Vesterkjaer PDF

Is it necessary to install a downhole
safety valve in a subsea oil/gas well?

A comparison of the risk level of a
well with, and without a safety valve.
Diploma thesis
By
stud.tech
Rune Vesterkjr
June 2002
Department of Production and Quality Engineering

Norwegian University of Science and Technology
Is it necessary to install a downhole safety valve in a subsea oil/gas well?
Preface
This report presents the results of a diploma thesis by Stud. Techn. Rune Vesterkjr,
completed at the Department of Production and Quality Engineering, Norwegian University
of Science and Technology. The work has been performed from January 2002 through May
2002.
The evaluation, analysis and calculations performed have been subjected to a number of
assumptions, limitations and definitions of system boundaries, all of which are stated further
in the report.
The author will accept no liability for conclusions being deduced by readers of the report. The
results derived in this report are based on a limited amount of sources. Caution should be
taken when using the results from this report further. A greater amount of reliability data must
be gathered to make use of the values calculated in the report.
I would like to thank my supervisors Prof. Marvin Rausand, the Norwegian University of
Science and Technology and Geir-Ove Strand, ExproSoft AS for valuable comments and
contributions to this diploma thesis. I would also like to thank Stein Brre Torp at Statoil
sgard RESU for providing information concerning well intervention, Ivar Ove Endresen at
Statoil for providing HAZOP information, and the rest of the staff at ExproSoft AS for
helping me when needed.
Trondheim, 2002-06-05
Rune Vesterkjr
Diploma thesis, NTNU 2002 I

Summary and conclusions

The overall objective of this diploma thesis is to develop an understanding of the contribution
a downhole safety valve (DHSV) represents to the overall risk in a subsea oil/gas well. The
contribution the DHSV represents to the overall risk during installation, production and well
intervention is considered.
Norway and the United States of America have specific requirements of subsurface safety
devices like the DHSV. There are no specific requirements in the UK regulations for a DHSV.
The Norwegian Petroleum Directorate (NPD) requires that there at all times shall be at least
two independent and tested well barriers during well activities. Other countries have similar
requirements.
Acceptable level of risk in an activity is described by acceptance criteria. Combining

acceptance criteria with the ALARP-principle solves acceptable risk problems. The
Norwegian Oil Industry Association has developed a list of minimum safety integrity levels
(SIL). The SIL requirement concerning the shut-in of the flow in a well (Wing valve, Master
valve and DHSV) is set to 3. It is therefore reasonable to require the SIL of the well without a
DHSV to be the same.
There are two main risk factors regarding oil/gas production, delays in time (lost production)
and the blowout risk. Lost production occurs when the well is unable to produce as expected
due to different problems, and is equal to economic loss in oil production. Risk related to the
installation and completion of a subsea oil/gas well is mainly related to blowout risk and time
delays. Production related risk comprises economic and environmental risk. The workover
risk is represented mainly by time delays and the blowout risk.
A case example is included illustrating the effect of a DHSV. A comparison of unavailability

calculations for a well with, and without a DHSV proves the effect of a DHSV. Barrier
diagrams and fault trees are constructed providing a basis for the calculations and illustrating
the leakage paths.
Fault trees display the interrelationships between a potential critical event in a system and the
reasons for this event. The TOP event of the fault tree analysis in this study is formulated,
Sustainable leakage to the surroundings through either the x-mas tree or the wellhead during
normal shut-in conditions.
Unavailability calculations are done in regard to the two exampled situations. The Mean
Fractional Dead Time (MFDT) model is applied in the calculations. MFDT can be given two
different meanings; the percentage of time where we are unprotected by the safety function, or
the probability that the safety function will fail on demand.
An introduction to well intervention methods and equipment is given in the thesis. There are
two types of well interventions, light and heavy (also known as workover). A blowout
preventer (BOP) system is a set of valves installed on the wellhead to prevent the escape of
pressure either in the annular space between the casing and tubing during drilling, completion
and workover operations.
HAZOP (Hazard and Operability analysis) is a method used to identify and assess problems
that may represent risks to personnel or equipment, or prevent efficient operation. Essentially
Diploma thesis, NTNU 2002 II

the HAZOP procedure involves taking a full description of a process or a procedure and
systematically question every part of it by the use of guide-words.
A HAZOP of the BOP handling procedure during workover is performed. The most frequent
finding in this HAZOP is the need for preparation before the different operations begin and
securing of the subsea equipment. The main hazards related to the BOP handling procedure
are delays in operation, dropped BOP and leakage to sea. If the operation is delayed it will
result in lost production and extra cost related to hiring of a workover rig and other
equipment. If the BOP is dropped this will always lead to a time delay, but more serious
scenarios may also occur.
Based on the quantitative findings in this study the DHSV reduces the risk of blowout. A
removal of the DHSV represents an increased failure probability, and two independent and
tested well barriers are not present in all cut sets. None of the cut sets do, however, violate a
required SIL3 level when the DHSV is removed from the completion.
The blowout frequency caused by the DHSV during workover is 1.7E-4 per well year, and
8.5E-5 per well year for a well without a DHSV. During production the blowout frequency is
found to be 4.47E-3 per well year for a well with a DHSV, and 1.85E-2 per well year when
the DHSV is removed. In addition to the blowout frequency during production and workover
a blowout frequency caused by accidental events should be included. The total blowout
frequency is found adding up the different contributions:
ftotal = fproduction + fintervention + (faccidential event * MFDTaccidential event)
The DHSV blowout frequency contribution during installation is not included in this study.
There is no data revealing the changes in blowout frequency when the DHSV is removed for
the installation phase.
The blowout frequencies found in the calculations are of very high. In total a removal of the
DHSV increases the blowout frequency. It is reasonable to believe that the calculations in this
report are either based on insufficient data, a bad model or calculated errors. Other factors
may also have contributed to the high frequency.
An alternative calculation method based on the proportion of the frequencies of the TOP-
events, and the experience data found in ref.[7] is applied. In the new calculations a removal
of the DHSV will increase the blowout frequency of 3.0E-5 per well year. The author finds
this result more reasonable.
50% of the shut-ins of a well leading to a workover are caused by a DHSV failure. A DHSV
failure requires a workover generating a loss of oil production of up to $5,6 million. In
addition there will also be expenses concerning the rental of a workover rig. A total cost of 20
million dollars per intervention is therefore not unrealistic.
The author cannot recommend removing the Downhole safety valve (DHSV) from a subsea
oil/gas production well based on the findings in this thesis. Although there may be some
economic advantages in removing the DHSV the risk of blowout should be given the greatest
attention. In addition to causing pollution, the occurrence of a blowout may in severe cases
lead to a bad reputation among consumers and environmental organisations. The
consequences of a bad reputation are hard to estimate.
Diploma thesis, NTNU 2002 III

A set of recommendations for further work regarding the work done in this thesis is given at
the end of the report.
Diploma thesis, NTNU 2002 IV

List of Acronyms and Abbreviations
AMV - Annulus master valve

AMVEXL - Annulus master valve external leakage
API - The American Petroleum Institute
ASWV - Annulus swab valve
AWV - Annulus wing valve
BOP - Blowout Preventer
CARA - Computer Aided Reliability Analysis
CLW - Control line to well communication (DHSV)
DHSV - Downhole safety valve
ESD - Emergency Shut Down
EXL - External Leakage
FAR - Fatal accident rate
FAR - Fatal accident rate
FSC - Fail Safe Close
FTA - Fault Tree Analysis
FTC - Fail To Close
GoM - Gulf of Mexico
HAZID - Hazardous identification analysis
HAZOP - Hazardous operation analysis
HID - The Hazardous Installations Directorate, UK
HSE - The Health and safety executive, UK
ISO - The International Organization for Standardization
ITL - Internal leakage
LCP - Leakage in Closed Position
MMS - The Minerals Management Service
MTTF - Mean Time To Failure
MV - Production Master Valve
MVEXL - Production Master valve External leakage
NORSOK - The competitive standing of the Norwegian offshore
sector
NPD - The Norwegian Petroleum Directorate
NTNU - Norwegian University of Technology and Science
OCS - Outer Continental Shelf
OLF - Norwegian Oil industry association
PLL - Potential Loss of Life
PMV - Production master valve
PP - Production packer
QRA Quantitative Risk Analysis
ROV - Remote operated vehicles
SA - Seal assembly
SCSSV - Surface Controlled SubSurface Safety Valve
SIL - Safety integrity level
SPE - Society of Petroleum Engineers
SWAB - Swab Valve
TAC - Tubing to Annulus communication
TaDHSV - Tubing above DHSV
Diploma thesis, NTNU 2002 V

TbDHSV - Tubing below DHSV

ThPb Tubing hanger seal on annulus bore side
ThT - Tubing hanger seal on production bore side
TIF - Test Independent Failures
TOP - Top cap flange
TRSCSSV - Tubing Retrievable Surface Controlled SubSurface Safety
Valve
US - United States of America
WH - Wellhead
WO - Workover
WRSCSSV - Wireline Retrievable Surface Controlled SubSurface
Safety Valve
WV - Wing valve
XOL Crossover line
XOV - Crossover valve
XOVEXL - Crossover valve external leakage
XOVITL - Crossover valve internal leakage
Diploma thesis, NTNU 2002 VI

Contents
Preface.........................................................................................................................................I
Summary and conclusions......................................................................................................... II
List of Acronyms and Abbreviations ........................................................................................ V
Contents...................................................................................................................................VII
List of figures ........................................................................................................................... IX
List of tables ............................................................................................................................. IX
1 Introduction ........................................................................................................................ 1
1.1 Objectives................................................................................................................... 1
1.2 Limitations ................................................................................................................. 2
1.3 Report structure .......................................................................................................... 3
2 Rules and regulations ......................................................................................................... 4
2.1 Norway ....................................................................................................................... 4
2.2 United Kingdom......................................................................................................... 4
2.3 United States of America ........................................................................................... 5
2.4 Standard organizations ............................................................................................... 5
2.5 Regulatory challenges ................................................................................................ 5
3 Use of acceptance criteria .................................................................................................. 7
3.1 The ALARP principle ................................................................................................ 8
3.2 Safety integrity level (SIL)......................................................................................... 9
4 Overall risk assessment .................................................................................................... 11
4.1 Consequences ........................................................................................................... 11
4.1.1 Economic.......................................................................................................... 12
4.1.2 Blowouts........................................................................................................... 12
4.2 Installation related risk ............................................................................................. 14
4.3 Production related risk ............................................................................................. 14
4.4 Workover related risk............................................................................................... 15
5 Risk reducing effect of a DHSV ...................................................................................... 17
5.1 Case example............................................................................................................ 17
5.1.1 Production tree ................................................................................................. 17
5.1.2 Production well ................................................................................................ 18
5.2 Barrier analysis......................................................................................................... 21
5.2.1 Case example.................................................................................................... 21
5.3 Fault Tree Analysis .................................................................................................. 25
5.3.1 Case example.................................................................................................... 25
5.4 Unavailability calculations....................................................................................... 26
5.4.1 The Mean Fractional Dead Time calculation model........................................ 26
5.4.2 Calculations done in CARA............................................................................. 28
5.4.3 Calculations done by hand ............................................................................... 28
5.4.4 CARA calculation results................................................................................. 29
5.4.5 Hand calculation results ................................................................................... 30
5.5 Risk reducing findings in the Case example ............................................................ 33
5.5.1 Comments to the risk reducing findings .......................................................... 35
6 Well intervention.............................................................................................................. 36
6.1 Intervention types..................................................................................................... 36
6.1.1 Light intervention............................................................................................. 36
6.1.2 Heavy intervention (workover) ........................................................................ 36
6.1.3 Workover equipment........................................................................................ 36
Diploma thesis, NTNU 2002 VII

6.1.4 Well intervention example ............................................................................... 38

6.2 HAZOP (Hazard and Operability Analysis) ............................................................ 42
6.2.1 Background ...................................................................................................... 42
6.2.2 HAZOP methodology ...................................................................................... 43
6.2.3 HAZOP of the BOP handling procedure.......................................................... 45
6.2.4 The BOP handling procedure........................................................................... 45
6.2.5 The HAZOP analysis ....................................................................................... 47
6.2.6 Result of the HAZOP analysis ......................................................................... 52
7 Conclusions and recommendations for further work ....................................................... 53
7.1 Conclusions .............................................................................................................. 53
7.2 Recommendations for further work ......................................................................... 55
8 References ........................................................................................................................ 56
9 Appendices ....................................................................................................................... 58
Diploma thesis, NTNU 2002 VIII

List of figures
Figure 3-1 Levels of risk and the ALARP principle [32] .......................................................... 9
Figure 4-1 Consequence breakdown structure of the installation of a subsea production well11
Figure 4-2 Consequence breakdown structure of normal production on a subsea production
well ................................................................................................................................... 11
Figure 4-3 Consequence breakdown structure of a workover on a subsea production well .... 12
Figure 5-1 Horizontal X-mas tree from the sgard field [24] ................................................. 18
Figure 5-2 A sketch of the production well used as an example in this thesis......................... 20
Figure 5-3 Barrier diagram for an oil/gas producing well with a DHSV................................. 23
Figure 5-4 Barrier diagram for an oil/gas producing well without DHSV .............................. 24
Figure 5-5 A plot comparing the approximation and the general formula of unavailability. .. 27
Figure 5-6 The parallel structure of two tested barriers ........................................................... 29
Figure 5-7 A fault tree illustrating the scenario when the flow has to be shut in due to a crisis
.......................................................................................................................................... 32
Figure 5-8 Sensitivity analysis of the total blowout frequency at different frequencies of
accidental events per well year......................................................................................... 34
Figure 6-1 A conventional subsea blowout preventer stack .................................................... 38
Figure 6-2 Flow chart of a HAZOP examination procedure (based on [2]) ............................ 44
Figure 6-3 A typical blowout preventer used on subsea wells................................................. 46
List of tables
Table 3-1 Experienced overall FAR values for offshore workers in the UK, Norway, and U.S.
GoM OCS, January 1980-January 1994 [7]....................................................................... 8
Table 3-2 Safety integrity levels for safety functions operating on demand or in a continuous
demand mode from IEC 61508-1, Table 2 and 3)[28]..................................................... 10
Table 3-3 Minimum SIL requirements - global safety functions, an extract [28] ................... 10
Table 4-1 Blowout frequencies as input to risk analysis of offshore installations, both subsea
and platform wells [7] ...................................................................................................... 13
Table 5-1 The unavailability of the TOP-event for a well with and without a DHSV at
different points of time t and the annual average calculated in CARA............................ 30
Table 5-2 The unavailability of selected cut sets concerned by the presence of a DHSV....... 30
Table 5-3 Calculation result of the cut sets with an applied lifetime of t=5years, t=10years and
t=15years .......................................................................................................................... 31
Table 5-4 Increased unavailability of the different cut sets when the DHSV is removed ....... 31
Table 5-5 The blowout frequency per well year for a well with and without a DHSV, and the
risk reducing effect of the DHSV..................................................................................... 34
Table 6-1 Advantages and disadvantages with the HAZOP analysis [9] (with some
supplements of the author.) .............................................................................................. 43
Table 6-2 HAZOP work sheet of the BOP handling procedure............................................... 48
Diploma thesis, NTNU 2002 IX

1 Introduction
Subsea installations are expensive to repair. If a failure occurs a workover rig is needed to
perform an intervention. The weather conditions in the area also affect the situation and repairs
may take a long time. Accidents have to be avoided, and the production loss kept to a
minimum for the situation to be viable. High reliability is therefore essential for all subsea
production systems.
According to regulations issued by the Norwegian Petroleum Directorate and the U.S. Mineral
Management Services (MMS), a Downhole Safety Valve (DHSV) is required in all production
and injection wells. The DHSV functions as a safety barrier. If a critical situation occurs the
DHSV may shut-in the flow from the reservoir and prevent a disaster.
The DHSV protects the surroundings when it functions as intended during production. Studies
have shown that 50% of all well interventions are caused by DHSV failure [25]. During well
intervention the risk of blowout is increased to an essential degree compared to the production
phase. The consequences related to subsea production blowouts are not of the same proportions
as for a platform well. Human risk is dramatically reduced when the well is not in direct
connection with the platform. All available reliability data is provided mainly from platform
wells. Due to the reduced human risk it is therefore reasonable to assume that subsea wells are
subject to a lower risk level.
Some experts say that the risks related to well intervention caused by DHSV failure is equal or
higher than the risk reduction a fully functioning DHSV represents. The need for a DHSV in a
subsea well is therefore not considered necessary in a subsea well. A paper was issued in the
Society of Petroleum Engineers (SPE) in 1999 [4] concerning this matter. The basis for the
statements made here is not well founded [19]. A better and more precise evaluation of the role
of the DHSV is needed before a conclusion can be stated.
1.1 Objectives
The overall objective of this diploma thesis is to develop an understanding of the contribution a
downhole safety valve (DHSV) represents to the overall risk in a subsea oil/gas well. This
diploma thesis will focus on the risk related to a DHSV at different phases during its lifetime.
The contribution the DHSV represents to the overall risk during installation, production and
well intervention is considered.
The objectives are as follows:
a) Give an overview of the requirements related to safety barriers and downhole safety
valves (DHSV), in Norway, the United Kingdom and the United States of America.
b) Introduce the reader to the use of acceptance criteria within offshore oil/gas production.
Explain the use of the ALARP-principle and the Safety Integrity Level (SIL) in
solving acceptable risk problems.
Diploma thesis, NTNU 2002 1

c) Find the risk reducing effect of a DHSV in a subsea oil/gas well. A case example will
be used to illustrate the effect. Barrier diagrams, fault trees and unavailability
calculations are used in the assessment.
d) Comment the consequences related to an unwanted event in the different life phases of
a well. Illustrate the economic and environmental effect in form of blowouts and lost
production.
e) Identify and describe risk related to the installation, production and workover phases of
a well.
f) Describe the different types of intervention and the most important intervention
equipment. This is done will be order to provide a basis for a HAZOP of the BOP
handling procedure in a workover situation.
g) Introduce the reader to the use of HAZOP as a risk assessment tool. Use the HAZOP
method to perform a detailed risk analysis on a part of a well intervention.
h) Give a recommendation to whether or not a DHSV should be installed in a subsea

oil/gas well from a risk point of view. The recommendation is based on the findings in
the thesis.
1.2 Limitations
The contents of System Reliability Theory [8] are assumed known to the readers of this report.
This includes the principles of fault tree analysis and reliability definitions. A limited
understanding of oil production is also required, although a brief introduction to subsea oil
production is given in appendix A.
The included rules and regulations concerning the presence of a Downhole Safety Valve
(DHSV) are limited to those of Norway, the United Kingdom and the United States of
America.
Due to lack of provided cost information from the operation companies, part four of the
diploma task is removed in agreement with Prof. Marvin Rausand, supervisor.
When identifying the risk reducing effect of a downhole safety valve (DHSV) is the case
example only the barrier situation to prevent leakage to the surroundings during a normal
shut-in will be modelled. External factors affecting the barrier situation like sabotage,
earthquakes and environmental influence on the well will not be applied to the barrier scenario.
The barriers analysed in the unavailability calculations are considered to be independent and
common failures are not included.
A HAZOP analysis of a well intervention is too extensive to be fully performed in this thesis.
Therefore the HAZOP is restricted to the BOP handling procedure, in understanding with Prof.
Marvin Rausand.

1.3 Report structure

The report structure of this thesis is evolved around seven chapters. Necessary background
information and a presentation of the diploma thesis is given in chapter one. Different
objectives and limitations set by the author are also presented here.
In chapter two overview of the different rules and regulations concerning the presence of a
Downhole Safety Valve issued in Norway, U.K. and the U.S. are presented.
The third chapter gives an introduction to the use of acceptance criteria in a risk assessment.
The ALARP-principle and use of a safety integrity level (SIL) are explained to perform a
evaluation basis for the assessment done in the following chapters.
A qualitative overall risk assessment with respect to the completion, production and workover
phase of a well is performed in chapter four. Chapter five presents the risk reducing effect of a
DHSV. Unavailability calculations are done to give quantitative results of the risk reducing
effect.
Chapter six looks into well intervention and provides a basis for an intervention where the
DHSV is replaced. A HAZOP analysis is carried though to reveal weaknesses in the BOP
handling procedure.
The final chapter, seven, concludes the thesis. The authors recommendation to whether or not
a DHSV should be present in a subsea well is given. Recommendations for further work are
also provided.

2 Rules and regulations

This chapter will give an overview of the requirements related to safety barriers and having a
downhole safety valve (DHSV), in Norway, the United Kingdom and the United States of
America.
2.1 Norway
In Norway, the following requirements to well barriers are included in the regulations from the
Norwegian Petroleum Directorate (NPD):
Section 76:
During drilling and well activities there shall at all times be at least two independent
and tested well barriers after the surface casing is in place, cf. also the Facilities
Regulations Section 47 on well barriers.
If a barrier fails, no other activities shall take place in the well than those
intended to restore the barrier.[29]
Section 47:
Well barriers shall be designed so that unintentional influx, crossflow to shallow
formation layers and outflow to the external environment is prevented, and so that they
do not obstruct ordinary well activities. [30]
The NPD has also issued specific requirements related to the use of downhole safety valves
(DHSV):
Section 53:
Completion strings shall be equipped with downhole safety valves (SCSSV). If the
production annulus is used for gas injection, this equipment shall also be equipped with
downhole safety valve (SCSSV) to provide for annulus barrier testing. [30]
2.2 United Kingdom

In the United Kingdom (UK), the offshore safety regulations are issued and followed up by the
Health and Safety Executive (HSE).
There are no specific requirements in the UK regulations for the installation of any type of
downhole valve in any type of well. The regulations, which do apply to this situation, are; The
Offshore Installations and Wells (Design and Construction etc,) regulations 1996, regulation
13.1:
The well-operator shall ensure that a well is so designed, modified, commissioned,

constructed, equipped, operated, maintained, suspended and abandoned that
(a) so far as is reasonably practicable, there can be no unplanned escape of
fluids from the well;[31]
and The Offshore Installations (Prevention of Fire and Explosion and Emergency Response)
regulations 1995, regulation 9.1 which requires installation owners to take appropriate
measures to prevent the uncontrolled release of flammable fluids. This regulation applies in
principle to subsea wells [31].

In practice the HSE would question any proposal to complete a production well without a
downhole safety valve but in some cases it might be possible for the company proposing the
well completion to argue that the inclusion of such valves was not reasonably practicable.
This would require a demonstration that the sacrifice (time, trouble and expense, including
increased risk) of installing the valve was grossly disproportionate to the benefit [31].
2.3 United States of America

The Minerals Management Service (MMS) manage the US's offshore mineral resources
including the oil/gas production. Regulations concerning offshore operations on the outer
continental shelf states
Paragraph 250.800:
Production safety equipment shall be designed, installed, used, maintained, and tested
in a manner to assure the safety and protection of the human, marine, and coastal
environments. [11]
Specific requirements of subsurface safety devices are included:
Paragraph 250.801:
All tubing installations open to hydrocarbon-bearing zones shall be equipped with
subsurface safety devices that will shut off the flow from the well in the event of an
emergency unless, after application and justification, the well is determined by the
District Supervisor to be incapable of natural flowing. These devices may consist of a
surface-controlled subsurface safety valve (SSSV), a subsurface-controlled SSSV, an
injection valve, a tubing plug, or a tubing/annular subsurface safety device, and any
associated safety valve lock or landing nipple. (c) Surface-controlled SSSVs. All
tubing installations open to a hydrocarbon-bearing zone which is capable of natural
flow shall be equipped with a surface-controlled SSSV. [11]
2.4 Standard organizations

The NORSOK standards (the competitive standing of the Norwegian offshore sector) and are
approved as in force regulations of the NPD and state:
During production activities at least two independent and tested barriers shall be
normally available between reservoir and environment in order to prevent an
unintentional flow from the well. The barriers shall be designed for rapid
reestablishment of a lost barrier. The position status of the barriers shall be known at
all times.[17]
Standards issued from the American Petroleum Institute (API) and the International
Organization for Standardization (ISO) refers to the DHSV as if the presence in an oil/gas well
is obvious. The standards include descriptions of design, installation, repair and operation of
the DHSV. The existing standards are more of technical character. None of the current API and
ISO standards, however, includes a demand for a DHSV in a subsea well.
2.5 Regulatory challenges

The regulations from the concerning authorities are clear. A downhole safety valve (DHSV) is
required in both the Norwegian and U.S. regulations. In the U.K. the HSE states that they will

question any proposal without a DHSV, but if the inclusion was not reasonably practicable
an assessment should be done. The author sees an opportunity to persuade the authorities if a
proper documentation of the needlessness of a DHSV is provided. In Norway the regulations
do, however, also require a minimum of two independent and tested barriers between the
reservoir and the environment. The DHSV is considered to be the primary barrier and the x-
mas tree to be the secondary barrier. A revision of the barrier formulation must be done if the
DHSV is to be removed from the completion. Considerations of making the x-mas tree either
the only barrier or implementing another and more reliable downhole barrier solution should be
taken. This thesis will consider the first alternative, making the x-mas tree the only barrier.

3 Use of acceptance criteria

To gain an impression of the risk an event represents, the consequence of and the probability
for the event must be considered. The assessment may be based on a load of different
developed risk assessment tools. Finding the right measurement for risk and by what criterion
it is acceptable may be tricky.
An acceptable level of risk in an activity is described by acceptance criteria. The criteria are
either based on standards, experience or theoretical knowledge. Acceptance criteria express the
probability and consequence of a hazardous event, and may either be qualitative or
quantitative. In a risk assessment the use of acceptance criteria is important to identify areas
that need risk reducing efforts. Acceptance criteria should be expressed in a way that makes
them applicable to the different areas of the assessment. The criteria should reflect the safety
goals of the operator and requirements set by the authorities. For an installation the acceptance
criteria perform a basis for what is consider acceptable at the present time. Formulation
accuracy may vary in accordance with the demand set by authorities and the operating
company. To verify whether the contents of the acceptance criteria are met, the values have to
be quantitative. In other cases the use of qualitative criteria are acceptable.
Acceptance criteria are established according to the extent and purpose of the assessment.
There are mainly three different ways to establish acceptance criteria.
A comparison with established and accepted methods

By the use of risk-matrixes and the ALARP-principle
By the use of predefined criteria for qualitative analysis
In the Norwegian sector of the North Sea, all operators have to define risk acceptance criteria
according to requirements by the NPD. Different regulations are issued to standardize
acceptance criteria.
Many interest are involved when discussing acceptable risk problems: the interest of society,
the interests of employees, and the interests of the oil company [32]. An important issue of risk
analysis is to determine what hazards present more danger than society is willing to accept. A
level of acceptable risk can be hard to find. To find a balance between having guarantee for a
safe, environmental friendly and healthy focus and making a reasonable profit is sometimes
difficult. The use of the ALARP-principle (As Low as Reasonable Practicable) is one
method to set acceptance criteria. Personnel risk is often subject to the use of the ALARP-
principle. A further description of The ALARP-principle is given in section 3.1.
When dealing with quantitative criteria are set by different methods of measurement. The
Norwegian Oil Industry Association has in the latter times standardized acceptance criteria for
certain operations in the North Sea. A Safety Integrity Level (SIL) to provide a basis for the
evaluation of appropriate risk levels for different events. SIL will be discussed further in
section 3.2.
Human risk
The most common rating when dealing with personnel risk is the fatal accident rate (FAR) and
the PLL-rate (Potential Loss of Life). The PLL-rate presents the average fatal accident per
year. The FAR value is the most common and represents the predicted number of fatalities per
100 million hours exposed to the hazard [7]. The FAR value is a reasonable measure for risk

analysis and a useful indicator in an overall risk approach. It should be noted that FAR values
for specific installations could never be verified through experienced fatality statistics. Low
probability incidents with a high number of fatalities will have high influence on the estimated
FAR value. The Piper Alpha and the Alexander Kielland accidents completely changed the
FAR values for the entire North Sea. The FAR represents an average for all offshore workers;
it is obvious that the value will vary from the drilling crew to the catering personnel on the
platform. Table 3-1 presents the experienced FAR value for offshore workers.
Table 3-1 Experienced overall FAR values for offshore workers in the UK, Norway, and U.S. GoM OCS,
January 1980-January 1994 [7]
Area Conditions for the FAR calculations FAR (fatalities per

108 working hours)
UK Total FAR (incl. Piper Alpha) 36.5
Total FAR (disregarding Piper Alpha) 14.2
Norway Total FAR (incl. Alexander Kielland) 47.3
Total FAR (disregarding Alexander 8.5
Kielland)
US GoM OCS Total FAR 9.0
Environmental risk
The environmental risk is mainly expressed by a spill rate. The spill rate is denoted by
discharges per kg or m3 per ton produced material. A blowout in Nigeria (1980) is the most
severe incident reported of spills from an installation. 30,000 tons of crude oil polluted the
islands and channels of the Niger delta. In the North Sea or the U.S. GoM OCS there has been
no severe pollution caused by oil spills to sea.
Environmental acceptance criteria must consider the overall risk through the lifetime of a well.
An evaluation of the surrounding environment, the effect of other installations in the area and
the possibility for immediate help in case of emergency must be performed. The use of risk
matrixes and superior criteria, e.g. maximum blowout frequency, provide a basis in a
quantification of the environmental risk.
Financial risk
In a risk assessment the economic aspect will mainly be expressed by cost-efficient
evaluations. The evaluations include a series of important parameters like material loss, loss of
production and costs related to environmental damages. Compilation of acceptance criteria
concerning financial risk is problematic. The risk analysis should ensure that the installation
does not involve an unacceptable high financial risk as a result of an accident.
3.1 The ALARP principle

The ALARP-principle implying that the risk should be reduced to a level as low as reasonably
practicable is widely used. ALARP is normally demonstrated using cost/benefit evaluations
with risk reducing measures being implemented when e.g. the cost of averting a fatality are not
prohibitively high.
Combining the acceptance criteria with the ALARP-principle solves acceptable risk problems
[32]. It is compulsory for operating companies to define probability values for certain

undesired events, corresponding to the upper horizontal line in the ALARP-principle. A

situation is unacceptable and must be treated further if a Quantitative Risk Assessment (QRA)
reveals higher probabilities than accepted. The ALARP-principle shown in Figure 3-1 is
commonly accepted. In the ALARP region additional efforts may be performed to reduce the
risk further. A weighing of cost and risk is done.
Unacceptable region Risk cannot be justified except

in extraordinary circumstances
Tolerable only if risk reduction

is impracticable or its cost is
grossly disproportionate to the
improvement gained
The ALARP or Tolerability

region (Risk is undertaken only
if a benefit is desired)
Tolerable if cost of reduction

would exceed the improvement
gained
Broadly acceptable region Necessary to maintain

(No need for detailed work to assurance that risk remains at
demonstrate ALARP) this level
Negligible risk
Figure 3-1 Levels of risk and the ALARP principle [32]
3.2 Safety integrity level (SIL)

The Norwegian Oil Industry Association has provided recommended guidelines for the
application of IEC 61508 and IEC 61511 standards in the petroleum activities on the
Norwegian Continental Shelf. A list of minimum safety integrity levels (SIL) for the most
common safety functions has been provided. [28]
SIL is a discrete level for specifying the safety integrity requirements of the safety functions.
The SIL requirements are based on experience, with a design practice that has resulted in an
adequate safety level. This reduces the need for time-consuming SIL calculations on standard
solutions and ensures a minimum level of safety. Another advantage of using pre-determined
SIL is that these figures can be used as input to a Quantitative Risk Analysis (QRA) during
early design stages and thereby set between the risk analysis and the integrity levels for
important safety functions.
For several safety functions it is difficult to establish generic definitions. Due to process
specific conditions, design and operational philosophies etc., the number of final elements to
be activated will differ from case to case. Consequently, several of the requirements are given
on a sub-function level.
It is important to emphasise that SIL requirements are minimum values, and therefore need to
be verified with respect to the overall risk level. If the QRA reveals that the overall risk level is
too high, e.g. due to a particularly large number of high pressure wells or risers, then this could
trigger a stricter requirement to one or more of the safety functions. Table 3-2 is found in ref.
[28] and shows the quantification of the four different SIL levels. The SIL requirement applies
only to a complete function, i.e. the field sensor, the logic solver and the final element. It is
therefore incorrect to refer to any individual item or equipment having a safety integrity level.

Table 3-2 Safety integrity levels for safety functions operating on demand or in a continuous demand mode
from IEC 61508-1, Table 2 and 3)[28]
Safety Demand Mode of Operation Continuous / High Demand

Integrity (average probability of failure to Mode of Operation
Level (SIL) perform its design function on (probability of a dangerous
demand PFD) failure per hour)
4 10-5 to < 10-4 10-9 to < 10-8
3 10-4 to < 10-3 10-8 to < 10-7
2 10-3 to < 10-2 10-7 to < 10-6
1 10-2 to < 10-1 10-6 to < 10-5
An extract of the minimum SIL requirements given in ref. [28] relating to the object of this
thesis is presented in Table 3-3. The SIL requirement concerning the shut-in of the flow in a
well (Wing valve, Master valve and DHSV) is set to 3. It is therefore reasonable to also require
a SIL3 for a well without a DHSV.
Table 3-3 Minimum SIL requirements - global safety functions, an extract [28]
Safety function SIL Functional boundaries for given SIL Ref.

requirement / comments APP. A
Isolation of well; 3 The SIL requirement applies to the sub-function A.6
(shut in of one well) needed for isolation of one well, i.e:
- ESD-node (wellhead control panel)
- Wing valve (WV) and master valve (MV)
including solenoide(s) and actuators
- Downhole safety valve (DHSV) including
solenoide(s) and actuator

4 Overall risk assessment

Risk may be denoted by the probability for and the consequence of unwanted events. When
discussing risk a focus on environmental damage, economic loss and the loss of human life are
essential. These factors must be considered in all well life phases in an overall risk assessment.
Hazard identification performs a basis for the assessment. The frequency and the related
consequences are evaluated and employed to the problem in order to provide a solution or a
documentation of the potential danger.
The role of the downhole safety valve (DHSV) will be discussed in each of the well life
phases. In this study the completion, production and workover phases will be the main focus.
The DHSV is not present during the drilling phase; this phase is therefore excluded from the
study.
4.1 Consequences
The consequences related to the presence of a DHSV are equal to the ones of well without a
DHSV. The DHSV is rather the cause of either an improvement or deterioration of the failure
frequency.
The consequences relating to incidents occurring in the different life phases of the well can be
broken down as illustrated in Figure 4-1 to Figure 4-3.
Consequences
Human Economic Environmental
Injured Broken Delayed Blowout + Lost

personnel equipment operations Leakages objects
Figure 4-1 Consequence breakdown structure of the installation of a subsea production well
Consequences
Economic Environmental
Lost Shut-in of Blowout +

production well leakages
Figure 4-2 Consequence breakdown structure of normal production on a subsea production well

Consequences
Human Economic Environmental
Injured Abandon- Expencive Delayed Blowout + Objects left

personnel ment of well repairs operations leakages on seabed
Figure 4-3 Consequence breakdown structure of a workover on a subsea production well
Each of the possible consequences should be subject to critical evaluation. The frequency
estimates are found either by statistical methods or by the use of engineering judgement. The
human risk may be neglected during the production phase when there are no personnel at the
subsea site.
Consequences related to the DHSV will be subject to further description. There are two main
risk factors to consider, delays in time (lost production) and the blowout risk. One is of
economic character and the other of a more complex character related both to economic and
environmental issues. These two factors are discussed in the following subsections.
4.1.1 Economic
The economic perspective is important in all businesses. For operating oil companies the
economic loss is related to not being able to produce as much as intended. Loss of production
occurs when the well is unable to produce as expected due to different problems.
To illustrate the economic loss a calculation from the sgard field is given.
The sgard field consists of 52 subsea wells producing 3.3 million cubic meters of gas,
200,000 barrels of oil and 65,000 barrels of condensate per day, [23]. If one single well were to
be closed in for a day, with an oil price of $20 per barrel (price today is about $25), the
economic loss would be of $76,920 per day. In addition to this the gas and the condensate that
contribute substantially to the earnings are left out here.
A failure of the DHSV would require a workover. A workover on one of the sgard Smrbukk
wells replacing a failed DHSV lasted for 43 days [35]. In addition there may be a waiting time
of e.g. 30 days or more to get a workover rig to the site. All in all this failure will generate a
loss of oil production of up to $5,6 million. In addition there will also be expenses concerning
the rental of a workover rig ($200.000 per day), operating equipment and personnel costs. The
authorities may also fine the operating company for any leakages that may occur. A total cost
of 20 million dollars per intervention is therefore not unrealistic.
4.1.2 Blowouts
A blowout is defined in ref. [7]
An uncontrolled flow of fluids from a wellhead or wellbore is classified as a blowout.

Unless otherwise specified, a flow from a flowline is not considered a blowout as long
as the wellhead control valve can be activated.

Blowouts are either caused by barrier failures, external factors or a combination of these two.
When all barriers in one or more leak paths fail in a shut-in system, it is considered to be a
blowout. The external factors leading to a blowout are more complex and difficult to explain.
Potential accidental events causing a blowout may be incidents like dropped objects, collisions,
or explosion loads.
The statistical numbers presented here are collected in the period from January 1980 through
January 1994. The latter years SINTEF has collected blowout data, but the data are not
publicly available yet. The results presented here have to go through minor changes to be up to
date. All theoretical considerations are, however, applicable for the scenario we have today.
Table 4-1 lists the blowout frequencies on offshore installations in the Gulf of Mexico outer
continental shelf (US GoM OCS) and the North Sea. A homogenous Poisson process is used to
describe the occurrences of blowouts, with blowout frequency . The blowout frequency is
estimated by [7]:
Number of blowouts n
= =
accumulated operating time s
Table 4-1 Blowout frequencies as input to risk analysis of offshore installations, both subsea and platform
wells [7]
Blowout frequencies
Recom- US GoM
North Sea
Phase mended OCS
frequency
frequency frequency
Completion Per well- completion 0.00023 - 0.00023
Production Per well- year 0.00005 0.00006 0.00005
Per well- year 0.00012 0.00006 0.00017
Workover Per workover (8 0.00093 0.00050 0.00136
years)
In addition to cause pollution the occurrence of a blowout may in severe cases lead to a bad
reputation among consumers and environmental organisations. The consequences of a bad
reputation are hard to estimate. If a boycott of the operating company is carried out it could
lead to greater economic losses.
The oil spill disaster of the Exxon Valdez tanker in 1989 is included to illustrate a possible
outcome of a major blowout. Although this is not an offshore installation the consequences
may be of the same proportions. The Exxon Valdez caused a spillage of over 40.000 ton of
crude oil. Rough estimates claim that 30.000 seabirds, 5.000 sea otters and 22 killer whales
were killed. In the aftermath of the Exxon Valdez disaster a 900 million dollar settlement with
Exxon was announced to settle all federal and state claims. In addition an extra 100 million
dollars in fines were given to cover any additional damage [18]. The negative publicity this
incident has caused Exxon (now Exxon Mobile) is hanging over them today. Negative
publicity not only affects the concerned company but the entire oil industry. The economic
losses related to this are impossible to estimate.

The risk of terror attacks on an oil installation is always present and represents an increasing
threat today. We have seen multiple terrorist-attacks on different target the latter years. The oil
and gas industry is very profitable and may very well be subject to a striking terror attack. The
fatal consequences related to such an attack might not be the major concern of the terrorist.
4.2 Installation related risk

Risk related to the installation and completion of a subsea oil/gas well is mainly related to
blowout risk and time delays. During the installation phase equipment may be broken or
dropped objects causing a delay. Human risk in form of injured personnel or fatalities may
occur. Normal focus on safety in operations and at the site will prevent this from happening.
Completion blowouts occur during installation of downhole and subsea equipment. There have
been seven blowouts concerning the completion phase of the wells during the study in ref. [7].
Most of the blowouts resulted in flow through the tubing or drill string. Holand points out that
for several of these blowouts the BOP-stack (Blowout preventer) did not include a blind-shear
ram. The presence of a functional shear ram would have stopped many of these blowouts at an
early stage and thus prevented the blowout. None of the completion blowouts have caused any
casualties. One blowout caused severe damage when ignited; otherwise there have only been
minor spillage.
During installation the presence of a DHSV makes the procedure more complex. The DHSV
may be scratched or deformed by the pressure and not function. A hydraulic control line is
strapped to the tubing, which increase the installation time. This will not result in any
significant change of blowout risk. Other than the increased installation time the author cannot
se any other inconveniences with the installation of a well with the DHSV.
4.3 Production related risk

Production related risk comprises economic and environmental risk. There are no personnel
present at the site during production and therefore the human risk is neglected.
Production blowouts occur in producing or mechanically closed in production or injection

wells. The SINTEF offshore blowout database includes 12 production blowouts. External
forces like ships collision, storm and fire, caused half the blowouts. The other half was caused
by mechanical failure in the primary and secondary barriers. Five of the six blowouts blew in
the x-mas tree and the last came outside the casing. Only one of the production blowouts has
caused small pollution. There have been no casualties. The blowout outside the casing caused a
subsea crater that tilted the platform and was the only severe damage. A $220 million
insurance claim was the result of this incident.
During normal production the DHSV may fail. The failures occurring are categorised into two
groups, critical and non-critical failures. Critical failures are fail to close (FTC), leakage in
closed position (LCP) or internal leakage (ITL). These failures will, however, not cause the
well to stop the production, but are significant if the DHSV is supposed to fulfil its task.
Premature closure (PC) and fail to open (FTO) will stop the production. If a failure occurs in
between the workover intervals the operating company must force open the DHSV by wireline,
proceed with a full workover or close in the well. The severity of this incident varies according
to when it occurs in the well lifetime. In some cases if failure occurs at the end of the lifetime.
The well pressure may be low and the well may be producing e.g. 80% water. An application
may than be sent to the governmental authorities obtaining a dispensation to produce without a
functioning DHSV. In these cases a wireline intervention may be carried out providing a
locked open DHSV awaiting abandonment or a scheduled workover. This option is also
applicable if the DHSV fails with a FTC or LCP. The lost production may in these cases be
reduced by this option. An early DHSV failure, when the production is in its prime, will cause
a more substantial economic loss.
Recent studies show that 50 % of the shut-ins of a well leading to a workover is caused by
DHSV failure [25]. With a DHSV failure rate of 5.84E-6 [13] this means that the DHSV
causes a well workover approximately every 19.6 well year. At the sgard field there are 52
wells. Every 2.7 years they have to carry out an intervention. On the field the total loss of
production, equipment and rental cost will amount to approximately 20 million dollars (see
subsection 4.1.1). In a well lifetime (15 years), this will represent a total value of 111 million
dollars for the operating company. These numbers have not taken in account that the well may
have been abandoned as a consequence of DHSV failure.
4.4 Workover related risk

The workover risk is represented mainly by the risk of delay and the risk of blowout. Other
things may also occur, like failures causing a need for abandonment of the well or extra repairs
due to equipment failures. The risk of injured personnel is as for the installation phase always
present. The operators must be precautious and the operating companies must provide a safe
working environment.
A workover is more likely to cause severe pollution than the other stages of the well. The well
is perforated and the production zone is alive nearly all the time. During workover the
operators usually use solid-free workover fluids. A mud filter cake, which during drilling acts
as a seal against the formation, will not be created. As a result continuous losses of formation
occur and may lead to a loss of the well. The casings may have deteriorated due to the stress
they have been affected by in the well.
All blowouts cause economic losses. Downtime of the well involves lost production. Millions
of dollars may be lost if damage to well equipment or workover rigs also occurs. With such
large amounts of money at stake the prevention of a blowout is preferable in preference to
saving money during the completion phase.
None of the blowouts recorded in the SINTEF offshore blowout database has caused severe
pollution. The most severe blowout recorded in the period from 1980-94 of was an oil blowout
emitting 10 m3 into the ocean [7]. Out of the 41 workover blowouts after January 1970, there
have been two reported blowouts with large spills. The Bravo blowout in 1977, 20.000m3
spilled into the North Sea. The second one was in 1992 in the U.S. Timbalier Bays shallow
waters offshore Louisiana. 500m3 of oil drifted ashore and caused damage to the wildlife [7].
The role of a DHSV in the workover process is vague. During the workover the DHSV is
pulled together with the tubing. This process will last slightly longer than if the DHSV was not
present. The control lines strapped onto the tubing mainly cause the delay. During the tubing
retrieval process the straps must be removed and the control lines handled with care. For a
completion without a DHSV the amount of control lines is reduced. Therefore the presence of
a DHSV will result in a more complex workover situation. A DHSV will not cause any
significant change of blowout risk during workover.

Probability of dropping an object and hitting the x-mas tree

Prior to the workover operation the workover rig is located at the site above the well. During
the period of preparation until the BOP is connected to the wellhead, there is a possibility of
dropping objects. This may result in a destruction of the x-mas tree and result in a blowout. If
this happens the downhole safety valve (DHSV) will play an important role. The DHSV will
seal off the well and prevent leakage. This scenario is, however, reasonably unlikely to happen.
According to ref. [3] the probability of dropping any crane load and hit something within 25
meter radius at 1000meters depth is 9,17E-3, for a derrick 7,84E-4. In addition there is a
probability of dropping a crane load of 2.0E-5. The probability of dropping a BOP or a
compact object from the derrick is 5.75E-4.
The x-mas tree is covering an area of about 4 square meters on the seabed. This is about 0.2
percent of the area for the crane load and 5 percent of the area for the derrick. In total the
frequency of dropping something from a crane or a derrick and hitting the x-mas tree at the
seabed is 2.29E-8 per year.
These calculations have not considered the impact the hit will have and does not include the
effect of water currents. Currents contribute significantly to the total spreading. [3]. Although
the wellhead is hit, the impact may also vary. Not all hits end with a broken x-mas tree. If the
use of safety integrity level (SIL) (see section 3.2) for a low demand system is required, the
probability of dropping an object and hitting the something on the seabed is fulfilling the
requirements of SIL4. A dropped object damaging the x-mas tree and providing a need for the
DHSV to prevent a blowout is therefore by any means within the acceptance criteria.

5 Risk reducing effect of a DHSV

The presence of a downhole safety valve (DHSV) shall reduce the risk of blowout in a subsea
production well. In this chapter, the risk reducing effect of a DHSV is found. A case study of a
subsea production well is included as an illustrative example. A comparison of unavailability
calculations for a well with, and without a DHSV proves the positive effect of the DHSV
during production. Barrier diagrams and fault trees are constructed to provide a basis for the
calculations and illustrate the leakage paths.
5.1 Case example

The studied well is composed out of standard well components. A technical description of the
different components is given in appendix A. The study is limited to the downhole and x-mas
tree configurations; topside equipment, manifolds and riser systems are not included.
To be able to calculate the risk with and without a DHSV in the well, the well lifetime is
assumed to be 15 years. This generates in most cases a conservative value for the non-tested
barriers. Periodic testing is carried out to reveal hidden failures in the system. For safety
reasons the most critical functions, including the DHSV, are tested every 6 months. Other parts
of the system are not tested.
The tested functions are:
Closing, opening and leak tight function of the DHSV

Closing, opening and leak tight function of the master valve
Closing, opening and leak tight function of the production wing valve
5.1.1 Production tree

The production tree in the example is a horizontal tree, as illustrated in Figure 5-1. A
production tree is an assembly of valves. It provides control of the well flow during production
and is capable, among other things, of cutting of the flow from the reservoir.
In the risk assessment the failure modes, external leakage (EXL), fail to close (FTC), internal
leakage (ITL) and leakage in closed position (LCP) are considered for the different valves.

Figure 5-1 Horizontal X-mas tree from the sgard field [24]
5.1.2 Production well

The studied production well is a standard completion and illustrated in Figure 5-2. The
example well is similar to an oil production well at the Oseberg B field. A figure presenting the
downhole completion of the Oseberg B well is shown in appendix B.

In the example the most common components are included and listed below. Other well
equipment is neglected.
The system of the example well comprise the following main items:
13 5/8 casing hanger seals

Annulus master valve
Annulus swab valve
Annulus wing valve
Crossover line
Crossover valve
Downhole safety valve
Hydraulic control line
Production master valve
Production packer
Production wing valve
Seal assembly
Swab valve
Tubing
Tubing hanger seal (annulus bore)
Tubing hanger seal (production bore)
Wellhead seal

Annulus swab valve

Annulus wing valve Tree cap
Swab valve
Control panel
Annulus Crossover valve
master valve Wing valve
Tubing hanger seal Production master valve

Annulusbore
Tubing hanger seal
(productionbore)
SEA BED
Casing
hanger seals Wellhead seal
Tubing hanger
Hydraulic
control line Casing
hanger seals
DHSV
Seal
assembly
Liner hanger seal
Production packer
Figure 5-2 A sketch of the production well used as an example in this thesis

5.2 Barrier analysis

The theory presented in this section is based on reference [7].
A well barrier is defined as:
An item that, by itself, prevents flow of the well reservoir fluids from the reservoir to
the atmosphere [26]
A well barrier system will vary depending on the operational phases of the well.
The barrier analyses are carried out to identify potential leakage paths and are based on barrier
diagrams.
Components provide safety barriers when working as supposed to. There are two main types of
barriers, dynamic barriers and static barriers. A static barrier is a barrier available over a long
period of time. A dynamic barrier is a barrier that varies over time. This will apply for drilling,
workover, and completion operations.
The barriers are normally denoted as primary, secondary and third barrier. It can be stated in
general that the primary barrier is the one in contact with the reservoir. For completion and
workover, in a shut-in well, the hydrostatic pressure is regarded as the primary barrier, and the
subsea equipment, usually a BOP, is regarded as the secondary barrier. During production the
downhole safety valve (DHSV) among others acts as the primary barrier and the x-mas tree as
the secondary.
Barrier diagrams are easy to understand and provide a good view of the barrier situation.
Possible leakage paths between the reservoir and the environment have to be identified to
establish a barrier diagram. The diagrams are read from the reservoir at the bottom and up
through to the surroundings. In the construction of barrier diagrams the safety barriers are
represented with rounded rectangles and connected with lines. To make the diagram easier to
understand triangles and colour codes are added representing different areas of the well.
Barrier ratings are also presented with a colour code. This is not standard, but gives the reader
a better overview of the diagram.
The leakage probability depends on each barrier and the structural relationship between the
barriers. If reliability data for the various components are added, a total leakage probability is
possible to assess from the diagram. The complexity in calculation increases with the
complexity of the situation. Therefore barrier diagrams are often transferred to fault trees; these
are commented in section 5.3.
Chapter two of this thesis deals with regulations regarding well barriers. The Norwegian
Petroleum Directorate states:
During drilling and well activities there shall at all times be at least two independent
and tested barriers after the surface casing is in place [29].
Other countries have similar requirements.
5.2.1 Case example

In the case example the barrier situation, to prevent leakage to the surroundings during
temporary shut-in of a production well, is modelled. The downhole safety valve (DHSV), the
master production valve and the wing valve are ordered to close in and be tight. Only the static
barrier scenario of the production phase is included.
The barrier diagrams are based on the following assumptions:
The master production valve, wing valve and the DHSV have been given a close
command from the surface control.
The system is shut-in.
Leakage through the tubing and back into the tubing is possible but not considered here.
The x-mas tree is not considered as a single barrier, but each main component is
regarded as a barrier.
The probability of leakage to the surroundings through the casings and cement is very
low and is not accounted for in the barrier- and fault tree analysis.
The leakage paths are illustrated in Figure 5-2. The reliability data dossiers in appendix D
include a column where the applied leakage modes of each valve are listed.
The barrier diagrams for the oil/gas production well with and without a DHSV are presented in
Figure 5-3 and Figure 5-4.

Surroundings
Wellhead Annulus wing Annulus swab Crossover line

seal leak valve ITL/EXL valve ITL/EXL EXL
Production
swab valve,
ITL/EXL
Crossover
Production
Crossover
wing valve,
valve, EXL
ITL/EXL
Annulus Annulus
Crossover
master valve master valve
valve, ITL
EXL ITL
Tubing hange tubing

hanger seal leak
ITL
M. Valve
Tubing hanger seal Production Production

annulus bore leak master valve, master valve,
ITL EXL
Tubing hanger seal
production bore leak
Wellhead
Production tubing
13 5/8" casing above DHSV
seal leak
Through
DHSV
A-annulus area A-
DHSV leak
Annulus
Through the DHSV or FTC
Wellhead area
Master production DHSV
EXL
valve ITL
Crossover line/
Production tubing
annulus area below DHSV
Production
packer leaks
Primary barrier
Secodary barrier
Reservoir
Third barrier
Figure 5-3 Barrier diagram for an oil/gas producing well with a DHSV

Surroundings
Wellhead Annulus wing Annulus swab Crossover line

seal leak valve ITL/EXL valve ITL/EXL EXL
Production
swab valve,
ITL/EXL
Crossover
Production
Crossover
wing valve,
valve, EXL
ITL/EXL
Annulus Annulus
Crossover
master valve master valve
valve, ITL
EXL ITL
Tubing hange tubing

hanger seal leak
ITL
M. Valve
Tubing hanger seal Production Production

annulus bore leak master valve, master valve,
ITL EXL
Tubing hanger seal
production bore leak
Wellhead
13 5/8" casing
seal leak
Above
tubing
A-annulus area A-
Annulus
Above tubing
Wellhead area
Master production
valve ITL
Crossover line/
annulus area
Production Production
packer leaks tubing
Primary barrier
Secodary barrier
Reservoir
Third barrier
Figure 5-4 Barrier diagram for an oil/gas producing well without DHSV

5.3 Fault Tree Analysis

The construction of the fault trees is based on the theory given in [8].
Fault tree analysis is a deductive technique that focuses on a particular unwanted system event
and provides a method for determining causes for that event. A risk analysis often includes the
fault tree analysis technique for evaluation of the individual component failure modes and their
impact on the system reliability.
The fault tree is constructed with the use of different logic gates and displays the
interrelationships between a potential critical event in a system and the reasons for this event.
The main logic elements are the TOP-event, the AND and OR gates, and the basic events.
The combination of the basic events and the system structure determines whether or not the
TOP-event will occur.
The fault tree provides a static picture of the combinations of failures and events that may cause a
TOP-event to occur. Fault tree analysis, as barrier diagrams, is thus not a suitable technique for
analysing dynamic systems.
5.3.1 Case example

In the case example the TOP-event is leakage to the surroundings. The TOP-event occurs
either if there is a leakage to the surroundings from the x-mas tree or leakage to the
surroundings from the wellhead. A more concise definition of the TOP event is:
Sustainable leakage to the surroundings through either the x-mas tree or the wellhead during
normal shut-in conditions. This TOP' event covers situations where the barrier combination
in one or more cut sets have failed.
The different components of the production well presented in subsection 5.1.2, are represent
basic events in the fault trees. The barrier diagrams, of subsection 5.2.1, provide the basis for
the fault tree construction. In order to simplify the construction of the fault tree, external stress
and common cause failures are not included.
The fault trees constructed for the oil/gas production well with and without a DHSV are
presented in appendix C. The CARA-fault tree program is used in the construction.

5.4 Unavailability calculations

The average unavailability of a safety function is often called Mean Fractional Dead Time
(MFDT). MFDT can be given two different meanings; the percentage of time where we are
unprotected by the safety function, or the probability that the safety function will fail on
demand for it. The most important well barriers have hidden critical failure modes and are
thus function tested regularly. The interval between two consecutive tests may be denoted by .
The MFDT formulas are based on a number of assumptions. The most distinctive are:
The failure rate of components is constant

All failures are detected during testing
The barrier failures are independent of each other
Production unavailability during testing and repair is neglected
5.4.1 The Mean Fractional Dead Time calculation model

The theory and all equations used in this section are found in reference [8].
If based on the fault tree analysis, the Mean Fractional Dead Time (MFDT) of the different cut
sets determines the probability of the TOP-event.
The MFDT of a single barrier i is given by its unavailability qi(t). A single well barrier is tested
with regular intervals of length , and a constant failure rate i. The general formula is given:
1 1
MFDTi(t)= qi (t) = (1 - e iu du ) = 1 (1 e i )
0 i Equation 5-1
The unavailability of the safety barrier may also be calculated using the approximation formula
below. This approximation is based on Taylor series development of Equation 5-1. Practical
calculations often make use of this approximation. A rule of thumb is that when is small
(<10-2) the formula is considered valid.
i
MFDTi (t ) = qi
2 Equation 5-2
For larger values of , Equation 5-1 must be applied.
Cut set unavailability of a parallel structure of n tested barriers with constant failure rates i, is
found by deriving the reliability function, and given as:
n
Rs (t ) = 1 (1 Ri (t ))
i =1 Equation 5-3
The evaluated system also contains non-tested barriers. MFDT of a non-tested well barrier i
with constant failure rate i can be calculated by the use of Equation 5-1 when the exponential
distribution is applied.
q i (t ) = (1 - e i t ) Equation 5-4

If the unavailability of a barrier i is expressed by qi(t), which states the probability that basic
event i occurs at time t. Cut set unavailability can be calculated by the use of Equation 5-5:

Q(t ) = qi (t ) ,
iK j Equation 5-5
Equation 5-5 is also applied when combining tested and non-tested barriers in a cut set.
The approximation formula 4-2

The approximation formula of Equation 5-2 is not always valid. Figure 5-5 illustrates the
relationship between the approximation of Equation 5-2 and the general unavailability formula
in Equation 5-1. By using the approximation formula an error will be generated. This error
increases as increases (see Figure 5-5). For a -value of 10-2 the generated error is 1.67E-
5. The difference will continue increasing as increases. When is set to 0.1, which is the
case for some of the barriers in this report, the unavailability difference between the two is
1.67E-3. The use of the thumb rule is applied in the CARA-calculations, but not in the
calculations done by hand.
The approximation
Approximation of
2
The general formula
Figure 5-5 A plot comparing the approximation and the general formula of unavailability.
Calculation uncertainties
In reliability studies of technical system one always has to work with models of the system. As
a rule to model construction, the models should be sufficiently simple to be handled by
available mathematical and statistical methods [8]. The reliability models are constructed by
applying generic data from existing systems. Models deduced from different formulas and
methods are never 100% correct. The value of expressing reliability values by decimals is
therefore limited. Failure rates and methods applied to determine reliability values have many
uncertainties and exact values are unlikely to be found.

Even if the mathematical model is correct the data applied will not be perfect for the specific
situation. Data books often pool data from a number of samples that all have individual
differences in construction and operating environment. These data are applied to the new
model and may not be valid there. Data books normally leave out environmental and
operational effects when assigning reliability values to components.
Reliability data
During the process of selecting a data set applicable for reliability quantification, the data
sources have been carefully examined. As a result of different data collection approaches,
reliability data often vary significantly from one data source to another. For some components
in the barrier system the data is scarce. An estimation is therefore done in understanding with
Marvin Rausand, supervisor [19]. The reliability input data used in the reliability calculations
are presented by data dossiers in appendix D. Reliability data used in this study mainly
originates from platform wells and are found in SINTEF reports and the OREDA handbook.
5.4.2 Calculations done in CARA

The fault trees of the case example are constructed by the use of a computerised fault tree
analysis package, CARA (Computer Aided Reliability Analysis). This program may also be used
for unavailability calculations. CARA assumes an exponentially distributed lifetime with
constant failure rates for the components is.
CARA calculates the unavailability of the TOP event by using approximation formula 5-2 for
tested barriers and Equation 5-4 for the non-tested barriers. The fault trees of appendix C, with
reliability values found in the data dossiers of appendix D, perform the basis for the
calculations. The results of the CARA-calculations are presented in subsection 5.4.4.
5.4.3 Calculations done by hand

The general MFDT formula (Equation 5-1) is applied when finding the unavailability of tested
barriers. The non-tested barriers make use of Equation 5-4 and Equation 5-5. Some of the
examined cut sets consist of combinations of tested and non-tested barriers. Dividing the
combined cut set into two parts solves this problem. The unavailability of the combined cut set
is found as the product of the unavailability of each part. The results of the calculations are
presented in subsection 5.4.5.
The non-tested barriers that are given a lifetime t=131400 hours (15 years). When applied to
the cut sets this generates the most conservative value of unavailability. Periodically tested
barriers are tested with time distribution =4380 hours (6 months). In these calculations
components are assumed to be as good as new when tested. The methods also consider the
barriers to have constant failure rates and be independent of each other.
Ex. 1 Unavailability of two tested barriers

The calculation of two tested barriers of a parallel structure will be done here. The reliability
function is derived from the structure function of the parallel structure as shown in Figure 5-6.

Tested
barrier 1
R s (t) = R1 (t) + R 2 (t) - R1 (t) R 2 (t) = e1t + e2t e(1 +2 )t

Tested
barrier 2
Figure 5-6 The parallel structure of two tested barriers

The reliability function is applied to Equation 5-1 and determines the unavailability.
1 1
MFDTS (t ) = Q1 (t ) = 1 - RS (t )dt = 1 - (e 1t + e 2t e ( 1 + 2 ) t )dt =
0 0
Equation 5-6
1 1 1 2 1
1 ( (1 e )+ (1 e ) (1 e ( 1 + 2 ) ))
1 2 (1 + 2 )
The {MV, WV} cut set is calculated with WV =1.7E-6 hours and MV=2.0E-6 hours. Applying
these values in Equation 5-6 obtain the unavailability, 2.16E-5
Ex. 2 Unavailability of two non-tested barriers

Unavailability of two non-tested barriers is calculated by the use of Equation 5-3 and Equation
5-5. The unavailability of barriers 1 and 2 is determined by the use of Equation 5-3. Than the
results are applied in Equation 5-5.
q 1 (t ) = (1 - e 1t ) ,
Q(t ) = (1 - e 1t ) (1 - e 2t )
q 2 (t ) = (1 - e 2t ) Equation 5-7
The {AMVEXL, Tub} cut set is calculated with AMVEXL =0.6E-6 hours and Tub=0.4E-6
hours. Applying these values to Equation 5-7 obtain the unavailability, 3.88E-3.
Ex. 3 Unavailability of a combination of two tested and one non-tested barriers

A combined cut set of two tested and two non-tested barriers is calculated by the use of

Equation 5-5. Q1 (t ) represents the unavailability of the two tested components, calculated in

ex.1 and Q 2 (t ) represents the non-tested barrier. The unavailability of the combined cut set is
calculated

Q comb (t ) = Q i (t ) = Q1 (t ) Q 2 (t ) Equation 5-8
i K j
Reliability data is inserted to the {DHSV, MV, SWAB} cut set, where DHSV =2.8E-6 hours
and MV=2.0E-6 hours and SWAB=2.2E-6 hours. Applying these values to Equation 5-8 obtain
the unavailability, 8.92E-6.
5.4.4 CARA calculation results

The results of the unavailability calculations done in CARA are presented here. The
unavailability of the TOP-event for a well with and without a DHSV is presented in Table
5-1. Calculations of the well with and without an x-mas tree are also included. The calculations
of a well without an x-mas tree reflect a situation where the x-mas tree is unavailable as a

safety barrier due to an external event. This situation is used to calculate the accidental
frequencies in section 5.5.
Table 5-1 The unavailability of the TOP-event for a well with and without a DHSV at different points of
time t and the annual average calculated in CARA.
CARA unavailability calculations

With x-mas tree Without x-mas tree
Time t Without Without
With DHSV With DHSV
DHSV DHSV
5 years 1.42E-3 4.76E-3 4,15E-02 1
10 years 7.17E-3 1.43E-2 7,25E-02 1
15 years 1.90E-2 3.29E-2 1,02E-01 1
Annual average 5,87E-03 1,19E-02 5,67E-02 1
The average unavailability of the TOP-event of a well without a DHSV is approximately

twice has high as for a well with a DHSV.
The blowout frequency during production is given by the frequency of the TOP-event and
represents the blowout frequency caused by intrinsic events. CARA calculates the frequency of
the TOP-event for a well with a DHSV of 4.47E-3 per year, and 1.85E-2 per well year
without a DHSV. The frequency of the TOP-event is 3.3 times higher for a well with a
without a DHSV compared to one without.
5.4.5 Hand calculation results

The results of the unavailability calculations done by hand are presented here. Only cut sets
concerned by the DHSV are included and presented in Table 5-2.
Table 5-2 The unavailability of selected cut sets concerned by the presence of a DHSV
Cut set unavailability

With DHSV Without DHSV
[DHSV, MVEXL] [MVEXL]
1.07E-5 1.31E-3
[DHSV, MV, WV] [MV, WV]
1.87E-7 2.16E-5
[DHSV, MV, SWAB] [MV, SWAB]
8.92E-6 1.10E-3
[DHSV, AMVEXL, Tub] [AMVEXL, Tub]
2.37E-5 3.88E-3
[DHSV, AMV, AWV, Tub] [AMV, AWV, Tub]
1.57E-5 2.57E-3
The Safety Integrity Level (SIL) level is set by the Norwegian Oil Industry Association (OLF).
The SIL expresses the average probability of failure to perform its design function on demand.
The author cannot find that any of the cut sets of a subsea production well violates a required
SIL 3 level even for the most conservative value (t=15years). Thus the reliability of a well
without a DHSV is considered to be acceptable.

Non-tested barriers
The failure probability of the non-tested components increases with time. To achieve a more
reasonable calculation result an applied lifetime of 10 years could be applied. This would give
a more realistic value for the non-tested barriers. This change would not affect the tested
barriers.
To gain an impression how these results change a calculation with lifetime t=43500 (5years) or
t=87600 (10 years) is done. A presentation of the results with different t-values is given in
Table 5-3.
Table 5-3 Calculation result of the cut sets with an applied lifetime of t=5years, t=10years and t=15years
Cut set unavailability

t=131400 t=87600 T=43500
Cut set hours hours hours
(15years) (10years) (5years)
[MVEXL] (tested) 1.31E-3 1.31E-3 1.31E-3
[MV, WV] (tested) 2.16E-5 2.16E-5 2.16E-5
[MV, SWAB] 1.10E-3 7.65 E-4 4.01E-4
[AMVEXL, Tub] 3.88E-3 1.76E-3 4.48E-4
[AMV, AWV, Tub] 2.57E-3 7.97E-4 2.19E-4
The unavailability of the cut set with only tested components remain the same. The
unavailability of cut sets including non-tested barriers does increase with time. Table 5-4
presents the increased unavailability that is archived by removing the DHSV from the well
with different lifetimes t applied.
Table 5-4 Increased unavailability of the different cut sets when the DHSV is removed
Increased cut set unavailability

t=131400 t=87600 t=43500
Cut set hours hours hours
(15years) (10years) (5years)
[(DHSV), MVEXL] (tested) 1.30E-3 1.30E-3 1.30E-3
[(DHSV), MV, WV] (tested) 2.14E-5 2.14E-5 2.14E-5
[(DHSV), MV, SWAB] 1.10E-3 6.23E-6 2.74E-6
[(DHSV), AMVEXL, Tub] 3.88E-3 1.07E-5 2.74E-6
[(DHSV), AMV, AWV, Tub] 2.57E-3 4.87E-6 1.34E-6
Need to close flow on demand

Different scenarios occurring on the platform may lead to a demanded shut-in of the well; such
as collision with ships, explosions, collapse due to wear, etc. If a crisis should occur on the
platform, the flow has to be closed immediately. A fault tree related to this situation is
presented in Figure 5-7

Fail to close the

flow when a crisis
occurs
And
Crisis on the Fail to shut-in

platform the flow
f And
FTC and ITL of FTC and ITL of

FTC or ITL of
theproduction the production
the DHSV
wing valve master valve
W M
And V V
The DHSV is FTC or ITL of

present or not theDHSV
House DHSV
1
Off
Figure 5-7 A fault tree illustrating the scenario when the flow has to be shut in due to a crisis
The risk related to this incident may be expressed as in the equations below.
The well with : R1= Cp2 C, represents a consequence

DHSV
The well with : R2= Cp1 P, represents the probability
DHSV of the TOP-event
R = R2-R1 = C(p2-p1) = Cp
p = MFDT2 MFDT1 = 2.16E-5 1.87 E-7 = 2.14E-5
A consequence C may either represent environmental damage, loss of human life, or economic,
loss due to an occurred event. R represents the risk of not including the DHSV in the
completion. The cut set in the flow direction consists of the barriers [DHSV, MV, WV].
Removing the DHSV increases the probability of not being able to shut in the well if crises
occur on the platform to 2.14E-5. The MFDT only tells us the percentage of the time where the
cut set function as a safety barrier. This means that the flow is unprotected 0.189 hours per well
year without a DHSV. If the DHSV were present this event would occur 0.0016 hours per well
year.

The required Safety Integrity Level (SIL) for the [DHSV, MV, WV] or [MV, WV] cut set is
SIL3 (10-4 to < 10-3) [28]. The results in show that the probability of not being able to close in
the well is increased when removing the DHSV. The SIL3 requirements are, however, still met
for all cut sets. The consequences of a leakage or a blowout are the same whether the DHSV is
present or not.
The events leading to a shut-in of the well, or the consequence of a blowout is not further
discussed in this thesis.
5.5 Risk reducing findings in the Case example

A weighing of the blowout frequency during production and workover proves the effect of the
downhole safety valve (DHSV). A contribution of external factors must also be included in
finding a total blowout frequency. The DHSV blowout frequency contribution during
installation is not included. There is no data revealing the changes in blowout frequency when
the DHSV is removed for the installation phase.
The blowout frequency during production is given by the frequency of the TOP-event (see
subsection 5.4.4) and represents the blowout frequency caused by intrinsic events. CARA
calculates the frequency of the TOP-event for a well with a DHSV of 4.47E-3 per year, and
1.85E-2 per well year without a DHSV. Sustainable leakage does not always classify as a
blowout, but this approximation is done here.
About 50% of the shut-ins of a well leading to a workover are caused by DHSV failure. The
blowout frequency during workover for a well with a DHSV is 1.7E-4 per well year (see
subsection 4.1.2). It is reasonable to assume that when the DHSV is removed the blowout
frequency will be reduced by 50%. The blowout frequency for a well without a DHSV during
workover is then 8.5E-5 per well year.
External factors have impact on the blowout frequency. The contribution remains the same
whether the DHSV is present or not. In this thesis the consequence of the external factor
comprise an accident where the x-mas tree is unavailable as a safety barrier due to impact by a
dropped object. The MFDT-contribution is found by removing the x-mas tree components in
the fault tree calculations (see subsection 5.4.5). The frequency causing an accidental event is
denoted, faccidential event. The blowout frequency caused by external factors is found in the
product of the accidental event frequency and the MFDT of the downhole barrier situation
(Unavailability without the x-mas tree). In these calculations the accidental event frequency is
2.29E-8 per well year. The contribution comprises dropping and hitting the x-mas tree from a
crane or a derrick (see section 4.4).
The total blowout risk is found by the use of Equation 5-9 and presented in Table 5-5.
ftotal = fproduction + fintervention + (faccidential event * MFDTaccidential event) Equation 5-9

Table 5-5 The blowout frequency per well year for a well with and without a DHSV, and the risk reducing
effect of the DHSV.
Reduced blowout frequency

With a DHSV Without a DHSV Risk reducing effect
Normal production 4.47E-3 1.85E-2 1.14E-2
Accidental event 1.30E-9 2.29E-8 2.16E-8
Workover 1.7E-4 8.5E-5 -8.5E-5
Total 1.13E-2
In total a removal of the DHSV will increase the risk of blowout due to the TOP-event by a
frequency of 1.13E-2 per well year.
A sensitivity analysis is performed to illustrate the accidental event contribution in the total
blowout frequency. Different frequencies of accidental events are applied to Equation 5-9. The
result of the sensitivity analysis is presented in Figure 5-8. The total blowout risk is always
higher for a well without a DHSV than for a well with a DHSV. Prior to the calculations the
author was assuming that for some values the blowout frequency was lower for a well with a
DHSV than for a well without a DHSV. The point where the two lines cross would represent
an equal blowout frequency in the sensitivity analysis.
Figure 5-8 Sensitivity analysis of the total blowout frequency at different frequencies of accidental events
per well year

5.5.1 Comments to the risk reducing findings

The author was expecting to find a blowout frequency for a well with a DHSV similar to ref.
[7], 5E-5 per well year. The frequencies in ref.[7] are based on actual events. The blowout
frequency found in the CARA-calculations is about 100 times larger. It is reasonable to believe
that the calculations in this report are either based on insufficient data, a bad model or
calculation errors. Other factors may also have contributed to the high frequency.
Reliability data
The author has limited access to valid data. The reliability data used in the calculations is
gathered for both platform and subsea wells. Valid data only for subsea wells should be applied
in the calculations. Another problem is the age of the applied data. All data in this thesis is
more than five years old due to the confidentiality of the operating companies. Implementing
new up-to-date data may change the outcome of the total blowout frequency and is
recommended.
Calculation model
In the model of this thesis the blowout frequency during production is based on the assumption
that all leakage classifies as a blowout. This generates a very conservative value. The leakage
may in some cases be very small and not classify as a blowout. The frequency of the TOP-
event of the CARA calculations are assuming that a leakage in closed position and fail to close
failure of the wing valve leads directly to sea. If the safety barriers in the flow direction fail
there are still barriers further up the line that may prevent a blowout, e.g. the manifold,
separator or other equipment. The calculation methods used are, however, valid.
Alternative calculation method

To illustrate the effect of the DHSV a calculation based on the blowout frequency found in ref.
[7] will be performed. It is obvious that the assumption that the all occurrences of the TOP-
event result in blowout is wrong. If the applied reliability data for the barriers is correct the
proportion between the frequency of the TOP-event with and without a DHSV will be
reasonable.
The frequency of the TOP-event in CARA is 3.3 times higher, for a well with than a well
without a DHSV (see subsection 5.4.4). It may therefore also be reasonable to operate with a
production blowout frequency 3.3 times higher. A blowout frequency of 5E-5 per well year
during production [7] is applied for a well with a DHSV. This results in a production blowout
frequency of 1.65E-4 per well year for a well without a DHSV. The same values for the
accidental event frequency and the well intervention frequency are applied.
In total a removal of the DHSV will then increase the blowout frequency of 3.0E-5 per well
year. This result sounds more reasonable than the one found in the other calculation.

6 Well intervention
6.1 Intervention types
In this subchapter a description of different intervention types and the most important
intervention equipment will be explained. The theory is based on ref. [14], [21], [33] and [34].
There are two types of well interventions, light and heavy (also known as workover). An
intervention requires a separate vessel or workover rig and is therefore complicated due to the
motion of the vessel. The subsea well intervention costs are very high especially when
operating in deep water. Equipment has to be rented and brought out to the location. Getting
the equipment out to the site requires a lot of planning and logistics. If a failure should occur in
between scheduled interventions it might take months before an intervention can be performed.
This could result in a production stop and be of great cost to the operating company.
6.1.1 Light intervention

Light interventions include operations performed within the flow conduit inside the tubing
string and the x-mas tree. There are many types of light interventions, e.g.:
Plugback operations
Coiled tubing operations
Fishing operations
Wireline operations
In some cases a failed DHSV can be repaired by a wireline operation if it is arranged for
insertion of an insert valve in the DHSV. An insert Wireline Retrievable Surface Controlled
SubSurface Safety Valve (WRSCSSV) can be installed as a backup inside the failed DHSV
and be activated by wireline. The insertion of an insert WRSCSSV reduces the diameter of the
production tubing and thus the production is reduced.
When the wireline method is applied a tool string attached to a wire is run by gravity force into
the well. Wireline methods are easy to operate and well known to the operating companies.
Short time is needed for the rigging and rig down. A problem may occur if the method is
applied in deviated and horizontal wells due to the dependability on gravity.
6.1.2 Heavy intervention (workover)

A workover on a subsea completed well require the use of a semi submersible drilling rig with
heavy lift capabilities. A workover involves a pulling of the production tubing. When a vertical
subsea x-mas tree is installed the x-mas tree has to be removed as well. The tubing has to be
pulled for various reasons, e.g. to replace or repair the DHSV. During the workover a blowout
preventer (BOP) stack and a drilling riser installed. Normally several jobs are done during one
workover. A full workover is required for repairs or replacement of the DHSV.
6.1.3 Workover equipment

The following section will describe some of the main equipment used when a workover is
needed to replace a DHSV.

Workover control system

A workover control system connects to the x-mas tree and overrides the installed control
system at seabed. It controls the lower riser package and tubing hanger running tool during
installation and workover. Workover control systems normally include an emergency
shutdown system (ESD). The ESD system secures a safe shut-in and prevents the release of
well fluid for all operation modes.
Risers
Several risers serve different purposes during the different stages of a workover. The
completion/workover riser is used for wireline intervention and retrieval of the x-mas tree.
Separate bores are included in the riser to provide communication with the tubing and the
annulus. The lower riser package is connected to the end of the riser and functions as a barrier
during workover. Riser pipes are used when running the blowout preventer (BOP) from the
workover rig. An iron roughneck screws new pipes on for every ten meters until the BOP
reaches the seabed.
Blowout preventer (BOP)

The blowout preventer (BOP) system is a set of valves installed on the wellhead to prevent the
escape of pressure either in the annular space between the casing and tubing during drilling,
completion and workover operations. Most BOP stacks are designed with a triple ram
configuration, which provides positive protection against blowouts and secures the well in
emergencies [27]. The BOP is normally hydraulically operated from the workover control
system. When installed the BOP is run on guidelines and attached to the wellhead. Prior to the
operation a remotely operated vehicle (ROV) attaches the guidelines to guideposts of a square
wellhead landing base. The BOP is close to the seabed, the guidelines are tightened to find the
right position for connection to the wellhead. The BOP is locked on and the operation can
begin. An illustration of a BOP is shown in Figure 6-1.

Figure 6-1 A conventional subsea blowout preventer stack
6.1.4 Well intervention example

This section describes a workover preformed on a well in the North Sea [35]. The main
objective of the intervention is to get the DHSV functioning again by replacing the whole
completion. This intervention will include pulling of the production tubing.
The workover also included a replacement of the flow control module, pulling and milling of a
production packer to increase the production potential. These events are neglected from this
workover example.
The description is given by the use of short sentences. A full detailed description is too
extensive for the work of this thesis.

1) Anchoring procedure
A workover rig has to be put in transit to the site
The anchors are run to keep the rig at the site.
Guide wires are established to direct the workover tools to the seabed.
2) Run in hole and test BOP

Prepare for running BOP on well.
The BOP is moved to the drill center.
Connect riser in rotary.
Run Marin riser/BOP,
Tests are preformed on the BOP and wellhead connector.
A jumper frame is installed
Function test the BOP.
3) Run Workover riser and pull Tubing hanger crown plug

Pressure is monitored thru the tree cap isolation line.
Run tubing hanger running tool, electric stab assembly, workover riser and surface tree
w/45 ft bails.
Rig up wireline and find the inner diameter (drift) of the tree cap ball valve.
Pull tubing hanger crown plug.
4) Kill well
Install tubing hanger isolation sleeve w/lockring
Bullhead 1,18 sg brine to kill well, this means that the production fluid is pushed back
into the reservoir so that the well can be killed.
Flow check the well for leakages.
Rig up wireline.
Run in hole and punch tubing above production polished bore receptacle (PBR)
Circulate out annulus fluid and flow check
Set back surface tree in moosehole.
Pull tree cap, workover riser, electric stab assembly.
Lay down surface tree on pipe-deck
5) Pull tubing, DHSV and downhole permanent gauges (DHPG) w/cable

Make up tubing hanger running tool on 5 inner tag drill pipe.
Run in hole.
Lock tubing hanger running tool to tubing hanger.
Unlock tubing hanger.
Pick up to shear production polished bore receptacle (PBR).
Pull out of hole the 7 tubing, DHSV, DHPG and clamps.
Install x-mas tree bore protector on drill pipe to protect the tubing hanger seal area.
6) Clean well
Run clean-out bottom hole assembly with a mill.
Pull x-mas tree bore protector on drill pipe.
7) Dummy tubing hanger

Run dummy tubing hanger.
8) Run tubing

Prepare for running completion.

Make up 7 double and rack back same.
Make up and run bottom of tubing completion assemblies.
Run tubing to DHSV depth.
Run in hole production PBR on drill pipe for space-out.
Close BOP and mark drill pipe.
Pull drill pipe out of hole.
Make up DHSV assembly.
Test control lines.
Run remaining tubing accessory to final space out
9) Run tubing hanger

Make up tubing hanger to tubing.
Connect control lines to tubing hanger. Install tubing hanger in center.
Make up tubing hanger running tool to tubing hanger
Run tubing hanger on drill pipe.
Land and lock tubing hanger to the x-mas tree.
Open downhole supply valves DS1-DS4.
Engage electric stab and hydraulic system.
Close middle pipe ram.
Pressure test tubing hanger gallery seals, DHSV control lines and tubing hanger.
Spot high viscosity mud across tubing hanger.
Unlatch tubing hanger running tool. Pull out of hole with tubing hanger running tool on
drill pipe.
10) Pull tubing hanger isolation sleeve

Pull tubing hanger isolation sleeve on 0.125 slick line through the marine riser.
11) Run workover riser

Run tree cap, tree cap running tool, electric stab assembly, workover riser and surface
tree w/45 ft bails
Land and lock tree cap.
12) Set prod packer

Displace well to diesel, drop ball to seal off tubing side.
Pressure up tubing to set production packer
Inflow test DHSV. Test production packer. Function test LBV and OBV
13) Pull Pre installed production packer

Rig up wire line and run in hole. Pull pre-installed production packer setting plug
14) Flow well

Flow well to test plant.
Rig up wireline production logging tool.
Log and flow well.
15) Test and abandonment of well

Shut in and inflow test DHSV.
Pump MEG on top of DHSV
Rig up tubing hanger crown plug.

Run in hole, set and test tubing hanger crown plug.

Pull out of hole.
Rig down wire line.
Test x-mas tree for abandonment
16) Pull workover riser

Disconnect tree cap running tool.
Set back surface tree in moosehole.
Pull workover riser and electric stab assembly.
Lay down surface tree
17) Pull BOP, lay down pipes

Disconnect BOP.
Move rig.
Pull BOP and marin riser.
Lay down pipes
18) Anchor handling

Install x-mas tree debris cap. Install wellhead protective roof. Pull anchors.
19) End of operations
In chapter 6.2.3 the role of the BOP will be analysed in a HAZOP study. The entire workover
process will not be analysed due to the limitation of time in this thesis.

6.2 HAZOP (Hazard and Operability Analysis)

6.2.1 Background
HAZOP (Hazard and Operability analysis) is a method for identifying and assessing problems
that may represent a risk to personnel or equipment, or prevent efficient operation. The
HAZOP originated within the chemical process industry and developed from critical
examination techniques in the 1960s. Different activities were examined and questioned with
critical questions like: What is achieved? What else could have been achieved? How is it
achieved? [10]
The International Electrotechnical Commission (IEC) developed in 1998 a proposal for an

international standard that was published in 2001, the IEC 61882. In this standard HAZOP is
defined:
A HAZOP study is a detailed hazard and operability problem identification process,

carried out by a team. HAZOP deals with the identification of potential deviations from
the design intent, examination of their possible causes and assessment of their
consequences. [2]
The classical process HAZOP technique is based on assessing plants and process systems e.g.
in a chemical plant. The system is broken down into pipe segments and main plant items.
Guide-words are applied to different process parameters to identify derivations in the system.
Different failure modes of every system component are evaluated when employing the process
HAZOP. The components impact on system functionality is identified and preventive action is
performed.
The HAZOP technique has developed to be applied in many different areas today. Within the
oil industry a drillers HAZOP has been developed to enhance offshore drilling safety. Other
HAZOPs like Human HAZOP and Software HAZOP are developed to focus on their specific
area. When dealing with well operations and workovers the employment of a procedure
HAZOP is preferred. In subsection 6.2.3 a HAZOP of a BOP handling procedure will be
performed.
A procedure HAZOP is also called a Safe Operations Analysis (SAFOP) and may be applied to
all sequences of operations. Procedure HAZOP is a further development of the original
HAZOP method. Focus on both human errors and failures of technical systems are held
through the analysis. A procedure e.g. a workover situation is broken down into different sub
procedures and finally operational steps. An identification of the potential causes and
consequences related to the different steps are done. An outcome of the study may normally be
a list of preventive actions. The procedure HAZOP is best suited for detailed assessments, but
may also be used for coarse preliminary assessments. In order to have an effective and useful
procedure the work description should be clear and unambiguous. All relevant information
should be available prior to the study.
As in all risk assessment tools there are advantages and disadvantages in accomplishing a
HAZOP study, these are presented in Table 6-1.

Table 6-1 Advantages and disadvantages with the HAZOP analysis [9] (with some supplements of the
author.)
Advantages and disadvantages with the HAZOP analysis

Advantages Disadvantages
Requires a mixed team of engineers and personnel
Identifies potential hazards before they become
from all fields in order to cover all aspects of the
built into the system
system
Human factors may sometimes be set as the reason
The systematic method covers all the
for hazards rather than looking at the underlying
potential hazards for of system
reasons
Provides a basis for a list of actions in order to The study will generate extensive information.
prevent or rectify problems This must be recorded by someone responsible
People with different fields of profession are The study takes long time to complete depending
working together. on the extent of the investigation.
The different parties included in the process or The HAZOP only reveals component weaknesses
procedure get an insight to the other areas of the and is not an in-depth review of the causes and
work or process. consequences.
6.2.2 HAZOP methodology

Essentially the HAZOP procedures involve taking a full description of a process or a procedure
and systematically question every part of it. A number of brain-storming sessions help
finding deviations from the design intent. Once identified, an assessment is made as to whether
such deviations and their consequences may have a negative effect on the safe and efficient
operation of the analysed system. If considered necessary, action is then taken to remedy the
situation. The outcome of a HAZOP may be a recommendation of actions that are to be taken
in order to address the concerns found during the analysis. The different steps of the HAZOP
procedure is presented in appendix D
An essential feature in the process of systematically questioning is the use of guide-words in

combination with different parameters in order to focus the attention on deviations and their
possible causes. The entire technique of HAZOP revolves around the effective use of these
guide-words, so their meaning and use must be clearly understood. A HAZOP study is in
principle qualitative, there is no quantification of risk. However, the hazards identified form
the basis for further quantitative risk or reliability analysis.
After finding appropriate the guide-words the procedure may begin by accessing each of the
different elements of the study. By making use of the flow diagram in Figure 6-2 the potential
problems can be identified.
The output of the study consists of a set of recommendations on how to approach a better
solution.
A HAZOP study is a team effort. The success is very much dependent on the team. To gain the
relevant information and a successful HAZOP analysis a reasonable composition by
experienced and contributing members must be established. Representatives of all disciplines
involved in the operations should be included in the team. Input based on their responsibility in
the performance of the operations is essential. The diversities in background help the different
members identifying all the important issues of the study and provide an ability to see the
scenario from different angles. A study will generally involve at least four and rarely more than
seven persons. The larger the team, the slower the process.

The need for an experienced HAZOP chairman is crucial. It is important that the chairman is
familiar with the type of work being analyzed and that sufficient authority is achieved to
control the discussion. During the team discussion the chairman should act as a catalyst and
guide the team in posing the appropriate type of questions. Finally the leader should draw the
conclusions from the discussion and propose the appropriate entry in the record sheet.
Select a procedure
Have all the relevant guide-words for

YES
this procedure been considered?
NO
Select a relevant guide-word not

previously considered
Are there any causes for this

NO
deviation not discussed and recorded
YES
Record the new cause
Are the associated consequences of

NO
any significance?
YES
Record the consequences
Record any safeguards identified
Having regard to the consequences

NO and safeguards, is an action
necessary?
YES
Record the agreed action
Figure 6-2 Flow chart of a HAZOP examination procedure (based on [2])

6.2.3 HAZOP of the BOP handling procedure

In an overall risk assessment the identification of hazards and hazardous events are important.
The implementation of a procedure HAZOP on a workover will help identifying the hazards
and its potential consequences. A complete HAZOP of a workover is to comprehensive for this
thesis and the competence of the author. In this study only the handling of the Blowout
preventer (BOP) is considered.
The HAZOP of the BOP handling procedure provided in this thesis has not been subject to a
group discussion and a HAZOP team. The outcome will be fully dependent on the authors
understanding of the problem. Important issues might have been left out and the weighing of
criticality may not have been done to the satisfaction of all readers.
In the traditional HAZOP analysis the guide-words; NO, MORE, LESS, AS WELL AS, etc.
are used. In a procedure HAZOP these words are, from some point of views, not as well suited.
Instead a set of guide-words in interest for the specific analysis are developed for the specific
procedure. The author experimented with the use of such guide-words in the procedure
HAZOP without success. The traditional guide-words are of a general character and easier to
apply to the different procedures in the study of BOP handling. An understanding of why this
guide-word is applied is given for each of the steps in the causes-column of the HAZOP-
sheet. The need for more specific guide-words was therefore neglected. Traditional guide-
words are also more common and easier to understand. As a result the traditional guide-words
are applied in this thesis. The guide-words used and their meaning is presented in appendix E.
6.2.4 The BOP handling procedure

In this chapter a Blowout preventer (BOP) handling procedure is described. This procedure
will be analysed systematically as a part of a procedure HAZOP. The procedure is only used to
illustrate the employment of a HAZOP study and is therefore reduced. If a full HAZOP study
of the BOP handling procedure is wanted a more extensive description of each step should be
done.
1. The BOP is tested on a hub

2. The AX-seal ring on the BOP is checked
3. The BOP is moved by forklift truck over the hole on the cellar deck.
4. A riser pipe is lifted off the pipe rack with the pipe handling equipment
5. The riser pipe is lowered through the drilling deck and screwed on to the top of the
BOP by an iron roughneck.
6. The BOP is lifted off the fork truck by a riser elevator, lowered and hung at the drilling
deck.
7. The roughneck screws a new riser pipe on and the riser elevator is used to lower the
riser with the BOP attached.
8. This procedure is repeated until the BOP is lowered to the seabed.
9. The guideline wires are tightened to find the right position for the BOP
10. The BOP is connected to the wellhead
11. The BOP is pressure tested for leakage in the AX-seal
12. Workover is performed through BOP
13. BOP is disconnected from wellhead
14. The BOP is raised with the riser elevator
15. Guidelines are loosened to move BOP away from well

16. Riser pipes are unscrewed with iron roughneck and placed on rack until BOP is on
cellar deck.
To gain an insight into the dimensions and the extent of the procedure a picture of a BOP is
presented in Figure 6-3.
Figure 6-3 A typical blowout preventer used on subsea wells

6.2.5 The HAZOP analysis

The HAZOP study consists of four basic sequential steps, definition, preparation, examination
and documentation. Appendix D will describe the different steps in detail. The study of the
BOP handling procedure is done to illustrate the use of a HAZOP analysis. A lot of the
essential documentation and preparatory work has not been done. Focus has been on the
examination. This limitation is done due to the educational perspective of this thesis.
Table 6-2 presents the result of the HAZOP analysis on a BOP handling procedure. The
columns in the HAZOP sheet are based on ref. [2]. A column where existing safeguards are
listed is left out due to the authors limited knowledge of the procedure.

Table 6-2 HAZOP work sheet of the BOP handling procedure
HAZOP of the BOP handling procedure

ID Work Guide Possible causes Consequences Actions required Action
step word by
1 1 NO The test HUB is not The BOP can not be tested Make sure the HUB is present
present or does not work and is functioning
2 1 NOT The testing is not done The BOP may have failures The BOP should be tested
that are not recovered before the procedure takes
place
3 1 MORE The testing procedure is The workover may be Only essential functions should
to extensive or lasts to unnecessarily delayed be tested on the rig, others are
long tested prior to going offshore
4 2 NOT The AX-seal is not The BOP will leak
present
5 2 PART A part of the AX-seal is The BOP will leak
OF ruptured or scratched
6 3 NO No BOP is present on the Delayed operation Make sure that BOP placed on
fork lift the forklift
7 3 MORE The forklift places the BOP has to be moved again
BOP in the wrong and the operation is delayed
position
8 3 MORE The BOP falls off the The BOP may not function
forklift or is bumped as intended or be broken
9 4 NO The riser pipe rack is not Operation will be delayed as Check the programming of the
in the right position or the rack must be moved or pipe handling system prior to
the system is the pipe handling system be operation
programmed wrong re-programmed

10 4 NO Riser pipes are not Delayed operation Make sure riser pipes are
present in the time of present
operation
11 5 OTHER The riser pipes are not This may lead to a delay in Check the programming of the
THAN connected; the roughneck the operation and in worst iron roughneck prior to
is screwing the pipe the case dropping the BOP operation
opposite direction.
12 5 REVER The riser pipes are not Delayed operation and Make sure the riser pipes are
SE connected, they are possibility dropping the stacked in the right direction
upside down BOP.
13 5 LESS Riser is not properly The riser is not screwed Use instruments to measure the
connected to BOP properly to the BOP. The torque and position
BOP may fall down
14 5 MORE Riser is screwed to tight Threads are damaged and Use instruments to measure the
to the BOP may not hold the BOP as torque and position
intended. BOP may fall
down
15 5 MORE Roughneck damages the The riser may leak or be Make sure the riser pipe is
rise by holding to tight damaged. controlled before the pipe is
lowered
16 5 PART The Riser pipe is The riser is not connected to Use instruments to measure the
OF lowered, but in the wrong the BOP position
position to be screwed on
17 6 LESS The riser flange The riser and BOP will fall Control dimensions prior to
dimension is too narrow down workover and use eye control
to hang on drilling deck. when operating
18 6 MORE The drilling deck does The riser and BOP will fall Check the drilling deck for
not hold the weight of the down corrosion and wear
BOP.

19 6 MORE The running speed of the Causing the drilling deck to Find a running speed that is
riser/BOP is too high crack and the BOP may ideal for this operation
swing and cause oscillating
20 6 PART The riser elevator is The assembly can not be
OF jammed lowered to the seabed
21 7 NOT The riser elevator is The assembly can not be Make sure elevator is
broken lowered to the seabed functioning prior to operation
22 7 LESS The assembly is lowered Causing the procedure to last Find a running speed that is
to slow too long ideal for this operation
23 7 MORE The assembly is lowered May cause the string to jerk Find a running speed that is
to fast when stopped to connect a ideal for this operation creating
new riser pipe and the a smooth stop when
assembly may swing connecting new pipes
24 7 LESS Riser is not properly The riser is not screwed Use instruments to measure the
connected properly on. The BOP torque and position
assembly may fall down
25 7 MORE Riser is screwed to tight Threads are damaged and Use instruments to measure the
may not hold the assembly as torque
intended. BOP may fall
26 7 NOT New riser pipes are not The operation is delayed Make sure that enough riser
present pipes are present
27 9 LESS The guidelines are not The BOP is not in the right
tightened enough position
28 10 MORE The BOP is attached to Stabs, AX-seal and locking Make sure the connection of
the Wellhead with to screws are damaged. the BOP is nice and steady
much force
29 10 NOT The BOP is not in The BOP may not connect to Use instruments to measure the
position with the the wellhead due to wrong exact position
Wellhead positioning

30 11 LESS The pressure is low The BOP is leaking Acceptable leakage must be
defined prior to operation
31 12 NOT The BOP is not working The operations may be
properly harder to perform or not able
to be performed
32 12 LESS Fluid is flowing from the The BOP is leaking
connection
33 13 NOT The BOP is jammed The BOP does not
disconnect
34 14 NOT The riser elevator is The BOP can not be lifted Make sure to have redundant
broken from the seabed lifting systems
35 14 MORE The riser/ BOP assembly The BOP can not be lifted Make sure the riser elevator
is to heavy to lift from the seabed and lifting gear is properly
proportionate for the job
36 15 NO The guidelines are not The BOP may not be moved
able to loosen away from the seabed
equipment and has to be
raised above the subsea
equipment
37 16 MORE Riser is screwed on to The pipes may not be able to Make sure to have cutting gear
tight demount present at the site
38 16 OTHER The roughneck is This may lead to a delay in Make sure the programming of
THAN screwing the pipe the the operation the iron roughneck is right
opposite direction. prior to operation
39 16 NO The riser pipe rack is not Operation will be delayed as Make sure the programming of
in the right position or the rack must be moved or is right prior to operation
the pipe handling system the roughneck be re-
is programmed wrong programmed

6.2.6 Result of the HAZOP analysis

The HAZOP analysis has revealed several hazards. The hazards and its causes should be
evaluated in order to reduce the risk related to this procedure. The main hazards related to
the BOP handling procedure are delay in operation, dropped BOP and leakage to sea. If
the operation is delayed it will result in lost production and extra cost related to hiring of
a workover rig and other equipment. If the BOP is dropped this will always lead to a
delay, but more serious scenarios may also occur. The BOP may fall down and hit the x-
mas tree, manifold or other subsea equipment. A damaged x-mas tree is not only a
scenario of economic character but there are also environmental consequences related to
this. The downhole safety valve (DHSV) will play an important role if the x-mas tree is
damaged. If no DHSV is present the leakage of hydrocarbons from the reservoir can be
significant. It would be a disaster. If by any chance a DHSV is present the leakages still
will be extensive and the damages may require an abandonment of the well.
The most frequent finding in this HAZOP is the need for preparation before the different
operations begin. It is important that all steps are carefully planned and the testing of the
equipment is done properly. Another important issue is the securing of the subsea
equipment. This should be considered already when a new well is in the planning phase.
If the BOP should be lost, or any other equipment, and hit the subsea equipment the
consequences may be enormous.
A list of the most important recommended actions derived from this HAZOP analysis is
given below.
1. Evaluate the probability of dropping the BOP and potential consequences

2. Make sure the AX-seal is present and adjusted on the BOP and that the BOP is
tested and functioning prior to running
3. Make sure the pipe handling system and the iron roughneck is operated correctly
4. Make sure there are enough riser pipes present and that they are stacked the right
way
5. Find a satisfactory running and pulling speed on the riser elevator
6. Have redundant lifting gear present on the workover rig if the riser elevator should
fail

7 Conclusions and recommendations for further

work
7.1 Conclusions
The overall objective has been to determine whether or not a DHSV should be installed in
a subsea oil/gas well from a risk point of view. A conclusion is presented in this section.
Based on the quantitative findings in this study the DHSV reduces the risk of blowout
with approximately 50%. A removal of the DHSV represents an increased failure
probability, and two independent and tested well barriers are not present in all cut sets.
None of the cut sets do, however, violate a required SIL3 level when the DHSV is
removed from the completion.
The blowout frequency caused by the DHSV during workover is 1.7E-4 per well year,
and 8.5E-5 per well year for a well without a DHSV. The blowout frequency during
production is based on the assumption that all occurrences of the TOP-event, leakage
to the surroundings, classify as a blowout. During production the blowout frequency is
found to be 4.47E-3 per well year for a well with a DHSV, and 1.85E-2 per well year
when the DHSV is removed. In addition to the blowout frequency during production and
workover a blowout frequency caused by accidental events should be included. The total
blowout frequency is found adding up the different contributions:
ftotal = fproduction + fintervention + (faccidential event * MFDTaccidential event)
The DHSV blowout frequency contribution during installation is not included in this
study. There is no data revealing the changes in blowout frequency when the DHSV is
removed for the installation phase.
The blowout frequencies found in the calculations are of very high. In total a removal of
the DHSV increases the blowout frequency by 1.13E-2 per well year. It is reasonable to
believe that the calculations in this report are either based on insufficient data, a bad
model or calculated errors. Other factors may also have contributed to the high frequency.
An alternative calculation method based on the proportion of the frequencies of the

TOP-events, and the experience data found in ref.[7] is applied. In the new calculations
a removal of the DHSV will increase the blowout frequency of 3.0E-5 per well year. The
author finds this result more reasonable.
50% of the shut-ins of a well leading to a workover are caused by a DHSV failure. A
DHSV failure requires a workover generating a loss of oil production of up to $5,6
million. In addition there will also be expenses concerning the rental of a workover rig. A
total cost of 20 million dollars per intervention is therefore not unrealistic.
The author cannot recommend removing the Downhole safety valve (DHSV) from a
subsea oil/gas production well based on the findings in this thesis. Although there may be
some economic advantages in removing the DHSV the risk of blowout should be given
the greatest attention. In addition to causing pollution, the occurrence of a blowout may in
severe cases lead to a bad reputation among consumers and environmental organisations.

The consequences of a bad reputation are hard to estimate. If a boycott of the operating
company is carried out it could lead to greater economic losses. Negative publicity not
only affects the concerned company but the entire oil industry.

7.2 Recommendations for further work

This thesis is carried out within a limited period of time and with limited access to data. It
is recommended that the conclusion of the thesis be explored further. A range of tasks
may be carried out to provide an even better basis in deciding whether or not a downhole
safety valve (DHSV) should be present in a subsea oil/gas well
Improved calculation model

In the calculation model of this thesis the blowout frequency during production is based
on the assumption that all leakage classifies as a blowout. This generates a very
conservative value. The leakage may in some cases be very small and not classify as a
blowout. The model used in the fault tree calculations assume that a leakage in closed
position and fail to close failure of the wing valve leads directly to sea. If the safety
barriers in the flow direction fail there are still barriers further up the line that may
prevent a blowout, e.g. the manifold, separator or other equipment. A better and improved
model could generate a better and more realistic blowout frequency result.
Data accuracy
The author has limited access to valid data. The reliability data used in the calculations is
gathered for both platform and subsea wells. Valid data only for subsea wells should be
applied in the calculations. Another problem is the age of the applied data. All data in this
thesis is more than five years old due to the confidentiality of the operating companies.
Implementing new up-to-date data may change the outcome of the total blowout
frequency and is recommended. The presented approach is, however, valid and applicable
when new data is found.
Including the consequence

The calculations done in this thesis do not consider the blowout consequences. Although
a blowout occurs it may not always cause severe pollution. None of the blowouts in the
production, workover or installation phase, recorded in ref. [7], has caused severe
pollution. During the production phase only one of seven blowouts caused small
pollution; the other six caused no pollution. A workover blowout is more likely to cause
severe pollution than the other stages of the well. An evaluation of the consequences of a
blowout at the different well life phases should be included in a further evaluation of the
risk reducing effect of the DHSV.
Economic cost evaluation

In this thesis some of the economic aspects related to the DHSV are discussed. Due to a
lack of cost information from operating companies an evaluation of the reduced cost a
removal of the DHSV would represent is not included. A total economic evaluation of the
costs related to the DHSV for the operating company should be performed. The findings
in this thesis have revealed that a substantial amount of money may be saved.
Alternative solutions
In some cases alternative solutions may be more reliable than a DHSV. A further study
developing new solutions and examining other existing solutions is recommended. The
economic cost and the environmental risk related to a frequent workover rate caused by
the DHSV may be reduced.

8 References
1. Aleksandersen, J., Sangesland, S., Well intervention in subsea completed wells,
Department of Petroleum Engineering and Applied Geophysics, The Norwegian
Institute of Technology, The University of Trondheim, Trondheim, 1994
2. British Standard Institute (BSI), Hazard and operability studies (HAZOP
studies)- Application guide, 2001
3. Dovre Safetech, Dropped object analysis Large water depths SAGA, April 1995
4. Durham, C.J, Paveley, C.A., SPE 56934 Radical Solutions Required:
Completion Without packers and Downhole Valves Can Be Safe, Society of
Petroleum Engineers, Inc. Offshore Europe Conference, Aberdeen, Scotland, 1999
5. Goland, M., Whitson, C.H., Well Performance 2nd edition, Prentice Hall,
Trondheim, 1991
6. Herfjord, H. J., Brnnteknologi, NKI Forlaget, Larvik, 1988
7. Holand P., Offshore Blowouts Causes and Control, Gulf Publishing Company,
Houston, TX, USA, 1997
8. Hyland, A. and Rausand, M., System Reliability Theory - Models and
Statistical Methods, John Wiley & Sons Inc., New York, 1994.
9. Kirwan, B., Ainsworth, L.K., A guide to task analysis, Taylor & Francis Ltd.,
Great Britain, 1992
10. Kletz, T.A., HAZOP AND HAZAN Identifying and Assessing Process Industry
Hazards, The Institution of Chemical Engineers, Warwickshire, England, 1992
11. Minerals Management Service, Part 250-Oil and gas and sulphur operations in
the outer continental shelf,
12. Mobile E. & P Technical Center, Mobile completions handbook, Dallas, TX,
USA, 1996
13. Molnes E., Sundet, I., Reliability of well completion equipment Phase II
Report. (SINTEF report no. STF75 F95051, 1996, Safety and Reliability,
SINTEF, Trondheim)
14. Molnes E., Sundet, I., Vatn, J., Reliability of well completion equipment Main
Report. (SINTEF report no. STF75 F92019, 1992, Safety and Reliability,
SINTEF, Trondheim).
15. Molnes, E., Holand, P., Sundet, I., Vatn, J., Reliability of surface controlled Sub
Safety Valves- Phase III- Main Report. (SINTEF report no. STF75 F89030, 1989,
Safety and Reliability, SINTEF, Trondheim).
16. Molnes, E., Sundet, I., Vatn, J., Reliability of surface controlled Sub Safety
Valves- Phase IV. (SINTEF report no. STF75 F91038, 1992, Safety and
Reliability, SINTEF, Trondheim).
17. NORSOK, 1998, Subsea production systems, [online] Found at
http://www.nts.no/norsok/u/u00102/u00102.htm, 18.11.01
18. Offshore Technology, Exxon Valdez Oil Spill, [online] Found at
http://www.offshore-technology.com/contractors/environmental/exxon-
valdez.html, 02.05.02
19. Rausand M., Personal conversation, Institutt for Produksjons og
Kvalitetsteknikk, NTNU, Norway, 08.02.2002
20. Rausand, M., Vatn, J., Reliability modelling of surface controlled subsurface
safety valves, Reliability Engineering and System Safety, Vol. 61, 1998

21. Sangesland, Sigbjrn, Petroleum Technology Introduction Part II, Department

of Petroleum Engineering and Applied Geophysics, The Norwegian Institute of
Technology, The University of Trondheim, Trondheim, 1994
22. SINTEF Industrial Management, Offshore Reliability Data 3rd Edition, OREDA
97, 1997
23. Statoil, 2002, sgard, [online] Found at
http://www.statoil.com/STATOILCOM/SVG00990.nsf/UNID/EB5BA0F3138B8
93D41256657004B2695?OpenDocument, 05.03.2002
24. Statoil, Personal handbook Subsea Equipment, Kongsberg, Norway, 1998
25. Strand G. O, Personal conversation, Exprosoft AS, Norway, 02.05.2002
26. Tallby R. J., Barriers in Well Operations, Statoil Report no R00290rjt/RJT,
Stavanger, Norway, 1990.
27. The Drilling People's Website, 2002, Blowout Preventer: (BOP), [online] Found
at http://www.workover.co.uk/bops/blow_out_prevention_bops.htm, 17.02.02
28. The Norwegian Oil Industry Foundation (OLF), 2001, RECOMMENDED
GUIDELINESFOR THE APPLICATION OF IEC 61508 AND IEC 61511 IN THE
PETROLEUM ACTIVITIES ON THE NORWEGIAN CONTINENTAL SHELF,
[online] Found at http://www.itk.ntnu.no/sil/Guideline_IEC.pdf, 10.04.2002
29. The Norwegian Petroleum Directorate, 2001, REGULATIONS RELATING TO
CONDUCT OF ACTIVITIES IN THE PETROLEUM ACTIVITIES (THE
ACTIVITIES REGULATIONS), [online] Found at
http://www.npd.no/regelverk/r2002/Aktivitetsforskriften_e.htm, 07.03.2002
30. The Norwegian Petroleum Directorate, 2001,REGULATIONS RELATING TO
DESIGN AND OUTFITTING OF FACILITIES ETC. IN THE PETROLEUM
ACTIVITIES (THE FACILITIES REGULATIONS), [online] Found at
http://www.npd.no/regelverk/r2002/Innretningsforskriften_e.htm, 02.05.02
31. Thomson, G., email 13.02.2002, HM Principal Inspector UK
32. Vatn, J., 1999, A discussion of the acceptable risk problem, [online] Found at
http://www.ipk.ntnu.no/RAMS/Notater/accept.pdf, 17.04.2002
33. Wahlstrm, E., Safety analysis of subsea production system workover, Institutt
for produksjons og kvalitetsteknikk, Norges Tekniske Hgskole, Trondheim, 1994
34. SG RESU sgard Intervention Program Smrbukk Well 6506/12-I-4 H, Statoil,
2001
35. SG RESU, sgard Intervention Summary Report Smrbukk Well 6506/12-I-4 H,
Statoil, 2001

9 Appendices
Appendix A: Introduction to a subsea production system

Appendix B: The production well
Appendix C The fault trees
Appendix D: Reliability data dossiers
Appendix E: The basic steps of a HAZOP procedure
Appendix F: HAZOP guide-words

APPENDIX A
A1 Subsea production system
This appendix is based on information found in references [5, 6, 12, 21]. The appendix is
included to provide a basis of understanding of a subsea production system and the different
hardware components included.
A production system is essentially a system that provides transportation of fluids from the
reservoir to the surface and separates it into oil, gas and water. The oil and gas streams are
transported from the field and prepared for sale. The water is treated and injected to the
reservoir or brought to disposal. A production system consists of different groups of
mechanical elements.
Subsea system components are normally exposed directly to the sea. The installation and
maintenance operations are carried out by specially designed manipulators, remote operated
vehicles (ROV), conventional divers, drill string from a vessel, or by recovering components
to the surface.
A1.1 Natural flow production well

Production from a natural flow well is probably the most common method of oil production.
Figure A-1 shows a naturally flowing production well. To be able to produce fluid from this
well different components are required. The main components relevant for a natural flow
subsea well are:
1. Casings
2. Tubing string
3. Production packer
4. Downhole Safety Valve (DHSV)
5. Subsea wellhead
6. Subsea x-mas tree
7. Control system
A-1
DHSV
Figure A-1 Natural flow well

The components mentioned here will be explained more detailed later in this chapter. The
build up of the well is as follows. A production casing is perforated along the hydrocarbon-
bearing formation to allow reservoir fluid to enter the well and flow upward through the
tubing. The tubing is the pipe that provides a flow path for the produced fluid from the
reservoir. A production packer is located in the annulus to seal off the annular space between
the casing and tubing. The tubing string may include accessories like seal assembly, safety
valve, packers and pumps. It is suspended from a tubing hanger installed at the wellhead. The
tubing hanger provides a sealing between the top of the tubing and the annulus. A series of
valves are placed above the tubing hanger, known as the x-mas tree assembly. The x-mas tree
production master valve functions as a safety barrier and is capable of cutting of the flow
from the reservoir. The production wing valve directs the flow away from the well into a
production manifold or storage unit. A swab valve is located in the top of the x-mas tree and
used to perform safe vertical re-entries into the tree and well during workover. The control
system allows operation of subsea valves during production.
A1.2 Well installation

Installation of subsea well and downhole maintenance is normally carried out from a drilling
rig. It is normal for the well to be drilled, completed, and the tree installed in one continuous
operation. On previously drilled wells, the subsea tree would be installed after re-entry, clean
up, and completion. As with any offshore operation, the successful installation of a subsea
well requires considerable logistics and planning. Additional processing facilities may be
required on the drilling vessel to permit initial clean up and testing of the well in order to
prevent introduction of sand or debris from the completion into the subsea flowlines. The
completion of wells from a floating vessel is somewhat more complicated than from a
platform. The motion vessel requires extra care and heave compensation equipment to prevent
damaging of completion tubing and seals.
A-2
A1.3 Well completion
A1.3.1 Tubing
The tubing is a string of pipes stretching from the reservoir and up to the wellhead. This is
where the produced fluid is led upward to the platform. Different accessories can be mounted
on the tubing to control the flow.
A1.3.2 Casing program

The well consists of a group of concentric pipes, which are tapped together into what is called
a casing program. During drilling operation a new casing pipe is added for every drilled
diameter. When the hole is drilled, a casing pipe is cemented in place. Usually three casings
are used. The outer casing is called a conductor pipe and provides a fundament for the well.
When the conductor casing is in place the surface casing, intermediate casing and the
production casing is added on. The production casing is also called a linear casing and varies
from the other casings by not going all the way up to the wellhead. The main function of the
casing is to provide a stabilisation barrier for the well and to protect the production tubing.
A1.3.3 Subsea x-mas tree

The subsea x-mas tree, an assembly of valves, provides the control of the well during
production and is located at the top of the wellhead. Configuration and design of the x-mas
tree depends upon several factors. The x-mas tree may be a single block type or several
valves joined together; it may be of a horizontal or conventional vertical alignment (dual
bore). The vertical tree is designed to connect to a wellhead and interface with the tubing
hanger previously installed in the wellhead. A horizontal tree differs from the conventional
with the annulus bore branch horizontally out to the side of the tree and the valves are
oriented on a horizontal axis. The access to the well bore is gained by removing the internal
tree cap.
The main purpose of the x-mas tree is to provide an ability to shut in the well at the wellhead.
The x-mas tree also fulfils the following functions
Direct the production flow from the well

Safely stop the flow.
Inject protection fluids into the well or the flowline
Allow injection of fluid to kill the well.
Provide annulus control.
Provide access to the annulus during the installation and the production phases.
Allow an easy connection of the tree running tool and its associated completion riser.
Facilitate all aspects of the maintenance outside of the tree.
Operate as a safety barrier.
A1.3.4 X-mas tree components

The components of a subsea x-mas tree are described in brief with the functions.
The production master valve is located on the vertical production bore. The master
valve always remains open except for emergencies or during pressure tests of the tree.
The production master valve is a fail-safe-gate valve.
A-3
The wing valve is located on the horizontal outlet from the x-mas tree. If it becomes
necessary to close the well, the wing valve is the first to be closed. This is where the
produced fluid is flowing through.
The swab valve is located on the vertical bores of the tree above the wing valve. The
swab valve is used to perform safe vertical re-entries into the tree and well during
workover.
The crossover valve connects the production bore to the annulus bore via a crossover
service line.
The annulus master valve is located on the vertical annulus bore. It is normally closed
and opened only if fluid is to be injected to the annulus bore.
The annulus wing valve is normally closed. It closes the side outlet oft the tree block
to isolate the service line during production and intervention.
Gate valves are the most common type valves in the x-mas tree. The gate valves are normally
operated either hydraulically, by mechanical override or remotely operated vehicle (ROV).
A1.4 Subsea wellhead

The subsea wellhead system is the primary component of a subsea production well. It
functions both as a pressure vessel and a structural support at the seabed. During oil and gas
production the wellhead support and seal the x-mas tree and holds the casings and the tubing.
In the wellhead, the tubing hanger and casing hangers are connecting and carrying the load of
the tubing and casings.
The tubing head is attached to the uppermost casing head and supports the tubing string. The
tubing hanger is an integrated part of the wellhead. It seals and locks the tubing inside the
wellhead housing. Seals isolate the production and annulus fluids and prevent leakage. The
tubing hanger can either be locked to the wellhead housing or directly via a casing hanger
lock down profile, or locked in the last casing hanger suspended in the wellhead. Hydraulic
and electrical communication with downhole equipment requires the use of penetrators in the
tubing hanger and x-mas tree.
The casing head is attached to the wellhead on a casing hanger. A seal is provided to avoid
leakage of annulus fluids into the next casing or to the surroundings.
A1.5 Guiding system

Two different guiding systems have been developed for well completions and workover,
guidelines and guidelineless. These systems are used to guide the Blowout preventer (BOP)
down to the seabed and place it in the right position.
A1.5.1 Guideline system

The guideline system is the most conventional and experienced method used for subsea
equipment installation. Four guidelines are connected to guideposts of a square wellhead
landing base. The BOP is lowered down on the guidelines. When the BOP is closing in on the
seabed they are tightened. This helps the BOP to connect to the wellhead at a precise position.
The guidelines can be installed and retrieved by ROV or a diver.
A-4
A1.5.2 Guidelineless system
Several manufactures have provided a guidelineless system for many years. Due to the
variation in equipment from the different manufacturers different methods are used for the
different manufacturer. One solution is described here. The guidelineless x-mas tree is run on
a completion riser. A sonar or TV tool is used to locate the wellhead and connect the x-mas
tree to it. Then the x-mas tree is oriented with reference to the tubing hanger. After the tree is
oriented in the right position, the pressure on 4 jack landing cylinders is bleed off and the x-
mas tree is landed.
A1.6 Tubing string accessories

A1.6.1 Downhole Safety Valve (DHSV)
Downhole in the production string a Downhole Safety Valve (DHSV) is located to provide a
shut in of the well if dangerous situations occur. The DHSV is normally hydraulically
operated from the surface, with control line pressure being supplied through control line
strapped to the tubing. If the hydraulic pressure in the control line is cut a spring forces the
valve to close. The fail-safe flapper or ball valve DHSV is also activated by an emergency
shut down (ESD) system and if any physical damage should occur on the control system.
The DHSV in the North Sea are set at up to 50 meters below the seabed. The hydrostatical
weight of the hydraulic control fluid set the depth in which the DHSV is set. The hydrostatical
weight is balanced by the use of a control line. If the pressure in the control line is increased
the DHSV will close.
A1.6.2 Seal Assembly

The seal assembly is connected as a part of the production tubing and equipped with sealing
gaskets on both sides. The seal assembly provides a possibility for the tubing to stretch
without rupturing the material during pressure and temperature changes in the well.
A1.6.3 Production packer

A production packer is constructed to increase the efficiency of the oil and gas production.
The packers are functioning as a barrier to isolate the annulus from reservoir fluid and are a
necessary part of the well. A tubing-to-casing seal and pressure barrier is provided. The
production packer also provides an anchoring of the well. A well can have multiple packers to
isolate it into different zones.
A1.7 Control system

The control system must be configured to meet necessary requirements of the well. The
control system includes various surface equipment and umbilical in addition to the subsea
control equipment. The control system may be operated by different configurations optical,
electric or hydraulic. A direct hydraulic system is the most reliable system today. One
hydraulic line is required to operate each device. A pilot hydraulic system stores the hydraulic
pressure at the work site with pilot valves to effect the actuation. A signal is sent from the
platform by a hydraulic (can also be optic or electric) signal line in the umbilical. The
umbilical also carries a main pressure line with hydraulic fluid to the hydraulic pressure
system. A pilot valve interprets the signal and actuates the valve, e.g. the DHSV. There are
two different hydraulic pressure systems. A high-pressure system at 10.000psi activates the
A-5
DHSV and a low-pressure at 5.000psi activates the x-mas tree valves. Figure A-2 gives an
overview of the actuation process.
Platform
control system X-mas tree
gate valves
Umbilical
SEABED
Pilot DHSV
Hydraulic LOW valves
pressure Hydraulic
signal Pilot
HIGH
system valve
Figure A-2 An overview of a subsea control system provided with a pilot hydraulic system.
A1.8 Umbilicals
Electric and hydraulic umbilicals are needed for communication purposes. Depending upon
the control system configuration umbilicals are made for the specific need of the control
system.
A-6
Appendix B
In this appendix a figure of the well that provides the basis for the used in the case example in
the thesis will be given.
In the example the completion of the well, see subchapter 5.1.2, is based on an oil production
well from the Oseberg B field. The well data is provided from Wellmaster managed by
ExproSoft AS. Some of the components are left out in the report. The downhole components
included in the report are:
1. the tubing
2. the tubing hanger
3. one downhole safety valve (DHSV)
4. a seal assembly
5. a production packer
These components are marked on the figure on the next page.
B-1
2
.
Figure B-1 A sketch of an oil production well from the Oseberg B field
B-2
Appendix C
Fault trees constructed for the oil/gas production well of this thesis are presented in
Figure C-1 and Figure C-2.
C-1
Leakage to the
surroundings
Or 1
Leakage to the Leakage to the

surroundings from surroundings from
the x-mas tree the wellhead area
And 1 And 2
DHSV failure LCP X-mas tree valves Leakage in the a Leakage regarding
or FTC fail to seal annulus the tubingstring
And 17 P2 Or 5 Or 3
DHSV failure LCP Leakage thrugh the Annulus master Leakage from the Leakage through The DHSV fails to Leakage in the DHSV failure EXL
or FTC annulus master valve EXL wellhead Production Packer close and the tubing tubing below the
valve above leaks DHSV
DHSV AMVEXL PP TbDHSV

House 1 And 9 And 10 And 5 And 16
Leakage in the Annulus master Leakage to the Wellhead seal leak Leakage in the DHSV failure LCP DHSV failure EXL
x-mas tree annulus valve LCP wellhead area tubing above the or FTC
area DHSV
DHSV
Figure C-1 Fault tree of an oil/gas producing well with and without a DHSV, part 1
AMV WH TaDHSV And 20
Or 13 Or 7 EXL House 3
Annulus Wing Valve Annulus Swab Valve Crossover line EXL Tubing hanger Tubing hanger seal The 13 5/8" casing DHSV failure LCP
EXL/ITL EXL/ITL tubing seal leak production bore seal leaks or FTC
C-2
AWV ASWV XOL ThT ThPb 13 5/8" DHSV
House 2
P2
X-mas tree valves

fail to seal
Or 2
The master valve ProductionMaster

fails to close or Valve EXL
internal leakage
And 4 MVEXL
Production Master The valves above

Valve ITL or FTC the master valve fail
to seal
MV
Or 4
Production Wing Crossover valve Production Swab Leakage through Production ving
valve ITL EXL Valve ITL/EXL the crossover valve valve EXL
WV XOVEXL SWAB WVEXL

And 15
Leakage in the Crossover Valve

x-mas tree annulus ITL
area
XOVITL
Or 13
Annulus Wing Annulus Swab Crossover line EXL

Valve EXL/ITL Valve EXL/ITL
AWV ASWV XOL
Figure C-2 Fault tree of an oil/gas producing well with and without a DHSV, part 2
C-3
Appendix D
Reliability data dossier
This appendix presents the data dossiers, which form a basis for the input to the reliability
calculations. Reliability data dossiers are databases where the information used in the
calculations are gathered to provide an easy access to the sources. Failure rates are found from
for each component included in the barrier system. The data collected are traceable and
testable for future work based on this thesis. To provide an overview over the leakage
situations of each component the dossiers of this report has included the leakage paths
concerning the TOP-event, leakage to the surroundings.
Note that the maintenance and test intervals are specific for this report (see subsection 5.4.2
for details).
The schemes are based on data from existing databases. The quality and quantity of the
provided data vary a lot. Many of the different components have got little or no documented
data available. For a wider quantitative study it is suggested that failure rates from several
more sources are supplied and even for the specific area the wells without a DHSV are to be
implemented. A weighing of the different sources according to their relevance for each
individual component is also suggested.

Component: Tubing
Failure rate Failure mode Data source/comment

(10-6/hours)
0.41 Leakage, TAC Reliability of well completion
equipment - Phase II p.18.
Operational time 13364.03 years,
failures 48.*
Recommended values for calculations:

Failure rate (10-6 /hrs):
TAC: 0.4
Testing and maintenance:

The tubing is never tested. Repairs on the tubing would require a well workover.
Comments and leakage paths:

The tubing leakage is trough the tubing material or in the tubing connections out to annulus.
The leakage would normally occur in the connections.
* The value does not include installation failures (i.e. failure occurring during the first six days
after installation).
D-1
Component: Production Packer

(10-6/hours)
0.357 Leakage, ITL Reliability of well completion
failures 9.*

ITL: 0.35

The production packer is never tested. A well workover would be required.

The leakage is caused because the production packer has failed to seal off the annulus and the
leakage flow continues up the annulus.
D-2
Component: DHSV (TRSCSSV flapper type)

(10-6/hours)
5.84 Total Data for TRSCSSV, Reliability of
well completion equipment - Phase
II p.20. Operational time 996.79
years, failures 51.
2.87 ITL= Failures regarding leakage through
LCP: 27.5% the DHSV. Reliability of well
FTC: 21.6% completion equipment - Phase II
=49.1% p.21.
0.34 EXL=CLW=5.9% Failures regarding leakage through
the DHSV control line. Reliability
of well completion equipment -
Phase II p.21.
3.00 Total Reliability of surface controlled
Sub Safety Valves- Phase IV p.18.
failures regarding the SCSSV for
all TRSCSSV, 30.
2.06 Total Reliability of surface controlled
Sub Safety Valves- Phase III p.61.
failures 17.
1.68 LCP: 11.8% Reliability of surface controlled
FTC: 52.9% Sub Safety Valves- Phase III p.62.
=64.4% Operational time 941.6 years,
failures 17.

EXL: 0.3
LCP, FTC: 2.8

The DHSV is tested every 6 months and repaired if failure is detected.

The leakage is trough the DHSV, leading the fluid up the production tubing. External leakage is
from the DHSV to the annulus.
D-3
Component: Tubing hanger seals, wellhead seal and casing hanger seals

(10-6/hours)
0.62 Leakage, EXL Reliability of well completion
failures 13.*

EXL: 0.6

The Tubing hanger and casing hanger seals are never tested. Repair and replacement would require
a well workover.

The tubing hanger failure rate is approximated to be identical to the casing hangers. The tubing
hanger is component tested in the Reliability of well completion equipment - Phase II
rapport. The leakage is though the seals at the casing/ tubing hanger and into the annulus or
wellhead.
D-4
Component: Production Master Valve and annulus master valve

(10-6/hours)
4.57 All All failures of gate valve when
calculating with a MTBF of 25 years,
personal conversation with Marvin
Rausand [19].
2.06 LCP: 21.76% Failures regarding leakage through
FTC: 9.37% the Production master valve. The
ITL: 14.74 % distribution of failure modes is
=45.15%
according to those of gate valves
in OREDA 97, p 348.
ITL: 14.74 % the annulus master valve, always
=36.34% closed. The distribution of failure
modes is according to those of gate
valves in OREDA 97, p 348.
0.56 EXL: 12.26% Failures regarding external leakage
to the surroundings. The
distribution of failure modes is
in OREDA 97, p 348.

LCP, FTC, ITL: 2.0
LCP, ITL: 1.7
EXL: 0.6

The master valves are tested every 6 months and repaired if failure is detected.

The external leakage is to the surroundings through the material of the valve, the actuator or the
seals. The LPC and FTC failures provide a leakage path trough the master valve and further up the
x-mas tree.
D-5
Component: Production wing valve

(10-6/hours)
4.57 All All failures of gate valves are
calculated with a MTBF of 25 years,
Rausand [19].
ITL: 14.74% the valve and external leakage.
EXL: 12.26% The distribution of failure modes is
=48.70%
in OREDA 97, p 348.
ITL: 14.74% the valve. The distribution of
=36.50% failure modes is according to those
of gate valves in OREDA 97, p 348.
0.56 EXL: 12.26% Failures regarding leakage to the
surroundings. The distribution of
failure modes is according to those

LCP, ITL, EXL: 2.2
LCP, ITL: 1.7
EXL: 0.6

The production wing valve is tested every 6 months and repaired if failure is detected

The external leakage is to the surroundings through the material of the valve, the actuator or the
seals. The LPC and FTC failures provide a leakage path trough the wing valve and out of the x-mas
tree.
D-6
Component: Swab valve, annulus swab valve, annulus wing valve and crossover valve

(10-6/hours)
4.57 All All failures of gate valves are
calculated with a MTBF of 25 years,
Rausand [19].
ITL: 14.74% the valves and external leakage.
EXL: 12.26% The distribution of failure modes is
=48.70%
in OREDA 97, p 348.
ITL: 14.74% the valves. The distribution of
=36.50% failure modes is according to those
0.56 EXL: 12.26% Failures regarding leakage to the
surroundings. The distribution of
failure modes is according to those

LCP, ITL, EXL: 2.2
LCP, ITL: 1.7
EXL: 0.6

The valves are not tested. A well workover is required for replacement.

The external leakage of these valves is through the material, actuator or seals and to the
surroundings. Internal leakage goes thru the valve.
D-7
Component: Crossover line

(10-6/hours)
0.1 EXL The crossover line is very unlikely to
fail. Calculating with a MTBF of
approx. 1140 years, personal
conversation with Marvin Rausand
[19].

EXL: 0.1

The crossover line is not tested.

The external leakage of the crossover line will be through the material.
D-8
Appendix E
This appendix presents the four basic sequential steps of a HAZOP according to the
IEC 61882 [2]. Figure E-1 illustrates the basic steps.
Definition
Define scope and objectives
Define responsibility
Select team
Preparation
Plan the study
Collect data
Agree style of recording
Estimate the time
Arrange a schedule
Examination
Divide system into parts
Select a part and define design intent
Identify deviation by using guide-words on each element
Identify consequences and causes
Identify whether a significant problem exists
Identify protection, detection and indicating mechanisms
Identify possible remedial/mitigating measures (optional)
Agree actions
Repeat for each element and then each part of the system
Documentation and follow-up

Record the examination
Sign off the documentation
Produce the report of the study
Follow up that actions are implemented
Re-study any parts of system if necessary
Produce final output report
Figure E-1 The four basic sequential steps of a HAZOP [2]
E-1
Appendix F
The guide-words used in the HAZOP analysis provided in this thesis are based on the
guide words found in the IEC standard, Hazard and operability studies [2]. Table F-1
present the guide-words.
Table F-1 Procedure guide-words used in the HAZOP of this thesis
Procedure HAZOP Guide words
Guide words Description
NO, NOT, DONT The intended activity does not occur, but no
direct substitute activity takes place.
MORE A greater activity than intended e.g. force,
pressure, weight, reaction and duration.
LESS A lesser activity than intended e.g. force,
pressure, weight, reaction, and duration.
OTHER THAN A totally different activity e.g. lifts instead of
roll.
PART OF One or more desired activities are missing e.g.
transfer instead of transfer and heat.
REVERSE The logical opposite to the desired activity e.g.
reverse chemical reaction, reverse direction of
flow.
F-1

Vesterkjaer PDF

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Vesterkjaer PDF

Hochgeladen von

Copyright:

Verfügbare Formate

Is it necessary to install a downhole

safety valve in a subsea oil/gas well?

Department of Production and Quality Engineering

Diploma thesis, NTNU 2002 I

Summary and conclusions

Acceptable level of risk in an activity is described by acceptance criteria. Combining

A case example is included illustrating the effect of a DHSV. A comparison of unavailability

Diploma thesis, NTNU 2002 II

ftotal = fproduction + fintervention + (faccidential event * MFDTaccidential event)

Diploma thesis, NTNU 2002 III

Diploma thesis, NTNU 2002 IV

List of Acronyms and Abbreviations

AMV - Annulus master valve

Diploma thesis, NTNU 2002 V

TbDHSV - Tubing below DHSV

Diploma thesis, NTNU 2002 VI

Diploma thesis, NTNU 2002 VII

6.1.4 Well intervention example ............................................................................... 38

Diploma thesis, NTNU 2002 VIII

Diploma thesis, NTNU 2002 IX

The objectives are as follows:

Diploma thesis, NTNU 2002 1

h) Give a recommendation to whether or not a DHSV should be installed in a subsea

Diploma thesis, NTNU 2002 2

1.3 Report structure

Diploma thesis, NTNU 2002 3

2 Rules and regulations

2.2 United Kingdom

The well-operator shall ensure that a well is so designed, modified, commissioned,

Diploma thesis, NTNU 2002 4

2.3 United States of America

Specific requirements of subsurface safety devices are included:

2.4 Standard organizations

2.5 Regulatory challenges

Diploma thesis, NTNU 2002 5

Diploma thesis, NTNU 2002 6

3 Use of acceptance criteria

A comparison with established and accepted methods

Diploma thesis, NTNU 2002 7

Area Conditions for the FAR calculations FAR (fatalities per

3.1 The ALARP principle

Diploma thesis, NTNU 2002 8

undesired events, corresponding to the upper horizontal line in the ALARP-principle. A

Unacceptable region Risk cannot be justified except

Tolerable only if risk reduction

The ALARP or Tolerability

Tolerable if cost of reduction

Broadly acceptable region Necessary to maintain

Figure 3-1 Levels of risk and the ALARP principle [32]

3.2 Safety integrity level (SIL)

Diploma thesis, NTNU 2002 9

Safety Demand Mode of Operation Continuous / High Demand

Safety function SIL Functional boundaries for given SIL Ref.

Diploma thesis, NTNU 2002 10

4 Overall risk assessment

Human Economic Environmental

Injured Broken Delayed Blowout + Lost

Lost Shut-in of Blowout +

Diploma thesis, NTNU 2002 11

Human Economic Environmental

Injured Abandon- Expencive Delayed Blowout + Objects left

An uncontrolled flow of fluids from a wellhead or wellbore is classified as a blowout.

Diploma thesis, NTNU 2002 12