.4.2.1)
Systems
Hydraulic
Supply - Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak/
383 2.1.4.1 Surface Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Rupture
Control seal the wellbore (linked to 1.5.1.2)
Systems
2650788-DFMECA-2-D2 C-24
Risk
Hydraulic
Supply - Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
External Leak/
384 2.1.4.1 Surface operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Rupture
Control 1.5.2.1)
Systems
Hydraulic
Supply - Failure of Shear Ram to Seal On Demand - Failure to seal the
External Leak/
385 2.1.4.1 Surface wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Rupture
Control wellbore (linked to 1.5.3.1)
Systems
Hydraulic
Supply - Failure to Maintain Sealing Pressure on Shear Ram - Failure to
External Leak/
386 2.1.4.1 Surface seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Rupture
Systems
Hydraulic
Supply - Unintentional Opening - Unintentional closing / opening -
External Leak/
387 2.1.4.1 Surface Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Rupture
Systems
Hydraulic
External Leak/
388 2.1.4.1 Surface Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Rupture
Control drill pipe and seal the wellbore (linked to 1.6.2.1)
Systems
Hydraulic
External Leak/
389 2.1.4.1 Surface Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Rupture
Control - Shear the drill pipe and seal the wellbore (linked to 1.6.3.1)
Systems
Hydraulic
Supply - Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
External Leak/
390 2.1.4.1 Surface Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Rupture
Systems
Hydraulic
External Leak/
391 2.1.4.1 Surface wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Rupture
Control pipe and seal the wellbore (linked to 1.6.4.1)
Systems
Hydraulic
External Leak/
392 2.1.4.1 Surface seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Rupture
Systems
2650788-DFMECA-2-D2 C-25
Risk
Hydraulic
External Leak/
393 2.1.4.1 Surface Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Rupture
Control the wellbore (linked to 1.6.5.2)
Systems
Hydraulic
Supply - Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
External Leak/
394 2.1.4.1 Surface LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Rupture
Systems
Hydraulic
Supply - Moves too slowly to disconnect - Failure to disconnect the LMRP -
External Leak/
395 2.1.4.1 Surface Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Rupture
Control 1.7.2.4)
Systems
Hydraulic
Supply - Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak/
396 2.1.4.1 Surface LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Rupture
Control Lower BOP stack (linked to 1.8.1.3)
Systems
Hydraulic
Supply - Moves too slowly to disconnect - Failure to disconnect the LMRP
External Leak/
397 2.1.4.1 Surface - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Rupture
Control BOP stack (linked to 1.8.1.4)
Systems
Hydraulic
Supply - Failure to Supply Hydraulic Fluid & Pressure to C&K Valves -
External Leak/
398 2.1.4.1 Surface Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Rupture
Systems
Hydraulic
External Leak/
399 2.1.4.1 Surface Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Rupture
Control disconnect (linked to 1.9.4.2)
Systems
Hydraulic
Supply -
External Leak/ External Leak - Loss of containment - Circulate the well after drill
400 2.1.4.1 Surface 8 3 3 72
Rupture pipe disconnect (linked to 1.9.5.1)
Control
Systems
Hydraulic
External Leak/
401 2.1.4.1 Surface Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Rupture
Control trapped gas (linked to 1.10.1.2)
Systems
2650788-DFMECA-2-D2 C-26
Risk
Hydraulic
Supply -
External Leak/ External Leak - Loss of containment - Circulate across the BOP
402 2.1.4.1 Surface 8 3 3 72
Rupture stack to remove trapped gas - (linked to 1.10.4.1)
Control
Systems
Hydraulic
Supply -
411 2.1.4.7 Surface 8 3 2 36
Control
Systems
Hydraulic
Supply -
412 2.1.4.7 Surface 8 2 3 48
Control
Systems
Hydraulic
Supply -
Loss of Function Failure to seal or partial seal on drill pipe through annular(s) -
413 2.1.4.7 Surface 9 2 3 54
Control
(linked to 1.1.3.2)
Systems
Hydraulic
Supply - Failure of Pipe Ram to Seal on Demand - Failure to seal or partial
Loss of Function
(general)
Systems
Hydraulic
Supply -
415 2.1.4.7 Surface 9 2 3 54
Control
(linked to 1.1.4.2)
Systems
Hydraulic
Supply - Actuates Too Slowly on Demand - Closes too slowly - Close and
Loss of Function
(general)
Control 1.1.7.1)
Systems
Hydraulic
Supply -
Loss of Function External Leak - Loss of containment - Close and seal on the drill
417 2.1.4.7 Surface 8 3 3 72
(general) pipe and allow circulation on demand (linked to 1.1.8.1)
Control
Systems
Hydraulic Failure to Supply Hydraulic Fluid & Pressure to Annular / Blind-
Supply - Shear Ram or C&K Valves - Failure to close on open hole through
Loss of Function
(general)
Systems 1.2.1.2)
2650788-DFMECA-2-D2 C-27
Risk
Hydraulic
Supply -
419 2.1.4.7 Surface 9 1 2 18
Control
Systems
Hydraulic
Supply -
420 2.1.4.7 Surface 9 1 2 18
Control
Systems
Hydraulic
Supply - Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure
Loss of Function
(general)
Systems
Hydraulic
Supply - Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram -
Loss of Function
(general)
Systems
Hydraulic
Supply - Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Supply - Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
Loss of Function
(general)
Control 1.5.2.1)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
2650788-DFMECA-2-D2 C-28
Risk
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Supply - Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Supply - Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
Loss of Function
(general)
Systems
Hydraulic
Supply - Moves too slowly to disconnect - Failure to disconnect the LMRP -
Loss of Function
(general)
Control 1.7.2.4)
Systems
2650788-DFMECA-2-D2 C-29
Risk
Hydraulic
Supply - Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
Loss of Function
(general)
Systems
Hydraulic
Supply - Moves too slowly to disconnect - Failure to disconnect the LMRP
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Supply -
Loss of Function External Leak - Loss of containment - Circulate the well after drill
441 2.1.4.7 Surface 8 3 3 72
(general) pipe disconnect (linked to 1.9.5.1)
Control
Systems
Hydraulic
Loss of Function
(general)
Systems
Hydraulic
Supply -
Loss of Function External Leak - Loss of containment - Circulate across the BOP
443 2.1.4.7 Surface 8 3 3 72
(general) stack to remove trapped gas - (linked to 1.10.4.1)
Control
Systems
Control Panels Failure to Provide Control Signal to Annular or C&K Valves When
- Surface Loss of, or Degraded Demanded - Failure to close on drill pipe through annular(s) -
450 2.1.5.1 9 2 1 18
Control Power Close and seal on the drill pipe and allow circulation on demand
Control Panels Failure to Provide Control Signal to Pipe Ram or C&K Valves
- Surface Loss of, or Degraded When Demanded - Failure to close on drill pipe through pipe rams
451 2.1.5.1 9 2 4 72
Control Power - Close and seal on the drill pipe and allow circulation on demand
Control Panels
- Surface Loss of, or Degraded
Control Power
to 1.1.5.1)
Systems
2650788-DFMECA-2-D2 C-30
Risk
Control Panels
Control Power
Systems
(linked to 1.2.1.1)
Control Panels
Control Power
Systems
Control Panels
Control Power
Systems
Control Panels
Control Power
Systems
Control Panels
Control Power
Systems
Control Panels
Control Power
(linked to 1.6.1.1)
Systems
Control Panels
Control Power
Systems
Control Panels
Control Power
Systems
Control Panels Failure to Provide Disconnect Signal (automatically or manually) -
- Surface Loss of, or Degraded Failure to disconnect the LMRP - Controlled Operation -
461 2.1.5.1 9 2 1 18
Control Power Disconnect the LMRP from the Lower BOP stack (linked to
Systems 1.8.1.1)
Control Panels
Control Power
(linked to 1.9.1.1)
Systems
Control Panels
Control Power
Systems
2650788-DFMECA-2-D2 C-31
Risk
Control Panels
Control Power
Systems
Control Panels Fails to respond (with Failure to Provide Control Signal to Annular or C&K Valves When
- Surface no output signal/ Demanded - Failure to close on drill pipe through annular(s) -
468 2.1.5.2 9 2 1 18
Control communication or to Close and seal on the drill pipe and allow circulation on demand
Systems input) (linked to 1.1.1.1)
Control Panels Fails to respond (with Failure to Provide Control Signal to Pipe Ram or C&K Valves
- Surface no output signal/ When Demanded - Failure to close on drill pipe through pipe rams
469 2.1.5.2 9 2 4 72
Control communication or to - Close and seal on the drill pipe and allow circulation on demand
Systems input) (linked to 1.1.2.1)
Control Panels Fails to respond (with
- Surface no output signal/
Control communication or to
to 1.1.5.1)
Systems input)
Systems input)
(linked to 1.2.1.1)
Systems input)
Systems input)
Systems input)
Systems input)
(linked to 1.6.1.1)
Systems input)
Systems input)
2650788-DFMECA-2-D2 C-32
Risk
Systems input)
Control Panels Fails to respond (with Failure to Provide Disconnect Signal (automatically or manually) -
- Surface no output signal/ Failure to disconnect the LMRP - Controlled Operation -
479 2.1.5.2 9 2 1 18
Control communication or to Disconnect the LMRP from the Lower BOP stack (linked to
Systems input) 1.8.1.1)
(linked to 1.9.1.1)
Systems input)
Systems input)
Systems input)
- Surface Demanded - Failure to close on drill pipe through annular(s) -
485 2.1.5.4 Erratic output 9 2 1 18
- Surface When Demanded - Failure to close on drill pipe through pipe rams
486 2.1.5.4 Erratic output 9 2 4 72
Control Panels
- Surface
487 2.1.5.4 Erratic output and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
to 1.1.5.1)
Systems
Control Panels
- Surface
488 2.1.5.4 Erratic output through blind-shear rams or annular - Close and seal on open 9 2 1 18
Control
Systems
(linked to 1.2.1.1)
Control Panels
- Surface
489 2.1.5.4 Erratic output and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
Control Panels
- Surface
490 2.1.5.4 Erratic output Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Control
Systems
2650788-DFMECA-2-D2 C-33
Risk
Control Panels
- Surface
491 2.1.5.4 Erratic output Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Control
Systems
Control Panels
- Surface
492 2.1.5.4 Erratic output - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Control
Systems
Control Panels
- Surface
493 2.1.5.4 Erratic output Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Control
(linked to 1.6.1.1)
Systems
Control Panels
- Surface
494 2.1.5.4 Erratic output receive EDS signal prevents disconnecting from stack during 10 2 1 20
Control
Systems
Control Panels
- Surface
495 2.1.5.4 Erratic output disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Control
Systems
- Surface Failure to disconnect the LMRP - Controlled Operation -
496 2.1.5.4 Erratic output 9 2 1 18
Systems 1.8.1.1)
Control Panels
- Surface
497 2.1.5.4 Erratic output - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Control
(linked to 1.9.1.1)
Systems
Control Panels
- Surface
498 2.1.5.4 Erratic output - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Control
Systems
Control Panels
- Surface
499 2.1.5.4 Erratic output - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Control
Systems
- Surface Fails to respond to Demanded - Failure to close on drill pipe through annular(s) -
500 2.1.5.5 9 2 1 18
Control input Close and seal on the drill pipe and allow circulation on demand
- Surface Fails to respond to When Demanded - Failure to close on drill pipe through pipe rams
501 2.1.5.5 9 2 4 72
Control input - Close and seal on the drill pipe and allow circulation on demand
2650788-DFMECA-2-D2 C-34
Risk
Control Panels
- Surface Fails to respond to
Control input
to 1.1.5.1)
Systems
Control Panels
Control input
Systems
(linked to 1.2.1.1)
Control Panels
Control input
Systems
Control Panels
Control input
Systems
Control Panels
Control input
Systems
Control Panels
Control input
Systems
Control Panels
Control input
(linked to 1.6.1.1)
Systems
Control Panels
Control input
Systems
Control Panels
Control input
Systems
- Surface Fails to respond to Failure to disconnect the LMRP - Controlled Operation -
511 2.1.5.5 9 2 1 18
Control input Disconnect the LMRP from the Lower BOP stack (linked to
Systems 1.8.1.1)
Control Panels
Control input
(linked to 1.9.1.1)
Systems
2650788-DFMECA-2-D2 C-35
Risk
Control Panels
Control input
Systems
Control Panels
Control input
Systems
Control Panels
- Surface
524 2.1.5.7 Short receive EDS signal prevents disconnecting from stack during 10 2 1 20
Control
Systems
- Surface Demanded - Failure to close on drill pipe through annular(s) -
525 2.1.5.7 Short 9 2 1 18
- Surface When Demanded - Failure to close on drill pipe through pipe rams
526 2.1.5.7 Short 9 2 4 72
Control Panels
- Surface
527 2.1.5.7 Short and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Control
to 1.1.5.1)
Systems
Control Panels
- Surface
528 2.1.5.7 Short through blind-shear rams or annular - Close and seal on open 9 2 1 18
Control
Systems
(linked to 1.2.1.1)
Control Panels
- Surface
529 2.1.5.7 Short and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
Control Panels
- Surface
530 2.1.5.7 Short Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Control
Systems
Control Panels
- Surface
531 2.1.5.7 Short Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Control
Systems
Control Panels
- Surface
532 2.1.5.7 Short - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Control
Systems
2650788-DFMECA-2-D2 C-36
Risk
Control Panels
- Surface
533 2.1.5.7 Short Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Control
(linked to 1.6.1.1)
Systems
Control Panels
- Surface
534 2.1.5.7 Short disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Control
Systems
- Surface Failure to disconnect the LMRP - Controlled Operation -
535 2.1.5.7 Short 9 2 1 18
Systems 1.8.1.1)
Control Panels
- Surface
536 2.1.5.7 Short - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Control
(linked to 1.9.1.1)
Systems
Control Panels
- Surface
537 2.1.5.7 Short - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Control
Systems
Control Panels
- Surface
538 2.1.5.7 Short - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Control
Systems
- Surface Loss of function Demanded - Failure to close on drill pipe through annular(s) -
542 2.1.5.8 9 2 1 18
- Surface Loss of function When Demanded - Failure to close on drill pipe through pipe rams
543 2.1.5.8 9 2 4 72
Control (general) - Close and seal on the drill pipe and allow circulation on demand
Control Panels
- Surface Loss of function
Control (general)
to 1.1.5.1)
Systems
Control Panels
Control (general)
Systems
(linked to 1.2.1.1)
Control Panels
Control (general)
Systems
2650788-DFMECA-2-D2 C-37
Risk
Control Panels
Control (general)
Systems
Control Panels
Control (general)
Systems
Control Panels
Control (general)
Systems
Control Panels
Control (general)
(linked to 1.6.1.1)
Systems
Control Panels
Control (general)
Systems
Control Panels
Control (general)
Systems
- Surface Loss of function Failure to disconnect the LMRP - Controlled Operation -
553 2.1.5.8 9 2 1 18
Control (general) Disconnect the LMRP from the Lower BOP stack (linked to
Systems 1.8.1.1)
Control Panels
Control (general)
(linked to 1.9.1.1)
Systems
Control Panels
Control (general)
Systems
Control Panels
Control (general)
Systems
Accumulators
- Surface -
561 2.1.6.1 Surface 8 3 2 36
Control
Systems
2650788-DFMECA-2-D2 C-38
Risk
Accumulators
- Surface -
562 2.1.6.1 Surface 8 2 3 48
Control
Systems
Accumulators
- Surface - Failure of Pipe Ram to Seal on Demand - Failure to seal or partial
External Leak/
Rupture
Systems
Accumulators
- Surface -
564 2.1.6.1 Surface 9 2 3 54
Control
(linked to 1.1.4.2)
Systems
Accumulators
- Surface - Actuates Too Slowly on Demand - Closes too slowly - Close and
External Leak/
Rupture
Control 1.1.7.1)
Systems
Accumulators Failure to Supply Hydraulic Fluid & Pressure to Annular / Blind-
- Surface - Shear Ram or C&K Valves - Failure to close on open hole through
External Leak/
Rupture
Systems 1.2.1.2)
Accumulators
- Surface -
567 2.1.6.1 Surface 9 1 2 18
Control
Systems
Accumulators
- Surface -
568 2.1.6.1 Surface 9 1 2 18
Control
Systems
Accumulators
- Surface - Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure
External Leak/
Rupture
Systems
Accumulators
- Surface - Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram -
External Leak/
Rupture
Systems
2650788-DFMECA-2-D2 C-39
Risk
Accumulators
- Surface - Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
External Leak/
Rupture
Systems
Accumulators
- Surface - Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak/
Rupture
Systems
Accumulators
- Surface - Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
External Leak/
Rupture
Control 1.5.2.1)
Systems
Accumulators
- Surface - Failure of Shear Ram to Seal On Demand - Failure to seal the
External Leak/
Rupture
Systems
Accumulators
- Surface - Failure to Maintain Sealing Pressure on Shear Ram - Failure to
External Leak/
Rupture
Systems
Accumulators
- Surface - Unintentional Opening - Unintentional closing / opening -
External Leak/
Rupture
Systems
Accumulators
External Leak/
Rupture
Systems
Accumulators
- Surface - Failure to initiate autoshear sequence - Failure to close -
External Leak/
Rupture
Systems
Accumulators
External Leak/
Rupture
Systems
2650788-DFMECA-2-D2 C-40
Risk
Accumulators
- Surface - Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
External Leak/
Rupture
Systems
Accumulators
External Leak/
Rupture
Systems
Accumulators
External Leak/
Rupture
Systems
Accumulators
External Leak/
Rupture
Systems
Accumulators
- Surface - Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
External Leak/
Rupture
Systems
Accumulators
- Surface - Moves too slowly to disconnect - Failure to disconnect the LMRP -
External Leak/
Rupture
Control 1.7.2.4)
Systems
Accumulators
- Surface - Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak/
Rupture
Systems
Accumulators
- Surface - Moves too slowly to disconnect - Failure to disconnect the LMRP
External Leak/
Rupture
Systems
Accumulators
- Surface - Failure to Supply Hydraulic Fluid & Pressure to C&K Valves -
External Leak/
Rupture
Systems
2650788-DFMECA-2-D2 C-41
Risk
Accumulators
External Leak/
Rupture
Systems
Accumulators
External Leak/
Rupture
Systems
Accumulators
- Surface -
592 2.1.6.2 Surface Internal Leak 8 3 2 36
Control
Systems
Accumulators
- Surface -
Control
Systems
Accumulators
594 2.1.6.2 Surface Internal Leak seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Systems
Accumulators
- Surface -
Control
(linked to 1.1.4.2)
Systems
Accumulators
596 2.1.6.2 Surface Internal Leak seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control 1.1.7.1)
Systems
597 2.1.6.2 Surface Internal Leak blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Systems 1.2.1.2)
Accumulators
- Surface -
Control
Systems
2650788-DFMECA-2-D2 C-42
Risk
Accumulators
- Surface -
Control
Systems
Accumulators
600 2.1.6.2 Surface Internal Leak to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Systems
Accumulators
601 2.1.6.2 Surface Internal Leak Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Systems
Accumulators
602 2.1.6.2 Surface Internal Leak maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Systems
Accumulators
603 2.1.6.2 Surface Internal Leak Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Systems
Accumulators
604 2.1.6.2 Surface Internal Leak operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Control 1.5.2.1)
Systems
Accumulators
605 2.1.6.2 Surface Internal Leak wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Systems
Accumulators
606 2.1.6.2 Surface Internal Leak seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Systems
Accumulators
607 2.1.6.2 Surface Internal Leak Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Systems
2650788-DFMECA-2-D2 C-43
Risk
Accumulators
608 2.1.6.2 Surface Internal Leak Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Systems
Accumulators
609 2.1.6.2 Surface Internal Leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 4 4 160
Systems
Accumulators
610 2.1.6.2 Surface Internal Leak Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Systems
Accumulators
611 2.1.6.2 Surface Internal Leak Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Systems
Accumulators
612 2.1.6.2 Surface Internal Leak wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Systems
Accumulators
613 2.1.6.2 Surface Internal Leak seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Systems
Accumulators
614 2.1.6.2 Surface Internal Leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Systems
Accumulators
615 2.1.6.2 Surface Internal Leak LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Systems
Accumulators
616 2.1.6.2 Surface Internal Leak Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control 1.7.2.4)
Systems
2650788-DFMECA-2-D2 C-44
Risk
Accumulators
617 2.1.6.2 Surface Internal Leak LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Systems
Accumulators
618 2.1.6.2 Surface Internal Leak - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Systems
Accumulators
619 2.1.6.2 Surface Internal Leak Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Systems
Accumulators
620 2.1.6.2 Surface Internal Leak Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Systems
Accumulators
621 2.1.6.2 Surface Internal Leak Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Systems
Accumulators
622 2.1.6.3 Surface Plugged Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 2 60
Systems
Accumulators
- Surface -
624 2.1.6.4 Surface Mechanical Failure 8 3 2 36
Control
Systems
Accumulators
- Surface -
Control
Systems
Accumulators
626 2.1.6.4 Surface Mechanical Failure seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Systems
2650788-DFMECA-2-D2 C-45
Risk
Accumulators
- Surface -
Control
(linked to 1.1.4.2)
Systems
Accumulators
628 2.1.6.4 Surface Mechanical Failure seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control 1.1.7.1)
Systems
629 2.1.6.4 Surface Mechanical Failure blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Systems 1.2.1.2)
Accumulators
- Surface -
Control
Systems
Accumulators
- Surface -
Control
Systems
Accumulators
632 2.1.6.4 Surface Mechanical Failure to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Systems
Accumulators
633 2.1.6.4 Surface Mechanical Failure Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Systems
Accumulators
634 2.1.6.4 Surface Mechanical Failure maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Systems
Accumulators
635 2.1.6.4 Surface Mechanical Failure Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Systems
2650788-DFMECA-2-D2 C-46
Risk
Accumulators
636 2.1.6.4 Surface Mechanical Failure operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Control 1.5.2.1)
Systems
Accumulators
637 2.1.6.4 Surface Mechanical Failure wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Systems
Accumulators
638 2.1.6.4 Surface Mechanical Failure seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Systems
Accumulators
639 2.1.6.4 Surface Mechanical Failure Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Systems
Accumulators
640 2.1.6.4 Surface Mechanical Failure Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Systems
Accumulators
641 2.1.6.4 Surface Mechanical Failure Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Systems
Accumulators
642 2.1.6.4 Surface Mechanical Failure Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Systems
Accumulators
643 2.1.6.4 Surface Mechanical Failure wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Systems
Accumulators
644 2.1.6.4 Surface Mechanical Failure seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Systems
2650788-DFMECA-2-D2 C-47
Risk
Accumulators
645 2.1.6.4 Surface Mechanical Failure Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Systems
Accumulators
646 2.1.6.4 Surface Mechanical Failure LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Systems
Accumulators
647 2.1.6.4 Surface Mechanical Failure Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control 1.7.2.4)
Systems
Accumulators
648 2.1.6.4 Surface Mechanical Failure LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Systems
Accumulators
649 2.1.6.4 Surface Mechanical Failure - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Systems
Accumulators
650 2.1.6.4 Surface Mechanical Failure Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Systems
Accumulators
651 2.1.6.4 Surface Mechanical Failure Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Systems
Accumulators
652 2.1.6.4 Surface Mechanical Failure Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Systems
Accumulators
- Surface -
654 2.1.6.5 Surface Wear 8 3 2 36
Control
Systems
2650788-DFMECA-2-D2 C-48
Risk
Accumulators
- Surface -
655 2.1.6.5 Surface Wear 8 2 3 48
Control
Systems
Accumulators
656 2.1.6.5 Surface Wear seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Systems
Accumulators
- Surface -
657 2.1.6.5 Surface Wear 9 2 3 54
Control
(linked to 1.1.4.2)
Systems
Accumulators
658 2.1.6.5 Surface Wear seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control 1.1.7.1)
Systems
659 2.1.6.5 Surface Wear blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Systems 1.2.1.2)
Accumulators
- Surface -
660 2.1.6.5 Surface Wear 9 1 2 18
Control
Systems
Accumulators
- Surface -
661 2.1.6.5 Surface Wear 9 1 2 18
Control
Systems
Accumulators
662 2.1.6.5 Surface Wear to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Systems
Accumulators
663 2.1.6.5 Surface Wear Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Systems
2650788-DFMECA-2-D2 C-49
Risk
Accumulators
664 2.1.6.5 Surface Wear maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Systems
Accumulators
665 2.1.6.5 Surface Wear Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Systems
Accumulators
666 2.1.6.5 Surface Wear operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Control 1.5.2.1)
Systems
Accumulators
667 2.1.6.5 Surface Wear wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Systems
Accumulators
668 2.1.6.5 Surface Wear seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Systems
Accumulators
669 2.1.6.5 Surface Wear Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Systems
Accumulators
670 2.1.6.5 Surface Wear Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Systems
Accumulators
671 2.1.6.5 Surface Wear Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 4 4 160
Systems
Accumulators
672 2.1.6.5 Surface Wear Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Systems
2650788-DFMECA-2-D2 C-50
Risk
Accumulators
673 2.1.6.5 Surface Wear Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Systems
Accumulators
674 2.1.6.5 Surface Wear wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Systems
Accumulators
675 2.1.6.5 Surface Wear seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Systems
Accumulators
676 2.1.6.5 Surface Wear Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Systems
Accumulators
677 2.1.6.5 Surface Wear LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Systems
Accumulators
678 2.1.6.5 Surface Wear Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control 1.7.2.4)
Systems
Accumulators
679 2.1.6.5 Surface Wear LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Systems
Accumulators
680 2.1.6.5 Surface Wear - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Systems
Accumulators
681 2.1.6.5 Surface Wear Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Systems
2650788-DFMECA-2-D2 C-51
Risk
Accumulators
682 2.1.6.5 Surface Wear Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Systems
Accumulators
683 2.1.6.5 Surface Wear Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Systems
Accumulators
- Surface -
688 2.1.6.7 Surface 8 3 2 36
Control
Systems
Accumulators
- Surface -
689 2.1.6.7 Surface 8 2 3 48
Control
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
- Surface -
691 2.1.6.7 Surface 9 2 3 54
Control
(linked to 1.1.4.2)
Systems
Accumulators
Loss of Function
(general)
Control 1.1.7.1)
Systems
Loss of Function
(general)
Systems 1.2.1.2)
Accumulators
- Surface -
694 2.1.6.7 Surface 9 1 2 18
Control
Systems
2650788-DFMECA-2-D2 C-52
Risk
Accumulators
- Surface -
695 2.1.6.7 Surface 9 1 2 18
Control
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Control 1.5.2.1)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
2650788-DFMECA-2-D2 C-53
Risk
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Control 1.7.2.4)
Systems
2650788-DFMECA-2-D2 C-54
Risk
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Accumulators
Loss of Function
(general)
Systems
Fluid
Reservoir Unit
723 2.1.7.1 - Surface 8 3 2 36
Control
Systems
Fluid
Reservoir Unit
724 2.1.7.1 - Surface 8 2 3 48
Control
Systems
Fluid
Reservoir Unit Actuates Too Slowly on Demand - Closes too slowly - Close and
External Leak/
725 2.1.7.1 - Surface seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Rupture
Control 1.1.7.1)
Systems
Fluid Failure to Supply Hydraulic Fluid & Pressure to Annular / Blind-
Reservoir Unit Shear Ram or C&K Valves - Failure to close on open hole through
External Leak/
726 2.1.7.1 - Surface blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Rupture
Systems 1.2.1.2)
2650788-DFMECA-2-D2 C-55
Risk
Fluid
Reservoir Unit Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure
External Leak/
727 2.1.7.1 - Surface to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Rupture
Systems
Fluid
Reservoir Unit Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram -
External Leak/
728 2.1.7.1 - Surface Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Rupture
Systems
Fluid
Reservoir Unit Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak/
729 2.1.7.1 - Surface Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Rupture
Systems
Fluid
External Leak/
730 2.1.7.1 - Surface Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Rupture
Systems
Fluid
External Leak/
731 2.1.7.1 - Surface Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Rupture
Systems
Fluid
Reservoir Unit Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
External Leak/
732 2.1.7.1 - Surface Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Rupture
Systems
Fluid
Reservoir Unit Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
External Leak/
733 2.1.7.1 - Surface LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Rupture
Systems
Fluid
Reservoir Unit Moves too slowly to disconnect - Failure to disconnect the LMRP -
External Leak/
734 2.1.7.1 - Surface Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Rupture
Control 1.7.2.4)
Systems
Fluid
Reservoir Unit Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak/
735 2.1.7.1 - Surface LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Rupture
Systems
2650788-DFMECA-2-D2 C-56
Risk
Fluid
Reservoir Unit Moves too slowly to disconnect - Failure to disconnect the LMRP
External Leak/
736 2.1.7.1 - Surface - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Rupture
Systems
Fluid
Reservoir Unit Failure to Supply Hydraulic Fluid & Pressure to C&K Valves -
External Leak/
737 2.1.7.1 - Surface Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Rupture
Systems
Fluid
External Leak/
738 2.1.7.1 - Surface Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Rupture
Systems
Fluid
External Leak/
739 2.1.7.1 - Surface Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Rupture
Systems
Fluid
Reservoir Unit
741 2.1.7.2 - Surface Internal Leak 9 2 3 54
Control
(linked to 1.1.3.2)
Systems
Fluid
Reservoir Unit
742 2.1.7.2 - Surface Internal Leak 9 2 3 54
Control
(linked to 1.1.4.2)
Systems
Fluid
Reservoir Unit Failure to Maintain Hydraulic Fluid & Pressure to Annulars -
743 2.1.7.2 - Surface Internal Leak Failure to maintain stripping pressure - Strip the drill string using 9 2 2 36
Control the annular BOP(s) (linked to 1.3.2.1)
Systems
Fluid
Reservoir Unit
746 2.1.7.3 - Surface Plugged 8 3 2 36
Control
Systems
Fluid
Reservoir Unit
747 2.1.7.3 - Surface Plugged 8 2 3 48
Control
Systems
2650788-DFMECA-2-D2 C-57
Risk
Fluid
748 2.1.7.3 - Surface Plugged seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control 1.1.7.1)
Systems
749 2.1.7.3 - Surface Plugged blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Systems 1.2.1.2)
Fluid
750 2.1.7.3 - Surface Plugged to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Systems
Fluid
751 2.1.7.3 - Surface Plugged Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Systems
Fluid
752 2.1.7.3 - Surface Plugged Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Systems
Fluid
753 2.1.7.3 - Surface Plugged Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Systems
Fluid
754 2.1.7.3 - Surface Plugged Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Systems
Fluid
755 2.1.7.3 - Surface Plugged LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Systems
Fluid
756 2.1.7.3 - Surface Plugged Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control 1.7.2.4)
Systems
2650788-DFMECA-2-D2 C-58
Risk
Fluid
757 2.1.7.3 - Surface Plugged LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Systems
Fluid
758 2.1.7.3 - Surface Plugged - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Systems
Fluid
759 2.1.7.3 - Surface Plugged Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Systems
Fluid
760 2.1.7.3 - Surface Plugged Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Systems
Fluid
761 2.1.7.3 - Surface Plugged Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Systems
Fluid
Reservoir Unit
763 2.1.7.4 - Surface Mechanical Failure 8 3 2 36
Control
Systems
Fluid
Reservoir Unit
764 2.1.7.4 - Surface Mechanical Failure 8 2 3 48
Control
Systems
765 2.1.7.4 - Surface Mechanical Failure blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Systems 1.2.1.2)
Fluid
766 2.1.7.4 - Surface Mechanical Failure to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Systems
2650788-DFMECA-2-D2 C-59
Risk
Fluid
767 2.1.7.4 - Surface Mechanical Failure Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Systems
Fluid
768 2.1.7.4 - Surface Mechanical Failure Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Systems
Fluid
769 2.1.7.4 - Surface Mechanical Failure Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Systems
Fluid
770 2.1.7.4 - Surface Mechanical Failure LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Systems
Fluid
771 2.1.7.4 - Surface Mechanical Failure LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Systems
Fluid
772 2.1.7.4 - Surface Mechanical Failure Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Systems
Fluid
773 2.1.7.4 - Surface Mechanical Failure Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Systems
Fluid
774 2.1.7.4 - Surface Mechanical Failure Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Systems
Fluid
Reservoir Unit
776 2.1.7.5 - Surface Wear 2 1 3 6
Control
Systems
2650788-DFMECA-2-D2 C-60
Risk
Fluid
Reservoir Unit
782 2.1.7.7 - Surface 8 3 2 36
Control
Systems
Fluid
Reservoir Unit
Loss of Function Failure to seal or partial seal on drill pipe through annular(s) -
783 2.1.7.7 - Surface 9 2 3 54
Control
(linked to 1.1.3.2)
Systems
Fluid
Reservoir Unit
784 2.1.7.7 - Surface 9 2 3 54
Control
(linked to 1.1.4.2)
Systems
Fluid
Loss of Function
785 2.1.7.7 - Surface seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
(general)
Control 1.1.7.1)
Systems
Loss of Function
786 2.1.7.7 - Surface blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
(general)
Systems 1.2.1.2)
Fluid
Loss of Function
787 2.1.7.7 - Surface to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
(general)
Systems
Fluid
Reservoir Unit Failure to Maintain Hydraulic Fluid & Pressure to Annulars -
Loss of Function
788 2.1.7.7 - Surface Failure to maintain stripping pressure - Strip the drill string using 9 2 2 36
(general)
Control the annular BOP(s) (linked to 1.3.2.1)
Systems
Fluid
Loss of Function
789 2.1.7.7 - Surface Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
(general)
Systems
Fluid
Loss of Function
790 2.1.7.7 - Surface Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
(general)
Systems
2650788-DFMECA-2-D2 C-61
Risk
Fluid
Loss of Function
791 2.1.7.7 - Surface Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
(general)
Systems
Fluid
Loss of Function
792 2.1.7.7 - Surface Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
(general)
Systems
Fluid
Loss of Function
793 2.1.7.7 - Surface LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
(general)
Systems
Fluid
Loss of Function
794 2.1.7.7 - Surface Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
(general)
Control 1.7.2.4)
Systems
Fluid
Loss of Function
795 2.1.7.7 - Surface LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
(general)
Systems
Fluid
Loss of Function
796 2.1.7.7 - Surface - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
(general)
Systems
Fluid
Loss of Function
797 2.1.7.7 - Surface Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
(general)
Systems
Fluid
Loss of Function
798 2.1.7.7 - Surface Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
(general)
Systems
Fluid
Loss of Function
799 2.1.7.7 - Surface Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
(general)
Systems
2650788-DFMECA-2-D2 C-62
Risk
Secondary &
Emergency
Control Failure to Provide Control Signal - Failure to Arm - Emergency
Loss of, or Degraded
804 2.1.8.1 Systems - Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Power
Control
Systems
Secondary &
Emergency
Control Failure to provide control signal, when demanded - Failure to
805 2.1.8.1 Systems - receive EDS signal prevents disconnecting from stack during 10 2 1 20
Power
Surface emergency operation when using the EDS (1.7) (linked to 1.7.1.1)
Control
Systems
Secondary &
Emergency
Control Failure to Provide Disconnect Signal (automatically) - Failure to
806 2.1.8.1 Systems - disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Power
Surface from the stack (linked to 1.7.2.1)
Control
Systems
Secondary &
Emergency
Failure to Provide Disconnect Signal (automatically or manually) -
Control
Loss of, or Degraded Failure to disconnect the LMRP - Controlled Operation -
807 2.1.8.1 Systems - 9 2 1 18
Power Disconnect the LMRP from the Lower BOP stack (linked to
Surface
1.8.1.1)
Control
Systems
Secondary &
Emergency
Control Failure to Provide Control Signal to C&K Valves when Demanded
808 2.1.8.1 Systems - - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Power
Control
Systems
Secondary &
Emergency
809 2.1.8.1 Systems - - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Power
Surface disconnect (linked to 1.9.4.1)
Control
Systems
2650788-DFMECA-2-D2 C-63
Risk
Secondary &
Emergency
810 2.1.8.1 Systems - - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Power
Surface trapped gas (linked to 1.10.1.1)
Control
Systems
Secondary &
Emergency
signal/
communication
(Includes Short)
Control
Systems
Secondary &
Emergency
signal/
communication
(Includes Short)
Control
Systems
Secondary &
Emergency
signal/
communication
(Includes Short)
Control
Systems
Secondary &
Emergency
Fails with no output Failure to Provide Disconnect Signal (automatically or manually) -
Control
signal/ Failure to disconnect the LMRP - Controlled Operation -
815 2.1.8.2 Systems - 9 2 1 18
communication Disconnect the LMRP from the Lower BOP stack (linked to
Surface
(Includes Short) 1.8.1.1)
Control
Systems
Secondary &
Emergency
signal/
communication
(Includes Short)
Control
Systems
2650788-DFMECA-2-D2 C-64
Risk
Secondary &
Emergency
signal/
communication
(Includes Short)
Control
Systems
Secondary &
Emergency
signal/
communication
(Includes Short)
Control
Systems
Secondary &
Emergency
Loss of function
(general)
Control
Systems
Secondary &
Emergency
Loss of function
(general)
Control
Systems
Secondary &
Emergency
Loss of function
(general)
Control
Systems
Secondary &
Emergency
Control
Loss of function Failure to disconnect the LMRP - Controlled Operation -
823 2.1.8.3 Systems - 9 2 1 18
(general) Disconnect the LMRP from the Lower BOP stack (linked to
Surface
1.8.1.1)
Control
Systems
2650788-DFMECA-2-D2 C-65
Risk
Secondary &
Emergency
Loss of function
(general)
Control
Systems
Secondary &
Emergency
Loss of function
(general)
Control
Systems
Secondary &
Emergency
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Failure to Provide Control Signal to Annular or C&K Valves When
Systems -
Loss of, or Degraded Demanded - Failure to close on drill pipe through annular(s) -
834 2.2.1.1 Electrical - 9 2 4 72
Power Close and seal on the drill pipe and allow circulation on demand
Subsea
(linked to 1.1.1.1)
Control
Systems
Blue & Yellow
Control
Failure to Provide Control Signal to Pipe Ram or C&K Valves
Systems -
Loss of, or Degraded When Demanded - Failure to close on drill pipe through pipe rams
835 2.2.1.1 Electrical - 9 2 4 72
Power - Close and seal on the drill pipe and allow circulation on demand
Subsea
(linked to 1.1.2.1)
Control
Systems
Blue & Yellow
Control
Systems - Unintentional Operation - Unintentional closing / opening - Close
836 2.2.1.1 Electrical - and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Power
Subsea to 1.1.5.1)
Control
Systems
2650788-DFMECA-2-D2 C-66
Risk
Blue & Yellow
Control Failure to Provide Control Signal to Annular / Blind-Shear Ram or
Systems - C&K Valves When Demanded - Failure to close on open hole
837 2.2.1.1 Electrical - through blind-shear rams or annular - Close and seal on open 9 2 1 18
Power
Subsea hole and allow volumetric well control operations on demand
Systems
Blue & Yellow
Control
Systems - Unintentional Closing - Unintentional closing / opening - Close
838 2.2.1.1 Electrical - and seal on open hole and allow volumetric well control 6 2 3 36
Power
Subsea operations on demand (linked to 1.2.2.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Provide Control Signal to Annulars When Demanded -
839 2.2.1.1 Electrical - Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Power
Subsea BOP(s) (linked to 1.3.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Provide Control Signal to Hang-off Ram When
840 2.2.1.1 Electrical - Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Power
Subsea pipe on a ram BOP and control the wellbore (linked to 1.4.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Provide Control Signal to Shear Ram When Demanded
841 2.2.1.1 Electrical - - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Power
Subsea seal the wellbore (linked to 1.5.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Provide Control Signal - Failure to Arm - Emergency
842 2.2.1.1 Electrical - Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Power
Subsea (linked to 1.6.1.1)
Control
Systems
2650788-DFMECA-2-D2 C-67
Risk
Blue & Yellow
Control
Systems - Failure to provide control signal, when demanded - Failure to
843 2.2.1.1 Electrical - receive EDS signal prevents disconnecting from stack during 10 2 1 20
Power
Subsea emergency operation when using the EDS (1.7) (linked to 1.7.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Provide Disconnect Signal (automatically) - Failure to
844 2.2.1.1 Electrical - disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Power
Subsea from the stack (linked to 1.7.2.1)
Control
Systems
Blue & Yellow
Control
Systems -
845 2.2.1.1 Electrical - 9 2 1 18
Subsea
1.8.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Provide Control Signal to C&K Valves when Demanded
846 2.2.1.1 Electrical - - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Power
Control
Systems
Blue & Yellow
Control
847 2.2.1.1 Electrical - - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Power
Subsea disconnect (linked to 1.9.4.1)
Control
Systems
Blue & Yellow
Control
848 2.2.1.1 Electrical - - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Power
Subsea trapped gas (linked to 1.10.1.1)
Control
Systems
2650788-DFMECA-2-D2 C-68
Risk
Blue & Yellow
Control
Systems - Fails with no output
Demanded - Failure to close on drill pipe through annular(s) -
851 2.2.1.2 Electrical - signal/ 9 2 1 18
Subsea communication
(linked to 1.1.1.1)
Control
Systems
Blue & Yellow
Control
When Demanded - Failure to close on drill pipe through pipe rams
- Close and seal on the drill pipe and allow circulation on demand
(linked to 1.1.2.1)
Control
Systems
Blue & Yellow
Control
Systems - Fails with no output Unintentional Operation - Unintentional closing / opening - Close
853 2.2.1.2 Electrical - signal/ and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Subsea communication to 1.1.5.1)
Control
Systems
Blue & Yellow
Systems - Fails with no output C&K Valves When Demanded - Failure to close on open hole
854 2.2.1.2 Electrical - signal/ through blind-shear rams or annular - Close and seal on open 9 2 1 18
Subsea communication hole and allow volumetric well control operations on demand
Systems
Blue & Yellow
Control
Systems - Fails with no output Unintentional Closing - Unintentional closing / opening - Close
855 2.2.1.2 Electrical - signal/ and seal on open hole and allow volumetric well control 6 2 3 36
Subsea communication operations on demand (linked to 1.2.2.1)
Control
Systems
Blue & Yellow
Control
Systems - Fails with no output Failure to Provide Control Signal to Annulars When Demanded -
856 2.2.1.2 Electrical - signal/ Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Subsea communication BOP(s) (linked to 1.3.1.1)
Control
Systems
2650788-DFMECA-2-D2 C-69
Risk
Blue & Yellow
Control
Systems - Fails with no output Failure to Provide Control Signal to Hang-off Ram When
857 2.2.1.2 Electrical - signal/ Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Subsea communication pipe on a ram BOP and control the wellbore (linked to 1.4.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Fails with no output Failure to Provide Control Signal to Shear Ram When Demanded
858 2.2.1.2 Electrical - signal/ - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Subsea communication seal the wellbore (linked to 1.5.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Fails with no output Failure to Provide Control Signal - Failure to Arm - Emergency
859 2.2.1.2 Electrical - signal/ Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Subsea communication (linked to 1.6.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Fails with no output Failure to provide control signal, when demanded - Failure to
860 2.2.1.2 Electrical - signal/ receive EDS signal - Emergency Operation: EDS - Disconnect 10 2 1 20
Subsea communication from the stack (linked to 1.7.1.1)
Control
Systems
Blue & Yellow
Control
Systems - Fails with no output Failure to Provide Disconnect Signal (automatically) - Failure to
861 2.2.1.2 Electrical - signal/ disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Subsea communication from the stack (linked to 1.7.2.1)
Control
Systems
Blue & Yellow
Control
Failure to disconnect the LMRP - Controlled Operation -
Disconnect the LMRP from the Lower BOP stack (linked to
1.8.1.1)
Control
Systems
2650788-DFMECA-2-D2 C-70
Risk
Blue & Yellow
Control
Systems - Fails with no output Failure to Provide Control Signal to C&K Valves when Demanded
863 2.2.1.2 Electrical - signal/ - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Subsea communication (linked to 1.9.1.1)
Control
Systems
Blue & Yellow
Control
864 2.2.1.2 Electrical - signal/ - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Subsea communication disconnect (linked to 1.9.4.1)
Control
Systems
Blue & Yellow
Control
865 2.2.1.2 Electrical - signal/ - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Subsea communication trapped gas (linked to 1.10.1.1)
Control
Systems
Blue & Yellow
Control
Systems -
Demanded - Failure to close on drill pipe through annular(s) -
867 2.2.1.3 Electrical - Erratic output 9 2 1 18
Subsea
(linked to 1.1.1.1)
Control
Systems
Blue & Yellow
Control
Systems -
When Demanded - Failure to close on drill pipe through pipe rams
- Close and seal on the drill pipe and allow circulation on demand
Subsea
(linked to 1.1.2.1)
Control
Systems
Blue & Yellow
Control
869 2.2.1.3 Electrical - Erratic output and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Subsea to 1.1.5.1)
Control
Systems
2650788-DFMECA-2-D2 C-71
Risk
Blue & Yellow
870 2.2.1.3 Electrical - Erratic output through blind-shear rams or annular - Close and seal on open 9 2 1 18
Systems
Blue & Yellow
Control
871 2.2.1.3 Electrical - Erratic output and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
Blue & Yellow
Control
872 2.2.1.3 Electrical - Erratic output Failure to close annulars - Strip the drill string using the annular 9 2 1 18
Control
Systems
Blue & Yellow
Control
873 2.2.1.3 Electrical - Erratic output Demanded - Failure of hang-off ram to close - Hang-off the drill 9 2 2 36
Control
Systems
Blue & Yellow
Control
874 2.2.1.3 Electrical - Erratic output - Failure to close - Controlled operation - Shear the drill pipe and 9 1 4 36
Control
Systems
Blue & Yellow
Control
875 2.2.1.3 Electrical - Erratic output Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 2 1 20
Control
Systems
2650788-DFMECA-2-D2 C-72
Risk
Blue & Yellow
Control
876 2.2.1.3 Electrical - Erratic output receive EDS signal prevents disconnecting from stack during 10 2 1 20
Control
Systems
Blue & Yellow
Control
877 2.2.1.3 Electrical - Erratic output disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Control
Systems
Blue & Yellow
Control
Systems -
Subsea
1.8.1.1)
Control
Systems
Blue & Yellow
Control
879 2.2.1.3 Electrical - Erratic output - Failure to circulate - Circulate the well after drill pipe disconnect 8 2 1 16
Control
Systems
Blue & Yellow
Control
880 2.2.1.3 Electrical - Erratic output - Failure to seal wellbore - Circulate the well after drill pipe 8 2 1 16
Control
Systems
Blue & Yellow
Control
881 2.2.1.3 Electrical - Erratic output - Failure to circulate - Circulate across the BOP stack to remove 10 1 1 10
Control
Systems
2650788-DFMECA-2-D2 C-73
Risk
Blue & Yellow
Control
Systems -
Fails to respond to Demanded - Failure to close on drill pipe through annular(s) -
884 2.2.1.4 Electrical - 9 2 1 18
input - Electrical Close and seal on the drill pipe and allow circulation on demand
Subsea
(linked to 1.1.1.1)
Control
Systems
Blue & Yellow
Control
Systems -
Fails to respond to When Demanded - Failure to close on drill pipe through pipe rams
885 2.2.1.4 Electrical - 9 2 4 72
input - Electrical - Close and seal on the drill pipe and allow circulation on demand
Subsea
(linked to 1.1.2.1)
Control
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Subsea to 1.1.5.1)
Control
Systems
Blue & Yellow
Fails to respond to
input - Electrical
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
2650788-DFMECA-2-D2 C-74
Risk
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
Systems -
Fails to respond to Failure to disconnect the LMRP - Controlled Operation -
895 2.2.1.4 Electrical - 9 2 1 18
input - Electrical Disconnect the LMRP from the Lower BOP stack (linked to
Subsea
1.8.1.1)
Control
Systems
2650788-DFMECA-2-D2 C-75
Risk
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
Fails to respond to
input - Electrical
Control
Systems
Blue & Yellow
Control
900 2.2.1.5 Electrical - Processing error receive EDS signal - Emergency Operation: EDS - Disconnect 10 2 1 20
Control
Systems
Blue & Yellow
Control
902 2.2.1.6 Electrical - Ground Fault and seal on the drill pipe and allow circulation on demand (linked 6 2 4 48
Subsea to 1.1.5.1)
Control
Systems
Blue & Yellow
Control
903 2.2.1.6 Electrical - Ground Fault and seal on open hole and allow volumetric well control 6 2 3 36
Control
Systems
2650788-DFMECA-2-D2 C-76
Risk
Blue & Yellow
Control
Systems -
Loss of function Demanded - Failure to close on drill pipe through annular(s) -
909 2.2.1.7 Electrical - 9 2 1 18
Subsea
(linked to 1.1.1.1)
Control
Systems
Blue & Yellow
Control
Systems -
Loss of function When Demanded - Failure to close on drill pipe through pipe rams
910 2.2.1.7 Electrical - 9 2 4 72
(general) - Close and seal on the drill pipe and allow circulation on demand
Subsea
(linked to 1.1.2.1)
Control
Systems
Blue & Yellow
Control
Loss of function
(general)
Subsea to 1.1.5.1)
Control
Systems
Blue & Yellow
Loss of function
(general)
Systems
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
2650788-DFMECA-2-D2 C-77
Risk
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Systems -
920 2.2.1.7 Electrical - 9 2 1 18
Subsea
1.8.1.1)
Control
Systems
2650788-DFMECA-2-D2 C-78
Risk
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Loss of function
(general)
Control
Systems
Blue & Yellow
Control
Systems -
External Leak / Valves When Demanded - Failure to close on drill pipe through
931 2.2.2.1 Hydraulics - 8 3 2 36
Subsea
Control
Systems
Blue & Yellow
Control
Systems -
External Leak / Valves When Demanded - Failure to close on drill pipe through
932 2.2.2.1 Hydraulics - 8 2 3 48
Subsea
Control
Systems
Blue & Yellow
Control
Systems -
External Leak / Failure to seal or partial seal on drill pipe through annular(s) -
933 2.2.2.1 Hydraulics - 9 2 3 54
Subsea
(linked to 1.1.3.2)
Control
Systems
2650788-DFMECA-2-D2 C-79
Risk
Blue & Yellow
Control
Systems - Failure of Pipe Ram to Seal on Demand - Failure to seal or partial
External Leak /
934 2.2.2.1 Hydraulics - seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Rupture
Subsea pipe and allow circulation on demand (linked to 1.1.4.1)
Control
Systems
Blue & Yellow
Control
Systems -
External Leak / Failure to seal or partial seal on drill pipe through pipe rams -
935 2.2.2.1 Hydraulics - 9 2 3 54
Subsea
(linked to 1.1.4.2)
Control
Systems
Blue & Yellow
Control
Systems - Actuates Too Slowly on Demand - Closes too slowly - Close and
External Leak /
936 2.2.2.1 Hydraulics - seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Rupture
Subsea 1.1.7.1)
Control
Systems
Blue & Yellow
Control Failure to Supply Hydraulic Fluid & Pressure to Annular / Blind-
Systems - Shear Ram or C&K Valves - Failure to close on open hole through
External Leak /
937 2.2.2.1 Hydraulics - blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Rupture
Subsea allow volumetric well control operations on demand (linked to
Control 1.2.1.2)
Systems
Blue & Yellow
Control
Systems -
External Leak / to close on open hole through blind-shear rams or annular - Close
938 2.2.2.1 Hydraulics - 9 1 2 18
Subsea
Control
Systems
Blue & Yellow
Control
Systems -
External Leak / Shear Ram - Failure to close on open hole through blind-shear
939 2.2.2.1 Hydraulics - 9 1 2 18
Subsea
Control
Systems
2650788-DFMECA-2-D2 C-80
Risk
Blue & Yellow
Control
Systems - Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure
External Leak /
940 2.2.2.1 Hydraulics - to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Rupture
Control
Systems
Blue & Yellow
Control
Systems - Failure to Maintain Hydraulic Fluid & Pressure to Annulars -
External Leak /
941 2.2.2.1 Hydraulics - Failure to maintain stripping pressure - Strip the drill string using 9 2 2 36
Rupture
Subsea the annular BOP(s) (linked to 1.3.2.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram -
External Leak /
942 2.2.2.1 Hydraulics - Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Rupture
Subsea BOP and control the wellbore (linked to 1.4.1.2)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
External Leak /
943 2.2.2.1 Hydraulics - maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Rupture
Subsea and control the wellbore (linked to 1.4.2.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak /
944 2.2.2.1 Hydraulics - Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Rupture
Control
Systems
Blue & Yellow
Control
Systems - Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
External Leak /
945 2.2.2.1 Hydraulics - operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Rupture
Subsea 1.5.2.1)
Control
Systems
2650788-DFMECA-2-D2 C-81
Risk
Blue & Yellow
Control
Systems - Failure of Shear Ram to Seal On Demand - Failure to seal the
External Leak /
946 2.2.2.1 Hydraulics - wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Rupture
Subsea wellbore (linked to 1.5.3.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Maintain Sealing Pressure on Shear Ram - Failure to
External Leak /
947 2.2.2.1 Hydraulics - seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Rupture
Control
Systems
Blue & Yellow
Control
Systems - Unintentional Opening - Unintentional closing / opening -
External Leak /
948 2.2.2.1 Hydraulics - Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Rupture
Control
Systems
Blue & Yellow
Control
Systems -
External Leak / External Leak - Loss of containment - Controlled operation -
949 2.2.2.1 Hydraulics - 10 3 1 30
Subsea
Control
Systems
Blue & Yellow
Control
External Leak /
950 2.2.2.1 Hydraulics - Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Rupture
Subsea drill pipe and seal the wellbore (linked to 1.6.2.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to initiate autoshear sequence - Failure to close -
External Leak /
951 2.2.2.1 Hydraulics - Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Rupture
Subsea the wellbore (linked to 1.6.2.2)
Control
Systems
2650788-DFMECA-2-D2 C-82
Risk
Blue & Yellow
Control
External Leak /
952 2.2.2.1 Hydraulics - Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Rupture
Subsea - Shear the drill pipe and seal the wellbore (linked to 1.6.3.1)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
External Leak /
953 2.2.2.1 Hydraulics - Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Rupture
Control
Systems
Blue & Yellow
Control
External Leak /
954 2.2.2.1 Hydraulics - wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Rupture
Subsea pipe and seal the wellbore (linked to 1.6.4.1)
Control
Systems
Blue & Yellow
Control
External Leak /
955 2.2.2.1 Hydraulics - seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Rupture
Control
Systems
Blue & Yellow
Control
External Leak /
956 2.2.2.1 Hydraulics - Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Rupture
Control
Systems
Blue & Yellow
Control
Systems - External Leak - Loss of containment - Emergency Operation -
External Leak /
957 2.2.2.1 Hydraulics - Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 10 2 2 40
Rupture
Subsea 1.6.7.1)
Control
Systems
2650788-DFMECA-2-D2 C-83
Risk
Blue & Yellow
Control
Systems - Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
External Leak /
958 2.2.2.1 Hydraulics - LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Rupture
Control
Systems
Blue & Yellow
Control
Systems - Moves too slowly to disconnect - Failure to disconnect the LMRP -
External Leak /
959 2.2.2.1 Hydraulics - Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Rupture
Subsea 1.7.2.4)
Control
Systems
Blue & Yellow
Control
Systems - Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak /
960 2.2.2.1 Hydraulics - LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Rupture
Subsea Lower BOP stack (linked to 1.8.1.3)
Control
Systems
Blue & Yellow
Control
Systems - Moves too slowly to disconnect - Failure to disconnect the LMRP
External Leak /
961 2.2.2.1 Hydraulics - - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Rupture
Subsea BOP stack (linked to 1.8.1.4)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Supply Hydraulic Fluid & Pressure to C&K Valves -
External Leak /
962 2.2.2.1 Hydraulics - Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Rupture
Control
Systems
Blue & Yellow
Control
External Leak /
963 2.2.2.1 Hydraulics - Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Rupture
Control
Systems
2650788-DFMECA-2-D2 C-84
Risk
Blue & Yellow
Control
External Leak /
964 2.2.2.1 Hydraulics - Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Rupture
Control
Systems
Blue & Yellow
Control
Systems -
968 2.2.2.2 Hydraulics - Internal Leak 8 3 2 48
Subsea
Control
Systems
Blue & Yellow
Control
969 2.2.2.2 Hydraulics - Internal Leak seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
Blue & Yellow
Control
Systems -
Subsea
(linked to 1.1.4.2)
Control
Systems
Blue & Yellow
971 2.2.2.2 Hydraulics - Internal Leak blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control 1.2.1.2)
Systems
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
2650788-DFMECA-2-D2 C-85
Risk
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
Blue & Yellow
Control
974 2.2.2.2 Hydraulics - Internal Leak to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
Systems
Blue & Yellow
Control
975 2.2.2.2 Hydraulics - Internal Leak Failure to maintain stripping pressure - Strip the drill string using 9 2 2 36
Control
Systems
Blue & Yellow
Control
976 2.2.2.2 Hydraulics - Internal Leak Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Blue & Yellow
Control
977 2.2.2.2 Hydraulics - Internal Leak maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Control
Systems
Blue & Yellow
Control
978 2.2.2.2 Hydraulics - Internal Leak Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
2650788-DFMECA-2-D2 C-86
Risk
Blue & Yellow
Control
979 2.2.2.2 Hydraulics - Internal Leak operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Subsea 1.5.2.1)
Control
Systems
Blue & Yellow
Control
980 2.2.2.2 Hydraulics - Internal Leak wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Blue & Yellow
Control
981 2.2.2.2 Hydraulics - Internal Leak seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Control
Systems
Blue & Yellow
Control
982 2.2.2.2 Hydraulics - Internal Leak Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Control
Systems
Blue & Yellow
Control
983 2.2.2.2 Hydraulics - Internal Leak Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
Blue & Yellow
Control
984 2.2.2.2 Hydraulics - Internal Leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
2650788-DFMECA-2-D2 C-87
Risk
Blue & Yellow
Control
985 2.2.2.2 Hydraulics - Internal Leak Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
Systems
Blue & Yellow
Control
986 2.2.2.2 Hydraulics - Internal Leak wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Blue & Yellow
Control
987 2.2.2.2 Hydraulics - Internal Leak seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Blue & Yellow
Control
988 2.2.2.2 Hydraulics - Internal Leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Control
Systems
Blue & Yellow
Control
989 2.2.2.2 Hydraulics - Internal Leak LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
Systems
Blue & Yellow
Control
990 2.2.2.2 Hydraulics - Internal Leak LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
2650788-DFMECA-2-D2 C-88
Risk
Blue & Yellow
Control
991 2.2.2.2 Hydraulics - Internal Leak Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
Systems
Blue & Yellow
Control
992 2.2.2.2 Hydraulics - Internal Leak Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Blue & Yellow
Control
993 2.2.2.2 Hydraulics - Internal Leak Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
Blue & Yellow
Control
Systems -
998 2.2.2.3 Hydraulics - Plugged 8 3 2 48
Subsea
Control
Systems
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
Blue & Yellow
Control
1000 2.2.2.3 Hydraulics - Plugged seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
2650788-DFMECA-2-D2 C-89
Risk
Blue & Yellow
Control
Systems -
Subsea
(linked to 1.1.4.2)
Control
Systems
Blue & Yellow
Control
Systems - Actuates Too Slowly on Demand - Closes too slowly - Close and
1002 2.2.2.3 Hydraulics - Plugged seal on the drill pipe and allow circulation on demand (linked to 9 3 4 108
Subsea 1.1.7.1)
Control
Systems
Blue & Yellow
1003 2.2.2.3 Hydraulics - Plugged blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control 1.2.1.2)
Systems
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
Blue & Yellow
Control
1006 2.2.2.3 Hydraulics - Plugged to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
Systems
2650788-DFMECA-2-D2 C-90
Risk
Blue & Yellow
Control
1007 2.2.2.3 Hydraulics - Plugged Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Blue & Yellow
Control
1008 2.2.2.3 Hydraulics - Plugged maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Control
Systems
Blue & Yellow
Control
1009 2.2.2.3 Hydraulics - Plugged Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Blue & Yellow
Control
1010 2.2.2.3 Hydraulics - Plugged operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Subsea 1.5.2.1)
Control
Systems
Blue & Yellow
Control
1011 2.2.2.3 Hydraulics - Plugged wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Blue & Yellow
Control
1012 2.2.2.3 Hydraulics - Plugged seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Control
Systems
2650788-DFMECA-2-D2 C-91
Risk
Blue & Yellow
Control
1013 2.2.2.3 Hydraulics - Plugged Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Control
Systems
Blue & Yellow
Control
Systems - Actuates Too Slowly on Demand - Closes too slowly - Controlled
1014 2.2.2.3 Hydraulics - Plugged operation - Shear the drill pipe and seal the wellbore (linked to 8 3 2 48
Subsea 1.5.5.1)
Control
Systems
Blue & Yellow
Control
1015 2.2.2.3 Hydraulics - Plugged Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
Blue & Yellow
Control
1016 2.2.2.3 Hydraulics - Plugged Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Control
Systems
Blue & Yellow
Control
1017 2.2.2.3 Hydraulics - Plugged Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
Systems
Blue & Yellow
Control
1018 2.2.2.3 Hydraulics - Plugged wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
2650788-DFMECA-2-D2 C-92
Risk
Blue & Yellow
Control
1019 2.2.2.3 Hydraulics - Plugged seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Blue & Yellow
Control
1020 2.2.2.3 Hydraulics - Plugged Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Control
Systems
Blue & Yellow
Control
Systems - Actuates Too Slowly on Demand - Closes too slowly - Emergency
1021 2.2.2.3 Hydraulics - Plugged Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 3 4 108
Control
Systems
Blue & Yellow
Control
1022 2.2.2.3 Hydraulics - Plugged LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
Systems
Blue & Yellow
Control
Systems - Moves too slowly to disconnect - Failure to disconnect the LMRP -
1023 2.2.2.3 Hydraulics - Plugged Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 4 108
Subsea 1.7.2.4)
Control
Systems
Blue & Yellow
Control
1024 2.2.2.3 Hydraulics - Plugged LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
2650788-DFMECA-2-D2 C-93
Risk
Blue & Yellow
Control
Systems - Moves too slowly to disconnect - Failure to disconnect the LMRP
1025 2.2.2.3 Hydraulics - Plugged - Controlled Operation - Disconnect the LMRP from the Lower 9 3 4 108
Control
Systems
Blue & Yellow
Control
1026 2.2.2.3 Hydraulics - Plugged Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
Systems
Blue & Yellow
Control
1027 2.2.2.3 Hydraulics - Plugged Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Blue & Yellow
Control
1028 2.2.2.3 Hydraulics - Plugged Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
Blue & Yellow
Control
Systems -
1032 2.2.2.4 Hydraulics - Mechanical Failure 8 3 2 36
Subsea
Control
Systems
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
2650788-DFMECA-2-D2 C-94
Risk
Blue & Yellow
Control
Systems -
Subsea
(linked to 1.1.3.2)
Control
Systems
Blue & Yellow
Control
1035 2.2.2.4 Hydraulics - Mechanical Failure seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
Blue & Yellow
Control
Systems -
Subsea
(linked to 1.1.4.2)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Actuate Under Fail-safe Conditions - Failure to open /
1037 2.2.2.4 Hydraulics - Mechanical Failure close fail-safe valves - Close and seal on the drill pipe and allow 9 2 7 126
Subsea circulation on demand (linked to 1.1.6.1)
Control
Systems
Blue & Yellow
1038 2.2.2.4 Hydraulics - Mechanical Failure blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control 1.2.1.2)
Systems
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
2650788-DFMECA-2-D2 C-95
Risk
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
Blue & Yellow
Control
1041 2.2.2.4 Hydraulics - Mechanical Failure to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
Systems
Blue & Yellow
Control
1042 2.2.2.4 Hydraulics - Mechanical Failure Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Blue & Yellow
Control
1043 2.2.2.4 Hydraulics - Mechanical Failure maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Control
Systems
Blue & Yellow
Control
1044 2.2.2.4 Hydraulics - Mechanical Failure Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Blue & Yellow
Control
1045 2.2.2.4 Hydraulics - Mechanical Failure operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Subsea 1.5.2.1)
Control
Systems
2650788-DFMECA-2-D2 C-96
Risk
Blue & Yellow
Control
1046 2.2.2.4 Hydraulics - Mechanical Failure wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Blue & Yellow
Control
1047 2.2.2.4 Hydraulics - Mechanical Failure seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Control
Systems
Blue & Yellow
Control
1048 2.2.2.4 Hydraulics - Mechanical Failure Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Control
Systems
Blue & Yellow
Control
1049 2.2.2.4 Hydraulics - Mechanical Failure Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
Blue & Yellow
Control
1050 2.2.2.4 Hydraulics - Mechanical Failure Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
Blue & Yellow
Control
1051 2.2.2.4 Hydraulics - Mechanical Failure Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
Systems
2650788-DFMECA-2-D2 C-97
Risk
Blue & Yellow
Control
1052 2.2.2.4 Hydraulics - Mechanical Failure wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Blue & Yellow
Control
1053 2.2.2.4 Hydraulics - Mechanical Failure seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Blue & Yellow
Control
1054 2.2.2.4 Hydraulics - Mechanical Failure Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Control
Systems
Blue & Yellow
Control
1055 2.2.2.4 Hydraulics - Mechanical Failure LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
Systems
Blue & Yellow
Control
1056 2.2.2.4 Hydraulics - Mechanical Failure LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
Blue & Yellow
Control
1057 2.2.2.4 Hydraulics - Mechanical Failure Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
Systems
2650788-DFMECA-2-D2 C-98
Risk
Blue & Yellow
Control
1058 2.2.2.4 Hydraulics - Mechanical Failure Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Blue & Yellow
Control
1059 2.2.2.4 Hydraulics - Mechanical Failure Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
Blue & Yellow
Control
Systems -
1064 2.2.2.6 Hydraulics - Corrosion/ Erosion 8 3 2 48
Subsea
Control
Systems
Blue & Yellow
Control
1065 2.2.2.6 Hydraulics - Corrosion/ Erosion seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
Blue & Yellow
Control
Systems -
Subsea
(linked to 1.1.4.2)
Control
Systems
Blue & Yellow
Control
Systems - Failure to Actuate Under Fail-safe Conditions - Failure to open /
1067 2.2.2.6 Hydraulics - Corrosion/ Erosion close fail-safe valves - Close and seal on the drill pipe and allow 9 2 7 126
Control
Systems
2650788-DFMECA-2-D2 C-99
Risk
Blue & Yellow
1068 2.2.2.6 Hydraulics - Corrosion/ Erosion blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control 1.2.1.2)
Systems
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
Blue & Yellow
Control
Systems -
Subsea
Control
Systems
Blue & Yellow
Control
1071 2.2.2.6 Hydraulics - Corrosion/ Erosion to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
Systems
Blue & Yellow
Control
1072 2.2.2.6 Hydraulics - Corrosion/ Erosion Failure to maintain stripping pressure - Strip the drill string using 9 2 2 36
Control
Systems
Blue & Yellow
Control
1073 2.2.2.6 Hydraulics - Corrosion/ Erosion Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
2650788-DFMECA-2-D2 C-100
Risk
Blue & Yellow
Control
1074 2.2.2.6 Hydraulics - Corrosion/ Erosion maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Control
Systems
Blue & Yellow
Control
1075 2.2.2.6 Hydraulics - Corrosion/ Erosion Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Blue & Yellow
Control
1076 2.2.2.6 Hydraulics - Corrosion/ Erosion operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Subsea 1.5.2.1)
Control
Systems
Blue & Yellow
Control
1077 2.2.2.6 Hydraulics - Corrosion/ Erosion wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Blue & Yellow
Control
1078 2.2.2.6 Hydraulics - Corrosion/ Erosion seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Control
Systems
Blue & Yellow
Control
1079 2.2.2.6 Hydraulics - Corrosion/ Erosion Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Control
Systems
2650788-DFMECA-2-D2 C-101
Risk
Blue & Yellow
Control
1080 2.2.2.6 Hydraulics - Corrosion/ Erosion Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
Blue & Yellow
Control
1081 2.2.2.6 Hydraulics - Corrosion/ Erosion Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
Blue & Yellow
Control
1082 2.2.2.6 Hydraulics - Corrosion/ Erosion Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
Systems
Blue & Yellow
Control
1083 2.2.2.6 Hydraulics - Corrosion/ Erosion wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Blue & Yellow
Control
1084 2.2.2.6 Hydraulics - Corrosion/ Erosion seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Blue & Yellow
Control
1085 2.2.2.6 Hydraulics - Corrosion/ Erosion Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Control
Systems
2650788-DFMECA-2-D2 C-102
Risk
Blue & Yellow
Control
1086 2.2.2.6 Hydraulics - Corrosion/ Erosion LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
Systems
Blue & Yellow
Control
1087 2.2.2.6 Hydraulics - Corrosion/ Erosion LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
Blue & Yellow
Control
1088 2.2.2.6 Hydraulics - Corrosion/ Erosion Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
Systems
Blue & Yellow
Control
1089 2.2.2.6 Hydraulics - Corrosion/ Erosion Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Blue & Yellow
Control
1090 2.2.2.6 Hydraulics - Corrosion/ Erosion Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
Accumulators Failure to Supply Hydraulic Fluid & Pressure to Annular & C&K
- Subsea External Leak/ Valves When Demanded - Failure to close on drill pipe through
1096 2.2.3.1 8 3 2 36
Control Rupture annular(s) - Close and seal on the drill pipe and allow circulation
Systems on demand (linked to 1.1.1.2)
Accumulators Failure to Supply Hydraulic Fluid & Pressure to Pipe Ram or C&K
- Subsea External Leak/ Valves When Demanded - Failure to close on drill pipe through
1097 2.2.3.1 8 2 3 48
Control Rupture pipe rams - Close and seal on the drill pipe and allow circulation
Accumulators Failure to Maintain Adequate Sealing Pressure on Annular -
- Subsea External Leak/ Failure to seal or partial seal on drill pipe through annular(s) -
1098 2.2.3.1 9 2 3 54
Control Rupture Close and seal on the drill pipe and allow circulation on demand
2650788-DFMECA-2-D2 C-103
Risk
Accumulators
Failure of Pipe Ram to Seal on Demand - Failure to seal or partial
- Subsea External Leak/
1099 2.2.3.1 seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control Rupture
Systems
Accumulators Failure to Maintain Adequate Sealing Pressure on Pipe Ram -
- Subsea External Leak/ Failure to seal or partial seal on drill pipe through pipe rams -
1100 2.2.3.1 9 2 3 54
Control Rupture Close and seal on the drill pipe and allow circulation on demand
Accumulators
Actuates Too Slowly on Demand - Closes too slowly - Close and
1101 2.2.3.1 seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control Rupture
1.1.7.1)
Systems
Accumulators
Shear Ram or C&K Valves - Failure to close on open hole through
1102 2.2.3.1 blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control Rupture
allow volumetric well control operations on demand (linked to
Systems
1.2.1.2)
Accumulators Failure of Annular / Blind-Shear Ram to Seal on Demand - Failure
- Subsea External Leak/ to close on open hole through blind-shear rams or annular - Close
1103 2.2.3.1 9 1 2 18
Control Rupture and seal on open hole and allow volumetric well control
Systems operations on demand (linked to 1.2.1.4)
Accumulators Failure to Maintain Adequate Sealing Pressure on Annular / Blind-
- Subsea External Leak/ Shear Ram - Failure to close on open hole through blind-shear
1104 2.2.3.1 9 1 2 18
Control Rupture rams or annular - Close and seal on open hole and allow
Systems volumetric well control operations on demand (linked to 1.2.1.5)
Accumulators
Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure
1105 2.2.3.1 to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control Rupture
(linked to 1.3.1.2)
Systems
Accumulators
Failure to Maintain Hydraulic Fluid & Pressure to Annulars -
1106 2.2.3.1 Failure to maintain stripping pressure - Strip the drill string using 9 2 2 36
Control Rupture
the annular BOP(s) (linked to 1.3.2.1)
Systems
Accumulators
Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram -
1107 2.2.3.1 Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control Rupture
BOP and control the wellbore (linked to 1.4.1.2)
Systems
Accumulators
Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
1108 2.2.3.1 Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control Rupture
Systems
Accumulators
Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
1109 2.2.3.1 operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Control Rupture
1.5.2.1)
Systems
2650788-DFMECA-2-D2 C-104
Risk
Accumulators
Failure of Shear Ram to Seal On Demand - Failure to seal the
1110 2.2.3.1 wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control Rupture
Systems
Accumulators
1111 2.2.3.1 Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control Rupture
Systems
Accumulators
Failure to initiate autoshear sequence - Failure to close -
1112 2.2.3.1 Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control Rupture
the wellbore (linked to 1.6.2.2)
Systems
Accumulators
1113 2.2.3.1 Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Control Rupture
- Shear the drill pipe and seal the wellbore (linked to 1.6.3.1)
Systems
Accumulators
Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
Control Rupture
(linked to 1.6.3.2)
Systems
Accumulators
1115 2.2.3.1 wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control Rupture
pipe and seal the wellbore (linked to 1.6.4.1)
Systems
Accumulators
Failure to Maintain Sealing Pressure on Shear Ram - Failure to
1116 2.2.3.1 seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control Rupture
Systems
Accumulators
Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
1117 2.2.3.1 LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control Rupture
(linked to 1.7.2.3)
Systems
Accumulators
Moves too slowly to disconnect - Failure to disconnect the LMRP -
1118 2.2.3.1 Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control Rupture
1.7.2.4)
Systems
Accumulators
Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
1119 2.2.3.1 LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control Rupture
Lower BOP stack (linked to 1.8.1.3)
Systems
Accumulators
Moves too slowly to disconnect - Failure to disconnect the LMRP
1120 2.2.3.1 - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Control Rupture
BOP stack (linked to 1.8.1.4)
Systems
Accumulators
Failure to Supply Hydraulic Fluid & Pressure to C&K Valves -
1121 2.2.3.1 Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control Rupture
(linked to 1.9.1.2)
Systems
2650788-DFMECA-2-D2 C-105
Risk
Accumulators
1122 2.2.3.1 Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control Rupture
Systems
Accumulators
1123 2.2.3.1 Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control Rupture
Systems
- Subsea Valves When Demanded - Failure to close on drill pipe through
1125 2.2.3.2 Internal Leak 8 3 2 36
Control annular(s) - Close and seal on the drill pipe and allow circulation
1126 2.2.3.2 Internal Leak 8 2 3 48
Control pipe rams - Close and seal on the drill pipe and allow circulation
Accumulators
- Subsea
1127 2.2.3.2 Internal Leak seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
- Subsea Failure to seal or partial seal on drill pipe through pipe rams -
1128 2.2.3.2 Internal Leak 9 2 3 54
Accumulators
- Subsea
1129 2.2.3.2 Internal Leak seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control
1.1.7.1)
Systems
Accumulators
- Subsea
1130 2.2.3.2 Internal Leak blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control
Systems
1.2.1.2)
- Subsea to close on open hole through blind-shear rams or annular - Close
1131 2.2.3.2 Internal Leak 9 1 2 18
Control and seal on open hole and allow volumetric well control
- Subsea Shear Ram - Failure to close on open hole through blind-shear
1132 2.2.3.2 Internal Leak 9 1 2 18
Control rams or annular - Close and seal on open hole and allow
Accumulators
- Subsea
1133 2.2.3.2 Internal Leak to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
(linked to 1.3.1.2)
Systems
2650788-DFMECA-2-D2 C-106
Risk
Accumulators
- Subsea
1134 2.2.3.2 Internal Leak Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Accumulators
- Subsea
1135 2.2.3.2 Internal Leak Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Accumulators
- Subsea
1136 2.2.3.2 Internal Leak operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Control
1.5.2.1)
Systems
Accumulators
- Subsea
1137 2.2.3.2 Internal Leak wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Accumulators
- Subsea
1138 2.2.3.2 Internal Leak Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
Accumulators
- Subsea
1139 2.2.3.2 Internal Leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
Accumulators
- Subsea
1140 2.2.3.2 Internal Leak Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Control
Systems
Accumulators
- Subsea
1141 2.2.3.2 Internal Leak Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
(linked to 1.6.3.2)
Systems
Accumulators
- Subsea
1142 2.2.3.2 Internal Leak wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Accumulators
- Subsea
1143 2.2.3.2 Internal Leak seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Accumulators
- Subsea
1144 2.2.3.2 Internal Leak LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
(linked to 1.7.2.3)
Systems
Accumulators
- Subsea
1145 2.2.3.2 Internal Leak Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control
1.7.2.4)
Systems
2650788-DFMECA-2-D2 C-107
Risk
Accumulators
- Subsea
1146 2.2.3.2 Internal Leak LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
Accumulators
- Subsea
1147 2.2.3.2 Internal Leak - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Control
Systems
Accumulators
- Subsea
1148 2.2.3.2 Internal Leak Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
(linked to 1.9.1.2)
Systems
Accumulators
- Subsea
1149 2.2.3.2 Internal Leak Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Accumulators
- Subsea
1150 2.2.3.2 Internal Leak Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
1153 2.2.3.4 Mechanical Failure 8 3 2 36
Accumulators
- Subsea
1155 2.2.3.4 Mechanical Failure seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
Accumulators
- Subsea
1157 2.2.3.4 Mechanical Failure seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control
1.1.7.1)
Systems
Accumulators
- Subsea
1158 2.2.3.4 Mechanical Failure blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control
Systems
1.2.1.2)
2650788-DFMECA-2-D2 C-108
Risk
Accumulators
- Subsea
1161 2.2.3.4 Mechanical Failure to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
(linked to 1.3.1.2)
Systems
Accumulators
- Subsea
1162 2.2.3.4 Mechanical Failure Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Accumulators
- Subsea
1163 2.2.3.4 Mechanical Failure Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Accumulators
- Subsea
1164 2.2.3.4 Mechanical Failure operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Control
1.5.2.1)
Systems
Accumulators
- Subsea
1165 2.2.3.4 Mechanical Failure wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Accumulators
- Subsea
1166 2.2.3.4 Mechanical Failure Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
Accumulators
- Subsea
1167 2.2.3.4 Mechanical Failure Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Control
Systems
Accumulators
- Subsea
1168 2.2.3.4 Mechanical Failure Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
(linked to 1.6.3.2)
Systems
Accumulators
- Subsea
1169 2.2.3.4 Mechanical Failure wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
2650788-DFMECA-2-D2 C-109
Risk
Accumulators
- Subsea
1170 2.2.3.4 Mechanical Failure seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Accumulators
- Subsea
1171 2.2.3.4 Mechanical Failure LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
(linked to 1.7.2.3)
Systems
Accumulators
- Subsea
1172 2.2.3.4 Mechanical Failure Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control
1.7.2.4)
Systems
Accumulators
- Subsea
1173 2.2.3.4 Mechanical Failure LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
Accumulators
- Subsea
1174 2.2.3.4 Mechanical Failure - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Control
Systems
Accumulators
- Subsea
1175 2.2.3.4 Mechanical Failure Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
(linked to 1.9.1.2)
Systems
Accumulators
- Subsea
1176 2.2.3.4 Mechanical Failure Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Accumulators
- Subsea
1177 2.2.3.4 Mechanical Failure Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
1179 2.2.3.5 Wear 8 3 2 36
1180 2.2.3.5 Wear 8 2 3 48
Accumulators
- Subsea
1181 2.2.3.5 Wear seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
2650788-DFMECA-2-D2 C-110
Risk
1182 2.2.3.5 Wear 9 2 3 54
Accumulators
- Subsea
1183 2.2.3.5 Wear seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control
1.1.7.1)
Systems
Accumulators
- Subsea
1184 2.2.3.5 Wear blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control
Systems
1.2.1.2)
1185 2.2.3.5 Wear 9 1 2 18
1186 2.2.3.5 Wear 9 1 2 18
Accumulators
- Subsea
1187 2.2.3.5 Wear to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
(linked to 1.3.1.2)
Systems
Accumulators
- Subsea
1188 2.2.3.5 Wear Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Accumulators
- Subsea
1189 2.2.3.5 Wear Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Accumulators
- Subsea
1190 2.2.3.5 Wear operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Control
1.5.2.1)
Systems
Accumulators
- Subsea
1191 2.2.3.5 Wear wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Accumulators
- Subsea
1192 2.2.3.5 Wear Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
2650788-DFMECA-2-D2 C-111
Risk
Accumulators
- Subsea
1193 2.2.3.5 Wear Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
Accumulators
- Subsea
1194 2.2.3.5 Wear Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Control
Systems
Accumulators
- Subsea
1195 2.2.3.5 Wear Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
(linked to 1.6.3.2)
Systems
Accumulators
- Subsea
1196 2.2.3.5 Wear wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Accumulators
- Subsea
1197 2.2.3.5 Wear seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Accumulators
- Subsea
1198 2.2.3.5 Wear LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
(linked to 1.7.2.3)
Systems
Accumulators
- Subsea
1199 2.2.3.5 Wear Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control
1.7.2.4)
Systems
Accumulators
- Subsea
1200 2.2.3.5 Wear LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
Accumulators
- Subsea
1201 2.2.3.5 Wear - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Control
Systems
Accumulators
- Subsea
1202 2.2.3.5 Wear Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
(linked to 1.9.1.2)
Systems
Accumulators
- Subsea
1203 2.2.3.5 Wear Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Accumulators
- Subsea
1204 2.2.3.5 Wear Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
2650788-DFMECA-2-D2 C-112
Risk
- Subsea Loss of Function Valves When Demanded - Failure to close on drill pipe through
1209 2.2.3.7 8 3 2 36
Control (general) annular(s) - Close and seal on the drill pipe and allow circulation
- Subsea Loss of Function Valves When Demanded - Failure to close on drill pipe through
1210 2.2.3.7 8 2 3 48
Control (general) pipe rams - Close and seal on the drill pipe and allow circulation
Accumulators
1211 2.2.3.7 seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control (general)
Systems
- Subsea Loss of Function Failure to seal or partial seal on drill pipe through pipe rams -
1212 2.2.3.7 9 2 3 54
Accumulators
1213 2.2.3.7 seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Control (general)
1.1.7.1)
Systems
Accumulators
Control (general)
Systems
1.2.1.2)
- Subsea Loss of Function to close on open hole through blind-shear rams or annular - Close
1215 2.2.3.7 9 1 2 18
Control (general) and seal on open hole and allow volumetric well control
- Subsea Loss of Function Shear Ram - Failure to close on open hole through blind-shear
1216 2.2.3.7 9 1 2 18
Control (general) rams or annular - Close and seal on open hole and allow
Accumulators
Control (general)
(linked to 1.3.1.2)
Systems
Accumulators
Control (general)
Systems
Accumulators
Control (general)
Systems
2650788-DFMECA-2-D2 C-113
Risk
Accumulators
1220 2.2.3.7 operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Control (general)
1.5.2.1)
Systems
Accumulators
1221 2.2.3.7 wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control (general)
Systems
Accumulators
Control (general)
Systems
Accumulators
1223 2.2.3.7 Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control (general)
Systems
Accumulators
1224 2.2.3.7 Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Control (general)
Systems
Accumulators
Control (general)
(linked to 1.6.3.2)
Systems
Accumulators
1226 2.2.3.7 wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control (general)
Systems
Accumulators
1227 2.2.3.7 seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control (general)
Systems
Accumulators
Control (general)
(linked to 1.7.2.3)
Systems
Accumulators
1229 2.2.3.7 Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Control (general)
1.7.2.4)
Systems
Accumulators
Control (general)
Systems
Accumulators
1231 2.2.3.7 - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Control (general)
Systems
2650788-DFMECA-2-D2 C-114
Risk
Accumulators
Control (general)
(linked to 1.9.1.2)
Systems
Accumulators
Control (general)
Systems
Accumulators
Control (general)
Systems
EDS - Subsea Failure to provide control signal, when demanded - Failure to
1241 2.2.4.1 Control receive EDS signal prevents disconnecting from stack during 10 2 1 20
Power
Systems emergency operation when using the EDS (1.7) (linked to 1.7.1.1)
EDS - Subsea Failure to Provide Disconnect Signal (automatically) - Failure to
1242 2.2.4.1 Control disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Power
Systems from the stack (linked to 1.7.2.1)
EDS - Subsea
1243 2.2.4.1 Control 9 2 1 18
Systems
1.8.1.1)
EDS - Subsea Fails with no output Failure to provide control signal, when demanded - Failure to
1246 2.2.4.2 Control signal/ receive EDS signal prevents disconnecting from stack during 10 2 1 20
Systems communication emergency operation when using the EDS (1.7) (linked to 1.7.1.1)
EDS - Subsea Fails with no output Failure to Provide Disconnect Signal (automatically) - Failure to
1247 2.2.4.2 Control signal/ disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
Systems communication from the stack (linked to 1.7.2.1)
EDS - Subsea Fails with no output
1248 2.2.4.2 Control signal/ 9 2 1 18
Systems communication
1.8.1.1)
1253 2.2.4.3 Control Erratic output receive EDS signal prevents disconnecting from stack during 10 2 1 20
1254 2.2.4.3 Control Erratic output disconnect the LMRP - Emergency Operation: EDS - Disconnect 10 2 1 20
EDS - Subsea
1255 2.2.4.3 Control Erratic output 9 2 1 18
Systems
1.8.1.1)
2650788-DFMECA-2-D2 C-115
Risk
Fails to respond to
input
Fails to respond to
input
EDS - Subsea
Fails to respond to Failure to disconnect the LMRP - Controlled Operation -
1261 2.2.4.4 Control 9 2 1 18
input Disconnect the LMRP from the Lower BOP stack (linked to
Systems
1.8.1.1)
1265 2.2.4.5 Control Processing error receive EDS signal - Emergency Operation: EDS - Disconnect 10 2 1 20
1267 2.2.4.6 Control Ground Fault receive EDS signal - Emergency Operation: EDS - Disconnect 2 7 1 14
Loss of function
(general)
Loss of function
(general)
EDS - Subsea
1273 2.2.4.7 Control 9 2 1 18
Systems
1.8.1.1)
Hydraulic
Supply: Rigid
Conduit and
1279 2.2.5.1 Manifold - 8 3 2 36
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
1280 2.2.5.1 Manifold - 8 2 3 48
Subsea
Control
Systems
2650788-DFMECA-2-D2 C-116
Risk
Hydraulic
Supply: Rigid
Conduit and
External Leak/ Failure to seal or partial seal on drill pipe through annular(s) -
1281 2.2.5.1 Manifold - 9 2 3 54
Subsea
(linked to 1.1.3.2)
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure of Pipe Ram to Seal on Demand - Failure to seal or partial
External Leak/
1282 2.2.5.1 Manifold - seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
1283 2.2.5.1 Manifold - 9 2 3 54
Subsea
(linked to 1.1.4.2)
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Actuates Too Slowly on Demand - Closes too slowly - Close and
External Leak/
1284 2.2.5.1 Manifold - seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Rupture
Subsea 1.1.7.1)
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
1285 2.2.5.1 Manifold - 8 3 3 72
Subsea
Control
Systems
Hydraulic
Supply: Rigid Failure to Supply Hydraulic Fluid & Pressure to Annular / Blind-
Conduit and Shear Ram or C&K Valves - Failure to close on open hole through
External Leak/
1286 2.2.5.1 Manifold - blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Rupture
Control 1.2.1.2)
Systems
2650788-DFMECA-2-D2 C-117
Risk
Hydraulic
Supply: Rigid
Conduit and
1287 2.2.5.1 Manifold - 9 1 2 18
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
1288 2.2.5.1 Manifold - 9 1 2 18
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Supply Hydraulic Fluid & Pressure to Annulars - Failure
External Leak/
1289 2.2.5.1 Manifold - to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Maintain Hydraulic Fluid & Pressure to Annulars -
External Leak/
1290 2.2.5.1 Manifold - Failure to maintain stripping pressure - Strip the drill string using 8 2 2 32
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Supply Hydraulic Fluid & Pressure to Hang-off Ram -
External Leak/
1291 2.2.5.1 Manifold - Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
External Leak/
1292 2.2.5.1 Manifold - maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Rupture
Control
Systems
2650788-DFMECA-2-D2 C-118
Risk
Hydraulic
Supply: Rigid
Conduit and Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak/
1293 2.2.5.1 Manifold - Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
External Leak/
1294 2.2.5.1 Manifold - operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Rupture
Subsea 1.5.2.1)
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure of Shear Ram to Seal On Demand - Failure to seal the
External Leak/
1295 2.2.5.1 Manifold - wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Maintain Sealing Pressure on Shear Ram - Failure to
External Leak/
1296 2.2.5.1 Manifold - seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
External Leak/ External Leak - Loss of containment - Controlled operation -
1297 2.2.5.1 Manifold - 10 3 1 30
Subsea
Control
Systems
Hydraulic
Supply: Rigid
External Leak/
1298 2.2.5.1 Manifold - Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Rupture
Control
Systems
2650788-DFMECA-2-D2 C-119
Risk
Hydraulic
Supply: Rigid
Conduit and Failure to initiate autoshear sequence - Failure to close -
External Leak/
1299 2.2.5.1 Manifold - Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Rupture
Control
Systems
Hydraulic
Supply: Rigid
External Leak/
1300 2.2.5.1 Manifold - Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
External Leak/
1301 2.2.5.1 Manifold - Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Rupture
Control
Systems
Hydraulic
Supply: Rigid
External Leak/
1302 2.2.5.1 Manifold - wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Rupture
Control
Systems
Hydraulic
Supply: Rigid
External Leak/
1303 2.2.5.1 Manifold - seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and External Leak - Loss of containment - Emergency Operation -
External Leak/
1304 2.2.5.1 Manifold - Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 10 3 1 30
Rupture
Subsea 1.6.7.1)
Control
Systems
2650788-DFMECA-2-D2 C-120
Risk
Hydraulic
Supply: Rigid
Conduit and Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
External Leak/
1305 2.2.5.1 Manifold - LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Moves too slowly to disconnect - Failure to disconnect the LMRP -
External Leak/
1306 2.2.5.1 Manifold - Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Rupture
Subsea 1.7.2.4)
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak/
1307 2.2.5.1 Manifold - LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Moves too slowly to disconnect - Failure to disconnect the LMRP
External Leak/
1308 2.2.5.1 Manifold - - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Supply Hydraulic Fluid & Pressure to C&K Valves -
External Leak/
1309 2.2.5.1 Manifold - Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Rupture
Control
Systems
Hydraulic
Supply: Rigid
External Leak/
1310 2.2.5.1 Manifold - Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Rupture
Control
Systems
2650788-DFMECA-2-D2 C-121
Risk
Hydraulic
Supply: Rigid
Conduit and
1311 2.2.5.1 Manifold - 8 3 3 72
Subsea
Control
Systems
Hydraulic
Supply: Rigid
External Leak/
1312 2.2.5.1 Manifold - Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Rupture
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
1315 2.2.5.2 Manifold - Internal leak 8 3 2 48
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
1317 2.2.5.2 Manifold - Internal leak seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
(linked to 1.1.4.2)
Control
Systems
2650788-DFMECA-2-D2 C-122
Risk
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
1321 2.2.5.2 Manifold - Internal leak to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
Systems
Hydraulic
Supply: Rigid
1322 2.2.5.2 Manifold - Internal leak Failure to maintain stripping pressure - Strip the drill string using 9 2 2 36
Control
Systems
Hydraulic
Supply: Rigid
1323 2.2.5.2 Manifold - Internal leak Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
1324 2.2.5.2 Manifold - Internal leak maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
Control
Systems
2650788-DFMECA-2-D2 C-123
Risk
Hydraulic
Supply: Rigid
1325 2.2.5.2 Manifold - Internal leak Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Hydraulic
Supply: Rigid
1326 2.2.5.2 Manifold - Internal leak operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Subsea 1.5.2.1)
Control
Systems
Hydraulic
Supply: Rigid
1327 2.2.5.2 Manifold - Internal leak wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Hydraulic
Supply: Rigid
1328 2.2.5.2 Manifold - Internal leak seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Control
Systems
Hydraulic
Supply: Rigid
1329 2.2.5.2 Manifold - Internal leak Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
Hydraulic
Supply: Rigid
1330 2.2.5.2 Manifold - Internal leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
2650788-DFMECA-2-D2 C-124
Risk
Hydraulic
Supply: Rigid
1331 2.2.5.2 Manifold - Internal leak Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
Systems
Hydraulic
Supply: Rigid
1332 2.2.5.2 Manifold - Internal leak wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Hydraulic
Supply: Rigid
1333 2.2.5.2 Manifold - Internal leak seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Hydraulic
Supply: Rigid
1334 2.2.5.2 Manifold - Internal leak LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
Systems
Hydraulic
Supply: Rigid
1335 2.2.5.2 Manifold - Internal leak LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
Hydraulic
Supply: Rigid
1336 2.2.5.2 Manifold - Internal leak Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
Systems
2650788-DFMECA-2-D2 C-125
Risk
Hydraulic
Supply: Rigid
1337 2.2.5.2 Manifold - Internal leak Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Hydraulic
Supply: Rigid
1338 2.2.5.2 Manifold - Internal leak Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
1343 2.2.5.3 Manifold - Plugged 8 3 2 36
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
1345 2.2.5.3 Manifold - Plugged seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
(linked to 1.1.4.2)
Control
Systems
2650788-DFMECA-2-D2 C-126
Risk
Hydraulic
Supply: Rigid
Conduit and Actuates Too Slowly on Demand - Closes too slowly - Close and
1347 2.2.5.3 Manifold - Plugged seal on the drill pipe and allow circulation on demand (linked to 9 3 4 108
Subsea 1.1.7.1)
Control
Systems
Hydraulic
1348 2.2.5.3 Manifold - Plugged blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control 1.2.1.2)
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
1351 2.2.5.3 Manifold - Plugged to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
Systems
Hydraulic
Supply: Rigid
1352 2.2.5.3 Manifold - Plugged Failure to maintain stripping pressure - Strip the drill string using 8 2 2 32
Control
Systems
2650788-DFMECA-2-D2 C-127
Risk
Hydraulic
Supply: Rigid
1353 2.2.5.3 Manifold - Plugged Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Hydraulic
Supply: Rigid
1354 2.2.5.3 Manifold - Plugged Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Hydraulic
Supply: Rigid
1355 2.2.5.3 Manifold - Plugged operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Subsea 1.5.2.1)
Control
Systems
Hydraulic
Supply: Rigid
1356 2.2.5.3 Manifold - Plugged wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Actuates Too Slowly on Demand - Closes too slowly - Controlled
1357 2.2.5.3 Manifold - Plugged operation - Shear the drill pipe and seal the wellbore (linked to 8 3 2 48
Subsea 1.5.5.1)
Control
Systems
Hydraulic
Supply: Rigid
1358 2.2.5.3 Manifold - Plugged Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
2650788-DFMECA-2-D2 C-128
Risk
Hydraulic
Supply: Rigid
1359 2.2.5.3 Manifold - Plugged Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
Hydraulic
Supply: Rigid
1360 2.2.5.3 Manifold - Plugged Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Control
Systems
Hydraulic
Supply: Rigid
1361 2.2.5.3 Manifold - Plugged Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
Systems
Hydraulic
Supply: Rigid
1362 2.2.5.3 Manifold - Plugged wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Hydraulic
Supply: Rigid
1363 2.2.5.3 Manifold - Plugged seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Actuates Too Slowly on Demand - Closes too slowly - Emergency
1364 2.2.5.3 Manifold - Plugged Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 3 4 108
Control
Systems
2650788-DFMECA-2-D2 C-129
Risk
Hydraulic
Supply: Rigid
1365 2.2.5.3 Manifold - Plugged LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Moves too slowly to disconnect - Failure to disconnect the LMRP -
1366 2.2.5.3 Manifold - Plugged Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 4 108
Subsea 1.7.2.4)
Control
Systems
Hydraulic
Supply: Rigid
1367 2.2.5.3 Manifold - Plugged LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Moves too slowly to disconnect - Failure to disconnect the LMRP
1368 2.2.5.3 Manifold - Plugged - Controlled Operation - Disconnect the LMRP from the Lower 9 3 4 108
Control
Systems
Hydraulic
Supply: Rigid
1369 2.2.5.3 Manifold - Plugged Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
Systems
Hydraulic
Supply: Rigid
1370 2.2.5.3 Manifold - Plugged Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
2650788-DFMECA-2-D2 C-130
Risk
Hydraulic
Supply: Rigid
Conduit and
External Leak - Loss of containment - Circulate the well after drill
Subsea
Control
Systems
Hydraulic
Supply: Rigid
1372 2.2.5.3 Manifold - Plugged Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
1376 2.2.5.4 Manifold - Mechanical Failure 8 3 2 36
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
(linked to 1.1.3.2)
Control
Systems
Hydraulic
Supply: Rigid
1379 2.2.5.4 Manifold - Mechanical Failure seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
2650788-DFMECA-2-D2 C-131
Risk
Hydraulic
Supply: Rigid
Conduit and
Subsea
(linked to 1.1.4.2)
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Actuate Under Fail-safe Conditions - Failure to open /
1381 2.2.5.4 Manifold - Mechanical Failure close fail-safe valves - Close and seal on the drill pipe and allow 9 2 7 126
Control
Systems
Hydraulic
1382 2.2.5.4 Manifold - Mechanical Failure blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control 1.2.1.2)
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
1385 2.2.5.4 Manifold - Mechanical Failure to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
Systems
2650788-DFMECA-2-D2 C-132
Risk
Hydraulic
Supply: Rigid
1386 2.2.5.4 Manifold - Mechanical Failure Failure to maintain stripping pressure - Strip the drill string using 8 2 2 32
Control
Systems
Hydraulic
Supply: Rigid
1387 2.2.5.4 Manifold - Mechanical Failure Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Hydraulic
Supply: Rigid
1388 2.2.5.4 Manifold - Mechanical Failure Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Hydraulic
Supply: Rigid
1389 2.2.5.4 Manifold - Mechanical Failure operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Subsea 1.5.2.1)
Control
Systems
Hydraulic
Supply: Rigid
1390 2.2.5.4 Manifold - Mechanical Failure wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Hydraulic
Supply: Rigid
1391 2.2.5.4 Manifold - Mechanical Failure Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
2650788-DFMECA-2-D2 C-133
Risk
Hydraulic
Supply: Rigid
1392 2.2.5.4 Manifold - Mechanical Failure Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
Hydraulic
Supply: Rigid
1393 2.2.5.4 Manifold - Mechanical Failure wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Hydraulic
Supply: Rigid
1394 2.2.5.4 Manifold - Mechanical Failure seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Hydraulic
Supply: Rigid
1395 2.2.5.4 Manifold - Mechanical Failure LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
Systems
Hydraulic
Supply: Rigid
1396 2.2.5.4 Manifold - Mechanical Failure LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
Hydraulic
Supply: Rigid
1397 2.2.5.4 Manifold - Mechanical Failure Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
Systems
2650788-DFMECA-2-D2 C-134
Risk
Hydraulic
Supply: Rigid
1398 2.2.5.4 Manifold - Mechanical Failure Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Hydraulic
Supply: Rigid
1399 2.2.5.4 Manifold - Mechanical Failure Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
1404 2.2.5.6 Manifold - Corrosion/ Erosion 8 3 2 36
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
(linked to 1.1.3.2)
Control
Systems
Hydraulic
Supply: Rigid
1407 2.2.5.6 Manifold - Corrosion/ Erosion seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Control
Systems
2650788-DFMECA-2-D2 C-135
Risk
Hydraulic
Supply: Rigid
Conduit and
Subsea
(linked to 1.1.4.2)
Control
Systems
Hydraulic
Supply: Rigid
Conduit and Failure to Actuate Under Fail-safe Conditions - Failure to open /
1409 2.2.5.6 Manifold - Corrosion/ Erosion close fail-safe valves - Close and seal on the drill pipe and allow 9 2 7 126
Control
Systems
Hydraulic
1410 2.2.5.6 Manifold - Corrosion/ Erosion blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Control 1.2.1.2)
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
Conduit and
Subsea
Control
Systems
Hydraulic
Supply: Rigid
1413 2.2.5.6 Manifold - Corrosion/ Erosion to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
Control
Systems
2650788-DFMECA-2-D2 C-136
Risk
Hydraulic
Supply: Rigid
1414 2.2.5.6 Manifold - Corrosion/ Erosion Failure to maintain stripping pressure - Strip the drill string using 8 2 2 32
Control
Systems
Hydraulic
Supply: Rigid
1415 2.2.5.6 Manifold - Corrosion/ Erosion Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Control
Systems
Hydraulic
Supply: Rigid
1416 2.2.5.6 Manifold - Corrosion/ Erosion Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Control
Systems
Hydraulic
Supply: Rigid
1417 2.2.5.6 Manifold - Corrosion/ Erosion operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Subsea 1.5.2.1)
Control
Systems
Hydraulic
Supply: Rigid
1418 2.2.5.6 Manifold - Corrosion/ Erosion wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Control
Systems
Hydraulic
Supply: Rigid
1419 2.2.5.6 Manifold - Corrosion/ Erosion Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Control
Systems
2650788-DFMECA-2-D2 C-137
Risk
Hydraulic
Supply: Rigid
1420 2.2.5.6 Manifold - Corrosion/ Erosion Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 1 20
Control
Systems
Hydraulic
Supply: Rigid
1421 2.2.5.6 Manifold - Corrosion/ Erosion Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Control
Systems
Hydraulic
Supply: Rigid
1422 2.2.5.6 Manifold - Corrosion/ Erosion wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Control
Systems
Hydraulic
Supply: Rigid
1423 2.2.5.6 Manifold - Corrosion/ Erosion seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Control
Systems
Hydraulic
Supply: Rigid
1424 2.2.5.6 Manifold - Corrosion/ Erosion LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Control
Systems
Hydraulic
Supply: Rigid
1425 2.2.5.6 Manifold - Corrosion/ Erosion LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Control
Systems
2650788-DFMECA-2-D2 C-138
Risk
Hydraulic
Supply: Rigid
1426 2.2.5.6 Manifold - Corrosion/ Erosion Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Control
Systems
Hydraulic
Supply: Rigid
1427 2.2.5.6 Manifold - Corrosion/ Erosion Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Control
Systems
Hydraulic
Supply: Rigid
1428 2.2.5.6 Manifold - Corrosion/ Erosion Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Control
Systems
Failure to Close Annular / Blind-Shear Ram on Demand - Failure
Annulars - External Leak/ to close on open hole through blind-shear rams or annular - Close
1439 2.3.1.1 10 2 2 40
BOP Stack Rupture and seal on open hole and allow volumetric well control
Failure to Close Annulars on Drill String on Demand - Failure to
Annulars - External Leak/
1440 2.3.1.1 close annulars - Strip the drill string using the annular BOP(s) 8 2 2 32
BOP Stack Rupture
(linked to 1.3.1.3)
Annulars - External Leak/ Failure of Annulars to Seal on Demand - Failure to seal - Strip the
1441 2.3.1.1 8 2 2 32
BOP Stack Rupture drill string using the annular BOP(s) (linked to 1.3.3.1)
Annulars - External Leak/ Failure to Maintain Sealing Pressure on Annulars - Failure to seal
1442 2.3.1.1 9 2 2 36
BOP Stack Rupture - Strip the drill string using the annular BOP(s) (linked to 1.3.3.2)
Failure to Close Annular on Demand - Failure to close on drill pipe
1443 2.3.1.1 through annular(s) - Close and seal on the drill pipe and allow 10 2 2 40
BOP Stack Rupture
circulation on demand (linked to 1.1.1.3)
Annulars - External Leak/ Valves When Demanded - Failure to close on drill pipe through
1444 2.3.1.1 10 2 2 40
BOP Stack Rupture annular(s) - Close and seal on the drill pipe and allow circulation
Annulars - External Leak/ Valves When Demanded - Failure to close on drill pipe through
1445 2.3.1.1 10 2 2 40
BOP Stack Rupture pipe rams - Close and seal on the drill pipe and allow circulation
2650788-DFMECA-2-D2 C-139
Risk
Failure to Close Pipe Ram on Demand - Failure to close on drill
1446 2.3.1.1 pipe through pipe rams - Close and seal on the drill pipe and allow 10 2 2 40
BOP Stack Rupture
Annulars - External Leak/ External Leak - Loss of containment - Close and seal on the drill
1447 2.3.1.1 10 2 2 40
BOP Stack Rupture pipe and allow circulation on demand (linked to 1.1.8.1)
Annulars - External Leak/ to close on open hole through blind-shear rams or annular - Close
1448 2.3.1.1 9 2 2 36
BOP Stack Rupture and seal on open hole and allow volumetric well control
Annulars - External Leak/ Shear Ram - Failure to close on open hole through blind-shear
1449 2.3.1.1 9 2 2 36
BOP Stack Rupture rams or annular - Close and seal on open hole and allow
BOP Stack Rupture
(linked to 1.3.1.2)
BOP Stack Rupture
Failure to Close Hang-off Ram on Demand - Failure of hang-off
1452 2.3.1.1 ram to close - Hang-off the drill pipe on a ram BOP and control 10 2 2 40
BOP Stack Rupture
BOP Stack Rupture
Failure to Adequately Seal under Fail-safe Conditions - Failure to
1454 2.3.1.1 open / close fail-safe valves to seal - Circulate the well after drill 10 2 2 40
BOP Stack Rupture
Failure to Adequately Seal under Fail-safe Condition - Failure to
1455 2.3.1.1 open / close fail-safe valves to seal - Circulate across the BOP 9 2 2 40
BOP Stack Rupture
stack to remove trapped gas (linked to 1.10.3.2)
Annulars - External Leak/ External Leak - Loss of containment - Circulate across the BOP
1456 2.3.1.1 10 2 2 40
BOP Stack Rupture stack to remove trapped gas - (linked to 1.10.4.1)
Annulars - to close on open hole through blind-shear rams or annular - Close
1459 2.3.1.2 Internal Leak 10 2 2 40
BOP Stack and seal on open hole and allow volumetric well control
Annulars - Valves When Demanded - Failure to close on drill pipe through
1460 2.3.1.2 Internal Leak 8 2 1 16
BOP Stack annular(s) - Close and seal on the drill pipe and allow circulation
2650788-DFMECA-2-D2 C-140
Risk
1461 2.3.1.2 Internal Leak 8 2 1 16
BOP Stack pipe rams - Close and seal on the drill pipe and allow circulation
Annulars -
1462 2.3.1.2 Internal Leak pipe through pipe rams - Close and seal on the drill pipe and allow 9 2 1 18
BOP Stack
Annulars -
BOP Stack
1.2.1.2)
1464 2.3.1.2 Internal Leak 10 2 1 20
Annulars - Shear Ram - Failure to close on open hole through blind-shear
1465 2.3.1.2 Internal Leak 10 2 1 20
BOP Stack rams or annular - Close and seal on open hole and allow
Annulars -
BOP Stack
(linked to 1.3.1.2)
Annulars -
BOP Stack
Annulars -
1468 2.3.1.2 Internal Leak ram to close - Hang-off the drill pipe on a ram BOP and control 9 2 1 18
BOP Stack
Annulars -
BOP Stack
Annulars -
1470 2.3.1.2 Internal Leak open / close fail-safe valves to seal - Circulate the well after drill 10 2 1 20
BOP Stack
Annulars -
1471 2.3.1.2 Internal Leak open / close fail-safe valves to seal - Circulate across the BOP 10 2 1 20
BOP Stack
1472 2.3.1.3 Plugged 8 3 2 36
2650788-DFMECA-2-D2 C-141
Risk
1473 2.3.1.3 Plugged 8 2 3 48
Annulars -
1474 2.3.1.3 Plugged blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
BOP Stack
1.2.1.2)
Annulars -
1475 2.3.1.3 Plugged to close annulars - Strip the drill string using the annular BOP(s) 8 3 3 72
BOP Stack
(linked to 1.3.1.2)
Annulars -
1476 2.3.1.3 Plugged Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
BOP Stack
Annulars -
1477 2.3.1.3 Plugged Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
BOP Stack
Failure of Annular to Seal on Demand - Failure to seal or partial
Annulars -
1479 2.3.1.4 Mechanical Failure seal on drill pipe through annular(s) - Close and seal on the drill 9 2 2 36
BOP Stack
Annulars - Failure of Annulars to Seal on Demand - Failure to seal - Strip the
BOP Stack drill string using the annular BOP(s) (linked to 1.3.3.1)
Annulars - Failure to Maintain Sealing Pressure on Annulars - Failure to seal
BOP Stack - Strip the drill string using the annular BOP(s) (linked to 1.3.3.2)
Annulars - Failure to Maintain Sealing Pressure on Annulars - Failure to seal
1486 2.3.1.5 Wear 9 2 2 36
BOP Stack - Strip the drill string using the annular BOP(s) (linked to 1.3.3.2)
Failure of Annular to Seal on Demand - Failure to seal or partial
Annulars -
1487 2.3.1.5 Wear seal on drill pipe through annular(s) - Close and seal on the drill 9 2 1 36
BOP Stack
1488 2.3.1.5 Wear 9 2 1 36
2650788-DFMECA-2-D2 C-142
Risk
1489 2.3.1.5 Wear 9 2 1 36
Annulars - Failure of Annulars to Seal on Demand - Failure to seal - Strip the
1490 2.3.1.5 Wear 9 2 1 36
BOP Stack drill string using the annular BOP(s) (linked to 1.3.3.1)
Blind Shear
1499 2.3.2.1 Ram - BOP 9 5 3 135
Stack
Blind Shear Shear Ram or C&K Valves - Failure to close on open hole through
External Leak/
1500 2.3.2.1 Ram - BOP blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Rupture
Stack allow volumetric well control operations on demand (linked to
1.2.1.2)
Blind Shear
1501 2.3.2.1 Ram - BOP 10 2 2 40
Stack
Blind Shear
1502 2.3.2.1 Ram - BOP 10 2 2 40
Stack
Blind Shear
1503 2.3.2.1 Ram - BOP 9 1 2 18
Stack
Blind Shear Failure to Engage Lock on Hang-off Ram - Failure to maintain
External Leak/
1504 2.3.2.1 Ram - BOP locking - Hang-off the drill pipe on a ram BOP and control the 8 5 2 80
Rupture
Stack wellbore (linked to 1.4.3.1)
Blind Shear Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
External Leak/
1505 2.3.2.1 Ram - BOP operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Rupture
Stack 1.5.2.1)
Blind Shear Failure of Shear Ram to Seal On Demand - Failure to seal the
External Leak/
1506 2.3.2.1 Ram - BOP wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Rupture
Blind Shear Failure to Maintain Sealing Pressure on Shear Ram - Failure to
External Leak/
1507 2.3.2.1 Ram - BOP seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Rupture
Stack seal the wellbore (linked to 1.5.3.2)
Blind Shear Unintentional Opening - Unintentional closing / opening -
External Leak/
1508 2.3.2.1 Ram - BOP Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Rupture
2650788-DFMECA-2-D2 C-143
Risk
Blind Shear Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak/
1509 2.3.2.1 Ram - BOP Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Rupture
Stack drill pipe and seal the wellbore (linked to 1.6.2.1)
Blind Shear Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
External Leak/
1510 2.3.2.1 Ram - BOP Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Rupture
External Leak/
1511 2.3.2.1 Ram - BOP wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Rupture
Stack pipe and seal the wellbore (linked to 1.6.4.1)
External Leak/
1512 2.3.2.1 Ram - BOP seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Rupture
External Leak/
1513 2.3.2.1 Ram - BOP Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Rupture
Stack the wellbore (linked to 1.6.5.2)
Blind Shear Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
External Leak/
1514 2.3.2.1 Ram - BOP LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Rupture
Blind Shear Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak/
1515 2.3.2.1 Ram - BOP LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Rupture
Stack Lower BOP stack (linked to 1.8.1.3)
Blind Shear
1516 2.3.2.1 Ram - BOP 10 4 3 120
Stack
Blind Shear
1517 2.3.2.1 Ram - BOP 10 4 3 120
Stack
1521 2.3.2.2 Ram - BOP Internal Leak blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
1.2.1.2)
Blind Shear
1522 2.3.2.2 Ram - BOP Internal Leak 10 2 2 40
Stack
1523 2.3.2.2 Ram - BOP Internal Leak locking - Hang-off the drill pipe on a ram BOP and control the 8 5 2 80
1524 2.3.2.2 Ram - BOP Internal Leak operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Stack 1.5.2.1)
2650788-DFMECA-2-D2 C-144
Risk
1525 2.3.2.2 Ram - BOP Internal Leak wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
1526 2.3.2.2 Ram - BOP Internal Leak Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
1527 2.3.2.2 Ram - BOP Internal Leak Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
1528 2.3.2.2 Ram - BOP Internal Leak wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
1529 2.3.2.2 Ram - BOP Internal Leak seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
1530 2.3.2.2 Ram - BOP Internal Leak LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
1531 2.3.2.2 Ram - BOP Internal Leak LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Blind Shear
External Leak - Loss of containment - Close and seal on the drill
1534 2.3.2.4 Ram - BOP Mechanical Failure 9 5 3 135
Stack
1535 2.3.2.4 Ram - BOP Mechanical Failure blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
1.2.1.2)
Blind Shear
Stack
Blind Shear
Stack
Blind Shear
Stack
2650788-DFMECA-2-D2 C-145
Risk
1539 2.3.2.4 Ram - BOP Mechanical Failure locking - Hang-off the drill pipe on a ram BOP and control the 8 5 2 80
1540 2.3.2.4 Ram - BOP Mechanical Failure operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Stack 1.5.2.1)
1541 2.3.2.4 Ram - BOP Mechanical Failure wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
1542 2.3.2.4 Ram - BOP Mechanical Failure seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
1543 2.3.2.4 Ram - BOP Mechanical Failure Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
1544 2.3.2.4 Ram - BOP Mechanical Failure Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
1545 2.3.2.4 Ram - BOP Mechanical Failure wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
1546 2.3.2.4 Ram - BOP Mechanical Failure seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
1547 2.3.2.4 Ram - BOP Mechanical Failure Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Blind Shear
Stack
Blind Shear
1553 2.3.2.5 Ram - BOP Wear 9 5 3 135
Stack
1554 2.3.2.5 Ram - BOP Wear blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
1.2.1.2)
Blind Shear
1555 2.3.2.5 Ram - BOP Wear 10 2 2 40
Stack
2650788-DFMECA-2-D2 C-146
Risk
Blind Shear
1556 2.3.2.5 Ram - BOP Wear 10 2 2 40
Stack
Blind Shear
1557 2.3.2.5 Ram - BOP Wear 9 1 2 18
Stack
Blind Shear Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
1558 2.3.2.5 Ram - BOP Wear maintain closing pressure - Hang-off the drill pipe on a ram BOP 9 2 1 18
Stack and control the wellbore (linked to 1.4.2.1)
1559 2.3.2.5 Ram - BOP Wear locking - Hang-off the drill pipe on a ram BOP and control the 8 5 2 80
1560 2.3.2.5 Ram - BOP Wear operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Stack 1.5.2.1)
1561 2.3.2.5 Ram - BOP Wear wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
1562 2.3.2.5 Ram - BOP Wear seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
1563 2.3.2.5 Ram - BOP Wear Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
1564 2.3.2.5 Ram - BOP Wear Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
1565 2.3.2.5 Ram - BOP Wear wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
1566 2.3.2.5 Ram - BOP Wear seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
1567 2.3.2.5 Ram - BOP Wear Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
1568 2.3.2.5 Ram - BOP Wear LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
2650788-DFMECA-2-D2 C-147
Risk
1569 2.3.2.5 Ram - BOP Wear LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Blind Shear
1570 2.3.2.5 Ram - BOP Wear 10 4 3 120
Stack
Blind Shear
External Leak - Loss of containment - Circulate across the BOP
1571 2.3.2.5 Ram - BOP Wear 10 4 3 120
stack to remove trapped gas - (linked to 1.10.4.1)
Stack
1576 2.3.2.6 Ram - BOP Corrosion/ Erosion operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Stack 1.5.2.1)
1577 2.3.2.6 Ram - BOP Corrosion/ Erosion wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
1578 2.3.2.6 Ram - BOP Corrosion/ Erosion Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
1579 2.3.2.6 Ram - BOP Corrosion/ Erosion wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
1580 2.3.2.6 Ram - BOP Corrosion/ Erosion seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Casing Shear
1588 2.3.3.1 Ram - BOP 9 5 3 135
Stack
Casing Shear Failure to Shear Pipe - Failure to shear the drill pipe - Controlled
External Leak/
1589 2.3.3.1 Ram - BOP operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Rupture
Stack 1.5.2.1)
Casing Shear Failure of Shear Ram to Seal On Demand - Failure to seal the
External Leak/
1590 2.3.3.1 Ram - BOP wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
Rupture
Casing Shear Failure to Maintain Sealing Pressure on Shear Ram - Failure to
External Leak/
1591 2.3.3.1 Ram - BOP seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
Rupture
Casing Shear Unintentional Opening - Unintentional closing / opening -
External Leak/
1592 2.3.3.1 Ram - BOP Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
Rupture
Casing Shear Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak/
1593 2.3.3.1 Ram - BOP Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Rupture
2650788-DFMECA-2-D2 C-148
Risk
Casing Shear Failure to Shear Pipe - Failure to shear the drill pipe - Emergency
External Leak/
1594 2.3.3.1 Ram - BOP Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
Rupture
External Leak/
1595 2.3.3.1 Ram - BOP wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Rupture
External Leak/
1596 2.3.3.1 Ram - BOP seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Rupture
External Leak/
1597 2.3.3.1 Ram - BOP Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Rupture
Casing Shear Failure of Hydraulic Fluid to disconnect - Failure to disconnect the
External Leak/
1598 2.3.3.1 Ram - BOP LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Rupture
Casing Shear Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak/
1599 2.3.3.1 Ram - BOP LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Rupture
Casing Shear
1600 2.3.3.1 Ram - BOP 10 4 3 120
Stack
Casing Shear
1601 2.3.3.1 Ram - BOP 10 4 3 120
Stack
1605 2.3.3.2 Ram - BOP Internal Leak operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Stack 1.5.2.1)
1606 2.3.3.2 Ram - BOP Internal Leak wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
1607 2.3.3.2 Ram - BOP Internal Leak Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
1608 2.3.3.2 Ram - BOP Internal Leak Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
1609 2.3.3.2 Ram - BOP Internal Leak wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
1610 2.3.3.2 Ram - BOP Internal Leak seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
2650788-DFMECA-2-D2 C-149
Risk
1611 2.3.3.2 Ram - BOP Internal Leak LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
1612 2.3.3.2 Ram - BOP Internal Leak LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Casing Shear
Stack
Casing Shear Failure to Engage Lock on Hang-off Ram - Failure to maintain
1617 2.3.3.4 Ram - BOP Mechanical Failure locking - Hang-off the drill pipe on a ram BOP and control the 8 5 2 80
1618 2.3.3.4 Ram - BOP Mechanical Failure operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Stack 1.5.2.1)
1619 2.3.3.4 Ram - BOP Mechanical Failure wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
1620 2.3.3.4 Ram - BOP Mechanical Failure seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
1621 2.3.3.4 Ram - BOP Mechanical Failure Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
1622 2.3.3.4 Ram - BOP Mechanical Failure Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
1623 2.3.3.4 Ram - BOP Mechanical Failure wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
1624 2.3.3.4 Ram - BOP Mechanical Failure seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
1625 2.3.3.4 Ram - BOP Mechanical Failure Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
Casing Shear
Stack
Casing Shear
Stack
2650788-DFMECA-2-D2 C-150
Risk
Casing Shear
1632 2.3.3.5 Ram - BOP Wear 9 5 3 135
Stack
Casing Shear Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
1633 2.3.3.5 Ram - BOP Wear maintain closing pressure - Hang-off the drill pipe on a ram BOP 9 2 1 18
Casing Shear Failure to Engage Lock on Hang-off Ram - Failure to maintain
1634 2.3.3.5 Ram - BOP Wear locking - Hang-off the drill pipe on a ram BOP and control the 8 5 2 80
1635 2.3.3.5 Ram - BOP Wear operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Stack 1.5.2.1)
1636 2.3.3.5 Ram - BOP Wear wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
1637 2.3.3.5 Ram - BOP Wear seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
1638 2.3.3.5 Ram - BOP Wear Controlled operation - Shear the drill pipe and seal the wellbore 6 1 4 24
1639 2.3.3.5 Ram - BOP Wear Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
1640 2.3.3.5 Ram - BOP Wear Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
1641 2.3.3.5 Ram - BOP Wear wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
1642 2.3.3.5 Ram - BOP Wear seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
1643 2.3.3.5 Ram - BOP Wear Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 2 2 40
1644 2.3.3.5 Ram - BOP Wear LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
1645 2.3.3.5 Ram - BOP Wear LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
2650788-DFMECA-2-D2 C-151
Risk
Casing Shear
1646 2.3.3.5 Ram - BOP Wear 10 4 3 120
Stack
Casing Shear
1647 2.3.3.5 Ram - BOP Wear 10 4 3 120
Stack
1652 2.3.3.6 Ram - BOP Corrosion/ Erosion operation - Shear the drill pipe and seal the wellbore (linked to 6 1 1 6
Stack 1.5.2.1)
1653 2.3.3.6 Ram - BOP Corrosion/ Erosion wellbore - Controlled operation - Shear the drill pipe and seal the 6 1 1 6
1654 2.3.3.6 Ram - BOP Corrosion/ Erosion Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 9 1 2 18
1655 2.3.3.6 Ram - BOP Corrosion/ Erosion wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
1656 2.3.3.6 Ram - BOP Corrosion/ Erosion seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
Pipe & Test Failure of Pipe Ram to Seal on Demand - Failure to seal or partial
External Leak/
1665 2.3.4.1 Rams - BOP seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Rupture
Stack pipe and allow circulation on demand (linked to 1.1.4.1)
Pipe & Test
1666 2.3.4.1 Rams - BOP 9 5 3 135
Stack
Pipe & Test
1667 2.3.4.1 Rams - BOP 9 3 3 54
Stack
1671 2.3.4.2 Rams - BOP Internal Leak seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Pipe & Test
1674 2.3.4.4 Rams - BOP Mechanical Failure 9 5 3 135
Stack
1679 2.3.4.5 Rams - BOP Wear seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Pipe & Test Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
1680 2.3.4.5 Rams - BOP Wear maintain closing pressure - Hang-off the drill pipe on a ram BOP 9 2 1 18
2650788-DFMECA-2-D2 C-152
Risk
1685 2.3.4.6 Rams - BOP Corrosion/ Erosion seal on drill pipe through pipe rams - Close and seal on the drill 9 3 2 54
Choke & Kill Failure to Supply Hydraulic Fluid & Pressure to Annular & C&K
Lines & External Leak/ Valves When Demanded - Failure to close on drill pipe through
1693 2.3.5.1 8 3 2 36
Valves - BOP Rupture annular(s) - Close and seal on the drill pipe and allow circulation
Stack on demand (linked to 1.1.1.2)
Choke & Kill Inability to Operate (an individual) C&K Valves as Needed -
Lines & External Leak/ Failure to close on drill pipe through annular(s) - Close and seal
1694 2.3.5.1 7 3 2 42
Valves - BOP Rupture on the drill pipe and allow circulation on demand (linked to
Stack 1.1.1.4)
Choke & Kill Failure to Supply Hydraulic Fluid & Pressure to Pipe Ram or C&K
Lines & External Leak/ Valves When Demanded - Failure to close on drill pipe through
1695 2.3.5.1 8 2 3 48
Valves - BOP Rupture pipe rams - Close and seal on the drill pipe and allow circulation
Choke & Kill
Lines & External Leak/
1696 2.3.5.1 pipe through pipe rams - Close and seal on the drill pipe and allow 9 1 6 63
Valves - BOP Rupture
Stack
Choke & Kill
Inability to Operate C&K Valves as Needed - Failure to close on
1697 2.3.5.1 drill pipe through pipe rams - Close and seal on the drill pipe and 7 3 2 42
Stack
Choke & Kill
Inability to Operate C&K Valves as needed - Failure to seal or
1698 2.3.5.1 partial seal on drill pipe through annular(s) - Close and seal on the 7 3 2 42
drill pipe and allow circulation on demand (linked to 1.1.3.3)
Stack
Choke & Kill
Inability to Operate C&K Valves as Needed - Failure to seal or
1699 2.3.5.1 partial seal on drill pipe through pipe rams - Close and seal on the 9 3 2 54
Stack
Choke & Kill
to 1.1.5.1)
Stack
Choke & Kill
Lines & External Leak/ External Leak - Loss of containment - Close and seal on the drill
1701 2.3.5.1 9 5 3 135
Valves - BOP Rupture pipe and allow circulation on demand (linked to 1.1.8.1)
Stack
Choke & Kill
Stack
1.2.1.2)
2650788-DFMECA-2-D2 C-153
Risk
Choke & Kill Failure to Close Annular / Blind-Shear Ram on Demand - Failure
Lines & External Leak/ to close on open hole through blind-shear rams or annular - Close
1703 2.3.5.1 10 2 2 40
Valves - BOP Rupture and seal on open hole and allow volumetric well control
Stack operations on demand (linked to 1.2.1.3)
Choke & Kill Inability to Operate C&K Valves as Needed - Failure to close on
Lines & External Leak/ open hole through blind-shear rams or annular - Close and seal
1704 2.3.5.1 9 2 2 36
Valves - BOP Rupture on open hole and allow volumetric well control operations on
Stack demand (linked to 1.2.1.6)
Choke & Kill
(linked to 1.3.1.2)
Stack
Choke & Kill
Stack
Choke & Kill
1707 2.3.5.1 ram to close - Hang-off the drill pipe on a ram BOP and control 5 1 6 30
Stack
Choke & Kill
Stack
Choke & Kill
Lines & External Leak/ External Leak - Loss of containment - Controlled operation -
1709 2.3.5.1 10 3 1 30
Valves - BOP Rupture Shear the drill pipe and seal the wellbore (linked to 1.5.6.1)
Stack
Choke & Kill
Stack
Choke & Kill
External Leak - Loss of containment - Emergency Operation -
1711 2.3.5.1 Auto-Shear - Shear the drill pipe and seal the wellbore (linked to 10 2 3 60
1.6.7.1)
Stack
Choke & Kill
(linked to 1.7.2.3)
Stack
Choke & Kill
Stack
2650788-DFMECA-2-D2 C-154
Risk
Choke & Kill
(linked to 1.9.1.2)
Stack
Choke & Kill
Lines & External Leak/ Inability to Operate C&K Valves as Needed - Failure to circulate -
1715 2.3.5.1 7 4 2 56
Valves - BOP Rupture Circulate the well after drill pipe disconnect (linked to 1.9.1.3)
Stack
Choke & Kill
Stack
Choke & Kill
Inability to Operate C&K Valves as Needed - Failure to seal
1717 2.3.5.1 wellbore - Circulate the well after drill pipe disconnect (linked to 7 4 2 56
1.9.4.3)
Stack
Choke & Kill
Lines & External Leak/ External Leak - Loss of containment - Circulate the well after drill
1718 2.3.5.1 10 4 3 120
Valves - BOP Rupture pipe disconnect (linked to 1.9.5.1)
Stack
Choke & Kill
Stack
Choke & Kill
Inability to Operate C&K Valves as Needed - Failure to circulate -
1720 2.3.5.1 Circulate across the BOP stack to remove trapped gas (linked to 10 4 2 80
1.10.1.3)
Stack
Choke & Kill
Lines & External Leak/ External Leak - Loss of containment - Circulate across the BOP
1721 2.3.5.1 10 3 3 90
Valves - BOP Rupture stack to remove trapped gas - (linked to 1.10.4.1)
Stack
Lines & Valves When Demanded - Failure to close on drill pipe through
1727 2.3.5.2 Internal Leak 8 3 2 36
Valves - BOP annular(s) - Close and seal on the drill pipe and allow circulation
Lines & Failure to close on drill pipe through annular(s) - Close and seal
1728 2.3.5.2 Internal Leak 7 3 2 42
Valves - BOP on the drill pipe and allow circulation on demand (linked to
Stack 1.1.1.4)
1729 2.3.5.2 Internal Leak 9 2 5 90
Valves - BOP pipe rams - Close and seal on the drill pipe and allow circulation
2650788-DFMECA-2-D2 C-155
Risk
Choke & Kill
Lines &
1730 2.3.5.2 Internal Leak drill pipe through pipe rams - Close and seal on the drill pipe and 7 3 2 42
Valves - BOP
Stack
Choke & Kill
Lines &
1731 2.3.5.2 Internal Leak partial seal on drill pipe through annular(s) - Close and seal on the 7 3 2 42
Valves - BOP
Stack
Choke & Kill
Lines &
1732 2.3.5.2 Internal Leak partial seal on drill pipe through pipe rams - Close and seal on the 9 3 2 54
Valves - BOP
Stack
Choke & Kill
Lines &
1733 2.3.5.2 Internal Leak and seal on the drill pipe and allow circulation on demand (linked 8 2 4 48
Valves - BOP
to 1.1.5.1)
Stack
Choke & Kill
Lines &
Valves - BOP
Stack
1.2.1.2)
Lines & open hole through blind-shear rams or annular - Close and seal
1735 2.3.5.2 Internal Leak 9 2 2 36
Valves - BOP on open hole and allow volumetric well control operations on
Choke & Kill
Lines &
Valves - BOP
(linked to 1.3.1.2)
Stack
Choke & Kill
Lines &
Valves - BOP
Stack
Choke & Kill
Lines &
Valves - BOP
Stack
Choke & Kill
Lines &
Valves - BOP
Stack
Choke & Kill
Lines &
Valves - BOP
(linked to 1.7.2.3)
Stack
2650788-DFMECA-2-D2 C-156
Risk
Choke & Kill
Lines &
Valves - BOP
Stack
Choke & Kill
Lines &
Valves - BOP
(linked to 1.9.1.2)
Stack
Choke & Kill
Lines & Inability to Operate C&K Valves as Needed - Failure to circulate -
1743 2.3.5.2 Internal Leak 7 4 2 56
Valves - BOP Circulate the well after drill pipe disconnect (linked to 1.9.1.3)
Stack
Choke & Kill
Lines &
1744 2.3.5.2 Internal Leak open / close fail-safe valves to seal - Circulate the well after drill 10 3 3 90
Valves - BOP
Stack
Choke & Kill
Lines &
Valves - BOP
Stack
Choke & Kill
Lines &
1746 2.3.5.2 Internal Leak wellbore - Circulate the well after drill pipe disconnect (linked to 7 4 2 56
Valves - BOP
1.9.4.3)
Stack
Choke & Kill
Lines &
Valves - BOP
Stack
Choke & Kill
Lines &
1748 2.3.5.2 Internal Leak Circulate across the BOP stack to remove trapped gas (linked to 10 4 2 80
Valves - BOP
1.10.1.3)
Stack
Choke & Kill
Lines &
1749 2.3.5.2 Internal Leak open / close fail-safe valves to seal - Circulate across the BOP 10 3 3 90
Valves - BOP
Stack
Choke & Kill
Lines & External Leak - Loss of containment - Circulate across the BOP
1750 2.3.5.2 Internal Leak 10 4 3 120
Valves - BOP stack to remove trapped gas - (linked to 1.10.4.1)
Stack
1753 2.3.5.3 Plugged 8 3 2 36
2650788-DFMECA-2-D2 C-157
Risk
1754 2.3.5.3 Plugged 8 2 3 48
Choke & Kill
Lines &
1755 2.3.5.3 Plugged and seal on the drill pipe and allow circulation on demand (linked 9 2 4 72
Valves - BOP
to 1.1.5.1)
Stack
Choke & Kill
Lines &
1756 2.3.5.3 Plugged seal on the drill pipe and allow circulation on demand (linked to 10 4 4 160
Valves - BOP
1.1.7.1)
Stack
Choke & Kill
Lines &
1757 2.3.5.3 Plugged blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Valves - BOP
Stack
1.2.1.2)
Choke & Kill
Lines &
1758 2.3.5.3 Plugged to close annulars - Strip the drill string using the annular BOP(s) 8 3 2 36
Valves - BOP
(linked to 1.3.1.2)
Stack
Choke & Kill
Lines &
1759 2.3.5.3 Plugged Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Valves - BOP
Stack
Choke & Kill
Lines &
1760 2.3.5.3 Plugged Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Valves - BOP
Stack
Choke & Kill
Actuates Too Slowly on Demand - Closes too slowly - Controlled
Lines &
1761 2.3.5.3 Plugged operation - Shear the drill pipe and seal the wellbore (linked to 8 3 2 48
Valves - BOP
1.5.5.1)
Stack
Choke & Kill
Lines &
1762 2.3.5.3 Plugged Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Valves - BOP
Stack
Choke & Kill
Lines &
1763 2.3.5.3 Plugged Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Valves - BOP
Stack
Choke & Kill
Actuates Too Slowly on Demand - Closes too slowly - Emergency
Lines &
1764 2.3.5.3 Plugged Operation - Auto-Shear - Shear the drill pipe and seal the wellbore 10 4 4 160
Valves - BOP
(linked to 1.6.6.1)
Stack
2650788-DFMECA-2-D2 C-158
Risk
Choke & Kill
Lines &
1765 2.3.5.3 Plugged LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Valves - BOP
(linked to 1.7.2.3)
Stack
Choke & Kill
Lines &
1766 2.3.5.3 Plugged Emergency Operation: EDS - Disconnect from the stack (linked to 10 4 4 160
Valves - BOP
1.7.2.4)
Stack
Choke & Kill
Lines &
1767 2.3.5.3 Plugged LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Valves - BOP
Stack
Choke & Kill
Lines &
1768 2.3.5.3 Plugged - Controlled Operation - Disconnect the LMRP from the Lower 10 4 4 160
Valves - BOP
Stack
Choke & Kill
Lines &
1769 2.3.5.3 Plugged Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Valves - BOP
(linked to 1.9.1.2)
Stack
Choke & Kill
Lines &
1770 2.3.5.3 Plugged Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Valves - BOP
Stack
Choke & Kill
Lines &
1771 2.3.5.3 Plugged Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Valves - BOP
Stack
Choke & Kill
Lines &
1776 2.3.5.4 Mechanical Failure and seal on the drill pipe and allow circulation on demand (linked 9 2 4 72
Valves - BOP
to 1.1.5.1)
Stack
Choke & Kill
Failure to Actuate Under Fail-safe Conditions - Failure to open /
Lines &
1777 2.3.5.4 Mechanical Failure close fail-safe valves - Close and seal on the drill pipe and allow 9 2 4 72
Valves - BOP
Stack
2650788-DFMECA-2-D2 C-159
Risk
Choke & Kill
Lines &
1778 2.3.5.4 Mechanical Failure seal on the drill pipe and allow circulation on demand (linked to 9 3 2 54
Valves - BOP
1.1.7.1)
Stack
Choke & Kill
Lines & External Leak - Loss of containment - Close and seal on the drill
Valves - BOP pipe and allow circulation on demand (linked to 1.1.8.1)
Stack
Choke & Kill
Lines &
1780 2.3.5.4 Mechanical Failure blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Valves - BOP
Stack
1.2.1.2)
Choke & Kill
Lines &
1781 2.3.5.4 Mechanical Failure to close annulars - Strip the drill string using the annular BOP(s) 8 3 2 36
Valves - BOP
(linked to 1.3.1.2)
Stack
Choke & Kill
Lines &
1782 2.3.5.4 Mechanical Failure Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Valves - BOP
Stack
Choke & Kill
Lines &
1783 2.3.5.4 Mechanical Failure Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Valves - BOP
Stack
Choke & Kill
Lines &
1784 2.3.5.4 Mechanical Failure Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Valves - BOP
Stack
Choke & Kill
Lines &
1785 2.3.5.4 Mechanical Failure Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Valves - BOP
Stack
Choke & Kill
Lines &
1786 2.3.5.4 Mechanical Failure LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Valves - BOP
(linked to 1.7.2.3)
Stack
Choke & Kill
Lines &
1787 2.3.5.4 Mechanical Failure Emergency Operation: EDS - Disconnect from the stack (linked to 9 3 2 54
Valves - BOP
1.7.2.4)
Stack
Choke & Kill
Lines &
1788 2.3.5.4 Mechanical Failure LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Valves - BOP
Stack
2650788-DFMECA-2-D2 C-160
Risk
Choke & Kill
Lines &
1789 2.3.5.4 Mechanical Failure - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Valves - BOP
Stack
Choke & Kill
Lines &
1790 2.3.5.4 Mechanical Failure Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Valves - BOP
(linked to 1.9.1.2)
Stack
Choke & Kill
Lines &
1791 2.3.5.4 Mechanical Failure Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Valves - BOP
Stack
Choke & Kill
Lines & External Leak - Loss of containment - Circulate the well after drill
Valves - BOP pipe disconnect (linked to 1.9.5.1)
Stack
Choke & Kill
Lines &
1793 2.3.5.4 Mechanical Failure Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Valves - BOP
Stack
Choke & Kill
Stack
1799 2.3.5.5 Wear 8 3 2 36
Lines & Failure to close on drill pipe through annular(s) - Close and seal
1800 2.3.5.5 Wear 7 3 2 42
Valves - BOP on the drill pipe and allow circulation on demand (linked to
Stack 1.1.1.4)
1801 2.3.5.5 Wear 8 2 3 48
Choke & Kill
Lines &
1802 2.3.5.5 Wear pipe through pipe rams - Close and seal on the drill pipe and allow 9 1 6 63
Valves - BOP
Stack
Choke & Kill
Lines &
1803 2.3.5.5 Wear drill pipe through pipe rams - Close and seal on the drill pipe and 7 3 2 42
Valves - BOP
Stack
2650788-DFMECA-2-D2 C-161
Risk
Choke & Kill
Lines &
1804 2.3.5.5 Wear partial seal on drill pipe through annular(s) - Close and seal on the 7 3 2 42
Valves - BOP
Stack
Choke & Kill
Lines &
1805 2.3.5.5 Wear partial seal on drill pipe through pipe rams - Close and seal on the 9 3 2 54
Valves - BOP
Stack
Choke & Kill
Lines &
1806 2.3.5.5 Wear and seal on the drill pipe and allow circulation on demand (linked 8 2 4 48
Valves - BOP
to 1.1.5.1)
Stack
Choke & Kill
Lines &
1807 2.3.5.5 Wear close fail-safe valves - Close and seal on the drill pipe and allow 9 2 4 72
Valves - BOP
Stack
Choke & Kill
Lines &
1808 2.3.5.5 Wear blind-shear rams or annular - Close and seal on open hole and 9 1 2 18
Valves - BOP
Stack
1.2.1.2)
Choke & Kill Failure to Close Annular / Blind-Shear Ram on Demand - Failure
Lines & to close on open hole through blind-shear rams or annular - Close
1809 2.3.5.5 Wear 10 2 2 40
Valves - BOP and seal on open hole and allow volumetric well control
Stack operations on demand (linked to 1.2.1.3)
Lines & open hole through blind-shear rams or annular - Close and seal
1810 2.3.5.5 Wear 9 2 2 36
Valves - BOP on open hole and allow volumetric well control operations on
Choke & Kill
Lines &
1811 2.3.5.5 Wear to close annulars - Strip the drill string using the annular BOP(s) 8 3 2 36
Valves - BOP
(linked to 1.3.1.2)
Stack
Choke & Kill
Lines &
1812 2.3.5.5 Wear Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Valves - BOP
Stack
Choke & Kill
Lines &
1813 2.3.5.5 Wear ram to close - Hang-off the drill pipe on a ram BOP and control 5 1 6 30
Valves - BOP
Stack
Choke & Kill
Lines &
1814 2.3.5.5 Wear Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Valves - BOP
Stack
2650788-DFMECA-2-D2 C-162
Risk
Choke & Kill
Lines &
1815 2.3.5.5 Wear Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Valves - BOP
Stack
Choke & Kill
Lines &
1816 2.3.5.5 Wear LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Valves - BOP
(linked to 1.7.2.3)
Stack
Choke & Kill
Lines &
1817 2.3.5.5 Wear LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Valves - BOP
Stack
Choke & Kill
Lines &
1818 2.3.5.5 Wear Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Valves - BOP
(linked to 1.9.1.2)
Stack
Choke & Kill
Lines & Inability to Operate C&K Valves as Needed - Failure to circulate -
1819 2.3.5.5 Wear 7 4 2 56
Valves - BOP Circulate the well after drill pipe disconnect (linked to 1.9.1.3)
Stack
Choke & Kill
Lines &
1820 2.3.5.5 Wear open / close fail-safe valves to seal - Circulate the well after drill 10 3 3 90
Valves - BOP
Stack
Choke & Kill
Lines &
1821 2.3.5.5 Wear Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Valves - BOP
Stack
Choke & Kill
Lines &
1822 2.3.5.5 Wear wellbore - Circulate the well after drill pipe disconnect (linked to 7 4 2 56
Valves - BOP
1.9.4.3)
Stack
Choke & Kill
Lines & External Leak - Loss of containment - Circulate the well after drill
1823 2.3.5.5 Wear 10 4 3 120
Valves - BOP pipe disconnect (linked to 1.9.5.1)
Stack
Choke & Kill
Lines &
1824 2.3.5.5 Wear Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Valves - BOP
Stack
Choke & Kill
Lines &
1825 2.3.5.5 Wear Circulate across the BOP stack to remove trapped gas (linked to 10 4 2 80
Valves - BOP
1.10.1.3)
Stack
Choke & Kill
Lines &
1826 2.3.5.5 Wear open / close fail-safe valves to seal - Circulate across the BOP 10 3 3 90
Valves - BOP
Stack
2650788-DFMECA-2-D2 C-163
Risk
Choke & Kill
1827 2.3.5.5 Wear 10 4 3 120
Stack
Choke & Kill
Lines &
1832 2.3.5.6 Corrosion/ Erosion and seal on the drill pipe and allow circulation on demand (linked 8 2 4 48
Valves - BOP
to 1.1.5.1)
Stack
Connectors - External Leak/ Valves When Demanded - Failure to close on drill pipe through
1840 2.3.6.1 8 3 2 36
BOP Stack Rupture annular(s) - Close and seal on the drill pipe and allow circulation
Connectors - External Leak/ Valves When Demanded - Failure to close on drill pipe through
1841 2.3.6.1 8 2 3 48
BOP Stack Rupture pipe rams - Close and seal on the drill pipe and allow circulation
Connectors - External Leak/
BOP Stack Rupture
1.2.1.2)
BOP Stack Rupture
(linked to 1.3.1.2)
BOP Stack Rupture
Failure to Maintain Closing Pressure on Hang-off Ram - Failure to
1845 2.3.6.1 maintain closing pressure - Hang-off the drill pipe on a ram BOP 8 1 2 16
BOP Stack Rupture
and control the wellbore (linked to 1.4.2.1)
BOP Stack Rupture
1847 2.3.6.1 seal the wellbore - Controlled operation - Shear the drill pipe and 6 1 2 12
BOP Stack Rupture
BOP Stack Rupture
Failure LMRP / BOP to Connect or Disengage - Failure to
BOP Stack Rupture
2650788-DFMECA-2-D2 C-164
Risk
BOP Stack Rupture
(linked to 1.7.2.3)
Failure of LMRP / BOP Connector to Disengage - Failure to
1851 2.3.6.1 disconnect the LMRP - Controlled Operation - Disconnect the 8 3 2 48
BOP Stack Rupture
LMRP from the Lower BOP stack (linked to 1.8.1.2)
BOP Stack Rupture
BOP Stack Rupture
(linked to 1.9.1.2)
BOP Stack Rupture
BOP Stack Rupture
Failure of Wellhead Connector to Properly Lock and Seal -
1856 2.3.6.1 Inadequate BOP Connection - Connect BOP and LMRP at 2 5 3 30
BOP Stack Rupture
Connectors - External Leak/ Failure of Connector Integrity - Inadequate BOP Connection -
1857 2.3.6.1 6 2 2 24
BOP Stack Rupture Connect BOP and LMRP at Landing (linked to 1.11.1.2)
Failure of LMRP Connector to Properly Lock and Seal (auxiliary
1858 2.3.6.1 connections) - Inadequate LMRP Connection - Connect BOP and 6 2 2 24
BOP Stack Rupture
LMRP at Landing (linked to 1.11.2.1)
Connectors - External Leak/ Failure of Connector Integrity - Inadequate LMRP Connection -
1859 2.3.6.1 6 2 2 24
BOP Stack Rupture Connect BOP and LMRP at Landing (linked to 1.11.2.2)
Connectors - Valves When Demanded - Failure to close on drill pipe through
1862 2.3.6.2 Internal Leak 8 3 2 36
Connectors - Valves When Demanded - Failure to close on drill pipe through
1863 2.3.6.2 Internal Leak 8 2 3 48
Connectors -
1864 2.3.6.2 Internal Leak pipe through pipe rams - Close and seal on the drill pipe and allow 9 1 6 63
BOP Stack
2650788-DFMECA-2-D2 C-165
Risk
Connectors -
BOP Stack
1.2.1.2)
Connectors - to close on open hole through blind-shear rams or annular - Close
1866 2.3.6.2 Internal Leak 10 2 2 40
Connectors -
BOP Stack
(linked to 1.3.1.2)
Connectors -
BOP Stack
Connectors -
1869 2.3.6.2 Internal Leak ram to close - Hang-off the drill pipe on a ram BOP and control 5 1 6 30
BOP Stack
Connectors -
BOP Stack
Connectors -
BOP Stack
Connectors -
1872 2.3.6.2 Internal Leak disconnect the LMRP - Emergency Operation: EDS - Disconnect 9 3 2 54
BOP Stack
Connectors -
BOP Stack
(linked to 1.7.2.3)
Connectors -
1874 2.3.6.2 Internal Leak disconnect the LMRP - Controlled Operation - Disconnect the 8 3 2 48
BOP Stack
Connectors -
BOP Stack
Connectors -
BOP Stack
(linked to 1.9.1.2)
Connectors -
BOP Stack
2650788-DFMECA-2-D2 C-166
Risk
Connectors -
BOP Stack
Connectors -
1882 2.3.6.4 Mechanical Failure close fail-safe valves - Close and seal on the drill pipe and allow 9 2 7 126
BOP Stack
Connectors -
1883 2.3.6.4 Mechanical Failure disconnect the LMRP - Emergency Operation: EDS - Disconnect 9 3 2 54
BOP Stack
Connectors -
1884 2.3.6.4 Mechanical Failure disconnect the LMRP - Controlled Operation - Disconnect the 8 3 2 48
BOP Stack
Connectors -
1885 2.3.6.4 Mechanical Failure Inadequate BOP Connection - Connect BOP and LMRP at 2 5 3 30
BOP Stack
Connectors - Failure of Connector Integrity - Inadequate BOP Connection -
BOP Stack Connect BOP and LMRP at Landing (linked to 1.11.1.2)
Connectors -
1887 2.3.6.4 Mechanical Failure connections) - Inadequate LMRP Connection - Connect BOP and 6 2 2 24
BOP Stack
Connectors - Failure of Connector Integrity - Inadequate LMRP Connection -
BOP Stack Connect BOP and LMRP at Landing (linked to 1.11.2.2)
Connectors -
1890 2.3.6.5 Wear disconnect the LMRP - Emergency Operation: EDS - Disconnect 9 3 2 54
BOP Stack
Connectors -
1891 2.3.6.5 Wear disconnect the LMRP - Controlled Operation - Disconnect the 8 3 2 48
BOP Stack
Connectors -
1894 2.3.6.6 Corrosion/ Erosion disconnect the LMRP - Emergency Operation: EDS - Disconnect 9 3 2 54
BOP Stack
Connectors -
1895 2.3.6.6 Corrosion/ Erosion disconnect the LMRP - Controlled Operation - Disconnect the 8 3 2 48
BOP Stack
Connectors - Loss of Function
BOP Stack (general)
1898 2.3.6.7 Inadequate BOP Connection - Connect BOP and LMRP at 2 5 3 30
BOP Stack (general)
2650788-DFMECA-2-D2 C-167
Risk
Connectors - Loss of Function Failure of Connector Integrity - Inadequate BOP Connection -
1899 2.3.6.7 6 2 2 24
BOP Stack (general) Connect BOP and LMRP at Landing (linked to 1.11.1.2)
1900 2.3.6.7 connections) - Inadequate LMRP Connection - Connect BOP and 6 2 2 24
BOP Stack (general)
Connectors - Loss of Function Failure of Connector Integrity - Inadequate LMRP Connection -
1901 2.3.6.7 6 2 2 24
BOP Stack (general) Connect BOP and LMRP at Landing (linked to 1.11.2.2)
Autoshear Unintentional Closing - Unintentional closing / opening -
External Leak/
1907 2.3.7.1 System - BOP Controlled operation - Shear the drill pipe and seal the wellbore 9 3 3 54
Rupture
Autoshear Failure to Supply Hydraulic Fluid & Pressure to Shear Ram -
External Leak/
1908 2.3.7.1 System - BOP Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Rupture
Autoshear Failure to initiate autoshear sequence - Failure to close -
External Leak/
1909 2.3.7.1 System - BOP Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 1 30
Rupture
External Leak/
1910 2.3.7.1 System - BOP Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Rupture
Stack - Shear the drill pipe and seal the wellbore (linked to 1.6.3.1)
Autoshear Failure of Hydraulic Fluid to Disconnect - Failure to disconnect the
External Leak/
1911 2.3.7.1 System - BOP LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Rupture
Autoshear Moves too slowly to disconnect - Failure to disconnect the LMRP
External Leak/
1912 2.3.7.1 System - BOP - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Rupture
Stack BOP stack (linked to 1.8.1.4)
1914 2.3.7.2 System - BOP Internal Leak Controlled operation - Shear the drill pipe and seal the wellbore 9 3 3 54
1915 2.3.7.2 System - BOP Internal Leak Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
1916 2.3.7.2 System - BOP Internal Leak Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 1 30
1917 2.3.7.2 System - BOP Internal Leak Failure to shear the drill pipe - Emergency Operation - Auto-Shear 9 3 2 54
Stack - Shear the drill pipe and seal the wellbore (linked to 1.6.3.1)
Autoshear Moves too slowly to disconnect - Failure to disconnect the LMRP
1918 2.3.7.2 System - BOP Internal Leak - Controlled Operation - Disconnect the LMRP from the Lower 9 3 2 54
Stack BOP stack (linked to 1.8.1.4)
2650788-DFMECA-2-D2 C-168
Risk
Autoshear Failure to Actuate Under Fail-safe Conditions - Failure to open /
1922 2.3.7.4 System - BOP Mechanical Failure close fail-safe valves - Close and seal on the drill pipe and allow 9 2 7 126
Stack circulation on demand (linked to 1.1.6.1)
1923 2.3.7.4 System - BOP Mechanical Failure Controlled operation - Shear the drill pipe and seal the wellbore 9 3 3 54
1924 2.3.7.4 System - BOP Mechanical Failure Emergency Operation - Auto-Shear - Shear the drill pipe and seal 10 3 1 30
Autoshear Failure of Shear Ram to Seal On Demand - Failure to seal the
1925 2.3.7.4 System - BOP Mechanical Failure wellbore - Emergency Operation - Auto-Shear - Shear the drill 10 2 6 120
Autoshear Failure to Maintain Sealing Pressure on Shear Ram - Failure to
1926 2.3.7.4 System - BOP Mechanical Failure seal the wellbore - Emergency Operation - Auto-Shear - Shear the 10 2 6 120
1930 2.3.7.6 System - BOP Corrosion/ Erosion Emergency Operation - Auto-Shear - Shear the drill pipe and seal 5 2 1 10
Loss of Function
1931 2.3.7.7 System - BOP Emergency Operation - Auto-Shear - Shear the drill pipe and seal 5 2 1 10
(general)
ROV Failure to Supply Hydraulic Fluid & Pressure to Annular & C&K
Intervention Valves When Demanded - Failure to close on drill pipe through
1937 2.3.8.3 Loss of Function 8 3 2 36
Interface - annular(s) - Close and seal on the drill pipe and allow circulation
BOP Stack on demand (linked to 1.1.1.2)
ROV Failure to Supply Hydraulic Fluid & Pressure to Pipe Ram or C&K
Intervention Valves When Demanded - Failure to close on drill pipe through
1938 2.3.8.3 Loss of Function 9 2 5 90
Interface - pipe rams - Close and seal on the drill pipe and allow circulation
BOP Stack on demand (linked to 1.1.2.2)
ROV
Intervention
1939 2.3.8.3 Loss of Function to close annulars - Strip the drill string using the annular BOP(s) 8 3 2 36
Interface -
(linked to 1.3.1.2)
BOP Stack
ROV
Intervention
1940 2.3.8.3 Loss of Function Failure of hang-off ram to close - Hang-off the drill pipe on a ram 8 1 4 32
Interface -
BOP Stack
ROV
Intervention
1941 2.3.8.3 Loss of Function Failure to close - Controlled operation - Shear the drill pipe and 6 1 4 24
Interface -
BOP Stack
2650788-DFMECA-2-D2 C-169
Risk
ROV
Intervention
1942 2.3.8.3 Loss of Function Failure to close - Emergency Operation - Auto-Shear - Shear the 9 1 4 36
Interface -
BOP Stack
ROV
Intervention
1943 2.3.8.3 Loss of Function LMRP - Emergency Operation: EDS - Disconnect from the stack 9 1 3 27
Interface -
(linked to 1.7.2.3)
BOP Stack
ROV
Intervention
1944 2.3.8.3 Loss of Function LMRP - Controlled Operation - Disconnect the LMRP from the 7 1 2 14
Interface -
BOP Stack
ROV
Intervention
1945 2.3.8.3 Loss of Function Failure to circulate - Circulate the well after drill pipe disconnect 6 1 2 12
Interface -
(linked to 1.9.1.2)
BOP Stack
ROV
Intervention
1946 2.3.8.3 Loss of Function Failure to seal wellbore - Circulate the well after drill pipe 6 1 2 12
Interface -
BOP Stack
ROV
Intervention
1947 mmix Loss of Function Failure to circulate - Circulate across the BOP stack to remove 10 1 2 20
Interface -
BOP Stack
2650788-DFMECA-2-D2 C-170

BOP Failure Mode Effect Analysis PDF

Caricato da

Informazioni sul documento

Descrizione originale:

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

BOP Failure Mode Effect Analysis PDF

Caricato da

Copyright:

Formati disponibili

BLOWOUT PREVENTER (BOP)

FAILURE MODE EFFECT CRITICALITY ANALYSIS (FMECA) – 2

2650788-DFMECA-2-D2 3 Final Report 6/27/2013

1. Surface Control System

 Choke & Kill Lines & Valves

Table S-1: Failure Modes with Highest RPN

ABS — American Bureau of Shipping

1.2 ANALYSIS SCOPE

1. Surface Control System

Table 1-2: IP FMECA Team Members

Table 1-3: ABS and ABS Consulting FMECA Team Members

2.1 ANALYSIS APPROACH

2.2.1 Functional Level (Top-Down) FMECA

2.2.2 Equipment Level (Bottom-Up) FMECA

Table 2-2: General Equipment Failure Modes

1. Postulating on specific equipment causes resulting in the failure mode and

2.2.3 Evaluation and Ranking of Equipment Failure Modes (Criticality/Risk Ranking)

 Frequency of Failure of the Major Equipment Failure Mode

RPN = Severity Rating X Occurrence Rating X Detection Rating

Table 2-3: Severity Ratings

Table 3-1a: Failure Modes with Highest RPN – Sorted by RPN

Table 3-2: Failure Modes with Severity ≥ 10

Table 3-4: Failure Modes with Detection ≥ 6

Table 3-6: Functional Failures with Highest Average RPN

 Choke & Kill Lines & Valves - BOP Stack

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

2 Unintentional Opening No scenarios resulting in unintentional opening

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

2 Failure to Adequately Seal No scenarios resulting in failure to adequately

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

2 Rupture Not credible causes resulting in rupture during

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

Item Failure Mode Causes Indications/Protections/Maintenance End Effects

2 Unintentional Opening No credible causes resulting in unintentional