Liptak on the Gulf of Mexico Oil Spill

Got the following short email from our columnist and process control guru, Bela Liptak this morning. If you read our pages regularly, you know that Bela has some pretty definite opinions on the way things ought to be in process manufacturing. Here is the drawing he sent of how the Deepwater Horizon oil rig should have been designed.

Here's his email: "I got a letter asking if process control could have prevented the oil spill. The answer is a definite yes. I would never allow ANY critical shut off valve to be installed without a remote trigger. Same with the dead man switch. The same with mine operation without methane monitored escape alarm, etc, etc."


Show Comments
Hide Comments

Join the discussion

We welcome your thoughtful comments.
All comments will display your user name.

Want to participate in the discussion?

Register for free

Log in for complete access.


  • <p> I would like to know why BOPs are not designed and certified to IEC 61508 (SIL 3 or better)?  There are none listed in the [[<a href="">|Safety</a> Automation Equipment List]] nor was able to find any by Google searching.  IEC 61508 has been the international standard for functional safety since 1998.  Numerous process automation valves and actuators (including hydraulic actuators) have been certified yet these super critical valves that are the last defense to prevent a catastrophe like the Deepwater Horizon don't seem to have any functional safety certification.    </p> <p> The literature I've seen lists the following certifications: API RP 500B, API RP 14F, NEC Article 500, NFPA 476, UL, CSA, FM, NEMA, CENELEC, BASEEFA, British Standards </p> <p> This excellent [[<a href="">|paper]]</a> discusses application of IEC 61508 and IEC 61511 in the Norwegian Petroleum Industry.  Section A14.2 discusses BOP's.  </p> <p> Finally, look at this [[<a href="">|picture]]</a> .  I don't understand the controls but it appears to me this valve was configured to be Normally Open (NO), doesn't it?  To be failsafe, shouldn't it have been designed to be Normally Closed and held open by a signal from the platform?  Clearly this thing wasn't designed to be failsafe.  According to this quote by BP, even the E-Stop didn't work. </p> <p> "We don't know why it didn't work," says BP spokesman William Salvin. "We know automatic systems did not close it, we know workers hit the manual switch before evacuating the rig, and we have been trying since hours after the incident to activate the blowout preventer [using remotely operated vehicles] and that has not been successful."  </p> <p> Unfortunately, if no one is specifying SIL rated BOP's then no one is going to get them.   </p>


RSS feed for comments on this page | RSS feed for all comments