A blowout preventer (BOP) (pronounced B-O-P)^[1] is a specialized valve or similar mechanical device, used to seal, control and monitor oil and gas wells to prevent blowouts, the uncontrolled release of crude oil or natural gas from a well. They are usually installed in stacks of other valves.

Blowout preventers were developed to cope with extreme erratic pressures and uncontrolled flow (formation kick) emanating from a well reservoir during drilling. Kicks can lead to a potentially catastrophic event known as a blowout. In addition to controlling the downhole (occurring in the drilled hole) pressure and the flow of oil and gas, blowout preventers are intended to prevent tubing (e.g. drill pipe and well casing), tools, and drilling fluid from being blown out of the wellbore (also known as bore hole, the hole leading to the reservoir) when a blowout threatens. Blowout preventers are critical to the safety of crew, rig (the equipment system used to drill a wellbore) and environment, and to the monitoring and maintenance of well integrity; thus blowout preventers are intended to provide fail-safety to the systems that include them.

The term BOP is used in oilfield vernacular to refer to blowout preventers. The abbreviated term preventer, usually prefaced by a type (e.g. ram preventer), is used to refer to a single blowout preventer unit. A blowout preventer may also simply be referred to by its type (e.g. ram). The terms blowout preventer, blowout preventer stack and blowout preventer system are commonly used interchangeably and in a general manner to describe an assembly of several stacked blowout preventers of varying type and function, as well as auxiliary components. A typical subsea deepwater blowout preventer system includes components such as electrical and hydraulic lines, control pods, hydraulic accumulators, test valve, kill and choke lines and valves, riser joint, hydraulic connectors, and a support frame.

Two categories of blowout preventer are most prevalent: ram and annular. BOP stacks frequently utilize both types, typically with at least one annular BOP stacked above several ram BOPs. Blowout preventers are used on land wells, offshore rigs, and subsea wells. Land and subsea BOPs are secured to the top of the wellbore, known as the wellhead. BOPs on offshore rigs are mounted below the rig deck. Subsea BOPs are connected to the offshore rig above by a drilling riser that provides a continuous pathway for the drill string and fluids emanating from the wellbore. In effect, a riser extends the wellbore to the rig. Blowout preventers do not always function correctly. An example of this is the Deepwater Horizon blowout, where the pipe line going through the BOP was slightly bent and the BOP failed to cut the pipe.

Use

Blowout preventers come in a variety of styles, sizes and pressure ratings. Several individual units serving various functions are combined to compose a blowout preventer stack. Multiple blowout preventers of the same type are frequently provided for redundancy, an important factor in the effectiveness of fail-safe devices.

The primary functions of a blowout preventer system are to:

• Confine well fluid to the wellbore;
• Provide means to add fluid to the wellbore;
• Allow controlled volumes of fluid to be withdrawn from the wellbore.

Additionally, and in performing those primary functions, blowout preventer systems are used to:

• Regulate and monitor wellbore pressure;
• Center and hang off the drill string in the wellbore;
• Shut in the well (e.g. seal the void, annulus, between drillpipe and casing);
• “Kill” the well (prevent the flow of formation fluid, influx, from the reservoir into the wellbore);
• Seal the wellhead (close off the wellbore);
• Sever the casing or drill pipe (in case of emergencies).

In drilling a typical high-pressure well, drill strings are routed through a blowout preventer stack toward the reservoir of oil and gas. As the well is drilled, drilling fluid, "mud", is fed through the drill string down to the drill bit, "blade", and returns up the wellbore in the ring-shaped void, annulus, between the outside of the drill pipe and the casing (piping that lines the wellbore). The column of drilling mud exerts downward hydrostatic pressure to counter opposing pressure from the formation being drilled, allowing drilling to proceed.

When a kick (influx of formation fluid) occurs, rig operators or automatic systems close the blowout preventer units, sealing the annulus to stop the flow of fluids out of the wellbore. Denser mud is then circulated into the wellbore down the drill string, up the annulus and out through the choke line at the base of the BOP stack through chokes (flow restrictors) until downhole pressure is overcome. Once “kill weight” mud extends from the bottom of the well to the top, the well has been “killed”. If the integrity of the well is intact drilling may be resumed. Alternatively, if circulation is not feasible it may be possible to kill the well by "bullheading", forcibly pumping in the heavier mud from the top through the kill line connection at the base of the stack. This is less desirable because of the higher surface pressures likely needed and the fact that much of the mud originally in the annulus must be forced into receptive formations in the open hole section beneath the deepest casing shoe.

If the blowout preventers and mud do not restrict the upward pressures of a kick, a blowout results, potentially shooting tubing, oil and gas up the wellbore, damaging the rig, and leaving well integrity in question.

Since BOPs are important for the safety of the crew and natural environment, as well as the drilling rig and the wellbore itself, authorities recommend, and regulations require, that BOPs be regularly inspected, tested and refurbished. Tests vary from daily test of functions on critical wells to monthly or less frequent testing on wells with low likelihood of control problems.^[2]

Exploitable reservoirs of oil and gas are increasingly rare and remote, leading to increased subsea deepwater well exploration and requiring BOPs to remain submerged for as long as a year in extreme conditions^{[citation needed]}. As a result, BOP assemblies have grown larger and heavier (e.g. a single ram-type BOP unit can weigh in excess of 30,000 pounds), while the space allotted for BOP stacks on existing offshore rigs has not grown commensurately. Thus a key focus in the technological development of BOPs over the last two decades has been limiting their footprint and weight while simultaneously increasing safe operating capacity.

Types

BOPs come in two basic types, ram and annular. Both are often used together in drilling rig BOP stacks, typically with at least one annular BOP capping a stack of several ram BOPs.

Ram blowout preventer

The ram BOP was invented by James Smither Abercrombie and Harry S. Cameron in 1922, and was brought to market in 1924 by Cameron Iron Works.^[3]

A ram-type BOP is similar in operation to a gate valve, but uses a pair of opposing steel plungers, rams. The rams extend toward the center of the wellbore to restrict flow or retract open in order to permit flow. The inner and top faces of the rams are fitted with packers (elastomeric seals) that press against each other, against the wellbore, and around tubing running through the wellbore. Outlets at the sides of the BOP housing (body) are used for connection to choke and kill lines or valves.

Rams, or ram blocks, are of four common types: pipe, blind, shear, and blind shear.

Pipe rams close around a drill pipe, restricting flow in the annulus (ring-shaped space between concentric objects) between the outside of the drill pipe and the wellbore, but do not obstruct flow within the drill pipe. Variable-bore pipe rams can accommodate tubing in a wider range of outside diameters than standard pipe rams, but typically with some loss of pressure capacity and longevity. A pipe ram should not be closed if there is no pipe in the hole.

Blind rams (also known as sealing rams), which have no openings for tubing, can close off the well when the well does not contain a drill string or other tubing, and seal it.

Shear rams are designed to shear the pipe in the well and seal the wellbore simultaneously. It has steel blades to shear the pipe and seals to seal the annulus after shearing the pipe.

Blind shear rams (also known as shear seal rams, or sealing shear rams) are intended to seal a wellbore, even when the bore is occupied by a drill string, by cutting through the drill string as the rams close off the well. The upper portion of the severed drill string is freed from the ram, while the lower portion may be crimped and the “fish tail” captured to hang the drill string off the BOP.

In addition to the standard ram functions, variable-bore pipe rams are frequently used as test rams in a modified blowout preventer device known as a stack test valve. Stack test valves are positioned at the bottom of a BOP stack and resist downward pressure (unlike BOPs, which resist upward pressures). By closing the test ram and a BOP ram around the drill string and pressurizing the annulus, the BOP is pressure-tested for proper function.

The original ram BOPs of the 1920s were simple and rugged manual devices with minimal parts. The BOP housing (body) had a vertical well bore and horizontal ram cavity (ram guide chamber). Opposing rams (plungers) in the ram cavity translated horizontally, actuated by threaded ram shafts (piston rods) in the manner of a screw jack. Torque from turning the ram shafts by wrench or hand wheel was converted to linear motion and the rams, coupled to the inner ends of the ram shafts, opened and closed the well bore. Such screw jack type operation provided enough mechanical advantage for rams to overcome downhole pressures and seal the wellbore annulus.

Hydraulic rams BOPs were in use by the 1940s. Hydraulically actuated blowout preventers had many potential advantages. The pressure could be equalized in the opposing hydraulic cylinders causing the rams to operate in unison. Relatively rapid actuation and remote control were facilitated, and hydraulic rams were well-suited to high pressure wells.

Because BOPs are depended on for safety and reliability, efforts to minimize the complexity of the devices are still employed to ensure longevity. As a result, despite the ever-increasing demands placed on them, state of the art ram BOPs are conceptually the same as the first effective models, and resemble those units in many ways.

Ram BOPs for use in deepwater applications universally employ hydraulic actuation. Threaded shafts are often still incorporated into hydraulic ram BOPs as lock rods that hold the ram in position after hydraulic actuation. By using a mechanical ram locking mechanism, constant hydraulic pressure need not be maintained. Lock rods may be coupled to ram shafts or not, depending on manufacturer. Other types of ram locks, such as wedge locks, are also used.

Typical ram actuator assemblies (operator systems) are secured to the BOP housing by removable bonnets. Unbolting the bonnets from the housing allows BOP maintenance and facilitates the substitution of rams. In that way, for example, a pipe ram BOP can be converted to a blind shear ram BOP.

Shear-type ram BOPs require the greatest closing force in order to cut through tubing occupying the wellbore. Boosters (auxiliary hydraulic actuators) are frequently mounted to the outer ends of a BOP's hydraulic actuators to provide additional shearing force for shear rams. If a situation arises whereby the shear rams are to be activated, it is best practice for the Driller to have the string spaced as to ensure the rams will shear the body of the drillpipe as opposed to having a tooljoint (much thicker metal) across the shear rams.

Ram BOPs are typically designed so that well pressure will help maintain the rams in their closed, sealing position. That is achieved by allowing fluid to pass through a channel in the ram and exert pressure at the ram's rear and toward the center of the wellbore. Providing a channel in the ram also limits the thrust required to overcome well bore pressure.

Single ram and double ram BOPs are commonly available. The names refer to the quantity of ram cavities (equivalent to the effective quantity of valves) contained in the unit. A double ram BOP is more compact and lighter than a stack of two single ram BOPs while providing the same functionality, and is thus desirable in many applications. Triple ram BOPs are also manufactured, but not as common.^{[citation needed]}

Technological development of ram BOPs has been directed towards deeper and higher pressure wells, greater reliability, reduced maintenance, facilitated replacement of components, facilitated ROV intervention, reduced hydraulic fluid consumption, and improved connectors, packers, seals, locks and rams. In addition, limiting BOP weight and footprint are significant concerns to account for the limitations of existing rigs.

The highest-capacity large-bore ram blowout preventer on the market, as of July 2010, was Cameron's EVO 20K BOP, with a hold-pressure rating of 20,000 psi, ram force in excess of 1,000,000 pounds, and a well–bore diameter of up to 18.75 inches.^{[citation needed]}

Annular blowout preventer

The annular blowout preventer was invented by Granville Sloan Knox in 1946; a U.S. patent for it was awarded in 1952.^{[4][better source needed]} Often around the rig it is called the "Hydril", after the name of the original manufacturer of such devices.

An annular-type blowout preventer can close around the drill string, casing or a non-cylindrical object, such as the kelly. Drill pipe including the larger-diameter tool joints (threaded connectors) can be "stripped" (i.e., moved vertically while pressure is contained below) through an annular preventer by careful control of the hydraulic closing pressure. Annular blowout preventers are also effective at maintaining a seal around the drillpipe even as it rotates during drilling. Regulations typically require that an annular preventer be able to completely close a wellbore, but annular preventers are generally not as effective as ram preventers in maintaining a seal on an open hole. Annular BOPs are typically located at the top of a BOP stack, with one or two annular preventers positioned above a series of several ram preventers.

An annular blowout preventer uses the principle of a wedge to shut in the wellbore. It has a donut-like rubber seal, known as an elastomeric packing unit, reinforced with steel ribs. The packing unit is situated in the BOP housing between the head and hydraulic piston. When the piston is actuated, its upward thrust forces the packing unit to constrict, like a sphincter, sealing the annulus or openhole. Annular preventers have only two moving parts, piston and packing unit, making them simple and easy to maintain relative to ram preventers.^{[citation needed]}

The original type of annular blowout preventer used a “wedge-faced” (conical-faced) piston. As the piston rises, vertical movement of the packing unit is restricted by the head and the sloped face of the piston squeezes the packing unit inward, toward the center of the wellbore.^{[citation needed]}

In 1972, Ado N. Vujasinovic was awarded a patent for a variation on the annular preventer known as a spherical blowout preventer, so-named because of its spherical-faced head.^{[5][better source needed]} As the piston rises the packing unit is thrust upward against the curved head, which constricts the packing unit inward. Both types of annular preventer are in common use.^{[original research?]}

Control methods

When wells are drilled on land or in very shallow water where the wellhead is above the water line, BOPs are activated by hydraulic pressure from a remote accumulator. Several control stations will be mounted around the rig. They also can be closed manually by turning large wheel-like handles.

In deeper offshore operations with the wellhead just above the mudline on the sea floor, there are five primary ways by which a BOP can be controlled. The possible means are:^{[citation needed]}

• Hydraulic Control Signal: sent from surface through a hydraulic umbilical;
• Electrical Control Signal: sent from the surface through a control cable;
• Acoustical Control Signal: sent from the surface based on a modulated/encoded pulse of sound transmitted by an underwater transducer;
• ROV Intervention: remotely operated vehicles (ROVs) mechanically control valves and provide hydraulic pressure to the stack (via “hot stab” panels);
• Deadman Switch / Auto Shear: fail-safe activation of selected BOPs during an emergency, and if the control, power and hydraulic lines have been severed.

Two control pods are provided on the BOP for redundancy. Electrical signal control of the pods is primary. Acoustical, ROV intervention and dead-man controls are secondary.

An emergency disconnect system/sequence (EDS) disconnects the rig from the well in case of an emergency. The EDS is also intended to automatically trigger the deadman switch, which closes the BOP, kill and choke valves. The EDS may be a subsystem of the BOP stack's control pods or separate.^{[citation needed]}

Pumps on the rig normally deliver pressure to the blowout preventer stack through hydraulic lines. Hydraulic accumulators are on the BOP stack enable closure of blowout preventers even if the BOP stack is disconnected from the rig. It is also possible to trigger the closing of BOPs automatically based on too high pressure or excessive flow.^{[citation needed]}

Individual wells along the U.S. coastline may also be required to have BOPs with backup acoustic control.^{[citation needed]} General requirements of other nations, including Brazil, were drawn to require this method.^{[citation needed]} BOPs featuring this method may cost as much as US$500,000 more than those that omit the feature.^{[citation needed]}

Deepwater Horizon blowout

During the Deepwater Horizon drilling rig explosion incident on April 20, 2010, the blowout preventer should have been activated automatically, cutting the drillstring and sealing the well to preclude a blowout and subsequent oil spill in the Gulf of Mexico, but it failed to fully engage. Underwater robots (ROVs) later were used to manually trigger the blind shear ram preventer, to no avail.

As of May 2010 it was unknown why the blowout preventer failed.^[6] Chief surveyor John David Forsyth of the American Bureau of Shipping testified in hearings before the Joint Investigation^[7] of the Minerals Management Service and the U.S. Coast Guard investigating the causes of the explosion that his agency last inspected the rig's blowout preventer in 2005.^[8] BP representatives suggested that the preventer could have suffered a hydraulic leak.^[9] Gamma-ray imaging of the preventer conducted on May 12 and May 13, 2010 showed that the preventer's internal valves were partially closed and were restricting the flow of oil. Whether the valves closed automatically during the explosion or were shut manually by remotely operated vehicle work is unknown.^[9] A statement released by Congressman Bart Stupak revealed that, among other issues, the emergency disconnect system (EDS) did not function as intended and may have malfunctioned due to the explosion on the Deepwater Horizon.^[10]

The permit for the Macondo Prospect by the Minerals Management Service in 2009 did not require redundant acoustic control means.^[11] Insofar as the BOPs could not be closed successfully by underwater manipulation (ROV Intervention), pending results of a complete investigation, it is uncertain whether this omission was a factor in the blowout.

Documents discussed during congressional hearings June 17, 2010, suggested that a battery in the device's control pod was flat and that the rig's owner, Transocean, may have "modified" Cameron's equipment for the Macondo site (including incorrectly routing hydraulic pressure to a stack test valve instead of a pipe ram BOP) which increased the risk of BOP failure, in spite of warnings from their contractor to that effect. Another hypothesis was that a junction in the drilling pipe may have been positioned in the BOP stack in such a way that its shear rams had an insurmountable thickness of material to cut through.^[12]

It was later discovered that a second piece of tubing got into the BOP stack at some point during the Macondo incident, potentially explaining the failure of the BOP shearing mechanism.^[13] As of July 2010 it was unknown whether the tubing might have been casing that shot up through the well or perhaps broken drill pipe that dropped into the well. The DNV final report indicated that the second tube was the segment of the drill string that was ejected after being cut by the blow out preventer shears.

On July 10, 2010, BP began operations to install a sealing cap, also known as a capping stack, atop the failed blowout preventer stack. Based on BP's video feeds of the operation the sealing cap assembly, called Top Hat 10, included a stack of three blind shear ram BOPs manufactured by Hydril (a GE Oil & Gas company), one of Cameron's chief competitors. By July 15 the 3 ram capping stack had sealed the Macondo well, if only temporarily, for the first time in 87 days.

The U.S. government wanted the failed blowout preventer to be replaced in case of any pressure change that occurs when the relief well intersected with the well.^[14] On September 3, 2010, at 1:20 p.m. CDT the 300 ton failed blowout preventer was removed from the well and began being slowly lifted to the surface.^[14] Later that day a replacement blowout preventer was placed on the well.^[15] On September 4 at 6:54 p.m. CDT the failed blowout preventer reached the surface of the water and at 9:16 p.m. CDT it was placed in a special container on board the vessel Helix Q4000.^[15] The failed blowout preventer was taken to a NASA facility in Louisiana for examination^[15] by Det Norske Veritas (DNV).

On March 20, 2011, DNV presented their report to the US Department of Energy.^[16] Their primary conclusion was that while the rams succeeded in partly shearing through the drill pipe they failed to seal the bore because the drill pipe had buckled out of the intended line of action of the rams (because the drill string was caught at a tool joint in the upper annular BOP valve), jamming the shears and leaving the drill string shear actuator unable to deliver enough force to complete its stroke and fold the cut pipe over and seal the well. They did not suggest any failure of actuation as would be caused by faulty batteries. The upper section of the blow out preventer failed to separate as designed due to numerous oil leaks compromising hydraulic actuator operation, and this had to be cut free during recovery.