hpht1 PDF

Case Study 4:
Production Operation in
HPHT and Sour
Environment
Submitted to
The Bureau of Safety and
Environmental Enforcement (BSEE)
Submitted by
ABSG CONSULTING INC.
1525 Wilson Blvd., Suite 625
Arlington, VA 22209
(703) 351-3700
September 2015
BPA Contract # E13PA00008

Task Order # E14PB00078
TDL #001, Deliverable D
Table of Contents
List of Figures ................................................................................................................................................ ii
List of Tables ................................................................................................................................................. ii
1. Introduction.................................................................................................................................... 1
1.1 Background..................................................................................................................................... 1
2. Scenario Development ................................................................................................................... 2
2.1 Scenario Descriptions ..................................................................................................................... 2
2.2 Risk and Barrier Assessment Workflow ......................................................................................... 3
3. Scenario Risk Assessment .............................................................................................................. 5
3.1 Subsea HAZID – HPHT and Sour Environment ............................................................................... 5
3.2 Failure Mode and Effect and Criticality Analysis (FMECA) – Surface Controlled Subsurface Safety
Valve (SCSSV) ................................................................................................................................ 27
4. Barrier Function and Barrier Critical Systems .............................................................................. 43
4.1 Barrier Function Description in Relation to Major Accident ........................................................ 43
4.2 Relevant Barrier Critical Systems and Brief Summary of Their Role in Realizing the Barrier
Function........................................................................................................................................ 43
5. Selected Barrier Critical Systems - SCSSV ..................................................................................... 45
5.1 System Description and Basis of Design ....................................................................................... 45
6. Barrier Model for SCSSV ............................................................................................................... 47
6.1 Barrier Model Scope (Interfaces and Barrier Elements) and Key Assumptions ........................... 47
6.2 Barrier Model ............................................................................................................................... 50
7. Barrier Element Attribute Checklist ............................................................................................. 53
8. Reference ..................................................................................................................................... 55
i | Page
List of Figures
Figure 1. New Technology Assessment Framework ..................................................................................... 4
Figure 2. Risk Matrix ..................................................................................................................................... 6
Figure 3. HAZID Study Process ...................................................................................................................... 7
Figure 4. Surface Controlled Subsurface Safety Valve System ................................................................... 28
Figure 5. Surface-controlled Safety Valve ................................................................................................... 29
Figure 6. FMECA Flowchart ......................................................................................................................... 31
Figure 7. Barrier Function, Barrier Critical Systems, and Barrier Critical System Functions ....................... 50
Figure 8. Barrier Critical System Function 1 – Close and Shut in Flow upon Loss of Hydraulic Power ....... 51
Figure 9. Barrier Critical System Function 2 – Close and Shut in Flow on Commanded Closure ................ 52
List of Tables
Table 1. Scenario 4 - Characteristics ............................................................................................................. 2
Table 2. Subsea HAZID Node List .................................................................................................................. 7
Table 3. Subsea HAZID Guidewords .............................................................................................................. 8
Table 4. HAZID Recommendations ............................................................................................................... 9
Table 5. Critical Barriers to Prevent MAHs ................................................................................................. 10
Table 6. Additional Studies ......................................................................................................................... 11
Table 7. Description of FMECA Worksheet Fields ...................................................................................... 32
Table 8. SCSSV System Assumptions – Barrier Elements ............................................................................ 48
Table 9. Barrier Element Attribute Checklists ............................................................................................. 54
ii | Page
ABBREVIATION EXPLANATION
API American Petroleum Institute
BSEE Bureau of Safety and Environmental Enforcement
CFD Computational Fluid Dynamics
DP Dynamic Positioning
ESD Emergency Shutdown
FMECA Failure Mode and Effect and Criticality Analysis
FPSO Floating Production Storage and Offloading
GoM Gulf of Mexico
HAZID Hazard Identification Study
HPHT High Pressure High Temperature
HSE Health, Safety, and Environment
MAH Major Accident Hazard
PLETs Pipeline End Terminations
QA/QC Quality Assurance/Quality Control
SSCSV Subsurface-Controlled Safety Valves
SCSSV Surface Controlled Subsurface Safety Valve
UTA Standard Operating Procedures
iii | Page
1. Introduction
1.1 Background
As part of the Bureau of Safety and Environmental Enforcement (BSEE) Emergent Technologies project,
ABSG Consulting Inc. developed a risk assessment framework to qualify new technology applications
submitted to BSEE. To provide a better understanding of the risk assessment framework, ABSG
Consulting Inc. selected the following five scenarios to test the proposed framework. The results of the
five risk assessment scenarios will guide BSEE during the review of new technology applications using
the proposed methodology.
 Scenario 1: Ultra-deep water drilling

 Scenario 2: Floating production installation with a surface BOP
 Scenario 3: Managed Pressure Drilling
 Scenario 4: Production in HPHT and sour Environment
 Scenario 5: Drilling from a semi-sub in the Arctic
It is important to consider when reviewing this document, that the subject scenario background
information and risk assessment were developed and tested based on publicly available information.
Therefore, due to this limitation the provided studies or assessment do not reflect actual real-life
projects and the studies performed for real-life project will be more comprehensive than what is
provided in this document.
This document provides information on the Scenario 4: Production in High Pressure High Temperature
(HPHT) and sour environment.
1 | Page
2. Scenario Development
2.1 Scenario Descriptions

The scenario is based on establishing production operations on ultra-deep waters in the Gulf of Mexico
(GoM) within HPHT environments. Another assumption surrounds the premise that the wells in the
area are sour wells, with relatively high concentrations of H2S and other contaminants that will
introduce challenges concerning corrosion and equipment detrition. The basic principle of well
construction, drilling and production in an HPHT and sour environment is not different compared to
conventional environments, but challenges arise in selecting suitable materials and designing equipment
that can withstand the HPHT and sour conditions. This scenario will review the use of a Surface
Controlled Sub-Surface Safety Valve (SCSSV) for well control in an emergency ‘last resort’ situation that
functions to close and shut in the flow (see Section 5).
As per 30 CFR 250.807(b), HPHT environment means when one or more of the following well conditions
exist:
1. The completion of the well requires completion equipment or well control equipment assigned a
pressure rating greater than 15,000 psi or a temperature rating greater than 350 degrees
Fahrenheit (°F).
2. The maximum anticipated surface pressure or shut-in tubing pressure is greater than 15,000 psi on
the seafloor for a well with a subsea wellhead or at the surface for a well with a surface wellhead.
3. The flowing temperature is equal to or greater than 350°F on the seafloor for a well with a subsea
wellhead or at the surface for a well with a surface wellhead.
Current BSEE regulations and American Petroleum Institute (API) design specification standards do not
address completion and well control equipment for subsea wells with pressure ratings greater than
15,000 psi or for surface wells with pressure ratings greater than 20,000 psi. There is currently a need
for the development of 20,000-psi subsea well equipment. High temperature generally equates to
anything over 350°F.
To evaluate the scenario using the new technology risk assessment framework, production operations
from a floating production unit in Gulf of Mexico (GoM) is considered.
Table 1 lists the characteristics of this scenario.
Table 1. Scenario 4 - Characteristics

Field Location 100 Miles Offshore in the Deep Water Gulf of Mexico
Water Depth: Approximately 6,000 ft.
Facility type Floating production storage and offloading (FPSO) unit
Reservoir/Datum Depth ( MD) 25, 000 ft.
Reservoir/Datum Depth ( TVD) 24, 500 ft.
Bottom Hole Temperature 300 F
Wellhead flow temperature 350-400 ⁰F
2 | Page
Field Location 100 Miles Offshore in the Deep Water Gulf of Mexico
Reservoir Pressure 15,000 – 20,000 PSIG
No. of development wells 15
Design Life 20 years
Rules and Regulation:
Design and build using recognized classification rules
IMO MODU code
SOLAS
Applicable rules and regulation, where applicable
NACE MR- 0175 complied systems design
It is imperative to note that not all the design basis information is included here. It is expected that
actual new technology application submissions should include, but not limited to, the following
supporting documentation:
Engineering/Design Documents
 Design basis document providing, but not limited to, the following information:
o Design Life
o Operating Envelope
o Working Environment
 Functional specification of all the major systems and associated interfaces
 General arrangement/layout drawings
2.2 Risk and Barrier Assessment Workflow

There has been limited development of HPHT wells in the GoM. Thus, meaning there is little experience
and data relating to the equipment used for these types of operations in this environment.
The new technology risk assessment framework follows a workflow that depends on the novelty of the
combination of the technology and the applied conditions. Figure 1 presents an overview of workflow
options. This scenario will apply Workflow 2 (WF2), which is for “Known Technology (SCSSV) in a
Different or Unknown Condition” (HPHT and Sour Environment). The risk assessment will focus on the
identification of Major Accident Hazards (MAHs) and associated consequences. As part to the risk
assessment, the team will identify the barrier critical systems that can prevent MAHs or provide
mitigation against the consequence resulting from MAHs.
Operation in a different or unknown condition using the known technology/barrier critical system would
require a greater focus on the consequence effects from the identified MAHs. In addition, failure of the
barrier critical system due to potential incompatibility or inadequate design for the unknown condition
could lead to the realization of a Major Accident Hazard (MAH). A barrier analysis to identify the critical
success attributes for the barrier elements that constitute the barrier critical system is of extreme
importance.
3 | Page
The Hazard Identification Study (HAZID) carried out as part of the risk assessment helps in identifying
the MAHs and affected barrier functions. A FMECA conducted will identify failure modes and
mechanisms for the SCSSV in HPHT-sour service. Section 3 of this report covers the risk assessments for
this scenario and related findings.
The barrier analysis is covered in Section 4, which includes a review of the select barrier critical system
(The SCSSV in this scenario) to understand what subsystems/components need to succeed in order for it
to perform its barrier function(s). The barrier analysis will determine the ways in which the barrier
critical system can succeed. A good understanding of the success logic is critical in determining the
requirements and related activities for ensuring the integrity of the barrier critical system.
The barrier analysis also provides insight about other barrier critical system(s)/barrier element(s) that
interface with the proposed barrier critical system and contribute to the realization of the barrier
function(s). The barrier model begins with the identification of the barrier function and contributing
barrier critical systems. The subsequent step involves identifying the required barrier critical system
function(s) for each barrier critical system and the relevant barrier elements. Each barrier element
contains physical and operational tasks that enable the barrier critical system function. Performance
influencing factors and attributes along with the relevant success criteria originate at this stage for the
barrier element to perform its intended physical/operational tasks, thereby realizing the barrier
function.
Note: For further detail on risk assessments, refer to the “Risk Assessment for New Technologies Technical Note”. For more
information on barrier analysis, refer to the “Barrier Analysis for New Technologies Technical Note”.
Figure 1. New Technology Assessment Framework
4 | Page
3. Scenario Risk Assessment
3.1 Subsea HAZID – HPHT and Sour Environment
3.1.1 Introduction
Scenarios have been developed in order to test and verify the assessment process for evaluating and
premiering emergent technology. The first step in the process is to perform a HAZID, which will support
the subsequent emergent technology, barrier analyses, and risk assessments.
3.1.2 Background
To evaluate the scenario using the new technology risk assessment framework, a floating production
unit is considered. It is designed for operations in the Gulf of Mexico environments.
This scenario considers the field characteristic as provided in Section 2.1.
The following comprises the production facilities for subject field:

 Subsea systems
 Floating Production Storage and Offloading (FPSO) Process Facilities
Hydrocarbons from the reservoir will be produced via high-rate subsea wells through a subsea
production system connected to a spread moored FPSO.
3.1.3 Objectives
A HAZID was conducted to identify hazards associated with the routine operation of the subsea
development including production and facility operation. The HAZID will document the qualitative risk
levels of each of the hazards identified and record risk elimination or reduction measures. Section 3.1.7
contains the results of the HAZID.
This HAZID aims to identify any impact on MAHs from new technology and/or changed conditions as
discussed during the pre-planning conference with BSEE. The focus is to identify any impact on barriers
in place to control the actual MAH and possible changes in consequences from the same hazards.
For this scenario, a MAH is defined as any incident or event that can lead to safety or environmental
consequence of 4 or higher (i.e., major or critical) without considering any safeguards as indicated in the
risk matrix in Figure 2.
5 | Page
Figure 2. Risk Matrix
The following questions should require an answer during the HAZID related to New Conditions and
New Technology:
1. Do the changed / unknown conditions directly impair or weaken or increase demand on any barrier
function(s) in place to control the MAH in question? Are any new barriers introduced?
2. Do the changed / unknown conditions give potential for increased or new consequences related to
the MAH in question?
The objective of the assessment is to:
 Review the selected subsea systems process functionality, specifications and operability.
 Identify major hazards associated with the design and operations of the systems.
 Develop hazard scenarios and identify potential consequences, causes, protection, detection, and
indicating mechanisms.
 Surface opportunities of alternative options towards an inherently safe design or identify risk
mitigation measures to reduce the estimated risk.
6 | Page
3.1.4 Scope
The scope of the study included all subsea facilities covering:
 All Subsea Trees / Subsea Well Center.

 All Subsea architecture including infield flow lines, umbilical, manifolds, jumpers and risers.
The Subsea HAZID covered the generic hazards associated with the overall subsea layout and associated
systems. Table 2 depicts the Subsea HAZID study nodes:
Table 2. Subsea HAZID Node List
Node # System
1 Overall Field Layouts
2 Subsea Production System
3.1.5 Methodology
The HAZID technique, as shown in Figure 3, is a brainstorming activity to consider hazards of system
using guidewords to assist with hazard recognition. The guideword list contains a mixture of hazard
sources and factors that may help control and/or help reduce damage recovery from exposure to those
hazards.
Select Plant AREA or NODE & Section, IDENTIFY

Select CATEGORY, Discuss and agree INTENT
HAZARD
GUIDE WORD IS IT POSSIBLE?
IS IT LIKELY ?
NO YES
BRAINSTORM
THREATS AND CAUSES
ASSESS
CONTROLS
WHAT BARRIERS OR CONTROLS
CONTROL OR RECOVER FROM
THE EFFECT?
The HAZID
Process
Figure 3. HAZID Study Process

Table 3 lists the HAZID guidewords that would be applicable to the systems under consideration.
Feedback from the subject matter experts on the HAZID team during the workshop session have
modified the list.
7 | Page
Table 3. Subsea HAZID Guidewords
Hazard Category Guideword
Node 1: Overall field Layout
Operations Hazards  Flow Assurance (including incorrect operations)
(hydrocarbon under  Thermal growth
pressure  Hydrocarbon release (internal corrosion, external corrosion, cracking,
erosion, etc.)
 Manufacturing defects (seam, pipe ,weld, threads)
 Equipment failure (flange, valve, seal, pressure relief, gauge, trap door,
non-metallic degradation)
 Dissimilar material
 Fluid commingling / compatibility
 Start-up / shutdown
 Unplanned events
 Pigging
Field Layout - Dropped  Approach points (escarpments, etc.)
Objects / Clashing  Accessibility (limitation due to existing infrastructure)
 Existing infrastructure - phasing
 Interference (with existing equipment)
 Trees interference
HPHT Condition  Well Construction
Field Layout –  Sea floor stability and Bathymetry
Environmental Hazards  Pipeline spans
 Umbilical spans
 Sea floor currents, waves, extreme events
 Hydrocarbon release (isolation valves PLEMs/ Pipeline End Terminations
[PLETs])
 Cutting
 Exclusion/expulsion zones
 Weather
Maintenance/Repair  3rd party damage (impact - anchor, trawling, marine life)
(future impacts)-  Dropped Objects (change out of damaged Umbilical Termination Assembly
Ergonomics [UTA], flying lead etc. in the future)
Node: 2. Subsea Production System - Surface Controlled Subsurface Valve (SCSSV) on each Production Well; Top
of production riser at hang-off elevation;
Dropped  Existing infrastructure - phasing
Objects/Clashing
Field Layout-  High flow
Environmental Hazards
Flex joint location  Existing infrastructure - phasing
The system under examination is broken down into sections (called nodes). Credible causes of a
hazardous scenario are identified for each hazardous scenario. The potential consequences that could
result are discussed, assessed and recorded along with proposed protection, detection, and indicating
mechanisms. The HAZID team can propose actions or requests for further considerations to
mitigate/reduce the identified risk.
8 | Page
The basic study approach for the HAZID involves:
 The assembly of an appropriate team of experienced personnel, including representatives of all
disciplines involved in the area being reviewed and (as needed) interfaces with adjacent systems.
 Short presentations detailing the scope of the study.
 Application of the relevant guidewords to identify hazards and other health, safety, and
environmental (HSE) concerns.
 Recording the discussions on worksheets summarizing the nature of the hazard, its consequences,
threats, the safeguards in place, risk ranking, and recommendations for any actions required.
3.1.6 Assumptions
Assumptions made at the start of the workshop for HAZID study include the following:
 Subsea system is designed in accordance with recognized standards.

 Equipment is delivered and ready to use.
 Contractor is aware of Safe Work Practices.
 Approved operating procedures will be in place before the start of operation.
3.1.7 Results and Conclusion
3.1.7.1 Results
During the HAZID, it was concluded that production in the HPHT condition does not generate any new
major accident hazard but the exposure of the equipment to the HPHT condition can lead to faster
degradation of the critical barriers than what will be experienced in the normal or known conditions and
will require further evaluations. Table 4 provides the list of recommendations generated during the
HAZID.
Table 4. HAZID Recommendations

Recommendations (HAZID) Place(s) Used
1. Ensure that the material of construction of the SSSV and subsea system are (HAZID Worksheet –
in accordance with HPHT environment. Also, perform a FMECA to see Section 3.1.9)
determine if any component failure of the SCSSV will result in the complete
loss of control or other unsafe situation.
2. Consider providing corrosion allowance in accordance with the HPHT (HAZID Worksheet –
environment see Section 3.1.9)
3. Ensure shock loads are considered in the well construction and design (HAZID Worksheet –
see Section 3.1.9)
4. Ensure wellhead and production packer seals are suitable for HPHT (HAZID Worksheet –
environment see Section 3.1.9)
5. Ensure the wellhead bay is designed to accommodate the rise of wellhead (HAZID Worksheet –
in accordance with the expected HPHT conditions see Section 3.1.9)
9 | Page
Recommendations (HAZID) Place(s) Used
6. Ensure that well tubular are suitable for HPHT environment (HAZID Worksheet –
see Section 3.1.9)
3.1.7.2 MAH Identification

This HAZID aims to identify any impact on MAHs from new technology and/or changed conditions. The
focus is to identify any impact on barriers in place to control the actual MAH and possible changes in
consequences from the same hazards.
For this scenario, MAH is defined as, any incident or event that can lead to safety or environmental
consequence of 4 or higher without considering any safeguards in place as indicated in the risk matrix
(see Figure 2). During this HAZID, the identified MAH was a subsea release during production operation
in the HPHT conditions. There were no new MAHs identified that were unique to HPHT conditions.
3.1.7.3 Barrier Critical System Identification

The review of the HAZID led to the identification of a list of the critical barriers, which can either prevent
the MAHs from occurring or mitigate the consequence of the MAH. See Table 5.
Table 5. Critical Barriers to Prevent MAHs

Barrier Critical System Description
Hydrocarbon Pressure containment systems and equipment whose failure can lead to a
Containment Systems loss of containment event. This includes the following:
 Sub-Surface Safety Valve
 Subsea System
o Trees and Tree Valves
o Subsea Jumpers
o Subsea Production Manifolds
o Subsea Flow line Connection System
o Subsea Flow lines
 Risers
 Flex Joint
Subsea Controls Control system components that help with the actuation and control of
subsea equipment to facilitate safety critical functions.
Emergency Shutdown All ESD measures that could minimize the risk by isolating hydrocarbon
(ESD) System inventories to minimize release durations and escalation potential.
During development, the Barrier model will follow the guidelines provided in the barrier model template
guide for all identified critical barriers. As a representation of the barrier model template, this project
will only contain a subsurface safety valve barrier model.
10 | Page
3.1.8 Additional Risk Assessment Work
The initial HAZID led to the conclusion that production operation in the HPHT environment does not
introduce any additional potential consequence vs. consequence potentially experienced during
production operation in the conventional deepwater production operations.
There were multiple scenarios where consequence related to loss of containment were identified but it
is imperative to note here that production operation in the HPHT environment will not lead to any
additional risk to the facility or the environment than what will be experienced in the normal conditions.
The following table provides information on the various studies that can be performed as part of the
general engineering practice and in most cases recommended by Operators. Table 6 also provides the
information on if HPHT environment can affect the study outcomes. If HPHT condition affects the study,
it will require conductance and submittal for review and acceptance. For this case study, the studies
affected by HPHT condition (i.e., Riser release risk analysis, system reliability assessment) were not
performed due to limitation on the information availability.
Table 6. Additional Studies

Study Comment
Failure Mode and Effect Provide information on the failure modes of SCSSV while operation in the
and Criticality Analysis HPHT environment
for the SCSSV
System Reliability Provide information on the system reliability while operation in the HPHT
Assessment environment
Escape Evacuation and Provide information on impairment of escape routes and evacuation means.
Rescue Analysis Focus on exposure of escape routes and evacuation means to fire loads. The
Escape Evacuation and Rescue Analysis Study will be not be dependent on or
influenced by the operation in the HPHT environment.
Dropped Objects Study Assess exposure of the subsea system to dropped object. The Study will be
not be dependent on or influenced by the operation in the HPHT
environment.
Collision Risk Will provide information on potential collision risk, but the study will be not
Assessment be dependent on or influenced by the operation in the HPHT environment.
Helicopter Risk Will only provide information on risk contribution to personnel, but the
Assessment study will be not be dependent on or influenced by the operation in the
HPHT environment.
Environmental Risk Important, provides consequences of release to the environment. No
Analysis separate study will be performed, but the environmental consequences will
be discussed as part of the risk analysis.
Explosion Risk Exposure of physical barriers to explosion loads, and subsequent exposure
Assessment from fires but the study will be not be dependent on or influenced by the
operation in the HPHT environment. Operation in the HPHT environment
will not affect the study outcome.
Riser Release Risk Provides information on risk contribution from riser releases; should
Analysis especially investigate possibility of exposure to HPHT environment.
Surface controlled subsurface safety valve was identified as a critical barrier in multiple scenarios during
the HAZID. The application of the SCSSV in the HPHT environment warrants a detailed analysis of the
SCSSV to ensure its performance does not degrade while working under HPHT conditions. A Failure
11 | Page
Modes and Effects and Criticality Analysis (FMECA) for the SCSSV was performed in addition to the
HAZID and its details are provided in the Section 4.
12 | Page
3.1.9 HAZID Worksheet
Node: 1. Overall Field Layouts - Drill Centers;
Hazardous Existing Risks

Hazard Guide Word Causes Consequence Safeguards Recommendation
Scenario CAT S L RR
1. 1. Flow 1. Leak in the 1. Leaking 1. Ingress of sea water 1. Leak test should be conducted 1. Ensure that the
Operations - assurance Subsea System connector due into the subsea system during commissioning material of
Crude Oil (including to incompatible leading to hydrate construction of the
Under incorrect materials with formation considering SSSV and subsea
Pressure operations) HPHT and sour sub ambient system systems are in
environment accordance with
2. Release of production 2. Subsea systems should be HPHT environment.
fluids to the environment designed for at least SITP( shut in Also, perform a
(environ- tubing pressure) FMECA to determine
mental and reputation if any component
ranking)considering 3. Primary and secondary seals on
connectors Environmental 4 B High failure of the SCSSV
system pressure above will result in the
ambient subsea pressure complete loss of
4. Pressure and temperature control, or other
sensors on subsea and topsides unsafe situation.
would be able to detect the leak
5. Ability to shut in the well using

SCSSV and Subsea Tree Valves
6. NACE MR- 0175 complied

systems design
2. Leaking valve 1. Ingress of sea water 1. Double barrier provided or valve

into the subsea system and cap arrangement
leading to hydrate
formation considering
sub ambient system
2. Release of production 2. Subsea systems are designed for

fluids to the environment at least SITP Environmental 5 B Extreme
(environmental and
reputation 3. Elastomer/soft goods need to be
ranking)considering suitable for HPHT environment
system pressure above 4. Ability to shut in the well using
ambient subsea pressure SCSSV and Subsea Tree Valves
13 | Page

Scenario CAT S L RR
3. Corrosion 1. Ingress of sea water 1. Fluid velocities are controlled by 2. Consider providing
and/or erosion into the subsea system operating procedures corrosion allowance
leading to hydrate in accordance with
formation considering the HPHT
sub ambient system environment
2. Release of production 2. Corrosion inhibitor connection

fluids to the environment points
(environmental and
reputation 3. Design in accordance with NACE
ranking)considering MR175
system pressure above Environmental 5 B Extreme
4. Internal cladding on subsea
ambient subsea pressure jumpers and manifolds
5. Intelligent pigging operation
6. Acoustic Sand Detectors
7. Corrosion coupons/probes
monitoring management on
topsides
8. Sand controlled completions
4. Excessive 1. Ingress of sea water 1. Subsea manifolds will be

movement of into the subsea system installed using piles
sea bed (faults) leading to hydrate
leading to formation considering
cracks on sub ambient system
subsea systems
2. Release of production 2. Jumpers will be installed such Environmental 4 B High
fluids to the environment that it will not cross the fault lines
(environmental and
reputation 3. Geohazard study will be
ranking)considering conducted for the project
system pressure above 4. Ability to shut in the well using
ambient subsea pressure SCSSV and Subsea Tree Valves
2. Flow 2. Hydrate 1. Leak when 1. No flow through the 1. Subsea equipment is fitted with
assurance formation (worst- operating on affected item resulting in Hot Water Hydrate Remediation
(including case in the flow sub ambient loss of or deferred Financial 5 D Extreme
incorrect line) conditions production 2. Multiple hydrate inhibitors
(Methanol) injection points
14 | Page

Scenario CAT S L RR
operations) resulting in 3. Subsea systems are designed for
water ingress at least SITP
into the system
2. Low 1. No flow through the 1. Subsea equipment is fitted with

temperature affected item resulting in Hot Water Hydrate Remediation
transients loss of or deferred
during startup / production 2. Multiple hydrate inhibitors
shutdown or (Methanol) injection points
other operating 3. Subsea systems are insulated
modes
4. Multiple pressure and Financial 5 E Extreme
temperature sensors on the
wellheads with Safe Operating
Procedures
5. Operating procedures and flow

assurance strategies include steps
to prevent hydrate formation
3. Flow 3. Water 1. Extended 1. High rates of 1. Conducting dead oil

assurance collection in low shutdown or corrosion in the risers displacement during shutdowns
(including spots on Lazy S high amounts potentially leading to
incorrect production of water loss of contain- 2. Chemical injection
Environmental 4 B High
operations risers entrained in ment 3. Corrosion allowance
) process fluids
4. Baseline and In service inline
Inspection
4. Thermal 4. Non identified

growth (system is
designed for
maximum thermal
range for wellhead
temperatures)
5. Hydro- 5. Subsea Release 1. Erosion/ 1. Loss of containment 1. Internal erosion monitoring

carbon Corrosion system
release Environmental 4 B High
(internal 2. Downhole completion design
corrosion, 3. Material selection
15 | Page

Scenario CAT S L RR
external 4. Acoustic and intrusive sand
corrosion, detectors
cracking,
erosion, 5. CFD modeling
etc.)
6. 7" piping downstream of choke
on tree for to reduce the flow
velocity
7. Corrosion Resistant Alloy

materials
8. Insulation / coating
9. Chemical inhibitor chemical
injection
10. NACE MR- 0175 complied

systems design
2. Loss of well 1. Fire hazard, 1. BOP during well intervention

control environmental impact,
release of toxics (H2S) 2. Ability to shut in the well using
SCSSV and Subsea Tree Valves Safety 5 B Extreme
3. Emergency Shutdown System

(ESD)
6. 6. Subsea release 1. Improper 1. Loss of containment, 1. On loss of control system will go

Manufacturing welding potential for to fail safe mode
defects (seam, fire/explosion resulting in
pipe ,weld, personnel injury/fatalities
threads)
2. Loss of control 2. Specified NDT based on the
equipment requirements Safety 5 B Extreme
3. Equipment 3. Regular inspection
replacement
4. Quality Assurance/Quality
Control (QA/QC) procedures
5. Manufacturer selection
2. Improper 1. QA/QC procedures

material
selection 2. Manufacturer selection
3. Improper 1. QA/QC procedures
16 | Page

Scenario CAT S L RR
machining 2. Manufacturer selection
7. Equipment 7. Inability to 1. Marine 1. Inability to isolate 1. Ability to shut in the well using
failure (flange, control/shut-in the growth during an emergency SCSSV and Subsea Tree Valves
valve, seal, field event
pressure
relief, gauge, 2. H2S 2. Loss of containment, 2. NACE MR- 0175 complied
trap door, exposure/corro potential for systems design Safety 5 B Extreme
non-metallic sive fire/explosion resulting in
degradation) environment personnel injury/fatalities
3. Not being able to use

future hubs
8. Dissimilar 8. Internal 1. Galvanic 1. See small leak events 1. Corrosion inhibitor is designed to
materials Corrosion that action between #1 prevent this scenario
leads to a leak clad and non- Environmental 5 B Extreme
clad boundaries
9. Dissimilar 9. External 1. Thermal 1. See small leak events 1. Cathodic Protection Monitoring
materials Corrosion that paste used in #1 system
leads to a leak hot water
remediation 2. Multi-layer coating around pipes
and thermal paste Environmental 5 B Extreme
system contains
graphite which
may cause a
galvanic action
10. Fluid 10. See hydrate 1 1. No HSE consequences

commingling formation Scenario . identified; operational
/ #2 issues only
compatibility
11. Start-up/ 11. See hydrate

shutdown Scenario #2
12. 12. Uncontrolled 1. Dynamic 1. Damage to the tree or 1. Marine vessel verification
Unplanned drive off or Drift Positioning (DP) other subsea equipment (minimum DP-2 requirement)
off during work malfunction/ (jumpers, etc.) Environmental 4 B High
events
over failure on the
2. Potential loss of 2. Weak point analysis
17 | Page

Scenario CAT S L RR
drill rig/loss of containment due to 3. Subsea infrastructure is designed
power contact between the riser to minimize elevation of
or LMRP and subsea components to avoid contact with
equipment risers and other subsea
infrastructures
4. LMRP emergency disconnect
5. BOP stack

3. Drilling rig drifting 7. FPSO moored via disconnectable

towards FPSO leading to turret buoy
allision with FPSO
8. Semiannual function test of
turret buoy
Safety 5 A High
9. Defined watch circle for
emergency disconnect
10. Subsea safety valves will be

closed before disconnect
13. 13. Controlled 1. Emergency 1. Potential loss of 1. Weak point analysis

Unplanned Drive off in on the Drilling containment due to
events response to an rig contact between the riser
emergency or LMRP and subsea
equipment
2. Damage to the tree or 2. Subsea infrastructure is designed

other subsea equipment to minimize elevation and location
(jumpers, etc.) of components to avoid contact
with risers and other subsea 4 B
infrastructures Safety High
4. BOP stack
5. Drill rig has the ability to shut-in

other wells in the same drill center

18 | Page

Scenario CAT S L RR
14.Pigging 14. Stuck pig 1. Wax, 1. Deferred production 1. 5D bends on subsea systems
paraffin, piping
arrangements 2. Inside Diameter matching
3. QA/QC on pigging tests Financial 5 D Extreme

4. Barred tees
5. Pigging procedures
2. Field 1. Approach 1. 1. Non

Layout - points identified
Dropped (escarpments
Objects / , etc.)
Clashing
2. 2. 1. Non
Accessibility identified
(limitation
due to
existing
infrastructur
e)
3. Existing 3. Dropped object 1. Work over, 1. Deferred production 1. Dropped object analysis
infrastructur over subsea installation of
e - phasing systems future 2. Damage to subsea 2. Dropped object shutdown
equipment, equipment resulting in system on the drill rig
maintenance / hydrocarbon release
3. Pre-defined lifting zones will be
OSV activities at determined based on dropped
the host Environmental 4 B High
object analysis
4. Design incorporates shielding of

sensitive equipment

4. 4. See drive off

Interference hazards above
(with existing
equipment)
19 | Page

Scenario CAT S L RR
5. Trees 5. 1. Non
interfer identified
ence
3. HPHT 1. Well 1. Failure of well 1. Incompatible 1. Potential damage to 1. Ability to shut in the well using 6. Ensure that well
conditions Construction tubular and materials well tubular, seals and SCSSV and Subsea Tree Valves tubular are suitable
s hangers well equipment leading for HPHT
to loss of containment environment
2. Well 2. Failure of sealing 1. Incompatible 1. Potential loss of seals a 1. Ability to shut in the well using 4. Ensure wellhead
Construction elements materials leading to loss of SCSSV and Subsea Tree Valves and production
s containment Environmental 4 B High packer seals are
suitable for HPHT
environment
3. Well 3. Rise of wellhead 1. Heating up of 1. Potential damage to 1. Ability to shut in the well using 3. Ensure shock loads
Construction the well well tubular, seals and SCSSV and Subsea Tree Valves are considered in the
s construction/Sh well equipment leading well construction and
ock loads to loss of containment design
5. Ensure the
Environmental 4 B High wellhead bay is
designed to
accommodate the
rise of wellhead in
accordance with the
expected HPHT
conditions
4. Field 1. Sea floor 1. Refer to

Layout – stability and scenario 1.1.5
Environ- Bathymetry movements on sea
mental bed
Hazards
2. Pipeline 2. Overstressed 1. Bathymetry 1. Possible deformation 1. Conducted extensive survey of

spans pipes to pipes field and span analysis Financial 3 B Moderate
3. Umbilical 3. VIV (vortex 1. Umbilical 1. Possible umbilical 1. Conducted extensive survey of

spans induced vibration) span damage / fatigue field and span analysis Financial 3 B Moderate
20 | Page

Scenario CAT S L RR
4. Sea floor 4. Lazy wave 1. Fatigue due 1. Early replacement of 1. CFD evaluations
currents, configuration on to VIV (vortex riser
waves, 20" export oil riser induced
extreme maybe subject to vibration), 2. Potential loss of 2. Flex joints on risers
events fatigue failures wave, VIM containment with release Environmental 3 B Moderate
of oil (leak/crack). 3. In-service performance
Potential failure likely to monitoring of the risers
occur at the touch down 4. The risers are fully straked
point away from the host except at the buoyancy elements
currents, configuration on to VIV (vortex riser
waves, 9" production riser induced
extreme maybe subject to vibration), 2. Potential loss of 2. Flex joints on risers
events fatigue failures wave, VIM, containment with release
of production fluid 3. In-service performance
slugging monitoring of the risers Environmental 4 B High
(leak/crack). Potential
failure likely to occur at 4. The risers are fully straked
the touch down point except at the buoyancy elements
away from the host
currents, configuration on to VIV vortex riser
waves, 12" gas export induced
extreme riser maybe vibration, wave,
events subject to fatigue VIM 2. Potential loss of 2. Flex joints on risers
failures containment with release Environmental 4 B High
of gas (leak/crack). 3. In-service performance
Potential failure likely to monitoring of the risers
occur at the touch down 4. The risers are fully straked
point away from the host except at the buoyancy elements
7.Hydrocarbo 7. Movement of 1. Seismic 1. Connection damage / 1. Seismic analysis

n release PLEMs/PLETs activities, rigid jumper damage
(isolation seabed leading to subsea release 2. Adequate flexibility in jumper
valves movement and PLET design
PLEMs/ 3. Routine inspection
PLETs)
21 | Page

Scenario CAT S L RR
8. Cutting 8. No hazardous
scenario identified
- wells will be pre-
jetted to avoid
debris from
cuttings
9.Exclusion/e 9. No hazardous
xpulsion scenario identified
zones
10. Weather 10. Emergency 1. Adverse 1. Damage to the well 1. Field shut-in
disconnect during weather jumper, potential for loss Environmental 4 B High
well work over of containment 2. Ability to shut in the well using
5. 1. 3rd party 1. No new hazards

Maintenanc damage identified - see
e /Repair (impact - dropped objects
(future anchor,
impacts) - trawling,
Ergonomics marine
life)
2. Dropped 2. Dropped object 1. Dropped 1. Damage to the tree or 1. Marine vessel verification
Objects over subsea Objects other subsea equipment (minimum DP-2 requirement)
(change systems (jumpers, etc.)
out of
damaged 2. Potential loss of 2. Subsea infrastructure is designed
UTA, flying containment due to to minimize elevation of
lead etc. contact between the riser components to avoid contact with
in the or LMRP and subsea risers and other subsea Environmental 4 B High
future) equipment infrastructures

5. Weak point analysis
22 | Page
Node: 2. Subsea Production System - Surface Controlled Subsurface Valve (SCSSV) on each Production Well; Top of Production Riser At Hang-OFF Elevation;
Existing Risks
Guide Hazardous
Hazard Causes Consequence Safeguards Recommendation
Word Scenario
CAT S L RR
1. Dropped 1. Existing 1. Dropped object 1. OSV / lifting 1. Deferred production 1. Dropped object analysis
Objects / infrastructure contacts the activities at the
Clashing - phasing pontoon riser tie-in host
spool below the 2. Damage to tie-in spool 2. FPSO gas detection system alarm
RIV resulting in loss of triggering personnel evacuation
containment and
Safety 2 B Low
potential fire/explosion
affecting the host
3. Potential escalation if 3. Accommodation is approx. 300

ignited jet plume ft. from the potential release point
impinges adjacent riser
2. Field 1. High flow 1. High gas flow 1. Flow induced 1. Early replacement of 1. Project is conducting flow induce
Layout - rates through gas pulsation riser pulsation study
Environmen lift flexible riser
tal Hazards 2. Damage to the gas lift 2. Topsides gas detection will shut
riser Potential loss of down the gas lift compressor
containment with release
of gas near the host
3. Potential oil flow back 3. Flow safety valve in the ILS,

from the well/production between the riser and gas lift
flow line through the leak injection flow line
4. PSHL on topsides
5. GLIV on the ILS will isolate flow

from the production flow line if a
shutdown is triggered
3. Flex 1. Existing 1. Releases from 1. Damage 1. Subsea release 1. Hydro testing of flex joints
joint infrastru flex joints during resulting in after installation
locatio cture - installation environment impact
Safety 4 B High
n phasing
2. Vapor cloud 2. Flex joints designed for 30
formation near years
23 | Page
Existing Risks
Guide Hazardous
Word Scenario
CAT S L RR
FPSO, possibly 3. Protective installation tool

leading to 4. SSIV to reduce the inventory
explosion/fire, released
resulting in 5. Proper installation procedures
personnel injury and 6. Regular inspection
fatalities, damage to
equipment
2. Pressure 1. Subsea release 1. Proto type testing to confirm

swings due resulting in design
to daily environment impact
nominatio 2. Vapor cloud 2. Designed with a safety factor
n of gas formation near of 10
FPSO, possibly
leading to 3. Standard Operating Safety 4 B High
explosion/fire, Procedures
resulting in
personnel injury and
equipment
3. Blowing 1. Subsea release 1. Standard Operating

down / resulting in Procedures
pressuring environment impact
up to fast 2. Vapor cloud 2. Restrictive Orifice on topsides
formation near to maintain the blowdown
FPSO, possibly flowrate
Safety 4 B High
leading to 3. Bypass valve across SSIV for
explosion/fire, pressure equalization
resulting in
equipment
24 | Page
Existing Risks
Guide Hazardous
Word Scenario
CAT S L RR
4. Excessive 1. Subsea release 1. Location and orientation of

vessel resulting in FPSO is such that to minimize
motion environment impact the excessive fatigue and
stress on the flex joints
2. Vapor cloud 2. Mooring inspection program

formation near 3. Tension monitoring of the
Safety 4 B High
FPSO, possibly FPSO mooring lines
leading to
explosion/fire,
resulting in
equipment
5. 1. Subsea release 1. Proper design (compatibility
Inco resulting in testing)
mpatible environment impact
materials 2. Vapor cloud 2. Use of bellows to isolate
formation near production from elastomers of
FPSO, possibly the flex joints
Safety 4 B High
leading to
explosion/fire,
resulting in
equipment
6. Operating 1. Subsea release 1. Proper design
temperatu resulting in
re of the environment impact
Safety 4 B High
incoming 2. Vapor cloud 2. Top of the riser temperature
fluids formation near monitoring
outside of
25 | Page
Existing Risks
Guide Hazardous
Word Scenario
CAT S L RR
the design FPSO, possibly 3. Bypass valve across SSIV for

leading to pressure equalization
explosion/fire,
resulting in
equipment
7. Ship 1. Subsea release 1. Loading/unloading are on the Safety

collision resulting in opposite side of the riser
with the environment impact location
attendant
vessel 2. Vapor cloud 2. Exclusion zone around the
formation near riser location
FPSO, possibly 4 B High
leading to
explosion/fire,
resulting in
equipment
26 | Page
3.2 Failure Mode and Effect and Criticality Analysis (FMECA) – Surface
Controlled Subsurface Safety Valve (SCSSV)
3.2.1 Introduction and Scope
3.2.1.1 General Information

As part of the emergent technology risk assessment framework a HAZID was performed to
identify the major accident hazard and associated barriers for production operation in the High
Pressure High Temperature GoM offshore well. One of the recommendations from the HAZID
was to perform the FMECA to determine if any component failure of the SCSSV will result in the
complete loss of control or other unsafe situation.
This study will help in early identification of any single point failures in the system design and
associated risks during operations, thereby leading to a more proactive risk management
approach.
3.2.1.2 Scope
The scope of the FMECA was to review the SCSSV and its components and evaluate their
operation to identify potential failures and address if adequate safeguards are in place to
contain or minimize the risk of failure.
The focus of the study will be on the use of SCSSV in the HPHT environment. It’s assumed that
all the failures related to operation of SCSSV in the normal operation are identified and
accounted for in the design of the SCSSV.
Downhole safety valves act as a last line of defense during the emergency events such as well
head failure to shut-off the well flow to avoid a catastrophic event. There are two basic types of
downhole safety valves:
 Subsurface-Controlled Safety Valves (SSCSV)

 Surface- Controlled Subsurface Safety Valves (SCSSV)
This study focuses on the Surface – Controlled Subsurface Safety Valves.
3.2.2 System Description

The Surface Controlled Subsurface Safety Valve system as prescribed in the API RP 14B is being
considered for the FMECA study and is shown in the Figure 4 below.
27 | Page
Figure 4. Surface Controlled Subsurface Safety Valve System1
1
API RP 14B
28 | Page
3.2.3 Surface-controlled Subsurface Safety Valves2
The tubing string below the surface tubing hanger also contains the SCSSVs . Hydraulic pressure
through a capillary (control) line that connects to a surface control panel (Figure 5) controls
them. Most SCSSV designs today use a flapper to form a seal. Both elastomeric and metal-to-
metal seal designs are available.
Figure 5. Surface-controlled Safety Valve3

The SCSSV is a normally closed (failsafe) valve and requires continuous hydraulic pressure on the
control line to keep it open. The pressure acts upon an internal piston in the valve, which pushes
against a spring. When the hydraulic pressure is relieved, the internal spring moves a flow tube
upward and uncovers the flapper. The flapper then swings closed, shutting the well in. Ball
valves work similarly. The surface control panel, because of a change in flowing characteristics
that exceed predetermined operating limits, generally initiates the closing sequence. However,
any failure of the system that results in loss of control-line pressure should result in the valve
shutting in the well.
2
http://petrowiki.org/Completion_flow_control_accessories#Flow_couplings
3
At the ready: Subsurface Safety Valve, Oil field Review
29 | Page
To open the SCSSV, the pressure above it must be equalized (usually by pressuring up on the
tubing string), and hydraulic pressure must be reapplied to the control line. Some models have a
self-equalizing feature and for reopening without the aid of pressuring up on the tubing.
Whether the valve is working or not, most models have a pump-through kill feature that allow
the pumping of fluids down the tubing to regain control of the well.
The SCSSV is available in a tubing-retrievable model and a wireline-retrievable type. The

wireline-retrievable SCSSV is installed in a special ported safety-valve nipple. The capillary line is
connected from the surface control panel to the ported nipple. The hydraulic pressure applied
at the surface communicates to the valve through the ported nipple. The wireline-retrievable
SCSSV can be pulled and serviced without pulling the tubing string out of the hole. Because of
the design and the use of elastomeric seals, they are somewhat less reliable than the tubing-
retrievable version. The wireline-retrievable valve has a smaller inside diameter, and reduces
flow area for production to pass through. The reduction in inside diameter can create a pressure
drop across the valve and turbulence in the tubing above it. In high-flow-rate wells, the
turbulence can lead to erosion of the valve or tubing string. When installed, the wireline-
retrievable SCSSV restricts access to the tubing string below the valve. The valve must be
removed before performing any through-tubing workover or wireline operations below the
valve.
The tubing-retrievable model is more robust and offers a larger internal flow diameter. This
helps eliminate turbulence and increases production capabilities. It also allows full-bore access
to the tubing string below the valve. One disadvantage, in some instances, is the large outside
diameter. This may limit the size of tubing that can run into certain sizes of casing. To service the
tubing-retrievable SCSSV, the tubing string must be retrieved. To avoid this and extend the life
of the completion, it is possible to disable the valve permanently by locking it open. A new
wireline-retrievable SCSSV can be inserted into the sealbore of the retrievable valve, enabling
the well to continue production without interruption.
3.2.4 Methodology
Identification of the critical failures that could disrupt the SCSSV operation resulted from a risk
assessment methodology known as FMECA. The FMECA tool can evaluate the ways equipment
can fail (or be improperly operated) and the effects of these failures on a system. FMECA can
identify local and global effects of component failures and, if carefully done, systemic failures
with undesirable and/or harmful impacts on the system as well as on those entities interfacing
or relying upon it.
The FMECA provides a basis for determining where to make changes to improve a system
design. Each individual failure exists as an independent occurrence with no relation to other
failures in the system, except for the subsequent effects that it might produce. In addition,
common cause failures of more than one system component will be considered.
Human/Operator errors are not considered as cause of the functional or equipment failure.
30 | Page
The FMECA technique (1) considers how the failure mode of each system component can result
in system performance problems, (2) identifies single point failures that can cause system
failure, and (3) highlights if appropriate safeguards against such problems are in in place or if
there is need for defining further safeguards. The criticality rating of the consequences and the
failure event will be based on the risk ranking matrix as provided in the HAZID.
If the analysis indicated that the undesirable HSE consequence could result from a single failure,
a corrective action item was suggested to demonstrate compliance with class design philosophy
(assuming existing safeguards are found to be inadequate). It will be the responsibility of entity
engaged on the contract with classification to follow through on the corrective actions needed
to comply with classification requirements. Figure 6 graphically presents the proposed FMECA.
Define Scope
Identify System and Component
Define Component Function
Identify Failure Mode
Determine Local and Global Effects

of Failure
Identify Consequence Category
Rate Consequence and Likelihood
Is residual HSE
risk falls
Single point Failure?
under medium or high risk with existing
NO
safeguards? NO
Yes Yes
Develop Recommendation/action item as applicable
Yes
More Failure Modes?
NO
Yes
More Component?
NO
End
Figure 6. FMECA Flowchart
31 | Page
The FMECA was documented by a systematic tabulation of the effects of equipment failures
within a system. Table 7 describes the worksheet fields used to describe equipment failure
modes in the FMECA.
Table 7. Description of FMECA Worksheet Fields

Worksheet Field Description
Equipment/Component A group of components that performs a function necessary for the

success of the major function.
Function/Description Concise statement of the function performed by the item.
Failure Mode The predictable failure mode for the item at the analyzed functional
level.
Potential Cause / Mechanism of Identification and description of the most probable causes associated
Failure with the listed failure mode.
Effect – Local Local effects concentrate specifically on the impact an identified failure
mode has on the operation and function of the item at the next higher
level under consideration.
Effect – Global System effects evaluate and define the total effect an identified failure
has on the operation, function, or status of the main system relative to
the analyzed consequence.
Effective Safeguard Existing safeguard design to respond to the failure mode so that the
function performed by the failed equipment is not lost.
Risk Ranking Each Failure mode was risk ranked against applicable consequence
category (i.e., Safety, Environment, Production, Financial)
Recommendations List of any ideas presented by the team for improving the system against
the failure mode for which the residual risk with existing safeguards falls
under the medium of high risk
32 | Page
3.2.5 Results of FMECA
Section 4.1.4 provides the results of the FMECA study performed for the SCSSV. During the
study, one recommendation was developed to ensure that the SCSSV components are suitable
for the intended environment, e.g., considering corrosion, stress-cracking (see ISO 10432 for
SSSV class of service applications), high pressure, flow rates, loads and high temperature. The
operation on the HPHT environment should place focus on performing further studies to
evaluate how the SCSSV component performs under such conditions. Examples of the studies
include performing Computational Fluid Dynamics (CFD), water hammer analysis, thermal stress
analysis, and Finite Element Analysis.
33 | Page
3.2.6 FMECA Worksheets
System: 1. SCSSV System
Subsystem: 1. SCSSV
Function Detection Preventive or Mitigating Single Point

Failure Mode Cause Local Effect Global Effect CAT S L RR Action Items Remarks
Description Method Safeguards of Failure?
Close on 1. Fail to 1. Flapper 1. Flow 1. Possible 1. Valve 1. Regular/periodic testing Yes Environment 5 B Extreme 1. Ensure
demand close on spring through well loss of unable to and calibration the SCSSV
Demand damage due when not containme close component
to required nt during 2. Before installation, qualified is suitable
prolonged the personnel will test SSCSVs in for the
exposure to emergency accordance with the intended
HPHT situation manufacturer’s operating environmen
condition as the manual to verify mechanical t, e.g.,
SCSSV are actuation and closure- corrosion,
Mechanical considered mechanism pressure integrity. stress-
Component as a last cracking
Damage due line of (see ISO
3. Opening and closing
to defense to 10432 for
hydraulic pressures,
prolonged shutoff the SSSV class of
mechanical actuation, closure-
exposure to well flow service
mechanism integrity and other
HPHT applications
features shall be verified
condition ), pressure,
according to the
flow rates,
manufacturer’s operating
Seat/ loads and
manual prior to valve
Locking temperatur
installation
mechanism e.
Damage
2. Control 1. Valve 1.Control Line Protectors to 2. Ensure

valve line unable to prevent the control damage casing
plug or close pressure is
maintained
34 | Page
Subsystem: 1. SCSSV

damaged 2. Valve 2. Regular/periodic testing and to ensure

unable to calibration the closure
closed due of SCSSV
to the
casing
pressure
increased
higher than
designed
pressure
3. Scale, 1. Valve 1. Scale, paraffin and hydrate 1. Ensure

paraffin and unable to deposition are considered in the SCSSV
hydrate close the setting depth component
deposition is suitable
for the
intended
environmen
t, e.g.,
corrosion,
stress-
cracking
(see ISO
10432 for
SSSV class of
service
applications
), pressure,
flow rates,
loads and
temperatur
e.
35 | Page
Subsystem: 1. SCSSV

4. 1. Valve 1. No automatic reset is

Automatic unable to provided in the control system
Reset maintain to ensure inadvertent
the close reopening of the SCSSV
position
2. Fail to 1. Flapper 1. No well 1. No well 1. Pressure 1. Regular/periodic testing and

open on spring flow when flow when drop during calibration
demand damage due required required - normal
to delay in operation
prolonged production -
exposure to no safety or 2. No well 2. Before installation, qualified
HPHT environmen flow personnel will test SSCSVs in
condition tal accordance with the
consequenc manufacturer’s operating
Mechanical es manual to verify mechanical
Component actuation and closure-
Damage due mechanism pressure integrity.
to
prolonged
exposure to
HPHT
condition
Seat/
according to the
Locking
mechanism
Damage
installation
2. Control 1. No well 1. Control Line Protectors to

valve line flow prevent the control damage
36 | Page
Subsystem: 1. SCSSV

plug 2. Regular/periodic testing and

calibration
3. Scale, 1. No well 1. Scale, paraffin and hydrate 1. Ensure

paraffin and flow deposition are considered in the SCSSV
hydrate the setting depth component
deposition is suitable
for the
intended
environmen
t, e.g.,
corrosion,
stress-
cracking
(see ISO
10432 for
SSSV class of
service
applications
), pressure,
flow rates,
loads and
temperatur
e.
Stay in the 1. Leakage 1. Flapper 1. Flow 1. Restricted 1. Valve 1. Regular/periodic testing and Environment 3 B Moderate 1. Ensure
close through spring through well well flow unable to calibration the SCSSV
position valve in damage due when not but well will maintain component
when closed to not be fully the close is suitable
37 | Page
Subsystem: 1. SCSSV

required position prolonged required shut-off position 2. Before installation, qualified for the
exposure to personnel will test SSCSVs in intended
HPHT accordance with the environmen
condition manufacturer’s operating t, e.g.,
manual to verify mechanical corrosion,
Mechanical stress-
actuation and closure-
Component cracking
mechanism pressure integrity.
Damage due (see ISO
to 10432 for
prolonged SSSV class of
exposure to service
HPHT applications
condition ), pressure,
flow rates,
Seat/ according to the
loads and
Locking manufacturer’s operating
temperatur
mechanism manual prior to valve
e.
Damage installation
2. Control 1. Valve 1. Control Line Protectors to

valve line unable to prevent the control damage
plug maintain
the close 2. Regular/periodic testing and
position calibration
38 | Page
Subsystem: 1. SCSSV

3. Scale, 1. Valve 1. Scale, paraffin and hydrate 1. Ensure the

paraffin and unable to deposition are considering in SCSSV
hydrate maintain the setting depth component
deposition the close is suitable
position for the
intended
environmen
t, e.g.,
corrosion,
stress-
cracking
(see ISO
10432 for
SSSV class of
service
applications
), pressure,
flow rates,
loads and
temperatur
e.
Remain 1. Fail to 1. Flapper 1. No well 1. No well 1. Pressure 1. Regular/periodic testing and

open on open on spring flow when flow when drop during calibration
demand demand damage due required required - normal
to delay in operation
prolonged production -
exposure to no safety or
39 | Page
Subsystem: 1. SCSSV

HPHT environmen 2. No well 2. Before installation, qualified

condition tal flow personnel will test SSCSVs in
consequenc accordance with the
Mechanical es manufacturer’s operating
Component
manual to verify mechanical
Damage due
to
mechanism pressure integrity.
prolonged
exposure to
HPHT
condition 3. Opening and closing
Seat/ mechanical actuation, closure-
Locking mechanism integrity and other
mechanism features shall be verified
Damage according to the
installation
2. Control 1. No well 1. Control Line Protectors to

valve line flow prevent the control damage
plug
2. Regular/periodic testing and

calibration
40 | Page
Subsystem: 1. SCSSV

3. Scale, 1. No well 1. Scale, paraffin and hydrate 1.

paraffin and flow deposition are considering in En
hydrate the setting depth sure the
deposition SCSSV
component
is suitable
for the
intended
environmen
t, e.g.,
corrosion,
stress-
cracking
(see ISO
10432 for
SSSV class of
service
applications
), pressure,
flow rates,
loads and
temperatur
e.
41 | Page
Subsystem: 2. Hydraulic Supply System

Provides 1. 1. 1. SCSSV 1. No 1. 1. Regular/periodic testing 1. No

hydraulic Unavailabili Hydraulic will go to well flow Pressure and calibration additional
supply to ty of line Failure close when drop hazards or
SCSSV hydraulic Hydraulic position required during failure
system control - delay in normal modes
when producti operation identified
needed Panel Failure on - no in respect
safety or to
environ 2. No well 2. Before installation, operation
mental flow qualified personnel will test of SCSSV in
consequ SSCSVs in accordance with HPHT
ences the manufacturer’s operating conditions
manual to verify mechanical
mechanism pressure
integrity.

mechanical actuation,
closure-mechanism integrity
and other features shall be
verified according to the
installation
4. Control Line Protectors to

prevent the control damage
5. Regular/periodic testing
and calibration
6. Scale, paraffin and

hydrate deposition are
considering in the setting
depth
42 | Page
4. Barrier Function and Barrier Critical Systems
4.1 Barrier Function Description in Relation to Major Accident
During the HAZID, subsea release was identified as a Major accident hazard that can lead to undesirable
consequence. Hence, the barrier function chosen for further assessment in this example is “Prevent Loss
of Subsea Well Control”. This barrier function provides a layer of safety for topside events that can
cause uncontrolled well flow, subsea and topside releases, and loss of risers due to marine events or
dropped objects, which can lead to spills to the environment.
This barrier function is established to stop flow from the well upon such events as described above, by
sealing the well within the production tubing in the well.
4.2 Relevant Barrier Critical Systems and Brief Summary of Their Role in
Realizing the Barrier Function
Barrier critical systems considered relevant for the barrier function “Prevent Loss of Subsea Well
Control” include the followint. Barrier critical systems identified during this phase will also include
additional systems that may have a direct or indirect effect on the barrier critical system identified
during the HAZID or contribute to barrier function.
1. Electrical Power Unit (EPU) – The EPU provides power to the control system and umbilical, which
sends a signal to the solenoid valve controlling the subsea quick-dump valve within the SCM.
2. Hydraulic Power Unit (HPU) – The main function of the HPU for this barrier function is to trip and
thereby stop the supply of hydraulic power to the SCSSV.
3. Subsea Control Module (SCM) - The SCM controls the flow of hydraulic fluid to the SCSSV. The SCM
has the task of actuating the solenoid valve and bleeding off hydraulic pressure on demand.
4. Emergency Shutdown (ESD) System - The ESD System is tasked with signaling the SCM to bleed off
hydraulic pressure, in order for the SCSSV to close.
5. Surface Controlled Subsurface Safety Valve – The SCSSV is tasked with stopping the flow of
hydrocarbons and is the main barrier critical system in this barrier function.
6. Production Tubing - The Production Tubing is required to contain the hydrocarbons, both during
normal operation, and while the SCSSV is closed. It is also to be noted that for a tubing retrievable
SCSSV, the valve body is located between the production tubing joints and undergoes same service
conditions (loads and duty cycles).
7. X-mas Tree (XT) - The XT has a support function only for the current barrier critical element. The XT
houses the SCM, Underwater Safety Valves (USVs) and hydraulic pressure and return line going to
the downhole SCSSV. Note that the XT also houses other redundant functions to the closure of the
SCSSV.
8. Production Casing System – The production casing system (including production packers) is required
to provide the structural protection to ensure production tubing and SCSSV integrity.
9. Wellhead – The wellhead provides a means of attaching the X-mass tree equipment for production
operations.
43 | Page
10. Boarding Shut-Down Valve – The boarding shut-down valve isolates the facility from the riser.
11. Cementing – The cementing helps with zonal isolation and maintains integrity of the casing and well
structure.
44 | Page
5. Selected Barrier Critical Systems - SCSSV
5.1 System Description and Basis of Design
The barrier critical system chosen for this example is the SCSSV. The SCSSV is a fail-safe valve, designed
for placement inside the production tubing to stop the flow from the well on demand. There are several
types of SCSSVs, but the selected type for this assessment is a surface controlled, tubing retrievable,
flapper mechanism type SCSSV which is held open by hydraulic pressure (illustrated example in Figure
5). When the hydraulic pressure is relieved, the piston and spring retract and the flapper mechanism
closes the tubing bore.
The SCSSV will be open during normal production and other operations and is installed as part of the
production tubing. It is located subsurface, meaning that it is placed downstream of the wellhead and
X-mas tree. Normal activation of the SCSSV is through the ESD system. The general design of the SCSSV
is not changed compared to what is used for a normal well. However, due to HPHT and Sour Well
conditions, the material selection and requirements regarding pressure and corrosion resistance may
change.
The barrier elements considered necessary for the SCSSV to perform its intended functions include the
following.
 Spring and Piston

o Spring/piston will automatically retract allowing the flapper to close and seal the tubing bore
upon loss of hydraulic pressure.
 Flapper
o Mechanical flapper mechanism automatically closes, sealing the tubing bore when hydraulic
power is lost to shut-in the flow.
In addition, there exists a valve control system consisting of the following components:
 Topside HPU Control Panel

o Topside HPU Control Panel provides visual indication of the hydraulic pressure. The Operator will
monitor and act on pressure loss as per relevant procedure.
 Topside Bleed-Off Valve
o Valve that allows the hydraulic fluid in the hydraulic control line to the SCSSV to bleed-off
manually upon pressure loss in the control system. This allows closure of the SCSSV. Operator,
who should receive an alert following pressure loss on Topside HPU Control Panel, will manually
open the Bleed-off valve.
 Hydraulic Control Tubing
o Hydraulic control tubing provides the necessary means of venting the hydraulic pressure to either
air or sea when the relevant valve is manually or electrically commanded open.
45 | Page
 ESD Control Panel
o Topside ESD Control Panel is used by the Operator to activate SCSSV closure by sending an
electrical command signal to the solenoid controlled valve in the Subsea Control Module (SCM).
 Umbilical
o Umbilical provides the necessary means of transmitting the command signal from the ESD
Control Station to the SCM.
 Subsea Control Module (SCM)
o SCM houses the electrically controlled solenoid Subsea Quick-Dump Valve.
 Subsea Quick-Dump Valve
o Subsea Quick-Dump Valve provides the necessary means of bleeding the hydraulic pressure in
the chamber upon command signal. The ESD Control Panel sends an electric command signal to
the solenoid to initiate the bleed-off.
46 | Page
6. Barrier Model for SCSSV
6.1 Barrier Model Scope (Interfaces and Barrier Elements) and Key
Assumptions
Read the contents of this section in conjunction to the Barrier Model (presented in Section 6.2).
6.1.1 Barrier Critical System Functions

The following Barrier Critical System Functions (BCSFs) are identified for the SCSSV as sufficient to
realize the barrier function “Prevent Loss of Subsea Well Control”:
 Close and Shut in Flow Upon Loss of Hydraulic Power (BCSF 1).
 Close and Shut in Flow on Commanded Closure (BCSF 2).
Close and Shut in Flow upon Loss of Hydraulic Power (BCSF 1)
Operator monitors the hydraulic pressure at the HPU Control Panel and upon loss of hydraulic power,
the Operator will act to manually bleed-off the hydraulic pressure topside by opening the Topside Bleed-
Off Valve. This will result in no hydraulic pressure being exerted on the piston, which will cause the
spring to retract and allow the flapper to close. Hence, the SCSSV is considered a fail-safe closed valve.
Close and Shut in Flow on Commanded Closure (BCSF 2)
This function is in place to close the SCSSV on demand through ESD command. If a demand occurs that
causes the Operator to initiate an ESD, a command signal is sent from the ESD Control Panel to the SCM
to initiate bleed-off at the solenoid controlled Subsea Quick-Dump Valve. Hydraulic pressure is vented
from the Quick-Dump Valve via a Hydraulic Control Tubing, which will cause the hydraulic pressure
exerted on the piston to decrease, enabling the spring to retract and the flapper to close.
6.1.2 Assumptions
Different SCSSV designs exist, such as ball valves or flapper valves, which can be either surface or
subsurface controlled. The barrier model for the SCSSV shown in this case study is an example
developed to illustrate how the barrier model template can be applied to a selected SCSSV (as specified
above and illustrated in Figure 7, Figure 8, and Figure 9) and should not be considered as representative
of all SCSSV designs and configurations. The barrier model was developed by the ABSG Consulting
project team and verified through a review workshop with industry BSEE Subject Matter Experts (SMEs).
47 | Page
For the purpose of this example, Table 8 represents the main assumptions relevant to the barrier
elements.
Table 8. SCSSV System Assumptions – Barrier Elements

Assumption Barrier Element
 The SCSSV is assumed to be a Category 1 HPHT Primary Barrier SCSSV
Pressure Containing and Pressure Controlling equipment.
 Upon loss of hydraulic pressure, the piston will retract. This retracts Spring and Piston
the spring holding the flapper in an open position.
 The Spring and Piston will not be exposed to Wellbore fluids/HPHT
conditions.
 The Flapper is a mechanical component that will be positioned Flapper

downwards into the well flow. When the flapper closes, it will seal
tubing bore and shut-in the flow.
 The HPU Control Panel includes visual indications that allow the HPU Control Panel
Operator to monitor hydraulic pressure.
 The Topside Bleed-Off Valve is designed to be manually opened to Topside Bleed-Off

bleed hydraulic pressure if necessary. Valve
 There is hydraulic control tubing that allows for the hydraulic fluid Hydraulic Control
bleed-off topsides for manual closure of the SCSSV by means of the Tubing
Topside Bleed-Off Valve (BCSF 1).
 There is hydraulic control tubing that connects the chamber to the
Subsea Quick-Dump Valve that enables the venting to sea of hydraulic
fluid in the chamber (BCSF 2).
 The ESD Control Panel includes the push-button and ESD systems ESD Control Panel
topside that provides the interface for the Operator to communicate
with the SCM for commanded closure of the SCSSV.
 Transmits the command signals from the ESD Control Panel to the Umbilical
SCM, which houses the Subsea Quick-Dump Valve.
 The SCM houses the Subsea Quick-Dump Valve and all subsea SCM
electronics required to communicate via topsides.
 Subsea Quick-Dump Valve is controlled via an electrical solenoid. The Subsea Quick-Dump
ESD system sends a command signal. This is the only method to close Valve
the SCSSV on commanded closure.
48 | Page
6.1.3 Independent Third Party Review Requirement
There is a requirement from BSEE that an independent third party must review and accept Category 1
HPHT equipment material selection/qualification, design verification and design validation. The
independent third party must provide their own review reports relating to the following:
 Basis of Design, Loads and Environment including the hazard and failure mode analysis
(HAZID/HAZOP and/or FMEA/FMECA).
 Material Selection, Qualification and Testing.
 Design Verification Analysis.
 Design Validation Testing.
 Load Monitoring.
 Fabrication processes, quality control/quality assurance process and inspections process of the final
product.
The lessee/Operator must nominate and receive BSEE acceptance of the independent third party
reviewer.
49 | Page
6.2 Barrier Model
The following figures show the developed barrier model for the SCSSC.
Prevent Loss of
Subsea Well
Control
Subsea X-mas Tree

Boarding Subsurface Production
Control Production and
Shut-Down EPU HPU ESD System Safety Valve Casing Wellhead Cementing
Module Tubing Underwater
Valve system System
System Safety Valve
Close and shut in flow Close and shut in flow

upon loss of hydraulic on commanded
power closure
50 | Page
BCSF-1 BCSF-2
Figure 7. Barrier Function, Barrier Critical Systems, and Barrier Critical System Functions
BCSF-1
Close and Shut in

Flow upon Loss of
Hydraulic Power
HPU Control Topside Hydraulic

Spring and
Panel Bleed-Off Control Flapper
Piston
Topside Valve Tubing
51 | Page
Provide Bleed-Off Vent line Retract to

visual hydraulic enabling allow Close to seal
indication fluid in bleed-off of flapper to tubing bore
that there is control line hydraulic close
loss of Act on feeding SCM fluid topside
hydraulic Monitor for Pressure Loss
power Hydraulic by Manually
Pressure Loss Opening
Bleed-Off
Valve
Figure 8. Barrier Critical System Function 1 – Close and Shut in Flow upon Loss of Hydraulic Power
BCSF-2
Close and Shut in

Flow on Commanded
Closure
Valve
control
system
Subsea Subsea Hydraulic

52 | Page
ESD control Spring and

Umbilical Control Quick-Dump Control Flapper
panel Piston
Module Valve Tubing
Send Transmits Vent line Retract to

Initiate Bleed off Close to seal
command to command enabling allow
bleed-off on hydraulic inner tubing
SCM signal from flow of flapper to
demand fluid in bore
through ESD ESD Control hydraulic close
system chamber on
Activate SSSV Panel to fluid from
demand
Closure initiate chamber to
through ESD bleed-off sea
system
Figure 9. Barrier Critical System Function 2 – Close and Shut in Flow on Commanded Closure
7. Barrier Element Attribute Checklist
Checklists highlighting attributes and related success criteria for the barrier elements have been
developed to ensure that they can perform the required physical/operational task(s) to meet their
intended barrier critical system function(s). The checklists have been developed as MS Excel™
workbooks. Each checklist structures the attributes influencing the performance of the barrier elements
into three tiers:
 Tier I – Covers the life cycle phases that need to be assessed

o Design;
o Fabrication and Testing;
o Installation and Commissioning;
o Operation and Maintenance;
o Decommissioning and Removal.
These are indicated by the worksheet labels.
 Tier II – Specific aspects that are required for assessment as part of each lifecycle phase.
As an example, corresponding to the Tier I Design worksheet, there are four Tier II attributes
indicated by headers in green with each worksheet:
o 1-1 Design Parameters
o 1-2 Interactions/Dependencies
o 1-3 Layout
o 1-4 Material
 Tier III – Provides specific detail and consideration for the BSEE reviewer to assess and validate.
These are developed in rows under each corresponding Tier II header.
It is important to note that the success attributes provided for the barrier elements are only examples
to illustrate the development of typical attributes based on available design standards/codes and should
not be interpreted as prescriptive requirements for compliance. For each proposed new technology,
attributes will have to be developed based on the barrier model by the Operator in conjunction with
relevant parties such as the equipment manufacturers.
Table 9 summarizes the barrier elements and the attribute checklists developed for the SCSSV used in a
HPHT and Sour environment scenario. Each barrier element checklist developed is provided as an
individual MS Excel workbook, which can be accessed by clicking on the icon within the table.
The Applicant Assurance column currently includes information on general documentation for validating
that the attributes meet its success criteria. With the third party review requirement from BSEE, the
Applicant Assurance column could be modified to refer to the relevant section of the third party review
report which confirms the same.
53 | Page
Table 9. Barrier Element Attribute Checklists
Barrier Element Checklist Provided Checklist (Double
(Yes(Y)/No(N)) Click to open in
MS Excel)
SCSSV
Spring and Piston Y
HPHT_SSSV_Checklis
t_Spring_Piston.xlsx
Flapper Y
HPHT_SSSV_Checklis
t_Flapper.xlsx
Topside HPU Control Panel N N/A
Topside Bleed-Off Valve N N/A
Hydraulic Control Tubing Y
HPHT_SSSV_Checklis
t_Hydraulic Control Tubing.xlsx
ESD Control Panel Y
HPHT_SSSV_Checklis
t_ESD Control Panel.xlsx
Umbilical N N/A
Subsea Control Module Y
HPHT_SSSV_Checklis
t_SCM.xlsx
Subsea Quick-Dump Valve Y
HPHT_SSSV_Checklis
t_Subsea Quick Dump Valve.xlsx
54 | Page
8. Reference
1 – API RP 14B, Design, Installation, Repair and Operation of Subsurface Safety Valve Systems
2 - http://petrowiki.org/Completion_flow_control_accessories#Flow_couplings
3 - http://petrowiki.org/Completion_flow_control_accessories#Flow_couplings
4 - At the ready: Subsurface Safety Valve, Oil field Review
55 | Page

hpht1 PDF

Uploaded by

Document Informationclick to expand document information

Document Informationclick to expand document information

Copyright:

Available Formats

hpht1 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

hpht1 PDF

Uploaded by

Copyright:

Available Formats

Case Study 4:

BPA Contract # E13PA00008

 Scenario 1: Ultra-deep water drilling

2.1 Scenario Descriptions

Table 1 lists the characteristics of this scenario.

Table 1. Scenario 4 - Characteristics

2.2 Risk and Barrier Assessment Workflow

Figure 1. New Technology Assessment Framework

3.1 Subsea HAZID – HPHT and Sour Environment

This scenario considers the field characteristic as provided in Section 2.1.

The following comprises the production facilities for subject field:

 All Subsea Trees / Subsea Well Center.

Select Plant AREA or NODE & Section, IDENTIFY

Figure 3. HAZID Study Process

 Subsea system is designed in accordance with recognized standards.

3.1.7 Results and Conclusion

Table 4. HAZID Recommendations

3.1.7.2 MAH Identification

3.1.7.3 Barrier Critical System Identification

Table 5. Critical Barriers to Prevent MAHs

Table 6. Additional Studies

Hazardous Existing Risks

5. Ability to shut in the well using

6. NACE MR- 0175 complied

2. Leaking valve 1. Ingress of sea water 1. Double barrier provided or valve

2. Release of production 2. Subsea systems are designed for

Hazardous Existing Risks

2. Release of production 2. Corrosion inhibitor connection

5. Intelligent pigging operation

6. Acoustic Sand Detectors

8. Sand controlled completions

4. Excessive 1. Ingress of sea water 1. Subsea manifolds will be

Hazardous Existing Risks

2. Low 1. No flow through the 1. Subsea equipment is fitted with

5. Operating procedures and flow

3. Flow 3. Water 1. Extended 1. High rates of 1. Conducting dead oil

4. Thermal 4. Non identified

5. Hydro- 5. Subsea Release 1. Erosion/ 1. Loss of containment 1. Internal erosion monitoring

Hazardous Existing Risks

7. Corrosion Resistant Alloy

10. NACE MR- 0175 complied

2. Loss of well 1. Fire hazard, 1. BOP during well intervention

3. Emergency Shutdown System

6. 6. Subsea release 1. Improper 1. Loss of containment, 1. On loss of control system will go

2. Improper 1. QA/QC procedures

3. Improper 1. QA/QC procedures

Hazardous Existing Risks

3. Not being able to use

10. Fluid 10. See hydrate 1 1. No HSE consequences

11. Start-up/ 11. See hydrate

Hazardous Existing Risks

4. LMRP emergency disconnect

6. Ability to shut in the well using

3. Drilling rig drifting 7. FPSO moored via disconnectable

10. Subsea safety valves will be

13. 13. Controlled 1. Emergency 1. Potential loss of 1. Weak point analysis

2. Damage to the tree or 2. Subsea infrastructure is designed