The Management of Hazards during Pinned to Seabed Operations. By: Paul Nardone, Graham Fraser, & Rita Painter. Revised 22 Aug 2016.

Transcription

1 The Management of Hazards during Pinned to Seabed Operations. By: Paul Nardone, Graham Fraser, & Rita Painter. Revised 22 Aug Supported by: Abstract This article presents a review of the current industry approach to the perception of risk and the managment of the hazards on a floating rig or vessel connected at the seabed. The range of possible consequences covers everything from minor operational delay to catastrophic failure of the workstring. This article includes two first-hand accounts of events that resulted in severe damage to the rig structure and also incorporates feedback from a survey of subject matter specialists to gauge a wider understanding of industry incidents and perception of risk. ing a combination of the riser tensioners and the draw-works. In all cases tension is applied primarily to reduce cyclic fatigue on the various workstring components. At the same time a device known as a motion compensator absorbs the movement of the rig or vessel, permitting the workstring to remain stationary and under constant tension. For the purposes of this article we will call these pinned to seabed operations. The duration of pinned to seabed operations might vary considerably and is often measured in days. Consider a typical completion after it is locked to the wellhead. The range of commissioning tasks that follow might include fluid displacement, setting a packer, pressure testing, wireline activities, and flowing the well to surface for unloading and clean up. During this entire period the rig may experience a wide range of sea states and unpredictable motions. The reliability of the motion compensator system is therefore an important safety consideration during these activities. Certain failure modes in the motion compensator may result in a complete lock up, by which we mean a complete and rapid loss of compensating action. A lock up either in the riser tensioner system or the travelling block compensator may result in a significant tension increase even for small vessel motions. The consequences would depend on water depth, sea state, and vessel heave. This article focuses primarily on the hazards associated with the traveling block compensator, however Experienced compensator lock up in 2008 when installing completions in well with water depth approx. 700m. Lock up was due to problem in PLC Card associated with Active Heave. No damage occurred but the draw-works were disabled due to lock up on Active Heave. Electronics Technician had to reset the PLC to re-enable AHC. Survey Contributor Pinned to Seabed Operations When conducting operations from a floating vessel, certain tasks require the workstring (either a landing string or open water workover riser) to be physically attached at the seabed. Such tasks occur during completions, well interventions, workovers, and well testing operations. During these periods the upper part of the workstring is pulled into tension by the draw-works, or in the case of an open water workover riser, tension may be applied us- both traveling block and riser tensioner systems present inherent hazards during pinned to seabed operations. One further general comment - we will focus on the hazards associated with a loss of motion compensation; one of the potential consequences of which might be catastrophic failure of the workstring. It is also possible that a similar consequence might eventuate from a loss of station keeping. Although station keeping issues are not the subject of this article, they would certainly be included in any comprehensive risk assessment study, in particular with regard to dynamically positioned vessels. Heave Motion The rise and fall motion experienced by a rig is its effective heave; this should not be confused with pitch and roll or with wave height or other particular measures of sea state. The actual motion of the rig at any given time is a function of several factors including wave height, wave direction, wave period and the swell motion of the sea. In practice it can be Copyright Well Test Knowledge Pty Ltd 1

2 Survey Feedback: Passive Compensator Failure Modes Hydraulic/Pneumatic Valve blockage or failure. Poor fluid quality Leak in pistons Air entrained in hydraulic system Loss of air/hydraulic supply due to hose or pump failure Reaction time with respect to sea state Mechanical Overload Chain failure Piston binding Cable failure on riser tensioner Human Error Incorrect stroke adjustment - compensator bottoms out Incorrect accumulator pressure applied Incorrect valve closure Inadeqaute maintenance Inadequate or failure to follow procedures difficult to predict accurately how a floating vessel will behave in any given sea state. Depending on rig type and location, heave motion can vary between fractions of a meter to over 6 meters. Weather forecasting, however accurate, will not always provide an accurate prediction of rig heave because there are many variables some of which are characteristics of the rig itself. The unpredictability of these motions and their potential magnitude has significant consequences for the safety of the rig and the way that risk is assessed. An important control for pinned to seabed operations is the predetermined operating envelope that defines limitations for a range of critical parameters; typically these include vessel offset, wave height and compensator stroke range. Rig Motion Compensators In general motion compensators fall into one of two categories, passive or active. Within each category there are further subdivisions, but for the purposes of our discussion these two general categories are adequate. Passive Compensators A Passive Compensator, in simple terms, places a piston cylinder between the hook supporting the workstring and the rig derrick structure. The tension applied to the workstring can be adjusted by changing the air pressure acting on one side of the piston. Hydraulic fluid on the other side of the Survey Feedback: AHC Failure Modes Hydraulic System override Motion Reference Unit (MRU) failure Software / Power Loss of communication with MRU Synchro issues Logic control Loss of power Anti Collision System engages Motion Sensor fault PLC Module failure Draw-works Motor failure Encoder failure Software bugs Mechanical Structural failure Frames/cylinders Control Console Wire Rope wear (Tonne Miles) Human Error Accidental manual activation of e-stop Design Over sensitive controls Poor ergonomic layout of controls piston is regulated to and from an accumulator. As the rig rises and falls with the motion of the sea the tension on the hook changes. With each change in tension, the piston moves inside the cylinder, the corresponding change in pressure of the fluid acts Copyright Well Test Knowledge Pty Ltd 2

3 to counteract the change in tension. In this way, the movement of the rig is absorbed by the motion of the piston inside the cylinder with fluid constantly moving to and from an accumulator, the net effect of which is a constant tension on the hook. A simple way to think about it is to imagine the compensator acting like a spring expanding or contracting with the motion of the rig to maintain a constant tension on the workstring. This type of compensator requires a reaction point, consider that a spring cannot expand or compress unless it is held at both ends, in other words, if the workstring is not in contact with any fixed point in the well there can be no change in tension on the piston. The compensator doesn t do anything until the workstring is in contact with a reference point such as the wellhead. Passive Compensators were involved in the 3 significant events documented in the IADC report referenced in this article. Active Heave Compensators With the introduction of modern generation deep-water rigs, the draw-works technology evolved to include electrically driven automated motion compensators, referred to as Active Heave Compensators (AHC). AHC technology has predominantly been applied to the traveling block system, and not riser tensioners. AHC systems are inherently complex, and dependent amongst other things on the PLC logic programmed into the electronics. In one instance just a greasy smudge on a touch screen resulted in the computer interpreting the smudge as an instruction that resulted in a near miss incident in The AHC works by accurately measuring the vessel motion in real-time using motion sensors. A computer directs the electric motors on the drawworks to pay out or take in wire in response to the vessel motion. In a black out scenario (total loss of electrical power), the system has no compensation back up and the break engages automatically. Additionally, a blackout would render the draw-works inoperative, a situation that would leave crews powerless to take any meaningful action. There may be other failure modes associated with PLC control failure that might result in similar consequences. The authors are not aware of any catastrophic loss of containment events associated with an active compensator. However, this may not reflect on their reliability but more on the fact that fewer operators tend to use active heave compensators when executing extended pinned to seabed operations. Some new generation rigs have dual compensators, combining active systems which are useful for precision control with passive systems which are often perceived as better suited to extended pinned to seabed operations. The Hazard Every motion compensator, whatever its design, has some potential for failure during the period the rig is pinned to seabed. There are failure-modes whereby this can occur rapidly and in such a manner that the compensator becomes rigidly locked. Should personnel on the rig not respond appropriately to early warning signs, the motion of the rig would be transmitted directly to the workstring. If the rig heave at the time were of sufficient magnitude, it is probable that such an event would result in the catastrophic failure of the workstring either in tension or compression. The consequence severity is further increased if wireline or coil tubing personnel happen to be working in the derrick at Glomar Coral Sea - Drillship single Varco passive compensator 100 meters water depth, with large swells caused the Olmsted valve to close. No damage, stopped drilling WOW. Separate incident, same rig - Olmsted closed due to hose failure in the derrick. No Damage to equipment replaced hose. Separate incident, same rig - main air fluid float parted and caused the system to lock up. No damage stopped drilling to repair float. Survey Contributor the time. Several holes in the Swiss cheese accident causation model must line up for the above to occur, and whilst they may be infrequent, they have happened; the paper IADC/SPE Unintentional Compensator Lock up Risks, Consequences and Measures, details three events of this nature that occurred in the North Sea during the 1990 s. Readers are also directed to the feedback from our survey which details different failure modes and a Copyright Well Test Knowledge Pty Ltd 3

4 range of issues known to have occurred. Our survey has uncovered a number of events of varying degrees of severity and it seems only too likely that similar events must have occurred elsewhere. Because of the potentially catastrophic consequences from this hazard, the risk must be analyzed in detail during the planning phase. The oil & gas industry does not widely publicize and make available the data needed to quantify such risks with precision. In the face of such uncertainty, it is recommended that a conservative approach be would also be helpful in assessing the full set of consequences from such an event. As an example, if the workstring did fail, then the shear joint at the BOP, or point just above the emergency disconnect package (EDP), would generally be the most desirable location for failure to occur in order to preserve the availability of the well control equipment, BOP, diverter etc. Depending on water depth, hydrocarbons escaping from a failed weak point might reach the drill floor in a matter of seconds or minutes. In some instances, it may be possible for the driller to UK Sector North Sea 2006/2007 Water depth: ft While hung off at the wellhead for weather, but still connected to the drill string and passively compensating, carrying a portion of the string weight, a wave came through that resulted in the semi-sub "dropping" fast into the "hole" in the sea. The rapid acceleration, coupled to the residual wt. being carried resulted in the Olmsted valve locking up, losing string compensation popping the connection on the hang off tool as the next wave came through. Survey Contributor taken when developing safety strategies. Tensile Failure Rig heave cycles typically have periods ranging between 8 and 30 seconds. If a compensator lock up occurred at the bottom travel of a heave cycle, in a matter of seconds the workstring would experience a significant increase in tensile stress as the rig moved upwards. Without manual intervention, the pipe would initially undergo elastic stretch followed by a rapid increase in stress to yield point, failure would occur at the weakest point in the workstring at that instant; the location of the weak point however, is another question. If the workstring were a free standing vertical pipe, the components near the top would experience greater stresses as a result of the additional weight supported by the top connections. In practice however, the weak point may occur elsewhere as a result of stresses present for other reasons. For example, a compression or fatigue induced weak point, or stress arising from contact between a landing string and the marine riser; the magnitude of such stresses would be a function of the offset of the rig from well center. Riser analysis studies can be used to determine where the weak point would occur at increasing offset angles and operating conditions; such a study provides input for establishing a project specific operating envelope. Understanding the weak point in the workstring activate the diverter and reduce or possibly prevent a release to the drill floor. Recoil Damage The energy released after the separation of the workstring due to over-tension will act to generate upward thrust in the workstring components. Furthermore, any pressure contained in the workstring provides an additional energy source. The released pressure energy would be directed upwards to combine with the recoil forces. Depending on the adopted strategy, safety systems can be configured to contain the workstring contents above the designated weak point using a retainer valve arrangement. Experience has shown that the damage caused by such an event might be considerable with projectiles and dropped objects falling onto the drill floor as the various components dislodge and damage other structure in the derrick. See the Deepsea Trym case study described in this article. The presence of hydrocarbons under pressure would add an escalation hazard in the form of fire and explosion. Though this is not known to have occurred in any recorded event, the potential is certainly there. The inventory of hydrocarbons would include the contents of the workstring, together with additional hydrocarbons flowing from the well up to the point where the subsurface safety valve, the subsea test tree, or BOP was closed. Copyright Well Test Knowledge Pty Ltd 4

5 Compression Failure Should a lock up event occur as the vessel was at the top of a heave cycle, then the workstring would experience compression and buckling forces, made up from the weight of the string and the flowhead, combined with any compression imparted to the flowhead through the lifting bails, or tension frame as the rig moved downwards. A number of outcomes are possible; in the case of the landing string, it may be that the entire landing string would squat down inside the marine riser, with helical buckling taking up most of the movement and the flowhead held more or less vertical; depending on the rigidity of the stick up joint and on the amount of downward heave. In the case of an open water work-over riser, the riser string Semi Submersible 2012: System lock up occurred during large swells in Bass Strait, stuck in the well for 8 days with parted drill string Survey Contributor would buckle and likely suffer bending failure under its own weight. In both cases without suitable support the flowhead is likely to fall over with the bail arms or tension frame articulating to one side at an angle corresponding to the amount of movement downwards. We are aware of at least one incident where this type of failure has occurred without any loss of containment. Analysis of the workstring on a case-by-case basis is recommended to evaluate what sort of buckling forces the tubulars and components would tolerate before failure. Even if this event did not alone cause a loss of containment, the stresses induced during the buckling event might weaken components which would subsequently fail on an upward heave cycle when the same components went into tension. Without some kind of intervention, the workstring will fail sooner or later. Therefore, the human factors, whether as a contributing cause to a failure, or as part of prevention and / or mitigation, must be included in any comprehensive discussion of this topic. Human Factors During a pinned to seabed operation, the role of the driller is an important one because it is the driller who operates, monitors, and directs the adjustment of the motion compensator according to changing conditions. He is also responsible for identifying early warning signs that the compensator system is starting to deteriorate and for responding to those warning signals. It follows that the driller should have a thorough understanding of this system. How well does the driller understand the motion compensator system? Several incidents involving active heave compensators have occurred directly as a result of a misunderstanding about how the system works. The complexity of the latest generation of rigs contributes to the hazard. In one instance a driller performing a maintenance function on the drill floor was unaware that this action would automatically retract the hydraulic riser tensioner arms. At that time an individual was working in the moonpool about to insert a pin to lock the tensioner arm to the tension ring, the arm retracted automatically and pinned the cherry picker in which the worker was standing against the moonpool wall; the worker had to be rescued using a man-riding tugger. Human factors extend to the thoroughness and clarity of the work instructions and procedures developed for the operation. Personnel conducting any kind of task during a pinned to seabed operation must follow clearly written work instructions which have considered carefully all the hazards specific to the task. Are task focused personnel fully aware of the criticality of the compensator systems? Does the work instruction include guidance on monitoring and adjusting this system and the various appropriate responses to any deviation in compensator parameters, including emergency response? Have simulation drills been conducted to test the response of individuals to the range of possible failures? Are personnel fully cognizant of the operating envelope and who is monitoring the conditions to ensure none of the parameters are exceeded? The case studies show that the reaction of personnel to these types of emergency are crucial both for prevention and mitigation. Deep Water vs Shallow Water The greater the depth between the rig and the anchor point on the seafloor, the more pipe stretch and squat available before the workstring experiences excessive stresses. Should a lock up occur in moderate heave conditions, it is entirely possible Copyright Well Test Knowledge Pty Ltd 5

6 the workstring would not experience the kind of stress that would cause an immediate failure; always provided the driller responds straight away. Some downsides in deep water are greater compressional loads, and an increased inventory of hydrocarbons in the workstring. There is also the potential to lose a significant hydrostatic head should the riser be evacuated by escaping gas after a landing string failure, perhaps leading to a well control event. The opposite is true in shallow water, with very little pipe elastic stretch or squat available, the workstring would experience over-tension or compression to the point of failure rapidly. Marine Riser vs Open Water Riser With a conventional landing string inside a marine riser, a particular hazard is often identified by which the marine riser could act as a conduit for gas leaking from the landing string to the drill floor. This may direct planners to consider an open water riser intervention system. However, this assessment may only be valid in deepwater where gas leaking from the lower end of the open water riser might be expected to go into solution or to disperse by the time it reached the surface. In shallow water this advantage is doubtful since gas leaking from an open water riser at shallow depths would reach the surface beneath the rig over an extended area exposing the entire rig to a potentially explosive cloud rendering evacuation, if required, very difficult or Anything situated across any of these devices that might compromise their ability to shear, close or seal must be considered during planning; examples of non-shearables might include wireline or slickline tools, coiled tubing, and in certain circumstances, perhaps hydrate. Had various experience s over 16 years in the industry with both active and passive compensator lock up in the North Sea in varying water depths. In my experience the compensator lock up is almost always caused by inexperience in use of the compensator by todays drillers who are put in that role with no where near enough experience or training. Survey Contributor impossible. Non-Shearable Items Assuming for a moment that a landing string parts for one reason or another and a loss of containment occurs:- The most important next step is to isolate the well at the seabed. With a conventional marine riser / BOP setup, there are two devices available to achieve this, the first is the subsea test tree and the second is the rig BOP. In the case of an open water riser system, the EDP/LRP package provides the same functionality. During completion operations both systems typically have the subsurface safety valve as a tertiary option. Industry Codes & Standards There is no uniformly followed international standard when it comes to completion & workover riser design & specification. In part this might be due to the fact that the International Maritime Organization (IMO) stipulates that floating vessels must refer back to flag classification standards. However, useful guidance can be found in API- RP-17G Recommended Practice for Completion/ Workover Risers, currently in working draft form, which specifies the requirements for systems engineering to ensure that the subsea well intervention systems and components are fit for purpose. Overarching is the requirement for the operator to develop a safety strategy that provides system definition for the safety, design, and operational principles of the system. This should include a summary of the recognized and potential hazards during operations, and define the need for risk-reducing measures. The safety strategy typically includes key design principles i.e. design should be fail-safe and be such as to ensure that no single failure will cause an unacceptable risk. Common cause failures shall be identified and measures implemented to minimize their probability of occurrence. & For all operations, the system design shall account for the most unfavorable combination of functional, environmental, and accidental loads, which might occur simultaneously. Operating limitations for the system may be established by global riser analysis and Failure Mode Effects Analysis (FMEA). An FMEA is a study performed to evaluate the credible failure modes that might occur within a particular system. The study would identify weak points both mechanical and human factors together with characteristic early indicators of deterioration. The output from such a Copyright Well Test Knowledge Pty Ltd 6

7 study would typically include a range of measures for example, a thorough service of the compensator system, early replacement of critical components, detailed inspections and a project specific set of monitoring controls to aid the driller. Engineered Controls When taken as a safety critical item and a single point of failure, many organizations determine the need for an additional engineered safeguard to provide redundancy or mitigation against compensator lock up. There are a number of products on the market that may fulfill this need, these fall into two broad categories; redundant compensators and telescopic bail arms. icant space on deck and will interface the derrick mounted hardware through a network of umbilicals. A system of this sort will require a crew of competent technicians to oversee installation and operation. One of the issues to consider during planning when using a dual system is the transition between systems during normal operations or in an emergency. Another consideratioin is the availability of both systems throughout the pinned to seabed operation. It only requires that a control unit is unattended briefly, or for communications to be temporarily unavailable to render this safeguard ineffectual. In other words this engineered solution itself depends to some extent on procedural controls to assure availability. A number of new generation rigs include a combination of both active and passive systems, which are permanently installed and operate in parallel at all times. The passive system provides back up during power failure. As both systems run parallel, system switching or transferring complexity is removed. Telescopic Bail Arms An alternative approach employs the use of telescopic bail arms. Whilst these devices are not full blown compensators, they offer some of the benefits with reduced complexity. There are two general designs of telescopic bails, the first is mechanically operated using shear pins and the second uses sealed pressurised nitrogen cylinders. Telescopic bails are installed in the derrick using spreader beams making an arrangement very similar to the CTLF. Should the rig compensator system fail the bail arms telescope to absorb the rig motion and protect the landing string. The mechanical system uses shear pins to prevent premature telescoping of the bails and is limited to protection from tensile loading only with little protection against compression or against recoil damage. This system has been used in service in a number of locations. Well Clean-up operation (ca. Fall 2012 timeframe) - Driller operated the wrong valve when attempting to increase compensator pressure. String parted and oil rained down on the drill floor. Layout and ergonomics of the panel was deemed the root-cause for the incident. - Another recommendation (consequence reduction) was to place the Subsea & ESD control panels away from the harms-way and to man these 24 / 7 during operations. Survey Contributor Redundant compensator The concept is simple enough; install an additional compensator in series with the existing rig compensator. If one fails, then the other can take over This temporary system would be installed in the derrick before the flowhead and may take the form of a Compensated Tension Lift Frame (CTLF) or an in-line compensator, both of which are passive systems. These have been used successfully in different parts of the world and operate effectively as a primary or secondary compensating device. Some additional hardware including accumulators, compressors and control modules would occupy signif- This system is self-contained with little or no additional deck located hardware required during operation. Similarly their reduced complexity involves very little additional personnel at the wellsite. The newer nitrogen spring design offers protection from both over-tension and compression using sealed and pressurised nitrogen cylinders which telescope only when a pre-set tension or compression has been exceeded, the nitrogen cylinders also limit potential recoil damage from an over-tension event. At time of writing this newer design has not yet been used in service. Copyright Well Test Knowledge Pty Ltd 7

8 Rig Selection Suppose an operator determined that a particular type of compensator was inappropriate for pinned to seabed operations, it would follow from that decision that rigs fitted with that type of compensator system would be excluded from selection by the operator. An engineered solution such as the addition of a CTLF, may re-open the opportunity to select a rig that would otherwise be disqualified. Availability of Contingency System Operators must also consider their response in circumstances where the primary protection device, the rig compensator is fully functional, but the back-up happens to be experiencing a problem. Since the risk assessment identifies the secondary system as a control, should it be unavailable for any reason, the operator is faced with the possibility of having to suspend operations even though the primary system is working fine. Controlled & Emergency Unlatch Every pinned to seabed operation will incorporate some means to disconnect the workstring at the seabed together with a means to isolate the well so as to prevent a release to the environment following disconnection. The interface between the drilling rig and the wellhead connector at the seabed will always include, either a hydraulic, or an electro-hydraulic disconnect feature. For the landing string system in a marine riser, this interface is the subsea test tree, and for open-water operations this will be the lower riser package (LRP) and Emergency Disconnect Package (EDP). Both systems are typically configured with push button ESD and EQD initiators, designed to follow a logic sequence to close the subsea barrier elements at the subsea test tree or LRP and then physically unlatch the system above the barrier elements so that the rig is no longer pinned to seabed. This process may take anything from seconds to minutes depending on the water depth and system configuration. The unlatch feature is certainly a safeguard available against compensator deterioration. However, whether it might be considered a full safeguard against every failure mode is a different question. Activation of this function requires human intervention, it does have some fail safe features, however, there are circumstances where these features might not be triggered. A rapid activation time, even if only 10 seconds, may not be adequate to prevent a catastrophic failure in circumstances where a sudden loss of compensation has occurred and the rig is experiencing an upward heave at the same time, or during a black out when using an AHC system, although in both cases this will certainly isolate the well quickly. Conclusions The consequences associated with compensator lock up can and have been catastrophic, planning should therefore be conducted accordingly. The assessement of the risk together with the developement of controls is a complex process involving a lot of variables many of which are operation specific, it follows that there should not be a prescriptive one size fits all solution. Based on what can be learned from industry experience we would prioritise the controls into the following order of importance: 1. Human Factors: 2. Design Specification: 3. Fit for Service Hardware: 4. Additional Engineered Controls: Human Factors: Planning is an exercise in risk reduction, but is only effective to the extent that the people on the rig, those who are actually exposed, fully appreciate the nature of risks and have the resources they need to control them. These resources include competent personnel, training, quality procedures, supervision, briefings, together with the drills and simulations performed to ensure that personnel can recognize and respond to all of the possible contingencies. The case histories show that the role of the driller in particular is an essential element in this equation. Design Specification: By this we mean the understanding of the safe working limitations of the entire system; including the tubulars, well control equipment, mooring/station keeping system and the compensator itself. Without thoroughly studying how the components of the landing string interact and what stresses they will experience in service, then it is would be difficult to state precisely what the safe operating envelope for the system will be. Fit for Service Hardware: Why would you undertake a risk which involved potentially catastrophic conseqeunces with less than optimal hardware? It is only common sense that prior to undertaking an operation of this nature that all steps be taken to ensure that the compensator system is fully functional. Any planned maintenance or sub optimal Copyright Well Test Knowledge Pty Ltd 8

9 components should be addressed beforehand and tested thoroughly before operations commence. Additional Engineered Control: We place this at the lowest priority, not because it is not important, but because an additional engineered control, such as a back up compensator, would only be required as a mitigation measure. Since prevention is better than cure, measures which prevent a situation from escalating to the point where an emergency system is required should be seen as preferred controls. Ultimately inadequate perception of risk is likely to result with inadequate planning and greater risk during execution. Supported by Copyright Well Test Knowledge Pty Ltd 9

10 Personal Account- Doug Low Polar Pioneer Semi Submersible Norway 1994 Water Depth: 332m Summary During a DST, while flowing the well through the surface well test plant and flaring oil and gas, the heave-compensator locked up and the test tubing parted below the flowhead at a pup joint connection about 2 meters above the rotary table, resulting in an uncontrolled release of hydrocarbons onto the drill floor and into the derrick. The control lines to the Subsea Test Tree remained intact after the failure of the landing string and manual activation of the Subsea Test Tree closure function was ultimately used to stop the hydrocarbon release. Rig contingency procedures recovered the situation, enabling removal of the parted pipe and reconnection of the flowhead. Witness Doug Low, Halliburton Senior Subsea Specialist, was present on the drill floor during the incident. The compensator lock-up happened when the driller was attempting to adjust the settings of the compensator. I never actually saw clearly what happened just prior to the lock-up but I recall that he said it locked up while (or just before) he was adjusting the height settings. I am unsure if it is possible to lock the compensator whilst altering its height as this, to my knowledge, is achieved by adding or removing pneumatic pressure to the compensator cylinders or by raising or lowering the blocks using the drawworks, and should have no effect on the lock mechanism. However, as I am no expert in this field the technical details should be verified on this point. time were extremely lucky to escape unharmed from this incident; there were three of us, the driller, Halliburton DST specialist and myself. The incident did not make any headlines at the time and the only reference I ever saw to it was a very small column in the local Norwegian newspaper. However, the Stat Pollution Authority had a government plane out over the location, as soon as it was light the following day, in order to quantify and, presumably, photograph the oil spill. In the aftermath of this incident, Norsk Hydro required that our SSTT control panels be fitted with a low pressure pilot which would activate the closure of the SSTT in the event that flowline pressure dropped below a predetermined value. We were flowing just over 6000 bopd through a 40/64 fixed choke, burning on one boom, when the lock-up happened. Initially, we couldn t get to the SSTT panel as the roller door leading through the heavy tool store, which was the shortest and safest route to the SSTT control panel, could not be opened from the doghouse side and so we were forced to go out and across the drill floor through the oil and gas which was flowing freely through open ended tubing into an enclosed derrick. The driller hit the Subsea Test Tree (SSTT) shut-down button as we ran past the panel to safety and the flow started to subside as the SSTT closed. There was never, to my knowledge, any attempt made to close the shear ram. I went back up to the panel a minute or so later and closed the Subsea Lubricator Valves (SSLVs) as an added precaution. The personnel on the drill floor at the Copyright Well Test Knowledge Pty Ltd 10

11 Feedback comments from 40 survey contributors. The following list of comments are from our survey contributors responding to questions regarding their own experiences of compensator issues. This list serves to indicate the frequency and variety of failure modes across different types of system. Crown Mounted Compensator (CMC) locked up due to deteriorated fluid condition and incorrect precharge on pilot accumulators - incorrect maintenance....lack of experience in using the compensator that directly led to damage Some electronic issues that had to be rectified Issues with synchronisation on a re-coil incident, we had to repair mechanical damage and exchange re-coil valves Compensator or parts of top drive breaking up and falling to rig floor Crown mounted active heave compensation system was programmed incorrectly and weight on bit fluctuations were 60klbs. Crown mounted passive system on another rig continually caused problems due to too much friction in the system experts from supplier weren t much help either Drill String Compensator (single piston) developed leak during flow back / clean up of subsea development well. Intent had been to support completion riser only on the drill string compensator. However upper tension joint had been rigged up with lines from a tension ring to each of rig s marine riser tensions, and this was brought into service to relieve load on DSC. Drill String Compensator Olmsted Valve needed to be replaced. leaks - drop off of tension support from compensator, required continuous monitoring and system re charging Incorrect compensator operation leading to compensator stroking out fully and landing out on the beams due to rig heave. This at a time when a landing string was connected to the wellhead system. Problems with PLC Card associated with AHC failed and draw-works locked up few times and PLC had to be reset every time compensator locked up. Damaged PLC Card was replaced and issue was never encountered after. As rig heaved up the compensator failed resulting in the landing string pulling ~250 klbs over string weight Seal leakage, position indication, lock bar indication and pressure sensor damage are the main failures Had various experience s over 16 years in the industry with both active and passive compensator lock up in the North Sea in varying water depths. In my experience the compensator lock up is almost always caused by inexperience in use of the compensator by drillers...with nowhere near enough experience or training. Experienced compensator lockup in 2008 when installing completions in well with water depth approx. 700m. Lock up was due to problem in PLC Card associated with Active Heave. No damage occurred but the draw-works were disabled due to lock up on Active Heave. Electronics Technician had to reset the PLC to re-enable AHC. Semi Submersible Water Depth: 165 m June 2011: Landing String locked to TH while performing slickline operations Temporary failure while rig heaving up in min. swell (1-2m) Landing string experienced overtension but did not fail. Copyright Well Test Knowledge Pty Ltd 11

12 Personal Account - Graham Fraser Deepsea Trym Semi-Submersible 1998 Compensator Lock-up Incident Summary On the Dec at the draw-works compensator system locked causing the landing string to catastrophically fail. The 7 flowhead and 7 wireline pressure control equipment fell to the drill floor causing significant damage to equipment, derrick structure and draw-works. The well flowed hydrocarbons through the open ended landing joint for a period of 17 secs until the SSTT closed and secured the well. Fortunately no one was injured during the incident. Operation Summary The Deepsea Trym was in the process of completing an oil producer well in the Norwegian sector of the North Sea. The rig was moored on location in approximately 150m water. It was winter and the rig was experiencing approximately 2-4m heave cycles which is typical for that time of year. The well was one of many already completed in the field of similar design. The completions were standard for the region which included a 5-1/2 completion string flow head and 7 wire-line BOP s suspended using a 40 bail arrangement. Surface flow tree disconnected from landing string and lodged in derrick. The SSTT was the primary subsea well control device for the operation. The SSTT included dual ball valves and an emergency unlatch system.. The BOP Landing string stick up 5 m higher than its original postion at an angle with master bushings dislodged from recess. and horizontal tree technology. The Completion and tubing hanger system was deployed on a landing string system configured with a direct hydraulic 7 Subsea Test Tree (SSTT), run on a heavy duty production riser. The surface package included a 7 Derrick equipment dislodged and dropped to the drill floor Copyright Well Test Knowledge Pty Ltd 12

13 middle pipe rams were closed on the 9-5/8 ported slick-joint located below the SSTT. The system also included a shear sub positioned across the BOP shear rams with a Retainer Valve positioned above The instrument safety system included a PSD, ESD and EQD configured with the IWOCS package. Upon activation the PSD was configured to at the time to investigate a tubing to annulus leak. The incident Throughout the afternoon the well was shut in at the PWV (PDS) whilst troubleshooting was ongoing to determine the cause of leak between the tubing and annulus. Lots of telephone calls ongoing between the rig and town. The rig was in well testing mode with an active ESD and EDQ safety system, with well pressures being monitored from the Workover Control System (WOC s). During this time drill-floor personnel were in a stand-by mode, the dog house was not manned full time, and generally the crew were awaiting further direction on the way forward. I decided to head inside the accommodation for dinner and shortly after entering the accommodation I heard a sequence of loud bangs which lasted about 3 seconds or so. The finger board located over 25 m in the derrick, struck by falling equipment note the angle. close the PWV, the ESD configured to close the TRSSV, SSXT valve and SSTT. The EQD would activate the ESD plus the RV close and unlatch function. A number of initiators were strategically located around the rig. Prior to the incident the well had been completed with the tubing hanger landed and locked in The lower sub of the surface flow tree, note the deformation the SSXT. The production packer had been set and tested. The well had been cleaned up (flowed back). The well was shut in at the well test choke manifold The subsea test tree after recovery to surface I also experienced the rig pitched or slew slightly. This was followed almost immediately by a loud high pitched gushing noise, much like a large airline breaking which lasted about 15 seconds. I knew instantly something was seriously wrong and was expecting alarms to sound any moment. I made my way towards the company office when I came across the driller and assistant drilling standing in the corridor of the accommodation soaking wet and in a state of shock or disbelief. I immediately put on my coveralls and went outside, I could immediately smell hydrocarbon and see fluid dripping off the derrick. I made my way to the IWOCS spooler to check the status of the SSTT. I observed the SSTT ball open pressure was fluctuating, maybe indicating fluid flow from the IWOC s system, I suspected the ESD had not been activated, but couldn t be sure To make certain the valves Copyright Well Test Knowledge Pty Ltd 13

14 were closed I manually vented the open lines at the IWOCS spooler. During this time the muster alarm sounded so I promptly made my way to the emergency muster point. The rig didn t perform an emergency evacuation, however down manned using helicopters to essential personnel only. PLC response to close hydraulic isolation valves and stop the hydraulic pump. Over time the system drained and the compensator piston bottomed out, this resulted in a further PLC response to close all isolation valves resulting in a pressure lock and compensator lock. During the initial inspection of the aftermath I could see the riser landing joint sticking out of the rotary table on a 15deg angle. The master bushings and been blown clear of the rotary table and were lying beside the dog house. The flowhead swivel was still attached to the landing joint, and I could clearly see the large 10 connection had parted below the flowhead, the stub-acme threads stripped clean. The 7 flowhead and wire-line BOP were seriously damaged and other bits of debris scattered across the drill-floor. I could also see a large section of the rig derrick had been badly twisted due to the impact forces. I hate to think what would have happened if personnel were on the drill floor, or in the derrick at the time. Very fortunately, no one was injured or killed Others I spoke with said they witnessed the elevators detach from the bails in compression, and the flowhead buckle in compression and free fall. Another roustabout witnessed the landing string shoot high into the derrick. Findings An examination of the hook load data revealed the string had experienced two locked tension and compression cycles prior to failure. The string parted on the second upward heave cycle. The down-hole gauge data indicated the well flowed for around 20 seconds prior to closing in at the SSTT. The stick up was measured approximately 5m higher than the original landing height, indicating that the string had also parted in a second location below the rotary table. Upon recovery it was found that the SSTT had parted at the latch and also at two other riser joint connections. The connections were found to be elongated appearing to show signs of compressional failure. Fortunately the SSTT was failsafe closed and had vented pressure when the latch parted. Interestingly no one activated the ESD during the incident. I wasn t involved in the investigation. It took a long time to complete. It appeared to be the result of a hydraulic leak across a pilot valve (rubber diaphragm failure). The leak initiated an automated Copyright Well Test Knowledge Pty Ltd 14

15 Glossary AHC: Active Heave Compensator is a motion compensator system, using a computer to control the draw works to pays out or draw in wire, in order to compensate for rig motion. API: American Petroleum Institute Bails: Steel extension arms which form part of the assembly used to support the work-string from the top drive. BOP: Blow Out Preventer is a safety critical component of the drilling rig that sits on the wellhead at the seabed and includes facility for isolating the well, including a set of shear rams capable of cutting pipe and a disconnect feature to release the rig from the well at the seabed. CTLF: Constant Tension Lift Frame, incorporating a passive compensator. This supports the completion work-string, facilitates pressure control equipment installation and incorporates a passive heave motion compensator. Draw works: The winch mechanism operated by the driller to raise and lower the main blocks (hook) in the derrick. EDP/LRP: Emergency Disconnect Package/Lower Riser Package, replace the drilling rig BOP. These devices interface directly with a subsea tree and provide much the same functionality as a drilling rig BOP but do away with the need for a separate marine riser. EQD: Emergency Quick Disconnect - an automated sequence of valve and latch functions followed by the subsea control equipment to isolate and disconnect from the well in an emergency. ESD: Emergency Shut Down refers to any automated or manual system which shuts off production from the well. This may refer both to subsea and / or surface shut down. FMEA: Failure Modes & Effects Analysis, a special study to examine a device or system in order to better understand how it may fail in operation and identify safeguards that can be implemented to prevent those failures. IADC: International Association of Drilling Contractors IWOCS: Integrated Work-Over Control System is the temporary umbilical control system installed to operate the functions on a subsea wellhead from a drilling rig. Marine Riser: A large diameter conduit, usually low pressure, between the drilling rig and the BOP on the sea bed. The completion and high pressure landing string tubing are conveyed through the marine riser. Moonpool: An opening through the lower deck of the rig which allows access to the sea for the various activities performed from the rig. MRU: Motion Reference Unit the sensor which detects rig motion. The draw works will be instructed to compensate based on the signal from the MRU. Open Water Riser: A particular form of intervention which takes place without the drilling rig BOP or marine riser. An EDP/LRP performs similar functions to that of the BOP and a high pressure riser replaces both the marine riser and the landing string. Non-Shearables: Anything which cannot be cut by the drilling rig BOP or EDP shear rams. These should be identified in advance so that procedures can be developed to minimize the time these may be situated across shear rams. Passive Compensator: A hydraulic / air system designed to absorb rig heave motion in order to prevent rig movement being transmitted to the workstring. PLC: Process Logic Card, a set of electronic components including microchip(s) programmed with a specific set of instructions which control the behaviour of a device such as the Active Heave Drawworks. PSD: Process Shut Down, is a switch or procedure to shut off production to a system from the well. Similar to an ESD, it may simply entail the activation of a single valve. Copyright Well Test Knowledge Pty Ltd 15