Managing Hazards during Pinned to Seabed Operations (1)

© Copyright Well Test Knowledge Pty Ltd 1

The Management of Hazards during Pinned to Seabed Operations.By: Paul Nardone, Graham Fraser, & Rita Painter. Revised 22 Aug 2016.Supported by:

AbstractThis article presents a review of the current industry approach to the perception of risk and the managment of the hazards on a floating rig or vessel connected at the seabed. The range of possible consequences covers everything from minor operational delay to catastrophic failure of the workstring. This article includes two first-hand accounts of events that resulted in severe damage to the rig structure and also incorporates feed-back from a survey of subject matter specialists to gauge a wider understanding of industry incidents and perception of risk.

Pinned to Seabed OperationsWhen conducting operations from a floating ves-

sel, certain tasks require the workstring (either a landing string or open water workover riser) to be physically attached at the seabed. Such tasks occur during completions, well interventions, workovers, and well testing operations. During these periods the upper part of the workstring is pulled into ten-sion by the draw-works, or in the case of an open water workover riser, tension may be applied us-

ing a combination of the riser tensioners and the draw-works. In all cases tension is applied primari-ly to reduce cyclic fatigue on the various workstring components. At the same time a device known as a motion compensator absorbs the movement of the rig or vessel, permitting the workstring to remain stationary and under constant tension. For the pur-poses of this article we will call these “pinned to seabed” operations.

The duration of pinned to seabed operations might vary considerably and is often measured in days. Consider a typical completion after it is locked to the wellhead. The range of commission-ing tasks that follow might include fluid displace-ment, setting a packer, pressure testing, wireline activities, and flowing the well to surface for un-loading and clean up. During this entire period the rig may experience a wide range of sea states and unpredictable motions. The reliability of the mo-tion compensator system is therefore an important safety consideration during these activities.

Certain failure modes in the motion compensa-

tor may result in a complete “lock up”, by which we mean a complete and rapid loss of compensating action. A lock up either in the riser tensioner sys-tem or the travelling block compensator may re-sult in a significant tension increase even for small vessel motions. The consequences would depend on water depth, sea state, and vessel heave. This article focuses primarily on the hazards associat-ed with the traveling block compensator, however

both traveling block and riser tensioner systems present inherent hazards during pinned to seabed operations.

One further general comment - we will focus on the hazards associated with a loss of motion com-pensation; one of the potential consequences of which might be catastrophic failure of the work-string. It is also possible that a similar consequence might eventuate from a loss of station keeping. Al-though station keeping issues are not the subject of this article, they would certainly be included in any comprehensive risk assessment study, in particular with regard to dynamically positioned vessels.

Heave MotionThe rise and fall motion experienced by a rig is

its effective heave; this should not be confused with pitch and roll or with wave height or other partic-ular measures of sea state. The actual motion of the rig at any given time is a function of several factors including wave height, wave direction, wave period and the swell motion of the sea. In practice it can be

“Experienced compensator lock up in 2008 when installing completions in well with water depth approx. 700m. Lock up was due to problem in PLC Card associated with Active Heave. No damage occurred but the draw-works were disabled due to lock up on Active Heave. Elec-tronics Technician had to reset the PLC to re-enable AHC.” Survey Contributor


difficult to predict accurately how a floating vessel will behave in any given sea state. Depending on rig type and location, heave motion can vary between fractions of a meter to over 6 meters. Weather fore-casting, however accurate, will not always provide an accurate prediction of rig heave because there are many variables some of which are characteris-tics of the rig itself. The unpredictability of these motions and their potential magnitude has signif-icant consequences for the safety of the rig and the way that risk is assessed. An important control for pinned to seabed operations is the predetermined operating envelope that defines limitations for a range of critical parameters; typically these include vessel offset, wave height and compensator stroke range.

Rig Motion CompensatorsIn general motion compensators fall into one of

two categories, passive or active. Within each cate-gory there are further subdivisions, but for the pur-

poses of our discussion these two general categories are adequate.Passive CompensatorsA Passive Compensator, in simple terms, plac-

es a piston cylinder between the hook supporting the workstring and the rig derrick structure. The tension applied to the workstring can be adjusted by changing the air pressure acting on one side of the piston. Hydraulic fluid on the other side of the

piston is regulated to and from an accumulator. As the rig rises and falls with the motion of the sea the tension on the hook changes. With each change in tension, the piston moves inside the cylinder, the corresponding change in pressure of the fluid acts

Survey Feedback: Passive Compensator Failure Modes

Hydraulic/PneumaticValve blockage or failure.Poor fluid qualityLeak in pistons Air entrained in hydraulic systemLoss of air/hydraulic supply due to hose or pump failureReaction time with respect to sea state

Mechanical Overload Chain failure Piston binding Cable failure on riser tensioner

Human Error Incorrect stroke adjustment - compensator “bottoms out”Incorrect accumulator pressure appliedIncorrect valve closureInadeqaute maintenance Inadequate or failure to follow procedures

Survey Feedback: AHC Failure Modes

Hydraulic System overrideMotion Reference Unit (MRU) failure

Software / PowerLoss of communication with MRU Synchro issuesLogic controlLoss of powerAnti Collision System engagesMotion Sensor faultPLC Module failureDraw-works Motor failureEncoder failureSoftware bugs

MechanicalStructural failure Frames/cylinders Control Console Wire Rope wear (Tonne Miles)

Human ErrorAccidental manual activation of e-stop

Design Over sensitive controlsPoor ergonomic layout of controls


to counteract the change in tension. In this way, the movement of the rig is absorbed by the motion of the piston inside the cylinder with fluid constantly moving to and from an accumulator, the net effect of which is a constant tension on the hook. A sim-ple way to think about it is to imagine the compen-sator acting like a spring expanding or contracting with the motion of the rig to maintain a constant tension on the workstring.

This type of compensator requires a reaction point, consider that a spring cannot expand or compress unless it is held at both ends, in other words, if the workstring is not in contact with any fixed point in the well there can be no change in tension on the piston. The compensator doesn’t do anything until the workstring is in contact with a reference point such as the wellhead.

Passive Compensators were involved in the 3 sig-nificant events documented in the IADC report ref-erenced in this article.

Active Heave CompensatorsWith the introduction of modern generation

deep-water rigs, the draw-works technology evolved to include electrically driven automated motion compensators, referred to as Active Heave Compensators (AHC). AHC technology has pre-dominantly been applied to the traveling block sys-tem, and not riser tensioners. AHC systems are inherently complex, and dependent amongst other things on the PLC logic programmed into the elec-tronics. In one instance just a greasy smudge on a

touch screen resulted in the computer interpreting the smudge as an instruction that resulted in a near miss incident in 2014.

The AHC works by accurately measuring the ves-sel motion in real-time using motion sensors. A computer directs the electric motors on the draw-works to pay out or take in wire in response to the vessel motion. In a black out scenario (total loss of electrical power), the system has no compensation back up and the break engages automatically. Ad-

ditionally, a blackout would render the draw-works inoperative, a situation that would leave crews pow-erless to take any meaningful action. There may be other failure modes associated with PLC control failure that might result in similar consequences.

The authors are not aware of any catastrophic loss of containment events associated with an ac-tive compensator. However, this may not reflect on their reliability but more on the fact that fewer op-erators tend to use active heave compensators when executing extended pinned to seabed operations.

Some new generation rigs have dual compensa-tors, combining active systems which are useful for precision control with passive systems which are often perceived as better suited to extended pinned to seabed operations.

The HazardEvery motion compensator, whatever its design,

has some potential for failure during the period the rig is pinned to seabed. There are failure-modes whereby this can occur rapidly and in such a man-ner that the compensator becomes rigidly locked. Should personnel on the rig not respond appropri-ately to early warning signs, the motion of the rig would be transmitted directly to the workstring. If the rig heave at the time were of sufficient magni-tude, it is probable that such an event would result in the catastrophic failure of the workstring either in tension or compression. The consequence se-verity is further increased if wireline or coil tubing personnel happen to be working in the derrick at

the time. Several holes in the Swiss cheese accident

causation model must line up for the above to oc-cur, and whilst they may be infrequent, they have happened; the paper IADC/SPE 59216 Uninten-tional Compensator Lock up Risks, Consequences and Measures, details three events of this nature that occurred in the North Sea during the 1990’s. Readers are also directed to the feedback from our survey which details different failure modes and a

Glomar Coral Sea - Drillship - 1984“...single Varco passive compensator 100 meters water depth, with large swells caused the Olmsted valve to close. No damage, stopped drilling WOW. Separate incident, same rig - Olmsted closed due to hose failure in the derrick. No Damage to equipment replaced hose.Separate incident, same rig - main air fluid float parted and caused the system to lock up. No damage stopped drilling to repair float.” Survey Contributor


range of issues known to have occurred. Our sur-vey has uncovered a number of events of varying degrees of severity and it seems only too likely that similar events must have occurred elsewhere. Be-cause of the potentially catastrophic consequences from this hazard, the risk must be analyzed in detail during the planning phase.

The oil & gas industry does not widely publicize and make available the data needed to quantify such risks with precision. In the face of such uncertainty, it is recommended that a conservative approach be

taken when developing safety strategies.

Tensile FailureRig heave cycles typically have periods ranging

between 8 and 30 seconds. If a compensator lock up occurred at the bottom travel of a heave cycle, in a matter of seconds the workstring would experi-ence a significant increase in tensile stress as the rig moved upwards. Without manual intervention, the pipe would initially undergo elastic stretch followed by a rapid increase in stress to yield point, failure would occur at the weakest point in the workstring at that instant; the location of the weak point how-ever, is another question. If the workstring were a free standing vertical pipe, the components near the top would experience greater stresses as a re-sult of the additional weight supported by the top connections. In practice however, the weak point may occur elsewhere as a result of stresses present for other reasons. For example, a compression or fatigue induced weak point, or stress arising from contact between a landing string and the marine riser; the magnitude of such stresses would be a function of the offset of the rig from well center. Riser analysis studies can be used to determine where the weak point would occur at increasing offset angles and operating conditions; such a study provides input for establishing a project specific op-erating envelope.

Understanding the weak point in the workstring

would also be helpful in assessing the full set of consequences from such an event. As an example, if the workstring did fail, then the shear joint at the BOP, or point just above the emergency disconnect package (EDP), would generally be the most desir-able location for failure to occur in order to preserve the availability of the well control equipment, BOP, diverter etc. Depending on water depth, hydrocar-bons escaping from a failed weak point might reach the drill floor in a matter of seconds or minutes. In some instances, it may be possible for the driller to

activate the diverter and reduce or possibly prevent a release to the drill floor.Recoil DamageThe energy released after the separation of the

workstring due to over-tension will act to generate upward thrust in the workstring components. Fur-thermore, any pressure contained in the workstring provides an additional energy source. The released pressure energy would be directed upwards to com-bine with the recoil forces.

Depending on the adopted strategy, safety sys-tems can be configured to contain the workstring contents above the designated weak point using a retainer valve arrangement. Experience has shown that the damage caused by such an event might be considerable with projectiles and dropped objects falling onto the drill floor as the various compo-nents dislodge and damage other structure in the derrick. See the Deepsea Trym case study described in this article.

The presence of hydrocarbons under pressure would add an escalation hazard in the form of fire and explosion. Though this is not known to have occurred in any recorded event, the potential is certainly there. The inventory of hydrocarbons would include the contents of the workstring, to-gether with additional hydrocarbons flowing from the well up to the point where the subsurface safety valve, the subsea test tree, or BOP was closed.

UK Sector North Sea 2006/2007 Water depth: 300-400 ft“While hung off at the wellhead for weather, but still connected to the drill string and

passively compensating, carrying a portion of the string weight, a wave came through that resulted in the semi-sub "dropping" fast into the "hole" in the sea. The rapid acceleration, coupled to the residual wt. being carried resulted in the Olmsted valve locking up, losing string compensation popping the connection on the hang off tool as the next wave came through.” Survey Contributor


Compression FailureShould a lock up event occur as the vessel was at

the top of a heave cycle, then the workstring would experience compression and buckling forces, made up from the weight of the string and the flowhead, combined with any compression imparted to the flowhead through the lifting bails, or tension frame as the rig moved downwards.

A number of outcomes are possible; in the case of the landing string, it may be that the entire landing string would squat down inside the marine riser, with helical buckling taking up most of the move-ment and the flowhead held more or less vertical; depending on the rigidity of the stick up joint and on the amount of downward heave. In the case of an open water work-over riser, the riser string

would buckle and likely suffer bending failure un-der its own weight.

In both cases without suitable support the flow-head is likely to fall over with the bail arms or tension frame articulating to one side at an angle corresponding to the amount of movement down-wards. We are aware of at least one incident where this type of failure has occurred without any loss of containment.

Analysis of the workstring on a case-by-case basis is recommended to evaluate what sort of buckling forces the tubulars and components would toler-ate before failure. Even if this event did not alone cause a loss of containment, the stresses induced during the buckling event might weaken compo-nents which would subsequently fail on an upward heave cycle when the same components went into tension.

Without some kind of intervention, the work-string will fail sooner or later. Therefore, the human factors, whether as a contributing cause to a failure, or as part of prevention and / or mitigation, must be included in any comprehensive discussion of this topic.

Human FactorsDuring a pinned to seabed operation, the role

of the driller is an important one because it is the driller who operates, monitors, and directs the ad-justment of the motion compensator according to changing conditions. He is also responsible for identifying early warning signs that the compen-

sator system is starting to deteriorate and for re-sponding to those warning signals. It follows that the driller should have a thorough understanding of this system.

How well does the driller understand the motion compensator system? Several incidents involving active heave compensators have occurred directly as a result of a misunderstanding about how the sys-tem works. The complexity of the latest generation of rigs contributes to the hazard. In one instance a driller performing a maintenance function on the drill floor was unaware that this action would automatically retract the hydraulic riser tensioner arms. At that time an individual was working in the moonpool about to insert a pin to lock the tension-er arm to the tension ring, the arm retracted auto-

matically and pinned the cherry picker in which the worker was standing against the moonpool wall; the worker had to be rescued using a man-riding tugger.

Human factors extend to the thoroughness and clarity of the work instructions and procedures de-veloped for the operation. Personnel conducting any kind of task during a pinned to seabed opera-tion must follow clearly written work instructions which have considered carefully all the hazards specific to the task. Are task focused personnel ful-ly aware of the criticality of the compensator sys-tems? Does the work instruction include guidance on monitoring and adjusting this system and the various appropriate responses to any deviation in compensator parameters, including emergency response? Have simulation drills been conducted to test the response of individuals to the range of possible failures? Are personnel fully cognizant of the operating envelope and who is monitoring the conditions to ensure none of the parameters are ex-ceeded?

The case studies show that the reaction of person-nel to these types of emergency are crucial both for prevention and mitigation.

Deep Water vs Shallow WaterThe greater the depth between the rig and the an-

chor point on the seafloor, the more pipe stretch and squat available before the workstring experi-ences excessive stresses. Should a lock up occur in moderate heave conditions, it is entirely possible

“Semi Submersible 2012: System lock up occurred during large swells in Bass Strait, stuck in the well for 8 days with parted drill string” Survey Contributor


the workstring would not experience the kind of stress that would cause an immediate failure; always provided the driller responds straight away. Some downsides in deep water are greater compressional loads, and an increased inventory of hydrocarbons in the workstring. There is also the potential to lose a significant hydrostatic head should the riser be evacuated by escaping gas after a landing string fail-ure, perhaps leading to a well control event.

The opposite is true in shallow water, with very lit-tle pipe elastic stretch or squat available, the work-string would experience over-tension or compres-sion to the point of failure rapidly.

Marine Riser vs Open Water RiserWith a conventional landing string inside a ma-

rine riser, a particular hazard is often identified by which the marine riser could act as a conduit for gas leaking from the landing string to the drill floor. This may direct planners to consider an open water riser intervention system. However, this assessment may only be valid in deepwater where gas leaking from the lower end of the open water riser might be expected to go into solution or to disperse by the time it reached the surface. In shallow water this advantage is doubtful since gas leaking from an open water riser at shallow depths would reach the surface beneath the rig over an extended area ex-posing the entire rig to a potentially explosive cloud rendering evacuation, if required, very difficult or

impossible.

Non-Shearable ItemsAssuming for a moment that a landing string parts

for one reason or another and a loss of containment occurs:- The most important next step is to isolate the well at the seabed. With a conventional marine riser / BOP setup, there are two devices available to achieve this, the first is the subsea test tree and the second is the rig BOP. In the case of an open water riser system, the EDP/LRP package provides the same functionality. During completion operations both systems typically have the subsurface safety valve as a tertiary option.

Anything situated across any of these devices that might compromise their ability to shear, close or seal must be considered during planning; examples of non-shearables might include wireline or slick-line tools, coiled tubing, and in certain circum-stances, perhaps hydrate.

Industry Codes & StandardsThere is no uniformly followed international stan-

dard when it comes to completion & workover riser design & specification. In part this might be due to the fact that the International Maritime Organiza-tion (IMO) stipulates that floating vessels must re-fer back to flag classification standards.

However, useful guidance can be found in API-RP-17G Recommended Practice for Completion/Workover Risers, currently in working draft form, which specifies the requirements for systems en-gineering to ensure that the subsea well interven-tion systems and components are fit for purpose. Overarching is the requirement for the operator to develop a safety strategy that provides system defi-nition for the safety, design, and operational prin-ciples of the system. This should include a summa-ry of the recognized and potential hazards during operations, and define the need for risk-reducing measures.

The safety strategy typically includes key design principles i.e. design should be fail-safe and be such as to ensure that no single failure will cause an unac-

ceptable risk. “Common cause failures shall be iden-tified and measures implemented to minimize their probability of occurrence.” & “For all operations, the system design shall account for the most unfavorable combination of functional, environmental, and acci-dental loads, which might occur simultaneously.”

Operating limitations for the system may be es-tablished by global riser analysis and Failure Mode Effects Analysis (FMEA). An FMEA is a study per-formed to evaluate the credible failure modes that might occur within a particular system. The study would identify weak points both mechanical and human factors together with characteristic early in-dicators of deterioration. The output from such a

“Had various experience’s over 16 years in the industry with both active and passive compensator lock up in the North Sea in varying water depths. In my experience the com-pensator lock up is almost always caused by inexperience in use of the compensator by todays drillers who are put in that role with no where near enough experience or training.” Survey Contributor


study would typically include a range of measures for example, a thorough service of the compensator system, early replacement of critical components, detailed inspections and a project specific set of monitoring controls to aid the driller.

Engineered ControlsWhen taken as a safety critical item and a single

point of failure, many organizations determine the need for an additional engineered safeguard to provide redundancy or mitigation against compen-sator lock up. There are a number of products on the market that may fulfill this need, these fall into two broad categories; redundant compensators and telescopic bail arms.

Redundant compensatorThe concept is simple enough; install an addition-

al compensator in series with the existing rig com-pensator. If one fails, then the other can take over

This temporary system would be installed in the derrick before the flowhead and may take the form of a Compensated Tension Lift Frame (CTLF) or an in-line compensator, both of which are passive systems.

These have been used successfully in different parts of the world and operate effectively as a pri-mary or secondary compensating device. Some additional hardware including accumulators, com-pressors and control modules would occupy signif-

icant space on deck and will interface the derrick mounted hardware through a network of umbil-icals. A system of this sort will require a crew of competent technicians to oversee installation and operation.

One of the issues to consider during planning when using a dual system is the transition between systems during normal operations or in an emer-gency.

Another consideratioin is the availability of both systems throughout the pinned to seabed opera-tion. It only requires that a control unit is unattend-

ed briefly, or for communications to be temporarily unavailable to render this safeguard ineffectual. In other words this engineered solution itself depends to some extent on procedural controls to assure availability.

A number of new generation rigs include a combi-nation of both active and passive systems, which are permanently installed and operate in parallel at all times. The passive system provides back up during power failure. As both systems run parallel, system switching or transferring complexity is removed.

Telescopic Bail ArmsAn alternative approach employs the use of tele-

scopic bail arms. Whilst these devices are not full blown compensators, they offer some of the bene-fits with reduced complexity. There are two general designs of telescopic bails, the first is mechanical-ly operated using shear pins and the second uses sealed pressurised nitrogen cylinders.

Telescopic bails are installed in the derrick using spreader beams making an arrangement very simi-lar to the CTLF. Should the rig compensator system fail the bail arms telescope to absorb the rig motion and protect the landing string. The mechanical sys-tem uses shear pins to prevent premature telescop-ing of the bails and is limited to protection from tensile loading only with little protection against compression or against recoil damage. This system has been used in service in a number of locations.

This system is self-contained with little or no addi-tional deck located hardware required during oper-ation. Similarly their reduced complexity involves very little additional personnel at the wellsite.

The newer nitrogen spring design offers protec-tion from both over-tension and compression using sealed and pressurised nitrogen cylinders which telescope only when a pre-set tension or compres-sion has been exceeded, the nitrogen cylinders also limit potential recoil damage from an over-tension event. At time of writing this newer design has not yet been used in service.

“Well Clean-up operation (ca. Fall 2012 timeframe) - Driller operated the wrong valve when attempting to increase compensator pressure. String parted and oil rained down on the drill floor. Layout and ergonomics of the panel was deemed the root-cause for the in-cident. - Another recommendation (consequence reduction) was to place the Subsea & ESD control panels away from the harms-way and to man these 24 / 7 during operations.” Survey Contributor


Rig SelectionSuppose an operator determined that a particular

type of compensator was inappropriate for pinned to seabed operations, it would follow from that de-cision that rigs fitted with that type of compensator system would be excluded from selection by the op-erator. An engineered solution such as the addition of a CTLF, may re-open the opportunity to select a rig that would otherwise be disqualified.

Availability of Contingency SystemOperators must also consider their response in

circumstances where the primary protection de-vice, the rig compensator is fully functional, but the back-up happens to be experiencing a problem. Since the risk assessment identifies the secondary system as a control, should it be unavailable for any reason, the operator is faced with the possibility of having to suspend operations even though the pri-mary system is working fine.

Controlled & Emergency UnlatchEvery pinned to seabed operation will incorporate

some means to disconnect the workstring at the seabed together with a means to isolate the well so as to prevent a release to the environment following disconnection. The interface between the drilling rig and the wellhead connector at the seabed will always include, either a hydraulic, or an electro-hy-draulic disconnect feature.

For the landing string system in a marine ris-er, this interface is the subsea test tree, and for open-water operations this will be the lower riser package (LRP) and Emergency Disconnect Package (EDP). Both systems are typically configured with push button ESD and EQD initiators, designed to follow a logic sequence to close the subsea barri-er elements at the subsea test tree or LRP and then physically unlatch the system above the barrier ele-ments so that the rig is no longer pinned to seabed. This process may take anything from seconds to minutes depending on the water depth and system configuration.

The unlatch feature is certainly a safeguard avail-able against compensator deterioration. However, whether it might be considered a full safeguard against every failure mode is a different question. Activation of this function requires human inter-vention, it does have some fail safe features, how-ever, there are circumstances where these features

might not be triggered. A rapid activation time, even if only 10 seconds, may not be adequate to prevent a catastrophic failure in circumstances where a sud-den loss of compensation has occurred and the rig is experiencing an upward heave at the same time, or during a black out when using an AHC system, although in both cases this will certainly isolate the well quickly.

ConclusionsThe consequences associated with compensator

lock up can and have been catastrophic, planning should therefore be conducted accordingly. The as-sessement of the risk together with the develope-ment of controls is a complex process involving a lot of variables many of which are operation specific, it follows that there should not be a prescriptive one size fits all solution. Based on what can be learned from industry experience we would prioritise the controls into the following order of importance:

1. Human Factors:2. Design Specification:3. Fit for Service Hardware:4. Additional Engineered Controls:Human Factors: Planning is an exercise in risk re-

duction, but is only effective to the extent that the people on the rig, those who are actually exposed, fully appreciate the nature of risks and have the re-sources they need to control them. These resourc-es include competent personnel, training, quality procedures, supervision, briefings, together with the drills and simulations performed to ensure that personnel can recognize and respond to all of the possible contingencies. The case histories show that the role of the driller in particular is an essential element in this equation.

Design Specification: By this we mean the un-derstanding of the safe working limitations of the entire system; including the tubulars, well control equipment, mooring/station keeping system and the compensator itself. Without thoroughly study-ing how the components of the landing string inter-act and what stresses they will experience in service, then it is would be difficult to state precisely what the safe operating envelope for the system will be.

Fit for Service Hardware: Why would you under-take a risk which involved potentially catastrophic conseqeunces with less than optimal hardware? It is only common sense that prior to undertaking an operation of this nature that all steps be taken to ensure that the compensator system is fully func-tional. Any planned maintenance or sub optimal


components should be addressed beforehand and tested thoroughly before operations commence.

Additional Engineered Control: We place this at the lowest priority, not because it is not important, but because an additional engineered control, such as a back up compensator, would only be required as a mitigation measure. Since prevention is better than cure, measures which prevent a situation from escalating to the point where an emergency system is required should be seen as preferred controls.

Ultimately inadequate perception of risk is likely to result with inadequate planning and greater risk during execution.

Supported by


Personal Account- Doug LowPolar Pioneer Semi Submersible Norway 1994

Water Depth: 332m

SummaryDuring a DST, while flowing the well through the surface well test plant and flaring oil and gas, the heave-com-pensator locked up and the test tubing parted below the flowhead at a pup joint connection about 2 meters above the rotary table, resulting in an uncontrolled release of hydrocarbons onto the drill floor and into the derrick.The control lines to the Subsea Test Tree remained intact after the failure of the landing string and manual activation of the Subsea Test Tree closure function was ultimately used to stop the hydrocarbon release. Rig contingency procedures recovered the situation, enabling removal of the parted pipe and reconnection of the flowhead.

Witness – Doug Low, Halliburton Senior Subsea Specialist, was present on the drill floor during the incident.

The compensator lock-up happened when the driller was attempting to adjust the settings of the compensator. I never actually saw clearly what hap-pened just prior to the lock-up but I recall that he said it locked up while (or just before) he was adjust-ing the height settings. I am unsure if it is possible to lock the compensator whilst altering its height as this, to my knowledge, is achieved by adding or removing pneumatic pressure to the compensator cylinders or by raising or lowering the blocks using the drawworks, and should have no effect on the lock mechanism. However, as I am no expert in this field the technical details should be verified on this point.

We were flowing just over 6000 bopd through a 40/64 fixed choke, burning on one boom, when the lock-up happened. Initially, we couldn’t get to the SSTT panel as

the roller door leading through the heavy tool store, which was the shortest and safest route to the SSTT control panel, could not be opened from the doghouse side and so we were forced to go out and across the drill floor through the oil and gas which was flowing freely through open ended tubing into an enclosed derrick. The driller hit the Subsea Test Tree (SSTT) shut-down button as we ran past the panel to safety and the flow started to subside as the SSTT closed. There was never, to my knowledge, any attempt made to close the shear ram. I went back up to the panel a minute or so later and closed the Subsea Lubricator Valves (SSLVs) as an added precaution. The personnel on the drill floor at the

time were extremely lucky to escape unharmed from this incident; there were three of us, the drill-er, Halliburton DST specialist and myself.

The incident did not make any headlines at the time and the only reference I ever saw to it was a very small column in the local Norwegian news-paper. However, the Stat Pollution Authority had a government plane out over the location, as soon as it was light the following day, in order to quantify and, presumably, photograph the oil spill.

In the aftermath of this incident, Norsk Hydro re-quired that our SSTT control panels be fitted with a low pressure pilot which would activate the clo-sure of the SSTT in the event that flowline pressure dropped below a predetermined value.


Feedback comments from 40 survey contributors.

The following list of comments are from our survey contributors responding to questions re-garding their own experiences of compensator issues. This list serves to indicate the frequency and variety of failure modes across different types of system.

“Crown Mounted Compensator (CMC) locked up due to deteriorated fluid condition and incorrect precharge on pilot accumulators - incorrect maintenance.”

“...lack of experience in using the compensator that directly led to damage”

“Some electronic issues that had to be rectified”

“Issues with synchronisation on a re-coil incident, we had to repair mechanical damage and exchange re-coil valves”

“Compensator or parts of top drive breaking up and falling to rig floor”

“Crown mounted active heave compensation system was programmed incorrectly and weight on bit fluctuations were 60klbs.”

“Crown mounted passive system on another rig continually caused problems due to too much friction in the system “experts” from supplier weren’t much help either”

“Drill String Compensator (single piston) developed leak during flow back / clean up of subsea de-velopment well. Intent had been to support completion riser only on the drill string compensator. However upper tension joint had been rigged up with lines from a tension ring to each of rig’s marine riser tensions, and this was brought into service to relieve load on DSC.”

“Drill String Compensator Olmsted Valve needed to be replaced.”

“leaks - drop off of tension support from compensator, required continuous monitoring and system re charging”

“Incorrect compensator operation leading to compensator stroking out fully and landing out on the beams due to rig heave. This at a time when a landing string was connected to the wellhead system.”

“Problems with PLC Card associated with AHC failed and draw-works locked up few times and PLC had to be reset every time compensator locked up. Damaged PLC Card was replaced and issue was never encountered after.”

“As rig heaved up the compensator failed resulting in the landing string pulling ~250 klbs over string weight”

“Seal leakage, position indication, lock bar indication and pressure sensor damage are the main fail-ures”

“Had various experience’s over 16 years in the industry with both active and passive compensator lock up in the North Sea in varying water depths. In my experience the compensator lock up is almost always caused by inexperience in use of the compensator by drillers ...with nowhere near enough experience or training.”

“Experienced compensator lockup in 2008 when installing completions in well with water depth ap-prox. 700m. Lock up was due to problem in PLC Card associated with Active Heave. No damage occurred but the draw-works were disabled due to lock up on Active Heave. Electronics Technician had to reset the PLC to re-enable AHC.”

“Semi Submersible Water Depth: 165 m June 2011: Landing String locked to TH while performing slickline operations Temporary failure while rig heaving up in min. swell (1-2m)” Landing string experienced overtension but did not fail.


Personal Account - Graham FraserDeepsea Trym Semi-Submersible

1998 Compensator Lock-up Incident

SummaryOn the Dec. 4 1998 at 18.21 the draw-works compensator system locked causing the landing string to

catastrophically fail. The 7” flowhead and 7” wireline pressure control equipment fell to the drill floor causing significant damage to equipment, derrick structure and draw-works. The well flowed hydrocar-bons through the open ended landing joint for a period of 17 secs until the SSTT closed and secured the well. Fortunately no one was injured during the incident.

Operation SummaryThe Deepsea Trym was in the process of complet-

ing an oil producer well in the Norwegian sector of the North Sea. The rig was moored on location in approximately 150m water. It was winter and the rig was experiencing approximately 2-4m heave cycles which is typical for that time of year. The well was one of many already completed in the field of sim-ilar design. The completions were standard for the region which included a 5-1/2” completion string

and horizontal tree technology. The Completion and tubing hanger system was deployed on a land-ing string system configured with a direct hydraulic 7” Subsea Test Tree (SSTT), run on a heavy duty production riser. The surface package included a 7”

flow head and 7” wire-line BOP’s suspended using a 40’ bail arrangement.

The SSTT was the primary subsea well control de-vice for the operation. The SSTT included dual ball valves and an emergency unlatch system. . The BOP

Landing string stick up 5 m higher than its original postion at an angle with master bushings dislodged

from recess.

Surface flow tree disconnected from landing string and lodged in derrick.

Derrick equipment dislodged and dropped to the drill floor


middle pipe rams were closed on the 9-5/8” ported slick-joint located below the SSTT. The system also included a shear sub positioned across the BOP shear rams with a Retainer Valve positioned above

The instrument safety system included a PSD, ESD and EQD configured with the IWOCS pack-age. Upon activation the PSD was configured to

close the PWV, the ESD configured to close the TRSSV, SSXT valve and SSTT. The EQD would ac-tivate the ESD plus the RV close and unlatch func-tion. A number of initiators were strategically lo-cated around the rig.

Prior to the incident the well had been complet-ed with the tubing hanger landed and locked in

the SSXT. The production packer had been set and tested. The well had been cleaned up (flowed back). The well was shut in at the well test choke manifold

at the time to investigate a tubing to annulus leak.

The incident Throughout the afternoon the well was shut in at

the PWV (PDS) whilst troubleshooting was on-going to determine the cause of leak between the tubing and annulus. Lots of telephone calls ongo-ing between the rig and town. The rig was in well testing mode with an active ESD and EDQ safety system, with well pressures being monitored from the Workover Control System (WOC’s). During this time drill-floor personnel were in a stand-by mode, the ‘dog’ house was not manned full time, and generally the crew were awaiting further direc-tion on the way forward. I decided to head inside the accommodation for dinner and shortly after entering the accommodation I heard a sequence of loud bangs which lasted about 3 seconds or so.

I also experienced the rig pitched or slew slightly. This was followed almost immediately by a loud high pitched gushing noise, much like a large air-line breaking which lasted about 15 seconds.

I knew instantly something was seriously wrong and was expecting alarms to sound any moment. I made my way towards the company office when I came across the driller and assistant drilling stand-ing in the corridor of the accommodation soak-ing wet and in a state of shock or disbelief. I im-mediately put on my coveralls and went outside, I could immediately smell hydrocarbon and see flu-id dripping off the derrick. I made my way to the IWOCS spooler to check the status of the SSTT. I observed the SSTT ball open pressure was fluctuat-ing, maybe indicating fluid flow from the IWOC’s system, I suspected the ESD had not been activat-ed, but couldn’t be sure To make certain the valves

The finger board located over 25 m in the derrick, struck by falling equipment note the angle.

The lower sub of the surface flow tree, note the deformation

The subsea test tree after recovery to surface


were closed I manually vented the open lines at the IWOCS spooler. During this time the muster alarm sounded so I promptly made my way to the emergency muster point. The rig didn’t perform an emergency evacuation, however down manned us-ing helicopters to essential personnel only.

During the initial inspection of the aftermath I

could see the riser landing joint sticking out of the rotary table on a 15deg angle. The master bushings and been blown clear of the rotary table and were lying beside the dog house. The flowhead swivel was still attached to the landing joint, and I could clearly see the large 10” connection had parted be-low the flowhead, the stub-acme threads stripped clean. The 7” flowhead and wire-line BOP were se-riously damaged and other bits of debris scattered across the drill-floor. I could also see a large sec-tion of the rig derrick had been badly twisted due to the impact forces. I hate to think what would have happened if personnel were on the drill floor, or in the derrick at the time. Very fortunately, no one was injured or killed

Others I spoke with said they witnessed the ele-vators detach from the bails in compression, and the flowhead buckle in compression and free fall. Another roustabout witnessed the landing string shoot high into the derrick.

FindingsAn examination of the hook load data revealed

the string had experienced two locked tension and compression cycles prior to failure. The string parted on the second upward heave cycle. The down-hole gauge data indicated the well flowed for around 20 seconds prior to closing in at the SSTT. The stick up was measured approximately 5m high-er than the original landing height, indicating that the string had also parted in a second location be-low the rotary table. Upon recovery it was found that the SSTT had parted at the latch and also at two other riser joint connections. The connections were found to be elongated appearing to show signs of compressional failure. Fortunately the SSTT was failsafe closed and had vented pressure when the latch parted. Interestingly no one activated the ESD during the incident.

I wasn’t involved in the investigation. It took a long time to complete. It appeared to be the result of a hydraulic leak across a pilot valve (rubber di-aphragm failure). The leak initiated an automated

PLC response to close hydraulic isolation valves and stop the hydraulic pump. Over time the sys-tem drained and the compensator piston bottomed out, this resulted in a further PLC response to close all isolation valves resulting in a pressure lock and compensator lock.


Glossary

AHC: Active Heave Compensator is a motion compensator system, using a computer to control the draw works to pays out or draw in wire, in order to compensate for rig motion.

API: American Petroleum Institute

Bails: Steel extension arms which form part of the assembly used to support the work-string from the top drive.

BOP: Blow Out Preventer is a safety critical com-ponent of the drilling rig that sits on the wellhead at the seabed and includes facility for isolating the well, including a set of shear rams capable of cut-ting pipe and a disconnect feature to release the rig from the well at the seabed.

CTLF: Constant Tension Lift Frame, incorporat-ing a passive compensator. This supports the com-pletion work-string, facilitates pressure control equipment installation and incorporates a passive heave motion compensator.

Draw works: The winch mechanism operated by the driller to raise and lower the main blocks (hook) in the derrick.

EDP/LRP: Emergency Disconnect Package/Low-er Riser Package, replace the drilling rig BOP. These devices interface directly with a subsea tree and provide much the same functionality as a drilling rig BOP but do away with the need for a separate marine riser.

EQD: Emergency Quick Disconnect - an auto-mated sequence of valve and latch functions fol-lowed by the subsea control equipment to isolate and disconnect from the well in an emergency.

ESD: Emergency Shut Down refers to any auto-mated or manual system which shuts off produc-tion from the well. This may refer both to subsea and / or surface shut down.

FMEA: Failure Modes & Effects Analysis, a spe-cial study to examine a device or system in order to better understand how it may fail in operation and identify safeguards that can be implemented to prevent those failures.

IADC: International Association of Drilling Con-tractors

IWOCS: Integrated Work-Over Control System is the temporary umbilical control system installed to operate the functions on a subsea wellhead from a drilling rig.

Marine Riser: A large diameter conduit, usually low pressure, between the drilling rig and the BOP on the sea bed. The completion and high pressure landing string tubing are conveyed through the ma-rine riser.

Moonpool: An opening through the lower deck of the rig which allows access to the sea for the various activities performed from the rig.

MRU: Motion Reference Unit the sensor which detects rig motion. The draw works will be in-structed to compensate based on the signal from the MRU.

Open Water Riser: A particular form of inter-vention which takes place without the drilling rig BOP or marine riser. An EDP/LRP performs simi-lar functions to that of the BOP and a high pressure riser replaces both the marine riser and the landing string.

Non-Shearables: Anything which cannot be cut by the drilling rig BOP or EDP shear rams. These should be identified in advance so that procedures can be developed to minimize the time these may be situated across shear rams.

Passive Compensator: A hydraulic / air system designed to absorb rig heave motion in order to prevent rig movement being transmitted to the workstring.

PLC: Process Logic Card, a set of electronic com-ponents including microchip(s) programmed with a specific set of instructions which control the be-haviour of a device such as the Active Heave Draw-works.

PSD: Process Shut Down, is a switch or procedure to shut off production to a system from the well. Similar to an ESD, it may simply entail the activa-tion of a single valve.


PWV: Production Wing Valve refers to the valve on a production flowhead, or production tree, through which fluid from the well flows to a pro-duction system such as a well test package. This valve is typically connected to the ESD system.

Shearables: Anything that can be cut by the drill-ing rig BOP or the EDP shear rams e.g. pipe, wire, coil tubing.

SPE: Society of Petroleum Engineers

SSTT: Subsea Test Tree is a special safety valve de-signed to interface a drilling BOP situated on the sea bed. The SSTT incorporates valves which iso-late the well and a latch feature which provides rap-id disconnect of the landing string at the sea bed.

SSXT: Subsea Production Tree refers to the man-ifold of valves and controls situated on the seabed through which production from the well is con-trolled.

Unlatch: The ability of a subsea safety device to separate into two parts, the lower part containing well barriers whilst the upper part releases the up-per workstring for recovery to surface.

WOW: Waiting On Weather

ReferencesAPI-RP-17G Recommended Practice for Comple-

tion/Workover Risers (Currently working draft)

IADC/SPE 59216 Unintentional Compensator Lockup Risks, Consequences and Measures

DNVGL-OS-E101, chapter 2, section 5, part 4 – Heave compensation and tensioning system (techni-cal requirements to compensation systems).

NORSOK D-001, chapter 6.7 (technical require-ments to compensation systems).

Managing Hazards during Pinned to Seabed Operations (1)

Documents

Transcript of Managing Hazards during Pinned to Seabed Operations (1)