Blowout Preventers
The last line of defense between a controlled well and a blowout. Here's exactly how a BOP stack works and what each component does.
What a BOP Does
A blowout preventer is a high-pressure valve system installed on top of the wellhead, capable of sealing the wellbore in seconds if formation fluids threaten to flow to surface uncontrolled. It's the physical hardware that makes the well control procedures possible — without a functioning BOP, there's no way to shut in a kick.
Sealing is only half the job, and the half people remember. A closed BOP holds the well while pressure is read at surface, and those two readings — shut-in drillpipe pressure and shut-in casing pressure — are what the kill sheet is built from. The choke and kill lines then let the crew circulate the influx out and pump heavier mud in without ever reopening the well. A BOP that seals but cannot circulate has only postponed the problem.
Every stack is several sealing elements mounted on top of each other, each for a different scenario — sealing around pipe, sealing an open hole, or cutting through pipe entirely when nothing else will work.
The Two Families of Preventer
Everything in a stack is either an annular or a ram. The difference is not just shape — it decides what each one can seal on, and it is why a stack carries both rather than several of the better one.
Annular preventers
An annular uses a doughnut of reinforced elastomer that is squeezed inward hydraulically until it packs off around whatever is in the hole. That single element will seal on drill pipe, on tool joints, on the kelly, on wireline, and — given enough closing pressure — on open hole with nothing through it at all.
That flexibility is why it sits at the top of the stack, and it comes at a price: annulars are rated lower than the rams beneath them, and the element is a wear part. They are also the only element you can strip through — moving pipe while the preventer stays closed — which is what makes them the first choice for a soft shut-in.
Ram preventers
Rams are opposing steel blocks driven together across the bore by hydraulic pistons. Each pair carries a rubber face cut for one job, and outside that job it is useless: a pipe ram sized for 5-inch pipe will not seal on 3½-inch. In exchange they hold more pressure than an annular and hold it far longer.
The Four Ram Types
Seal around one specific pipe diameter, holding the annulus while the string stays in the hole. The workhorse of a hard shut-in, and the reason a stack's ram sizes have to match the string actually being run.
Seal across a range of diameters rather than one, so a single cavity covers drill pipe and tubing without a ram change. Convenient and increasingly standard, but they wear faster than a fixed-bore ram doing the same duty.
Flat faces that close across an empty wellbore. They seal open hole and nothing else — close them with pipe in the way and they will neither cut it nor seal around it.
Cut the drill pipe and seal the open bore in one motion. The last resort, used when the string cannot be cleared from the stack in time. Shearing capability depends on what is across the rams — tool joints and heavy-wall pipe are far harder to cut than plain drill pipe body.
A fifth type appears on many subsea stacks and is worth separating out, because assuming otherwise is dangerous: casing shear rams cut heavy tubulars that a blind shear ram cannot, but they do not seal. They are installed to cut, with a blind shear ram above them to close the well afterwards.
How a Stack Is Arranged
Order is not arbitrary. Reading a surface stack from the wellhead up, the rams come first, with a drilling spool carrying the choke and kill outlets set between them, and the annular on top. Two principles drive that arrangement.
The annular goes highest because it is the most forgiving element and the least able to hold pressure — it is the one you reach for first and the one you least want holding the well alone. The choke and kill outlets go below at least one sealing element, because an outlet above everything that is closed is connected to nothing.
Subsea stacks follow the same logic with more of everything. The ram bodies sit on the wellhead connector at the seabed, and a lower marine riser package — carrying the annulars and the flex joint — lands on top of them, so the LMRP can be released and recovered while the rams stay latched to the well.
Choke and Kill Lines
Two lines run from outlets in the stack back to surface. The kill line pumps into the well; the choke line takes returns out through an adjustable choke that holds backpressure. Together they are what turns a shut-in well into a killed one.
On a subsea stack these are full-length lines running the water depth alongside the riser, and their friction is not a rounding error — circulating up a choke line thousands of feet long adds pressure the driller has to account for, which is why choke line friction loss is measured rather than assumed.
The Control System
A BOP is only as good as its ability to close when everything else has failed, which is a question about the control system rather than the stack.
Accumulators
Closing pressure comes from accumulator bottles — steel vessels precharged with nitrogen, then filled with hydraulic fluid against that gas cushion. The stored energy means the stack can be closed with the rig black and the pumps dead, which is exactly the condition you need it in. API STD 53 sets how much usable volume must be available, sized so the critical functions can be operated without recharging.
This is what the daily pressure readings below are checking. An accumulator that has bled down, or lost its nitrogen precharge, can look fine on a gauge and still not have the volume to close a ram.
Subsea control pods
A subsea stack cannot be piped directly to the rig floor, so control runs through two redundant pods — conventionally blue and yellow — mounted on the LMRP. Either pod can operate the whole stack. Older systems pilot hydraulically down the umbilical; modern deepwater stacks are multiplexed electro-hydraulic (MUX), sending an electrical signal that opens valves at the seabed, because a hydraulic pilot signal through several thousand feet of hose is slow.
Emergency systems
Subsea stacks carry backups that close the shear rams with no instruction from the rig at all. Deadman fires when hydraulic power, electrical power and communications are lost together — the stack concludes the rig is gone. Autoshear fires on an unplanned LMRP disconnect. The emergency disconnect sequence (EDS) is the deliberate version, shearing and releasing in a controlled order when a rig has to come off the well. An ROV intervention panel gives a remotely operated vehicle hot-stab ports to work functions directly, which is the last option available once everything else is unavailable.
Sealing Elements and How They Fail
Nearly every seal in a BOP is an elastomer, and elastomers have a service envelope. Heat, H2S, CO2 and aromatics in the mud all attack them, and the compound is chosen for the well: nitrile for general service, hydrogenated nitrile where temperature or sour exposure is higher, and specialist compounds beyond that.
Two failure modes matter on the floor. Annular elements wear from stripping and from repeated closures — the rubber extrudes and stops packing off cleanly. Ram packers and top seals take a set after long periods closed or long periods stored, and a ram that has not been cycled in months is not proven until it has been. This is the real argument for function testing on schedule rather than on convenience: the test is not paperwork, it is the only thing that tells you the rubber still moves.
Surface vs Subsea BOP Stacks
On land rigs and platforms, the BOP sits directly on the wellhead at surface. It is reachable, inspectable, and testable in hours.
On floating offshore rigs — semi-submersibles and drillships — the stack sits on the seabed, connected to the rig by a marine riser, potentially under thousands of feet of water. Everything gets harder: control signals travel further, choke line friction becomes significant, hydrostatic head from the riser column has to be accounted for in every pressure calculation, and any repair means pulling the stack. That last point is why subsea stacks carry so much redundancy. Retrieval is measured in days, so the equipment is built not to need it.
Pressure Ratings & Classes
BOP stacks are rated by working pressure class under API 16A: 2,000, 3,000, 5,000, 10,000, 15,000 and 20,000 psi are the recognised classes, with 5,000 through 15,000 covering most drilling. The class is chosen against the maximum anticipated surface pressure for the well, and the stack is only ever as strong as its lowest-rated component — an annular rated below the rams beneath it sets the ceiling for anything it is holding alone.
Testing Requirements
Two different tests answer two different questions. A function test cycles each element open and closed without pressure, proving it still moves. A pressure test seals it against a real test pressure, proving it still holds. Passing one says nothing about the other.
Intervals are set by the standard that governs the rig rather than by a single global rule. API STD 53 is the industry reference, having superseded API RP 53; for US outer continental shelf work, BSEE 30 CFR 250.737 is the binding version, and it is broadly a function test every 7 days and a pressure test every 14 days on a subsea stack. Onshore and non-US intervals differ, and every jurisdiction tightens the schedule after a well control event or any change to the equipment. A full sequence tests each ram and the annular individually before drilling resumes.
Frequently Asked Questions
What is a blowout preventer?
A blowout preventer is a stack of high-pressure sealing elements installed on the wellhead that can close the wellbore in seconds if formation fluid starts flowing to surface uncontrolled. It is the hardware that makes shutting in a kick possible: without a functioning BOP there is no way to hold pressure while the well is killed.
What does a blowout preventer actually do?
It seals the annulus — the space around the drill pipe — or the open hole, so that pressure can be contained and read at surface. Sealing is only the first step. Once shut in, the choke and kill lines let the crew circulate the influx out and pump heavier mud in while the well stays closed.
What are the types of blowout preventer?
Two families. Annular preventers use a rubber element that squeezes closed around almost any pipe size or on open hole. Ram preventers use opposing steel blocks and come in four kinds: pipe rams for one specific pipe diameter, variable bore rams for a range of sizes, blind rams for open hole, and shear rams that cut the pipe. A stack normally carries both families.
What is in a BOP stack?
From the top down, a typical stack runs annular preventer, then several ram preventers, with choke and kill outlets between them, landing on the wellhead connector. The annular is highest because it is the most forgiving and the lowest rated; the rams below it hold more pressure but each only seals on what it was cut for. Subsea stacks add a lower marine riser package on top.
How does a BOP control system work?
Hydraulic pressure stored in nitrogen-charged accumulator bottles closes the preventers, so the stack can be operated with the rig black. Surface stacks are piped directly to the accumulator unit. Subsea stacks are operated through two redundant control pods, conventionally blue and yellow, and carry emergency backups that close the shear rams without any signal from the rig.
How often is a BOP tested?
Function tests cycle each element open and closed without pressure; pressure tests seal it against a real test pressure. Under API STD 53 and, for US outer continental shelf work, BSEE 30 CFR 250.737, that is broadly a function test every 7 days and a pressure test every 14 days for subsea stacks. Intervals differ by jurisdiction and tighten after any well control event or equipment change, so work to the standard that governs your rig.