Offshore Drilling and Wells: The MODU Perspective

A drilling rig sitting over a well in 1,500 metres of water is two machines fighting each other. One is a ship, or a barge, or a steel island, that has to stay afloat, stay upright, and stay over a point on the seabed the size of a dinner plate while the sea tries to move it. The other is a pressure vessel, a steel tube running from the deck to the rock, holding back a formation that may be charged to 15,000 pounds per square inch and would very much like to come up the hole. The marine job and the well job are run by different people on different watches, but they share one hull, and when one of them goes wrong the other usually finds out fast. This article is the hub for the offshore drilling and well cluster. It takes the subject from the marine and naval-architecture side: what the units are, how they hold station, how the drilling and circulation system works, how the well is kept under control, and what happened on the Deepwater Horizon when control was lost. The cluster’s calculators run the arithmetic behind each of those topics, from the drilling mud formation-pressure balance that sets primary control to the BOP shear-ram activation check that sizes the last barrier.

The unit and the well are governed by separate rulebooks that meet at the deck. The marine side answers to the IMO Code for the Construction and Equipment of Mobile Offshore Drilling Units, the MODU Code, adopted in its current form by Assembly resolution A.1023(26) on 2 December 2009 and applied to units built on or after 1 January 2012. The well side answers to the petroleum regulator of the state whose waters the unit sits in: in the US Gulf of Mexico that is the Bureau of Safety and Environmental Enforcement (BSEE) under 30 CFR Part 250, and the engineering standard the regulator points to for the blowout preventer is API Standard 53. A drilling contractor’s crew is certified to a well-control standard accredited by the International Association of Drilling Contractors (IADC) or by IWCF. The cluster splits along the same seam: the marine articles and calculators sit beside the well-control ones, and a master or a barge engineer needs both.

Mobile offshore drilling units: the three families

A mobile offshore drilling unit is defined in the MODU Code as a vessel capable of engaging in drilling operations for the exploration for or exploitation of resources beneath the seabed. The word that matters is mobile. Unlike a fixed platform welded to a jacket on the seabed, a MODU moves from well to well, which is why it is a vessel under the Code and carries a flag, a class, and a crew that stands navigational and engineering watches. Three families cover almost every drilling unit afloat, and they divide cleanly by how they sit relative to the water.

The jack-up is a self-elevating unit. It floats to location with its legs up, then lowers three or four legs to the seabed, preloads them to prove the soil will hold, and jacks the hull up out of the waves on those legs. Once elevated it is, for the duration of the job, a fixed platform: the sea passes under the hull and the drilling takes place from a stationary deck. That is the jack-up’s great advantage, no wave-induced motion at the rotary table, and its limit, because the legs can only be so long. Practical jack-up drilling runs to roughly 120 metres of water, with the largest harsh-environment units reaching a little beyond. The jack-up dominates the shallow-water market by unit count for that reason: where the water is shallow enough, a fixed deck beats a floating one every time.

The other two families float while they drill, and they handle the motion rather than escape it. The semi-submersible is a column-stabilized unit: its working deck is carried on large vertical columns that rise out of two submerged pontoons, so most of the buoyant volume sits well below the wave zone. That arrangement gives a small waterplane area and a long natural period in heave, pitch, and roll, which keeps the deck steadier in a seaway than a ship-shaped hull of the same size. The drillship is exactly that ship-shaped hull, with a derrick built over a moonpool, an opening through the hull amidships, through which the drill string and riser pass. A drillship transits faster, carries more variable deck load, and stores more on board, which suits long deepwater campaigns far from port; it pays for that with more motion than a semi-submersible in the same sea.

A fourth configuration, the tender-assisted and bottom-supported units, fills the gaps the three main families leave. A drilling tender is a barge or ship that carries the mud, the power, and the accommodation alongside a fixed or minimal platform that holds only the derrick, which keeps the platform light and cheap. A submersible (as distinct from a semi-submersible) sets its hull down on the seabed in shallow water and drills from a hull that rests on the bottom rather than floats. These are minority types by number, and the MODU Code groups all of them under the same definition because the marine safety problem, a manned vessel carrying a drilling plant offshore, is shared regardless of how the unit sits on or above the water.

Whatever the type, a MODU carries the same three layers of oversight as a merchant ship: a flag state that registers it and gives the MODU Code force in law, a classification society that surveys the hull, the machinery, and the position-keeping system against its rules, and a coastal state whose petroleum regulator licenses the drilling itself. The flag and class layer is why a drilling unit has a load line, a safety certificate, and a crew holding STCW certificates, and why its stability book, fire plan, and life-saving appliances are surveyed on the same cycle as a tanker’s. The drilling plant sits on top of that marine baseline, not instead of it, which is the whole point of treating a MODU as a vessel rather than as a platform.

Where each type works, and how it holds station

The choice between the three families is set first by water depth and then by station-keeping. The jack-up cannot float and drill, so it is out the moment the water is deeper than its legs. Between the two floaters, the deepest water and the longest-range work tend to go to drillships on dynamic positioning, while moored semi-submersibles hold a strong position in the mid-depth and harsh-environment range where their motion advantage counts and a mooring spread is still practical. The table below sets the three side by side on the two axes that decide the selection.

Station-keeping splits floating units into two camps, and the split drives the whole marine operation. A moored unit is held by a spread of anchor lines, commonly eight to twelve, run out to anchors or pre-laid points and tensioned to balance the environmental load. Mooring is cheap to run once set, holds without burning fuel, and fails slowly, but it takes anchor-handling tugs days to deploy and recover, and it does not scale to great depth because the line weight becomes unmanageable. A dynamically positioned unit holds station with thrusters driven by a control system that reads the unit’s position against acoustic, taut-wire, or satellite references and counters the wind, wave, and current as they shift. Dynamic positioning scales to any depth and repositions in hours, but it burns fuel continuously and depends on power and control redundancy, which is the whole subject of the dynamic positioning article and the reason a drilling DP unit is built to DP class 2 or 3 so that a single fault does not lose the position. The bow thruster and stern thruster sizing behind that capability is its own topic.

Ballast and stability of column-stabilized units

A semi-submersible is stable for a different reason than a ship, and the difference is the key to operating one safely. A ship gets most of its righting moment from waterplane area: a wide hull resists heel because the immersed wedge on the low side and the emerged wedge on the high side shift the centre of buoyancy outboard. A column-stabilized unit deliberately throws most of that waterplane area away, sinking the buoyant pontoons below the surface and leaving only the slender columns piercing the waterline. That is what buys the gentle motion, and it is also why a semi-submersible has far less reserve of waterplane stability than a ship of equal displacement, so its stability has to be actively managed through ballast rather than assumed from the hull form.

The ballast system is the unit’s stability control. Seawater is pumped between tanks in the pontoons and columns to set the operating draft, to trim the unit level as the deck load shifts during operations, and to hold the designed reserve buoyancy and freeboard. The MODU Code sets the intact stability standard the unit must meet at every operating and transit draft, and a damage stability standard that the unit must survive a defined extent of flooding, typically the loss of any one compartment, and remain afloat and upright within stated limits. Those rules exist because the failure mode of a column-stabilized unit is not the slow list of a ship but a progressive loss of a corner: flood one column or pontoon compartment, lose buoyancy and trim on that side, and the unit can heel and downflood far faster than its small waterplane can resist. The 1982 loss of the Ocean Ranger off Newfoundland, where flooding through a broken porthole in the ballast control room and mishandled valves led to capsize with the loss of all 84 aboard, is the documented case that shaped the damage-stability and ballast-control requirements now in the Code.

Variable deck load and the weight budget

Stability and the daily weight budget are the same problem on a floating drilling unit. Every tonne of drill pipe, casing, cement, mud, and stores landed on deck raises the centre of gravity and changes the trim, and the ballast operator answers each change by moving water. A drillship carries the largest variable deck load of the three types, which is part of why it suits long campaigns, but it also means the marine crew tracks a constantly shifting weight and centre of gravity against the stability book. The same discipline appears across the offshore-installation cluster, where a crane lift or a topside set changes a vessel’s weight and stability in real time; the offshore topside centre-of-gravity check is the installation-side version of the same calculation. On a drilling unit the consequence of getting it wrong is not just a list but a reduced reserve against the next damage case, which is why ballast and weight control sit under the marine watch, not the drilling watch.

The drilling system: derrick, top drive, and the circulation loop

The visible part of a drilling unit is the derrick, the tall lattice or mast tower that stands over the well centre and carries the weight of the drill string hanging in the hole. Inside it, the modern unit turns the string with a top drive, a motor that grips the top of the string and rotates it directly, replacing the older rotary table and kelly. The top drive hangs from the travelling block, and the block is raised and lowered by the drawworks through the crown block at the top of the derrick, which is how the string is run in and pulled out. The whole hoisting system is sized to the hook load, the total suspended weight of pipe, collars, and bit, buoyed by the mud it hangs in; the drill string hook load calculation is what sets the derrick and drawworks rating, and it is the first number a rig is specified against.

Drilling is not just turning a bit. It is a circulation loop, and the fluid in that loop, the drilling mud, does more work than the bit does. Mud is pumped down the inside of the drill string by the rig’s mud pumps, out through nozzles in the bit, and back up the annulus, the gap between the string and the wall of the hole, carrying the cut rock (the cuttings) to surface. At the surface the mud passes over shale shakers and through separators that strip the cuttings out, then drops into the active pits to be pumped back down. The mud displacement volume and the pump rate that drives this loop are core to every operation that changes what is in the hole. The mud does four jobs at once: it lifts the cuttings, it cools and cleans the bit, it plasters a thin filter cake on the borehole wall to stop the hole caving, and, the job that keeps the well alive, it holds back the formation by the weight of its own column.

The pit room is where the marine watch and the drilling watch overlap, because the volume of mud in the active system is the well-control instrument that matters most. A drilling unit measures the mud it pumps in and the mud that comes back out continuously, and the difference is the first number that tells the crew whether the well is behaving. The pit-volume totaliser, the flow sensor on the return line, and the trip tank are not glamorous instruments, but they are the early-warning system that primary control depends on, and the mud displacement bookkeeping behind them is checked on every operation that swaps one fluid for another in the hole. When a drillship or a moored semi-submersible heaves on a swell, the mud level in the open pits moves too, and a competent pit watch knows the difference between a reading that is the sea and a reading that is the formation.

The drill string itself is not a plain pipe. At the bottom sits the bottomhole assembly: heavy drill collars that put weight on the bit, stabilisers that keep the hole straight, and on a directional well the steerable motor or rotary steerable tool that points the bit. Above the collars run thousands of metres of drill pipe in stands of two or three joints, made up and broken out at the rotary table as the string goes in and comes out. The buoyed weight of all of it, hanging in the mud, is the hook load, and it changes every time a stand is added or the mud weight is raised, which is why the drill string hook load is recomputed rather than assumed. The same string that drills the hole is the one a blind shear ram has to cut in an emergency, so its diameter, grade, and tool-joint position in the BOP bore are not academic details.

The riser and the marine connection to the well

On a floating unit the drill string does not run straight into open water; it runs inside a marine drilling riser, a large-diameter pipe that connects the BOP stack on the seabed to the rig floor and gives the mud a closed path back to surface. The riser is the marine engineer’s pipe as much as the driller’s: it has to stay in tension so it does not buckle, it has to follow the floating rig’s heave and offset without overstressing, and it has to be able to disconnect from the wellhead in an emergency and recoil safely. That is a family of marine-operations problems, and the subsea-installation cluster carries the arithmetic: the production riser top tension that keeps it straight, the riser recoil and emergency-disconnect behaviour when it parts from the stack, and the riser vortex-shedding frequency that drives fatigue in current. The riser is what makes deepwater drilling a naval-architecture problem and not only a petroleum-engineering one, and it was the riser that carried the gas to the Deepwater Horizon deck in 2010.

Well control: the barrier philosophy

Well control is the discipline of keeping formation fluids in the formation, or, when some get into the well, getting them back out without losing the hole, the rig, or the crew. It is built on barriers, and the whole subject is best understood as a layered defence rather than a single device. The pressure the well is fighting is the formation pore pressure, the pressure of the fluid held in the rock at the depth being drilled. The pressure the rig opposes it with is hydrostatic: the weight of the mud column standing in the hole. As long as the hydrostatic pressure at the bottom of the hole exceeds the pore pressure by a sensible margin, the formation stays put. When it does not, the well kicks.

Primary well control is that hydrostatic balance. The driller weights the mud, by adding barite or other heavy solids, so its density gives a bottomhole pressure above the pore pressure but below the pressure that would fracture the formation and lose mud into it. That window between the pore pressure and the fracture pressure is the drilling margin, and it narrows with depth and in depleted or abnormally pressured zones until it is only a fraction of a pound per gallon wide. Setting the mud weight is the single most important well-control decision taken every day, and it is exactly the calculation behind the drilling mud formation-pressure balance: pick the density that keeps the bottomhole pressure inside the window at the deepest point currently exposed.

Secondary well control takes over the instant primary control is lost. A kick, an influx of gas, oil, or saltwater that the mud column failed to hold, enters the wellbore, and the crew’s job is to detect it early, shut the well in, and circulate the influx out under control. The detection comes first and matters most, because the danger grows while the kick rises. The clearest sign is more flow out of the well than the pumps are putting in, read on a flow sensor in the return line; the next is a gain in the active pit volume as the influx displaces mud. While tripping pipe the warning is in the trip-tank book: the hole should take a volume of mud exactly equal to the steel pulled out, and if it takes less, something is filling the space. The kick detection calculation is the volumetric check that turns those readings into a yes-or-no on whether the well is flowing.

The blowout preventer stack

When a kick is confirmed, the well is shut in by closing the blowout preventer, the BOP, a stack of hydraulically operated valves clamped on the wellhead. On a floating unit the BOP sits on the seabed at the bottom of the riser, which is why it is called a subsea stack; on a jack-up or a platform it sits on the surface. The stack has two kinds of closing element. Annular preventers use a doughnut of reinforced rubber that squeezes in around whatever is in the bore, pipe or open hole, and seal the annulus. Ram preventers use opposed steel blocks that move in from the sides: pipe rams have a half-circle face that seals around a specific pipe diameter, blind rams seal an open hole, and blind shear rams carry a blade that cuts the pipe and then seals the bore, the last-ditch barrier when nothing else will close. API Standard 53, the standard the US regulator points to, sets out the required components and the test regime for these systems; the BOP test calculation sizes the pressure-test that proves the stack will hold.

Shutting in is itself a choice between two methods, and the cluster carries both. A hard shut-in closes the BOP fast with the choke line already shut, which stops the influx in the least volume but spikes the casing pressure; a soft shut-in opens the choke first, closes the BOP, then closes the choke, which is gentler on the casing but lets a little more influx in. The trade-off is between the surface pressure the wellhead and casing can stand and the kick volume allowed into the hole, and it is the subject of the hard shut-in and soft shut-in calculations. Once shut in, the kick is circulated out by one of the established kill methods, pumping kill-weight mud down the string and bleeding the influx out through an adjustable choke while holding the bottomhole pressure constant, so the formation neither flows further nor fractures.

The kill itself is a controlled-pressure exercise, and two named methods dominate the field. The Driller’s Method circulates the influx out first with the original mud weight, then circulates kill-weight mud in on a second pass, which is simpler to run but holds higher surface pressures for longer. The Wait-and-Weight Method weights the mud up before circulating, so the kill mud follows the bit down and removes the influx in one pass, which keeps the casing pressure lower but needs the kill-weight mud mixed and ready before the pump starts. Both keep the bottomhole pressure constant at slightly above the formation pressure by adjusting the choke as the gas migrates and expands up the annulus, and on a subsea well the long choke and kill lines down the riser add a friction loss that the choke operator has to allow for. The whole sequence is recorded on a kill sheet worked out before circulation begins, because there is no time to do the arithmetic once the pump is turning.

Gas behaviour is what makes a deepwater kick dangerous out of proportion to its starting size. Gas trapped at the bottom of a 4,000-metre well is compressed to a small volume; as it migrates up the annulus the pressure on it falls and it expands, so a few barrels of influx at depth becomes a large, fast-expanding gas cap near the surface that can unload the well in seconds if it is not bled off through the choke on the way up. That single fact is why early detection at the bottom of the hole matters so much more than detection near the surface, and why the kick detection volume check is run continuously rather than only when something looks wrong.

Casing, cementing, and the permanent barriers

The barriers so far are operational: mud and a BOP that the crew can open and close. The permanent barriers are the steel and cement that line the hole. As drilling deepens, casing strings, concentric steel pipes, are run in and cemented in place to seal off the formations already drilled and to give the next hole section a pressure-tight base to drill on from. The casing running operation lands the string, and primary cementing pumps cement down the casing and up the annulus to bond the pipe to the rock; where the primary cement leaves a gap, a squeeze cement job repairs it. The integrity of that cement is a barrier in its own right, and at Macondo the cement job at the bottom of the production casing was one of the barriers the investigations found had failed before the kick ever started up the hole. Between casing points the crew drills ahead, and the routine operations of drilling ahead, tripping the string in and out to change the bit, and logging the formation by wireline or logging while drilling fill the time between the barrier-setting milestones.

Marine hazards on a drilling unit

A drilling unit faces every hazard a ship faces, plus one no ship carries: a live connection to a high-pressure hydrocarbon reservoir running through the deck. The marine hazards alone are serious. A jack-up can suffer a punch-through, where one leg’s footing fails and drives suddenly into soft seabed, racking the hull and risking collapse; the preload sequence that proves the soil before the hull is jacked up exists to catch that before it happens. A floating unit faces the loss of station-keeping, a mooring line parting or a thruster or power failure on a DP unit, which moves the rig off the well and can part the riser if the drive-off is not caught and the riser disconnected in time. A column-stabilized unit faces the flooding-and-capsize mode that the ballast and damage-stability rules guard against. These are the hazards the MODU Code and the class rules are written around, and they would exist even if the unit drilled nothing.

The hydrocarbon hazard is the one that makes a drilling unit a special case. Gas reaching the deck of a floating unit, from a kick that vented up the riser, finds a structure full of ignition sources: engines, generators, electrical gear, and hot work. The defence is layered: the well-control barriers keep the gas in the well, gas detectors and a fire-and-gas system watch the deck and the moonpool area, hazardous-area electrical equipment is rated not to ignite a gas cloud, and an emergency shutdown system kills the ignition sources when gas is detected. The riser’s emergency disconnect package is the marine-side last line: it parts the riser from the BOP, closes the well at the seabed, and lets the unit drive clear, which is why the riser disconnect EDS sequence and the riser recoil that follows it are engineered with the same care as the BOP itself. When all of that fails in the right order, the result is the documented case that follows.

The Macondo blowout: a documented loss of control

The Deepwater Horizon was a Transocean-owned, dynamically positioned semi-submersible drilling for BP on the Macondo prospect in about 1,500 metres of water in the US Gulf of Mexico. On 20 April 2010, as the crew was temporarily abandoning the completed exploration well, the well took a kick that was not recognised in time. Hydrocarbons flowed up the production casing, through the failed cement and the wellhead seal, up the riser, and onto the rig floor, where gas found an ignition source at about 21:45 CDT and exploded. Of the 126 people aboard, 11 died and were never recovered. The rig burned for two days and sank on 22 April, and oil flowed from the well for 87 days until it was capped, the largest offshore oil spill in US history.

The blowout preventer was the last barrier, and it did not seal. The blind shear ram is built to cut the drill pipe and close the bore, and the crew tried to fire it. The forensic examination of the recovered stack found that the upward flow had buckled the drill pipe inside the riser and pushed it off-centre in the BOP bore, so the pipe lay against the wall rather than in the middle where the shear ram’s blade meets it. The ram was designed to cut and seal a pipe centred in the bore; it could not fully cut and seal a pipe pinned to the side, so it closed without sealing and the well kept flowing past it. That single mechanical fact, a barrier designed for one geometry meeting another, sits at the centre of every technical report on the disaster.

The lesson the investigations drew was about the order of the barriers, not only the hardware. The National Academies study and the US government reports treated the blowout preventer as a last-resort device that should almost never be called on, and traced the loss to a chain of earlier failures: a cement job that did not isolate the formation, a negative-pressure test misread as a pass when it showed the well was flowing, kick signs on the rig’s data that were not acted on, and a decision flow that let the well unload before anyone shut it in. The marine consequence, gas on the deck of a floating unit, followed from the well-control failure; the BOP shear-ram activation check that sizes the force a shear ram needs to cut the pipe is one narrow piece of the response the industry built afterwards, alongside the BSEE Well Control Rule that tightened BOP testing, real-time monitoring, and shear-ram capability requirements under 30 CFR Part 250.

Where each topic goes deeper

This article is the map of the drilling unit and the well; the arithmetic lives in the cluster’s calculators, grouped by where on the rig the number is needed. The hoisting and string side starts with the drill string hook load, the suspended weight that sizes the derrick and drawworks, and runs through drilling ahead, tripping in and out, casing running, and the two cementing jobs, primary and squeeze, that set the permanent barriers.

The circulation and pressure side is the heart of well control. The drilling mud formation-pressure balance sets the mud weight for primary control, the mud displacement volume drives the circulation loop, and the kick detection check turns flow and pit readings into a flow-or-no-flow decision. When the well is shut in, the hard shut-in and soft shut-in calculations frame the casing-pressure-versus-kick-volume trade-off, and the BOP test and BOP shear-ram activation calculations prove and size the secondary barrier.

The formation-evaluation and production side rounds out the well’s life: wireline logging and logging while drilling read the rock, and the production-phase calculations for gas lift and water injection cover lifting the hydrocarbons and maintaining reservoir pressure once the well is on stream. Across the wider offshore domain the links run on into the subsea and offshore installation cluster for the riser and seabed-hardware arithmetic, into dynamic positioning for how a floating unit holds station over the well, into offshore permit and emergency response for the safe-work and spill-response framework around the operation, and up to the offshore, cruise and specialised operations overview that sits above the whole specialised-operations domain.

Limitations

This article describes the marine and well-control principles of mobile offshore drilling units; it is not an operating manual, a well-control certification, or a substitute for the unit’s own approved documents. The stability of a specific unit is governed by its class-approved stability book and the MODU Code as given force by its flag state, not by any general description here; ballast operations follow the unit’s ballast control manual and the operator’s procedures. The well-control descriptions state the barrier philosophy and the role of each device at a conceptual level. The mud weight, the kill procedure, the BOP test pressures, and the shut-in method for any real well are set by the operator’s well program and the regulator’s rules for that jurisdiction, and a kick is handled by crews certified to an IADC- or IWCF-accredited well-control standard, not by reading a hub article. The linked calculators illustrate the method and give order-of-magnitude figures; none of them is a design tool, and none replaces the engineered well program, the rig-specific procedures, or the judgement of the people on the watch.

The depth ranges and unit characteristics given are typical industry figures and vary by individual rig design, leg length, mooring spread, and environmental class; a specific unit’s water-depth rating comes from its own specification, not from the bands in the comparison table. The Macondo account follows the published US government and National Academies investigations into the 20 April 2010 blowout and is included as a documented case study of barrier failure, not as a complete technical history; the full causation is set out in those reports and the federal litigation that followed, and any operational lesson should be taken from the primary investigations rather than from this summary.

See also

• Subsea and offshore installation: the riser, pipelay, and seabed-hardware arithmetic that surrounds the drilling unit.
• Dynamic positioning: how a floating drilling unit holds station over the well, and the redundancy that keeps it there.
• Offshore permit and emergency response: the safe-work permit, muster, and spill-response framework around an offshore operation.
• Offshore, cruise and specialised operations: the overview that sits above the whole specialised-operations domain.
• Bow thruster and stern thruster: the thrust units behind a dynamically positioned unit’s station-keeping.
• Drilling mud formation-pressure balance calculator: sets the mud weight for primary well control.
• Kick detection calculator: turns flow and pit readings into a flow-or-no-flow decision.
• BOP shear-ram activation calculator: sizes the force the last-resort barrier needs to cut the pipe.
• Drill string hook load calculator: the suspended weight that sizes the derrick and drawworks.
• Production riser top tension calculator: keeps the marine drilling riser straight against the floating unit’s motion.