Details of Failed Blowout Preventer (BOP) on Deepwater Horizon Rig
Source: http://www.nytimes.com/2010/05/11/science/11blowout.html

BOP specifics:

- a huge stack of equipment
- height 53 feet
- width 16 feet
- weight 325 tons
- controlled by elaborate circuits custom built from pipes, not wires,
- uses hydraulic fluid instead of electrons
- has sealed electronic and hydraulic components
- has multiple redundant and backups systems
- has five hydraulic rams
- sits on the seabed between the well and the pipe that carries oil to the surface, the riser

Excerpts from the article:

Hydraulic circuits can leak, seals can erode, and other problems can crop up when the devices are tested, as they are supposed to be regularly.

Investigators still do not know exactly why this B.O.P., which was tested 10 days before the accident, did not do its job.

The key to safely drilling for oil or gas is controlling the pressure in the well-hole. The primary method involves circulating special fluid, generically called “mud,” down through the drill pipe and back up the space between the pipe and a larger pipe called a casing.

The mud recipe can be altered to make it lighter or heavier as needed. As long as the hydrostatic pressure of the column of mud exceeds the pressure in the formation being drilled, the well remains under control.

But if the drill bit hits an area of higher pressure, there can be a surge of oil or gas into the mud — a “kick” in oil-speak. That is when operators on the drilling rig will activate the blowout preventer to block the upward flow of higher-pressure mud, which if not controlled can quickly be followed by oil and gas.

In the blowout preventer, one or more massive rams mounted perpendicular to the flow can be activated, sealing the space between the drill pipe and the bore of the preventer, covering the opening if there is no drill pipe or even shearing the pipe if necessary. Another device on the stack, a doughnutlike rubber ring called an annular preventer, can seal the space between the drill pipe and the bore but still allow the pipe.

However the flow is blocked, the mud can be diverted into a separate line with a valve called a choke. By closing this valve, the open loop of circulating mud becomes a closed one, and back pressure builds until it exceeds the pressure of the kick. Then heavier mud can be circulated and drilling can be resumed.

The principle of using brute-force rams to control a well was developed nearly a century ago. “The basic function hasn’t changed,” said Bob Sherrill, who built and repaired blowout preventers for 20 years and now runs Blackwater Subsea, a Houston company that supplies personnel for deepwater work. “What has changed are the materials — they’ve gotten a lot more sophisticated, a lot stronger.”

They have also been made more corrosion resistant, to counteract problems caused largely by hydrogen sulfide gas found in oil deposits. Still, Mr. Sherrill said, the harsh conditions mean that preventers must be rebuilt every seven years or so.

Preventers used on land are far easier to repair, and the rams can be locked in place manually or closed with wrenches if hydraulics fail. In water, below about 1,000 feet, they can be serviced only by robotic submersibles, and locking the rams in place requires a second hydraulic system.

There is also no way to close them by hand if the hydraulics fail. So the control systems on subsea B.O.P.s are far more elaborate and redundant, with two identical pods on each stack.

Those pods are huge — 20 feet tall in some cases — and filled with a hundred or more hydraulic valves, electrically operated solenoids and other devices. The works are enclosed to protect them from pressure and moisture, but exposed, the gleaming array of pipes and switches, fabricated from high-strength steel, looks like a techno version of an old telephone operator’s console.

Graeme Reynolds, manager of B.O.P. controls at Oceaneering International, a company that is best known for its robotic submersibles used in deepwater work, said pods had to be custom-built for each blowout preventer.

“We can’t go into the industrial hydraulics market and buy stuff that will satisfy us,” he said. “It won’t meet our thermal criteria, it won’t meet our pressures. So we have to make all that stuff ourselves.”

As a result they can be extremely expensive — as much as $18 million or more for the controls on a typical deepwater B.O.P.

In normal use, the controls are activated by an electrical line that accompanies a hydraulic line running from the drill rig. If a decision is made to close a ram, a signal activates solenoids that open valves, allowing water-based hydraulic fluid to flow into the proper cylinders on the stack. Special pressure tanks on the drill ship called accumulators, which contain hydraulic fluid and a charge of nitrogen, provide a burst of power to close the rams, usually in about 30 seconds.

But the control pods have backup systems, including accumulators on the stack itself that can provide enough hydraulic power to close rams if power is lost from the surface. A deadman device fires some of the switches if both electric and hydraulic power are lost. (A 2003 report for the Minerals Management Service, the federal agency that oversees offshore drilling, found that deadman devices often were not armed because of fear that they would activate prematurely, necessitating costly fixes. BP said the deadman switch did not activate in the April 20 blowout.)

As a final backup, B.O.P.s must be able to be activated by robotic submersibles. So the control units have special valves that can use hydraulic fluid provided by the submersible using a probe called a hot stab. BP officials said that since the accident they had been able to activate some of the rams to some degree using this method.

If the blowout preventer is damaged or contains an unsealable section of pipe, the best hope for stopping the leak, other than drilling a relief well, is to route heavy mud around the preventer stack and into the well. This would involve first reconfiguring the preventer, something that is difficult but not impossible, experts say.

Other than that, though, a damaged blowout preventer is really not repairable until it is brought to the surface.