Process Safety Sample Dissertation

Process Risk Management of Offshore Oil Production Facilities at Near End
of Field Life
Smith, Brendan M, BEng (Hons) in Chemical Engineering, AMIChemE

SI: 51772795
A dissertation submitted in partial fulfilment of the requirements of the award of Master

of Science in Process Safety Engineering at the University of Aberdeen
August 2018
Acknowledgements
I would like to extend thanks to; my technical supervisor Colin McWhirr (Xodus); my
academic supervisor Waheed Afzal (University of Aberdeen); and to Antonios Karadimos
(University of Aberdeen) for their support and guidance during the development of this paper.
.
Smith, B. M.
i
Abstract
Decommissioning presents a new and great challenge for mature oil basins around the
world- and particularly for challenging environments such as the North Sea. Due to the
volume of assets coming to their End of Field Life (EOFL), and with advancing
technology in the sector, operators are often opting to delay the process for many years.
During this time of non-producing operation, maintaining manned platforms puts
workers at unnecessary risk and is expensive in operation. This paper reviews operating
strategies for EOFL assets and finds that transition to a Not Normally Attended (NNA)
operation mode would be beneficial for operation cost and for achieving inherently safer
facilities. A case study of an offshore platform is presented (based upon a real-life
project) and a Preliminary Hazard Analysis is performed to identify and assess the
hazards of shut-in wells. Two undesirable events are identified including wellhead/tree
structure leak and surface casing blowout. Leak pathways are identified and assessed as
to their effect and severity utilising a Failure Mode & Effect Analysis procedure,
pathways are probabilistically assessed using a Fault Tree Analysis procedure. The
results show that pressure monitoring on well annuli and an annulus relief system are
required to achieve optimal wellhead status as well as an effective safety management
system and Safety and Environmental Critical Elements asset register needed for NNA
status. Further, technologies and asset operation(s) are reviewed to provide measures
which could optimise the NNA mode, making the asset safer whilst keeping practicable
cost. Such measures using boat transport for offshore tours (keeping helicopter access
for emergencies), investing in; remote operational strategies such as wireless, and data
gathering for maintenance optimisation; implementing robotics for inspection duties;
and installing low voltage, low maintenance power generation.
Keywords: Decommissioning, End of Field Life, Not Normally Attended,

inherent, safety, leaks, pathways, optimisation, operating, strategies, hazard,
identification, assessment
ii
Contents
1. Process Risk Management of Offshore Oil Production Facilities at Near
End of Field Life .............................................................................................................. 1
2. Review of Near-End of Life Operating Strategies ..................................... 6
3. Regulatory Background on the UK Continental Shelf ............................... 8
4. Hazard Identification and Assessment Related to Shut in Wells .............. 10
5. Functionality and Reliability Analysis of a Typical Plugged Wellhead ... 18
6. Developing an Optimal Wellhead/Tree System Status ............................. 39
7. Transitioning toward a ‘Lighthouse’ Mode of Operation ......................... 45
8. Recommendations for achieving Optimal Operation for Facilities at End

of Field Life 52
9. Recommendations for Future Work.......................................................... 54
10. References ................................................................................................ 55
11. Appendix A – Spider Diagrams of Operational Mode Base Requirement 58
iii
Abbreviations
ALARP – As Low As Reasonably Practicable
ATEX - European Directives for controlling explosive atmospheres
Barg – Bar (Pressure) Gauge
BOP – Blowout Preventer
CCTV – Closed-Circuit Television
COSHH – Control of Substances Hazardous to Health
DCS - Distributed Control System
EOFL – End of Field Life
EU – European Union
FMEA – Failure Mode & Effect Analysis
FTA – Fault Tree Analysis
HSE – Health & Safety Executive (United Kingdom)
H2S – Hydrogen Sulphide
LoC – Loss of Containment
MAH – Major Accident Hazard
MAASP - Maximum Allowable Annulus Surface Pressure
MEI – Major Environmental Incident
NNA – Not Normally Attended
OPEX – Operational Expenditure
OSPAR – Oslo/Paris Convention for the Protection of the Marine Environment
of the North-East Atlantic
P&A – Plugging and Abandonment
PHA – Preliminary Hazard Analysis
QRA – Quantitative Risk Assessment
UK – United Kingdom
UKCS – United Kingdom Continental Shelf
UNCLoS - United Nations Convention on the Law of the Sea
USD – United State Dollars
SCP – Sustained Casing Pressure
SCSSSV – Surface Controlled Sub-Surface Safety Valve
SECE – Safety & Environmental Critical Element
SG – Standard Gravity
SMS – Safety Management System
iv
1. Process Risk Management of Offshore Oil Production Facilities
at Near End of Field Life
The offshore industry has dealt with Major Accident Hazards (MAH) and Major
Environmental Incidents (MEI) for many decades now- mainly those associated with
drilling for oil deposits and maintaining production from viable wells- thus, good
health, safety, and environmental management is important1. As with a handful of other
regions in the world, the North Sea is becoming a mature basin with many assets
coming to the end of their productive lives. This brings about a new challenge of
decommissioning these old assets in a safe and responsible way which recognizes the
law both nationally & internationally and protects the environment. Legislation relating
to decommissioning has mostly come from international law, however its treatment is
sensitive to cost and technical issues and- as learned in the Shell UK Brent Spar
decommissioning case2- it is also important to be wary of public opinion. International
law on the topic began in 1958 with the Convention on the Continental Shelf, and more
recently with the United Nations Convention on the Law of the Sea 1982 and the
OSPAR Convention 19923. In general, the consensus to offshore installations that the
UK sets its international obligations is with the United Nations Convention on the Law
of the Sea (UNCLoS) 1982, where article 60(3) states:
“Any installations or structures which are abandoned or

disused shall be removed to ensure safety of navigation, taking into
account any generally accepted international standards established in
this regard by the competent international organisation. Such removal
shall also have due regard to fishing, the protection of the marine
environment and the rights and duties of other States. Appropriately
publicity shall be given depth, position and dimensions of any
installation or structures not entirely removed” 4
This is enforced by the Petroleum Act 19985. Removal is expected to occur

within reasonably practicable timeline following abandonment/disuse, and dependent on
depth and weight of the structures, it is expected that they are removed entirely (in less
than 100m water depth and 4000 tonnes)3. This can only be waived if it can be proven
that such removal is technically or economically unfeasible, or the risk to personnel and
the environment is justified to be unacceptable. It should be noted that there is
1
considerable opposition to such complete removal which may see changes to legislation
in the future. Currently, decommissioning costs are paid by the UK tax payer, as the UK
government must provide a tax rebate for decommissioning and removal costs to
operators. A leading voice of this opposition comes from the University of Aberdeen’s
Tom Baxter and his publications on The Conversation6,7- a leading platform for
academics to publish articles on everyday topics of interest. For now, approval must be
given by the secretary of state prior to the decommissioning project going ahead,
following regulations enshrined in the Petroleum Act 1998.
Decommissioning is a great technical challenge8 with the well Plugging &

Abandonment (P&A) being the first stage of this- isolating the well from topside
equipment. Within the North Sea, the harsh environment allows for a greater challenge
in comparison to the more moderate environments of the Gulf of Mexico, West Africa,
Persian Gulf etc9. Well P&A requires extensive planning beforehand, as well as
continuous contact with the regulating authority. Once the planning stage has been
completed, and the competent authority has signed off, the well(s) connected to the
installation must be isolated in any productive zones with cement, and followed with the
setting of a surface cement plug in the well (approximately 30-50m below the
mudline)9. This is completed along with removal of some or all the production tubing.
Figure 1 shows a typical cement plugging schematic. Following the final plugging, pre-
abandonment surveys are to be completed- covering all engineering and environmental
aspects of structure, process & utility decommission and removal (partial or full). See
the reference by Day9 for full detail. Such high demand on operators can result in years
of project development and actioning, before the project can be considered complete.
Figure 1 – Basic Cement Plug and Performance Requirements8
2
During the near end of field life (EOFL), the water cut from production reaches
a very high percent (~95%) and depending on various operational expenditure (OPEX)
and production income an operator may choose to cease production and prepare for
permanent installation shut down and well abandonment. This requires a large sum of
company resources and man-hoursa. This is often coupled with other assets also
Figure 2 – Example of a Temporary Well

Plugging Tool42
approaching this mature stage, and operators may have to suspend the P&A for many
years until preparations and resources are made for the abandonment project to begin.
To quantify the scale of decommissioning in the North Sea Basin, Oil & Gas UK in
November 2017 estimated that over 200 platforms will be removed, and almost 2,500
wells are to undergo P&A in the North Sea between 2017 and 202511. A common
strategy is to decommission the platform topsides, temporarily plug any wells (example
seen in figure 2) and run platforms in a non-producing state- thus requiring lower
criticality maintenance due to the large removal of its hydrocarbon profile. However
besides large OPEX costs of offshore installations, the risk of putting offshore teams out
a
See literature by Gorman10 for full technical and regulatory needs of decommissioning in the
UK Continental Shelf (UKCS)
3
on these assets to perform such low criticality maintenance is futile- presenting a
challenge as to an optimal strategy of operating such installations.
Further to the Oil & Gas UK Decommissioning Insight Report, 46% of

decommissioning costs between 2017 and 2025 will come from the shallow central
North Sea11 (depths range from 40-100m, seen in figure 3). In shallower waters,
wellheads are often above the surface of the water and are present in the well bay of
platforms- commonly referred to as dry wellheads12. This arrangement is like onshore
setups and allows easy access to wellhead equipment. The wellhead is the interface
between the subsurface well and the drilling platform and thus presents considerable
MAH and MEI profiles during drilling and well intervention operations. During
shutdown and plugging (at end of producing life), the well – dependent on its
characteristics – may continue to present these hazards to the asset and any persons on
Figure 3 – North Sea Water Depth Chart41
4
board due to the presence of the wellhead on the platform. The reasons why will be
subsequently discussed in the upcoming hazard identification section.
The challenge of decommissioning with its long timeline of

development/actioning, in addition to managing hazards still presented by live wells,
provide the motivation for this paper- how to optimally operate facilities until their
eventual decommission and well P&A. Thus, this paper aims to present a method of
operating fixed EOFL assets in a way which minimises risk exposure to offshore
workers and allows the simplification of safety systems. This in turn allows operators to
free up resources to prepare for decommissioning and reduce running costs of the
facilities up until this milestone.
Paper Objectives
- Review and discuss possible operating strategies regarding EOFL facilities

and review the regulatory requirements of operators on the UKCS
- Present a case study of a typical temporarily plugged facility (with a dry
wellhead), and use a Preliminary Hazard Analysis (PHA), Failure Mode
Effect and Analysis (FMEA) and Fault Tree Analysis (FTA) to provide
identification and assessment (semi-quantitative) of Major Accident Hazard
(MAH)/Major Environmental Incident (MEI) potential.
- From the above, develop optimal wellhead/tree status given the requirements
to monitor wellhead, tubing, and annular pressures. Then review
technologies which could support meeting the functional requirements of the
facility whilst maintaining minimal risk exposure and practicable cost
- Develop final recommendations for optimal facility operation/integrity
management for the MAH/MEI potential found
5
2. Review of Near-End of Life Operating Strategies
Reservoirs may produce for many years, however eventually production will
become economically unfeasible- as water-cut will become excessively high. The exact
timing is hard to predict as economic climate and control over the OPEX of an offshore
installation are themselves difficult to know until the present arrives. Once production is
deemed economically unfeasible, it is stopped and topside equipment under go’s
engineer down and clean allowing it to be decommissioned. Up until the final well P&A
and topside removal, operators must find strategies to optimally maintain facilities at
this mature stage. This section shall discuss the:
- Manned mode of operation
- Not Normally Attended (NNA) mode of operation
Note that literature regarding this topic is almost non-existent as it primarily exists
within industry- in mature petroleum basins.
Manned Platform Retention
Following the engineer down and clean, the platform moves from a producing to
a non-producing operating mode, and maintenance becomes considerably less critical-
as the MAH/MEI profile is reduced throughout much of the platform. In this mode
however, a base level of personnel is kept to maintain the integrity of the installation- as
required by offshore safety regulations within the UKCS (see the following section).
Due to the presence of a base level personnel, utilities such as water, power and heating,
and accommodation must be provided and such a change in operation is subject to a
management of change process and subsequent regulatory approval. As mentioned in
the earlier introduction, it is unappealing from both an OPEX and safety point of view
to maintain this POB level for such low criticality needs- as many Safety &
Environmental Critical Elements (SECE) and life support functions and facilities must
be maintained in active operation (see diagram 1 in appendix A). For this reason, further
measures will be explored
Not Normally Attended (NNA) Transition
NNA mode is used for several reasons and not solely for near EOFL. Whilst
many installations have permanently manned production and drilling platforms, often
the use of water injection platforms and satellite wells (utilising the lower cost dry
6
wellhead option over subsea) do not need to be manned continually and can be operated
remotely. In a case study consulted during the development of this work, platform X
was moved from a manned operation into the NNA mode of operationb. To begin,
process equipment was engineer down and cleaned, then decommissioned- with only
vital utilities kept in working condition. This allowed the removal for permanent
occupation. This removal of personnel for considerable periods allows many SECE’s to
also be decommissioned- which often further reduces the MAH/MEI profile due to the
removal of power generators such as gas (turbines) and diesel as well as fire and gas
systems needed for the occupied areas. Some continuous power supply, though small, is
required for basic monitoring functions of the well, and for maintaining basic navigation
lighting for air and sea traffic. Where maintenance is needed (for asset integrity)
offshore teams can attend the installation for scheduled maintenance trips (likely in
typical good weather windows) in which to minimise the chance of unscheduled trips.
By moving assets to this operating mode, risk can be controlled due to the reduction in
risk exposure during maintenance (time exposed) as well as decommissioning plant
operations/utilities which are hazardous. The result for platform X was an OPEX
reduction from £12m per annum, to £2m per annum and allowed for infrequent
maintenance trips approximately every 6 months. This reduces risk exposure to offshore
workers and the number of SECE’s needed and hence maintained- see diagram 2 in
appendix A.
It has been demonstrated that continuing to run the asset as a manned platform
presents high OPEX costs, greater maintenance and increased risk of harm to personnel.
Thus, a move to transition an asset to NNA mode allows personnel to be removed from
the MAH’s- which is very desirable from a process safety aspect – but further allows
operators to free up resources and prepare for P&A of the asset. Further reasons to make
the transition to unmanned facilities include13:
- Meeting legislative requirements
- Having a strong business case to achieve project sustainability
- Achieving Inherently Safer Facilities
b
Platform X refers to a real-life offshore installation situated in the UKCS part of the North Sea-
which is undergoing final transition to NNA operation and cannot be named due to confidentiality.
7
3. Regulatory Background on the UK Continental Shelf
This section will briefly outline the regulatory environment within UK
Continental Shelf (UKCS). Regulations set the expectation of the state on private
exploration and production (commonly abbreviated as E&P) companies and thus
provide the motivation to; fully identify and assess risks; provide barriers to mitigate,
control; and processes to recover from any MAH/MEI propagation. In the UK, the base
level legislation in which all other regulations umbrella under is the Health and Safety
at Work Act (HSWA) 1974- in which the general binding statement states that3:
“…the duty on the employer to ensure, so far as reasonably

practicable, the health, safety, and welfare of employees”
This is applicable across industry in the UK, however following disasters such as Piper
Alpha (1988) -which brought about the Cullen Inquiry headed up by Lord Cullen-
resulted in the offshore industry having its own applicable regulations. The offshore
legislation, which changed from the previous prescriptive approach (applied by the
department of energy), became a more permissioning approach (now enforced by the
HSE), and is formally known as the Offshore Safety Act & the Safety Case Regulations.
This act of parliament requires operators to propose safety cases for every installation
operated on the UKCS, and then is subjected to approval by the HSE. The HSE must
ensure that each submitted safety case has fully assessed both the facility’s construction
and operation, and the asset can be deemed safe (as far as reasonably practicable and
meeting ALARP levels). The following objectives are expected to be achieved and
documented in any safety case:
- the safety management system is adequate to ensure that the design &
operation of the installation and equipment is safe
- That all MAH’s have been identified and controlled to at least an ALARP
level using an appropriate Quantitative Risk Assessment (QRA) method
- Adequate provision is made to provide temporary safe refuge for personnel
and safe and full evacuation, escape and rescue
Further to the 1992 regulations, operators of fixed installations are required to propose a
safety case relating to the proposed abandonment of the installation, and any ‘material’
changes to the safety case must be approved by the HSE.
8
Improvements have since been made to these regulations with the introduction
of EU directives and various reviews and responses to industry incidents within the UK
and other parts of the world. These changes include examples such as; the use of permit
to work systems (covered in The Offshore Installations and Pipeline Works
(Management and Administration) Regulations); arrangements for communications to
shore, other vessels, aircraft and other installations; helicopter operations; gathering of
meteorological and related data; as well as many others. This has increasingly created
the goal-setting regulations seen in modern UK oil & gas law today. The reference
provided by Gordon et al.3 gives an excellent overview and historical development of
law in the UKCS and is recommended for further interest- note it does not contain the
most recent regulation amendments in 2015. The most recent change in Offshore Safety
Law seen in 2015 was enacted into law via EU directives responding to the Macondo
Deepwater accident (Deep Water Horizon, 201014). This introduced the Major
Environmental Incident (MEI) term into regulation and requires operators to have a
Safety and Environmental Management System in place (as part of the safety case)-
which has associated SECE’s to act as barriers to MAH/MEI. The HSE15 have provided
a guidance document for further information.
9
4. Hazard Identification and Assessment Related to Shut in Wells
In the earlier review of options for operators with EOFL assets two options were
discussed, including maintaining a manned platform and transitioning to the NNA mode
of operation. This report will now aim to demonstrate the transition to the NNA
operation. This section will look to assess typical hydrocarbon threats to installations
and not focus on hazards such as helicopter/ship impact in too much detail as this is less
concerning regarding process safety management.
A key part to any Safety case – as noted in the previous regulatory section- is the
identification and assessment of MAH/MEI’s. For this section it is key to define the
case study that this paper explores, and further develop a basic understanding of
hydrocarbon reservoirs and how they interact with the system during shut in with deep
set plugging. Do note that this will be brief as to maintain the focus on the Safety aspect
of installations transitioning to the NNA mode of operation.
Offshore Facility Case Study Description
As mentioned in the operating strategy review, a real-life case study was

consulted during the development of this work. In order to provide relevance in this
paper, a hypothetical platform based upon this case will be explored. This platform:
- Started production in the early 1990’s and is located in the UKCS North Sea
in water roughly 80m deep, primarily producing natural gas (small
percentage of H2S present) and crude oil via a dry wellhead/tree structure.
Transport to and from the facility has primarily been via helicopter
- Consists of two steel jacketed structures (drilling and production) in the main
facility connected via bridge link. The production platform performs crude
stabilisation, gas/oil export and water treatment. Production is supported by
a remotely operated satellite water injection facility 6km north of the main
facility
- Recently hit the EOFL milestone in its operating life due to uneconomical
production (high water-cut)
- Has undergone full engineer down and cleaning work and has been
positively isolated from export lines and risers. The water injection facility
has been fully decommissioned
10
- Following well shut-in, well engineers have identified considerable wellhead
pressurisation occurrence in 4 of the 20 drilled wells, resulting in slow
tubing head pressurisation up to 80 barg
- Drilling equipment has been audited and no longer operational, thus any well
P&A is not possible without a tender jack-up rig
The operator has chosen to put off final well P&A and structure removal for
several years to allow other high priority EOFL projects to be completed and to allow
decommissioning costs to reduce- due to the currently expanding decommissioning
sector.
Hazard Identification for Shut-In Wells
Loss of Containment (LoC) presents a potential hazard to facilities in NNA

mode, despite the high-water cuts observed at EOFL. The reason for the hazard is linked
to reservoir behaviour. At EOFL once production ceases, natural gravity separation
results in the oil/gas mixture settling on top of any formation water (brine) and is a
process known as oil flushing, as presented in figure 4. At near EOFL mostly brine is
produced and once this flow is stopped, oil flushing begins to occur and dependent on
reservoir characteristics an oil cap and potentially a gas cap may form at the well bore.
Figure 4 - Natural Reservoir Gravity Separation Process
A completed well with deep set plugs in place, is shown in figure 5. The outer levels of
casing are also known as the annuli and these are rated to various pressures dependent
on the pressure of each rock formation they are to protect against (i.e. will not collapse
due to formation pressure). During production, dependent on production rate, water
breakthrough will likely occur due to the lower viscosity of the brine relative to the oil.
This is demonstrated in figure 6 (where M is the ratio of oil to water viscosity). This
also results in water coning- also shown in figure 6. At the EOFL and after subsequent
well shut-in, the reservoir relaxes, and the coning disappears (reverts to stable
11
displacement shown in figure 6) which can allow the lower standard gravity (SG) oil
and gas to displace the brine and return into the well bore and into the production
tubing. As this lower SG fluid fills the tubing column, its hydrostatic pressure reduces
and thus increases pressure at the surface. If the reservoir further has an active aquafer,
then this can cause further pressure increase- allowing the potential of free-flowing
hydrocarbons. This presents a MAH/MEI profile on the installation. Following the
EOFL, the wireline plug is set and SCSSSV (Surface Controlled Subsurface Safety
Valve) and tree valves are closed (see figure 5)- which present the barriers to free-
Figure 5 – Typical Shut-In Well Schematic (Annulus

Diameter in Inches)
12
flowing hydrocarbons. Having discussed the reasons as to how a MAH/MEI may
materialise within the well, the MAH/MEI identification procedure can now be looked
at in detail- using a qualitative version of the Preliminary Hazard Analysis (PHA)
method.
Figure 6 – Unstable Displacement of Oil and

Water (Left) and Water Coning Effect (Right)
Preliminary Hazard Analysis Method
The PHA assessment is commonly used in front end engineering design

(commonly referred to as FEED projects) and provides an early assessment of hazard(s)
that may impact the hypothetical facility with information available at the conceptual
design stage. This can be used to draw a comparison of processes as to choosing an
inherently safer design. However, it has been adapted in this paper to provide hazard
identification and (qualitative) assessment of the proposed well shut-in & NNA mode of
operation. This will feed into more detailed assessments later- the FMEA and FTA
procedures. Here the assessment takes the form:
- Hazard:
Identifies a potential hazard that the facility may be susceptible to
- Location on the asset that the hazard may present itself:
Supports hazard assessment and any future propagation modelling (fire,
explosion, dispersion etc.)
- Hazard Assessment:
Provides key details as to the credibility of occurrence/propagation of the
hazard and whether it requires further assessment
13
- Severity:
Does the hazard represent a potential MAH/MEI event, and does it warrant
further assessment?
- Comments:
Assessor can provide any extra details or explanations to support the assessment
and provide guidance to the reader
Description of the general procedure can be found in literature, including in reference16.
The aim(s) of this PHA assessment are to:
- Identify the hazards present during well shut-in & NNA mode
- Identify the location on the asset vulnerable to the hazard
- Provide an assessment of the hazard as per the previous description
- Determine the severity of the hazard if realised (does it constitute a potential
MAH/MEI)
- Provide any necessary comments to give description/explanation
Table 1 shows the identification and assessment procedure for shut-in & plugged wells
that are still connected to their respective facilities. For this MAH/MEI identification
and assessment takes account of the characteristics presented in the case study
description previously.
14
Table 1 – Preliminary Hazard Analysis of a Platform in NNA Mode of Operation
Hazard Location Hazard Assessment Severity (MAH/MEI) Remarks/Further Actions

Wellbore A blowout at the wellhead presents a significant MAH/MEI. Future well interventions
Blowout Only credible possibility is during well interventions as leaks must be carefully planned,
through boreholes/flanges will have a small volumetric MAH and MEI, not a and risk assessed with
Wellbay of asset flowrate at the maximum pressure found. This may involve credible scenario during appropriate propagation
both oil and gas. Interventions must take account of fire well shut-in barriers in place. Further need
and/or explosion modelling to understand hazard to monitor pressures of the
propagation and mitigate and control such an event. annuli during NNA mode.
Casing Shoe Should the A annulus suffer sustained casing pressure (SCP)
(B annulus) and further lose integrity and leak into the B-annulus, there Requirement to monitor
Blowout is a risk of over pressure in this surface casing (as it is rarely pressure within well tubing
Bottom of the B rated as the A annulus is). The casing shoe under this Potential for MEI, further and casing is important. Well
annulus circumstance may leak and allow the well pressure to assessment needed integrity loss could result in
fracture the rock formation- causing a loss of well integrity considerable negative
at the least and could result in cratering and leak financial impact (~£50m).
hydrocarbons toward the sea bed.
Gas Leak Gas leak possible where a gas cap forms due to reasons Leak paths and probability
Wellbay of discussed earlier in the section. Generally, the tubing and A required to be assessed. If a
Potential for MAH/MEI,
asset/around annulus is rated for MAASP, thus it would be expected that significant leak is possible,
further assessment needed
wellhead the worst case is a small flowrate such as through an dispersion models will be
instrument borehole (approx. 3mm) at the wellhead/tree. required.
Unignited Gas Like the gas leak scenario mentioned earlier, without an
Specific leak paths and
ignition source. Not likely for there to be a large volume in
As above - credibility need to be
well ventilated area and can be verified via dispersion
assessed.
models
Jet Fire Pressure likely to vent and allow depressurizing of the
As above wellhead thus unlikely fire would last long if an ignition - As above
source was found.
Explosion Leak paths and probability
Following the gas leak mentioned above, if there were
required to be assessed. If a
enough time for a gas cloud to form, an explosion may
significant leak/poor
occur. As mentioned in the Gas Leak case above, small
As above - ventilation is possible,
flowrates are most likely during well shut-in and gas clouds
dispersion models will be
would unlikely form to meet the lower explosive limit (LEL)
required to assess if the LEL
thus probability is low.
has been met.
15
Oil Leak Leak paths and probability
Drilling decks vary platform to platform, assess whether required to be assessed.
liquid pools could form around wellbay area and/or leak into Liquid pools could allow for a
the sea below. Leak would be expected around the tree- Potential MAH/MEI, pool fire. If grated floor is
As above
through instrument connection or leak hole- and in most further assessment needed present, then minor leak may
cases would be a small liquid flow- as pressurisation was occur into the sea causing
noted to be gradual. pollution (environmental
incident)
Annulus Leak If well fluid pressurises and leaks past the packing or
(Well Fluid) through the production tubing, then this presents a potential
LoC path for hydrocarbon inventory. The A annulus is rated Specific leak paths and
Annulus A Casing
for MAASP so would present a barrier to further - credibility need to be
Wall
propagation, however if the inventory then leaked into the B assessed.
annulus, this could over-pressurise the B annulus and cause
LoC at weak points in the casing.
Non-process Power generation options
pool fires Any chemicals and fuels kept on board must be identified must be reviewed for any
Fuel/chemical and comply with COSHHc regulations. If so, these should be stored fuel hazards.
-
storage containers assessed for Loss of Containment scenarios and consequence Chemicals for injection are
analysis. removed with Engineering
Down and Clean procedure
Helicopter Most likely around There is the potential to
Impact helipad and during Platform has used helicopter access during normal remove/reduce this operation
helicopter operations productive life so will not necessarily need to alter current - however- to reduce risk to
(transport, med-evac arrangements personnel/the facility. Needs
etc.). to be reassessed.
Ship Collision Since the removal of process equipment operations and
Platform dependent- It is still expected that
hydrocarbon inventory, MEI are reduced to ship inventory
often platforms are installations will retain
only. As wells are isolated there further is no expected -
designed to withstand navigation lighting as to stand
propagation potential, however assessment may require
such impacts out to sea traffic
updating from that of the previous safety case.
Structural This is not expected to drastically change from previous
Collapse (Loss Platform operation. Primary structure will need to be properly -
maintained until the final well P&A and structure removal
c
Refer to the Health and Safety Executive L5 ACOP (Sixth Edition- can be found online) for the approved guide to complying with COSHH regulations
16
of Structural
Integrity
Transportation Helicopter and boat access are the most common modes of
Method of transport needs to
Helideck/Vessel transport. Navigation aids (lighting) and well head pressure
- be reassessed as to its
Access Point monitoring should be maintained to minimise threat to
suitability in NNA mode.
transporting personnel offshore.
Toxic Gas During well shut-in the likelihood is low (as with gas leak) Specific leak paths and
Release (H2S) Wellbay of asset however portable H2S detection systems should be retained - credibility need to be
for well intervention activities assessed.
Results and Discussion
Having completed the PHA, the most concerning set of hazards is related to the potential presence of statically pressurised well fluid within the well
connection of the asset. This was associated with the following hazards- which will be further assessed as to their credibility:
- Hydrocarbon Leak into B-Annulus with a Casing Shoe Blowout
- Gas Release (Hydrocarbon and/or H2S) and Oil Release via wellhead/tree leak
These are well system integrity-based hazards thus need system analysis to further understand how these hazards may evolve into credible scenarios
and any undesirable events.
17
5. Functionality and Reliability Analysis of a Typical Plugged
Wellhead
In the previous section, it was identified that any hydrocarbons’ remaining in a
plugged wellhead presented a potential MAH/MEI to the facility and the surrounding
environment. The expected functionality of the wellhead system will be looked at using
the Failure Mode & Effect Analysis (FMEA) method to properly understand potential
LoC pathways and what impact they may have on asset integrity. To provide
probabilistic assessment of leak potential, a fault tree analysis (FTA) will be completed.
Wellheads are required to have the following functions for satisfactory

operation17:
- Provide any orientation of the wellhead with respect to tree-manifold
connection
- Support the Xmas tree structure
- Be able to tolerate any loads exerted by drilling, completion and production
operations taking account of thermal expansion
- Be of field tested design to withstand the environment it is placed and to be
of minimum sensitivity to potential conditions
More specific details regarding wellhead and tree process systems can be found in the
reference by Samie18. A schematic of a typical dry wellhead is given in figure 7.
Regarding the Tree itself (also referred to as a Xmas tree, Cross-tree, and Christmas
tree), it is used to control and occasionally regulate flow for production, and for
water/gas injection systems- injection systems are not however within the scope of this
work. Trees require the following functionality in production:
- Direct the produced well fluid to the flowline leading to the production
facility- which will stabilise and separate phases (gas, liquid, aqueous etc.)
- (Can) regulate flow from the well via choke valves – this is not mandatory
- Monitor key well conditions at tree level such as temperature and pressure
(well and annulus), as well as sand detection, and so on
- Safely shut in wells via an automated control system powering actuated gate
valves and with a backup manually operated valve
- Be able to inject into the well or flowlines flow assuring and line protection
measures such as chemical inhibitors (hydrate and corrosion) if required
18
Figure 7 – Typical Single String Dry Wellhead System
19
Figure 7 shows all the key working parts of the tree system and allows for
failure mode (leak during NNA mode) causes to be identified via the various
components within the well system. For this, an FMEA procedure will be performed
following guidance given in BS EN 60812:200619 (British Standard). A brief description
on how the procedure was carried out will be given however, it is recommended to
consult the references given for specifics of how an FMEA may be performed. For those
without access to standards, the application of the FMEA is provided by Stålhane20 and
Mannan21.
FMEA Procedure for Analysis of a Shut-in & Plugged (Temporary) Wellhead

during NNA Phase
The purpose of this FMEA is to:

- Identify key components in the wellhead system and their function- limited
to where hydrocarbons may leak
- Identify causes of leaks (failure mode being assessed) with each component
and the effect this may have on the wellhead (system) and its immediate
surroundings
- Classify the (potential) hazard on a nominal scale of 1-4 as specified in the
table below:
Effect Rating Criteria
Catastrophic 1 Failure mode that may cause death or complete system loss
Critical 2 Failure mode which may cause severe injury or major
system degradation, damage, or reduction in system
performance
Marginal 3 A failure that may result in minor injury or system
degradation or system performance
Minor 4 Failure that does not cause injury or system degradation but
may result in system and unscheduled maintenance or repair
Table 2 - Effect Rating Criteria (Reformatted from US DOD MIL-STD-1629A)22
- Provide methods of detecting the failure or stating it is an unrevealed failure

- Provide compensating provisions and any relevant remarks
It is expected that the procedure will determine well components that are most
critical to any planned maintenance activities. The critical function(s) that the well
20
system provides is preventing; Loss of Hydrocarbon Containment; and pressure does
not exceed the Maximum Allowable Annulus Surface Pressure (MAASP) in
intermediate/surface casing- the upper pressure limit at the wellhead (i.e. reservoir
pressure minus the hydrostatic pressure of the well fluid column in production
tubing/casing)
FTA Method for Probabilistic Analysis
Fault Tree Analysis (FTA) is a common method used to represent system

reliability via paths to system degradation. It is a logical and structured approach which
can implement probabilities of occurrence (here is leak probability) to determine
whether sufficient barriers are implemented or if further action is required to prevent an
accident should its effect be deemed significant. Further description as to the logical
implementation of FTA can be found from the chapter presented by Vinnem16.
Further Notes for the Assessment
The analysis presented in this paper supports highlighting the importance of

wellhead status during the unmanned operational mode. Thus, it is critical to obtaining
success of any transition of a previously manned facility. A flowsheet of the procedure
is provided in figure 8. Note that this FMEA procedure is to serve as guidance and does
not take account of specific designed equipment and asset characteristics that may exist
with other case studies. Actions identified are to highlight importance of specific
components and their reliability. It cannot predict this for every current and future
wellhead system design. Firstly, a detailed graphic and explanation demonstrating LoC
pathways will be provided (as well as the probabilities used for the case study),
followed by the FMEA worksheet (table 4), ending with a section discussing the results
and actions that should be taken.
21
Figure 8 – Reformatted FMEA flowchart of BS EN 60812:200619
22
Loss of Containment Pathways in a Shut -In Well and Leak
Probabilities
This section gives graphical detail as to the potential pathways hydrocarbons

may take to be released from containment. These are labelled as to support ease of
identification in the FMEA assessment. There are two undesired top-level events; 1)
Wellhead LoC; 2) LoC into the lower pressure rated B annulus
Initial Wellbore Loss of Contain ment
In the initial stage, there are 5 identified routes for containment loss (see figure
9), and involve the hydrocarbons escaping to two areas:
1. Into production tubing leading to the wellhead
2. Into the A annulus casing
Each will be discussed:
P1 – This leak path follows the route of leaking through the packer used to seal off the A
annulus from the production casing.
P2 – This leak path occurs below the deep-set plugs but above the packer element. It
escapes through weakness in the production tubing into the A annulus.
P3 – A leak direct through the deep-set plug and into the production tubing
P4 – Following a leak through the plug, a further leak may occur through weakness in
the production tubing and into the A annulus
P5 – Following the leak through the set plug, pressurised hydrocarbons may seep
through the SCSSSV (often a flapper check valve) dependent on the sequence of valve
shutoffs- this allows hydrocarbons to accumulate and build to the wellhead
23
P5
P4
P1
P3
P2
Figure 9 – LoC Pathways (Initial Events)
Loss of Containment into the B-Annulus and Resultant Events
Following the LoC paths identified in the initial wellbore/lower well level,
hydrocarbons may leak into the lower pressure rated B-annulus. As discussed
previously, this can seriously impact well integrity resulting in high remedy cost and
potential environmental incident. This could further impact operator finances and
reputation.
Each Pathway/Event shall be discussed (see figure 10 for graphic):
P6 – Production tubing leaks into the A annulus (above the SCSSSV) following
events P3, P5 and/or P6
24
P7 – Integrity loss of the A annulus casing following events P1, P2, P4 and/or P6
will result in a loss of containment into the B-annulus, which will potentially follow
with events E1, E2, and/or E3.
E1 – This event results in the casing (B annulus) shoe blow out scenario, which
once pressure is sufficient, the formation rock will crack resulting in a loss of well
integrity (as discussed).
E1
P7
P6
Figure 10 – LoC Pathways into the B annulus
Following the arrow (red) leading the wellhead of the B annulus gives the following
LoC pathways and diagram (figure 11).
25
E2
E3
E3.1
E3.2
E3.3
Figure 11 – LoC Pathways of the B annulus at the Wellhead

Which leads the following events:
E2 – the B annulus casing seal (hanger) suffers a loss of integrity and leaks
hydrocarbon fluid to the wellbay of the asset
E3 – B annulus surface access valve suffers a leak (multiple points) and leaks
hydrocarbon fluid to the wellbay of the asset (added leak points above):
E3.1 – Leak originates from valve flange points
26
E3.2 – Leak originates from valve stem point
E3.3 – Leak originates from access point instrument connection (borehole)
Loss of Containment in the Production Tubing/Casing (A annulus) at

the Wellhead and Resultant Events
Following the identified LoC pathways identified in figure 9, figure 12 gives further
LoC pathways at the wellhead/tree through the tubing/A annulus.
E4
E5 E5.1/2/3
E6
E7
Figure 12 – LoC Pathways of the Tubing/A annulus at the Wellhead/Tree
27
E4 – A leak occurs at the wellhead flanged connection/seal with fluid from the A
annulus (via P1, P2, and/or P4)
E5 – A leak occurs at the A annulus access valve (via P1, P2, and/or P4),
following three leak points identified with access valve in event E3
E6 – Leak occurs at the tubing flanged connection/seal with fluid from the
production tubing (via events P3 and P5 or P6)
E7 – Leak occurs at the Tree with fluid from the production tubing (via events
P3 and P5 or P6)
This section has presented the various LoC pathways that well fluid may take to
cause the two credible scenarios discussed:
1. Release to the above surface environment
2. Loss of well integrity via B annulus exposure to A annulus MAASP
This is to support the FMEA assessment and thus should be used alongside the
assessment.
Leak Probabilities for Well System Components
Table 3 – Probabilities used for the Fault Tree Analysis
Failure Event LoC Probability of Failure (leak. year-1)

Pathway Minor Leak (PS) Major Leak (PL)
Identifier
Packer leak P1 0.1 1x10-3
Production tubing leak (to A annulus P2 0.1 1x10-4
below DSP)
DSP leak P3 0.01 1x10-4
below SCSSSV)
SCSSSV Leak P5 0.5 1x10-3
above SCSSSV)
Production casing leak (To B P7 0.1 1x10-4
annulus)
B annulus casing blowout E1 1 1
B annulus casing seal (hanger) E2 1x10-4 1x10-7
leak
B annulus valve leak E3 2.1x10-3 1x10-6
A annulus casing (hanger) seal E4 1x10-4 1x10-7
leak
A annulus valve leak E5 2.1x10-3 1x10-6
Tubing flanged connection/seal E6 1x10-4 1x10-7
leak
Xmas tree leak E7 1x10-3 1x10-7
28
FMEA Worksheet for Well Process System in NNA Mode
Table 4 – FMEA Procedure for Well System LoC Analysis
Item Item Failure Failure Possible Local Final Detection Compensating Severity Remarks/
Ref. Description/ Mode Mode Causality Effect Effect Method Provision Class Comments
Function Ref. Against
Failure
I-01 Sustained
Production Casing
Tubing: Corrosion, Hole develops Pressure in Well
Well fluids leak
Production flow Leak P3 Stress in pipeline A annulus intervention 4
into A annulus
pathway for well Cracking below plug (pressure maintenance
fluid gauge
reading)
Hole develops
P4 As above in pipeline As above As above As above 4
above the plug
Well fluids leak
Same as P2
P6 As above As above into A annulus As above 4
and P4
above the SCSSSV
I-02 Packer Element: Crack Sustained
Barrier to well develops in Casing Well
Stress Well fluids leak
fluid entering the Leak P1 packer Pressure in intervention 4
Cracking into A annulus
production casing allowing well the A maintenance
(A annulus) fluid leakage annulus
I-03 Deep Set
Corrosion,
Plugging
Stress
Element: Barrier Well fluid Well
Cracking Well fluid build-up
to fluid entering Leak P2 seeps past None intervention 4
(material below SCSSSV
the production plug maintenance
dependent),
tubing during shut
Seal failure
in
I-04 Valve not Well fluid Well fluid within Well
Surface Valve
Leak P5 sealed migrates into wellhead intervention 4 Same as P6 (I-01)
Controlled Sub- Position
(closed), production equipment- maintenance
29
Failure
Surface safety corrosion, tubing ending increasing leak Sensor (if
valve (SCSSSV): stress cracking at the paths/probability present)
Allows wellhead
production
cessation during
unsafe events
I-05 Production
Casing (A
Hole develops
annulus):
in casing wall
Provides a barrier B annulus
allowing well
to well fluid Corrosion, pressure Well
fluid Casing Shoe Blow Loss of well
migration to Leak P7 Stress gauge, intervention 2
migration to Out integrity
formation Cracking cratering maintenance
the surface
rock/aquifers- impact
casing (B
provides well
annulus)
integrity
protection
I-06 Seal Failure
Wellhead Hanger Weeping
(due to over
Seal: Seal buckles wellhead None-
pressure Well fluid release Minor
Maintain allowing well equipment, equipment not
Leak E2 scenario in B- to environment 3 pollution/ignition
containment and fluid release to B annulus designed for
annulus), (which may ignite) event possible
connection during wellbay pressure well pressure
corrosion,
use gauge
Stress cracking
I-07 B annulus access Threading Weeping
valve flange failure (due to LoC allows access None-
Well fluid release Minor
connection: overpressure well fluid to valve, B equipment not
Leak E3.1 to environment 3 pollution/ignition
Allow casing scenario), be released in annulus designed for
(which may ignite) event possible
maintenance Corrosion, wellbay pressure well pressure
activities stress cracking gauge
30
Failure
I-08 Weeping
Corrosion,
B annulus access LoC allows access None-
stress cracking Well fluid release Minor
valve stem: well fluid to valve, B equipment not
Leak E3.2 (due to to environment 3 pollution/ignition
Allow control of be released in annulus designed for
overpressure (which may ignite) event possible
valve position wellbay pressure well pressure
scenario)
gauge
I-09 B annulus access Weeping
Corrosion,
valve instrument LoC allows instrument None-
stress cracking Well fluid release Minor
connection: well fluid to connection, equipment not
Leak E3.3 (due to to environment 3 pollution/ignition
Allows condition be released in B annulus designed for
overpressure (which may ignite) event possible
monitoring in the wellbay pressure well pressure
scenario)
B annulus gauge
I-10 Production Weeping
Hanger Seal: LoC allows wellhead
Maintain Corrosion, well fluid to equipment, Wellhead
Leak E4 to environment 3 pollution/ignition
containment and stress cracking be released in A annulus Maintenance
connection during wellbay pressure
use gauge
I-11 A annulus access Threading Weeping
valve flange failure (due to LoC allows access
connection: overpressure well fluid to valve, A Wellhead
Allow casing scenario), be released in annulus Maintenance
maintenance Corrosion, wellbay pressure
activities stress cracking gauge
I-12 Weeping
A annulus access LoC allows access
valve stem: Corrosion, well fluid to valve, A Wellhead
Allow control of stress cracking be released in annulus Maintenance
valve position wellbay pressure
gauge
31
Failure
I-13 A annulus access Weeping
valve instrument LoC allows instrument
connection: Corrosion, well fluid to connection, Wellhead
Allows condition stress cracking be released in A annulus Maintenance
monitoring in the wellbay pressure
B annulus gauge
I-14 Tubing Hanger
Seal: LoC allows
Well fluid release Weeping Minor
Maintain Corrosion, well fluid to Wellhead
Leak E6 to environment wellhead 3 pollution/ignition
containment and stress cracking be released in Maintenance
(which may ignite) equipment event possible
connection during wellbay
use
I-15 Xmas Tree
LoC allows
Element: Well fluid release Weeping Minor
Corrosion, well fluid to Xmas tree
Provide control of Leak E7 to environment tree 3 pollution/ignition
stress cracking be released in maintenance
well fluid at the (which may ignite) equipment event possible
wellbay
surface
32
Discussion of FMEA Results and Probability of Leaks from Fault Tree
Analysis
The FMEA assessment revealed that there are two undesirable events that might
occur during the shut-in phase of the NNA mode. These include
1. Release to the above surface environment
2. Loss of well integrity via B annulus exposure to well pressure
Fault Tree Diagrams (see figure 13/14) along with the probabilistic calculations (see
table 5/6) provided on page 37 and 38 with example calculations. Each event will be
discussed in detail.
The loss of well integrity presents a dangerous scenario which could cause major well
integrity issues resulting in expensive remediation and a risk of an environmental
incident. The FTA assessment (figure 13) shows the potential for an undetected minor
leak (1.01E-03 leak. year-1) which would result in B casing shoe blowout. A minor leak
does allow for pressure monitoring on the annulus to detect the sustained casing
pressure rise and thus time to mobilise an offshore team to attend the installation. In the
event this detection does fail however (as accounted for in the above probability), it is
recommended that a relief system be in place (on the A/B annulus) in the event high
sustained casing pressure does occur- this system would involve a blowdown drum
where high pressure liquid could be gathered, and any gas can be vented to the
atmosphere. The gathered liquid could then be drained and disposed of to shore. A
major leak scenario probability is low (1.10E-07 leak. year-1), however as detailed
before the severity of its occurrence is great. This demonstrates the further need to
monitor pressure in the A/B/C annulus for sustained casing pressure, and ensure its
integrity is maintained.
A release to the environment is a potentially hazardous occurrence as found in

the hazard identification. However, within NNA mode a major leak is highly unlikely
due to the size of boreholes and connections thus has been discounted. The FTA
assessment provided in figure 14 shows that there is some probability of a minor leak
(1.46E-03 leak. year-1). In the case of a minor leak, the low release rate would allow for
human response time to fix the problem- however may result in unscheduled
maintenance. It would be advantageous to identify a detection method for a release
33
however, as typical gas detection would unlikely detect a minor leak. Oil leaks would
best be detected by real-time video surveillance. Therefore, maintaining an active
fire/gas detection system would be futile.
To conclude, the likelihood of a major leak at the surface is minimal and a

slightly higher risk within the B annulus. For avoiding a costly B annulus blowout, it
has been recommended that annulus pressure monitoring be used, in combination with a
relief system. Thus, minor leaks present the biggest probability and allow for human
response time. This makes it unlikely that a major incident will occur, however there is
the issue that any unscheduled trips offshore will raise safety issues and require
resources and man-hours.
34
Figure 13 – Sheet 1 of FTA Diagram (for B Casing Shoe Blowout Event)
35
Figure 14 – Sheet 2 of FTA Diagram (Wellbay LoC Event)
36
Fault Tree Analysis Probability Calculation Sheet
Examples are given below:

AND gate operators take the product (multiplication) of the
two inputs (here P4 and P3). Thus:
𝐵(𝑃𝑆 ) = 𝑃4(𝑃𝑆 ) ∗ 𝑃3(𝑃𝑆 ) = 0.1 ∗ 0.01 = 0.001
𝐵(𝑃𝐿 ) = 𝑃4(𝑃𝐿 ) ∗ 𝑃3(𝑃𝐿 ) = 1𝑥10−4 ∗ 1𝑥10−4 = 10−8
OR gate operators take the sum of the two inputs (here E7 & E6).
Thus:
𝐹(𝑃𝑆 ) = 𝐸4(𝑃𝑆 ) + 𝐸5(𝑃𝑆 ) = 1𝑥10−4 + 2.1𝑥10−3 = 0.0022
Calculation sheets are given for each scenario being assessed in this
functionality section below. Basic events (i.e. pathways and events identified in the LoC
procedure) are shown as alpha-numerical symbols, and products/sums are represented
by capitalised letters only (used in the Fault Tree Diagram(s) only). Leak calculation
Table 5 – B Casing Shoe Blowout Event Likelihood Calculation
Sheet 1
FTA Leak Minor Leak Major Leak
Identifier Calculation (Ps) Solution (PL) Solution
A P5*P3 0.005 1.00E-07

B P4*P3 0.001 1.00E-08
C A*P6 0.0005 1.00E-11
D C+B+P2+P1 0.2015 1.10E-03
E* - 5.00E-02 1.00E+00
F D*P7 0.02015 1.10001E-07
G E*F 1.01E-03 1.10E-07
*assume occurrence is 0.05 (1 in 50 year) event for PS and 1
for PL
demonstrates the variables being summed or multiplied to give the solutions for minor
and major leak (sheet 1 only). The final FTA identifiers (G (sheet 1) and I (sheet 2))
give the final probabilities of the occurrence of the scenario being considered.
37
Table 6 - Wellbay LoC Event Likelihood Calculation
Sheet 2
FTA Leak Minor
Identifier Calculation Leak
(Ps)
Solution
A P3*P5 0.005
B P3*P4 0.001
C P3*P5*P6 0.0005
D E7+E6 1.10E-03
E P1+P2+B+C 0.2015
F E5+E4 2.20E-03
G D*A 5.5E-06
H E*F 0.000443
I G+H+S1 1.46E-03
NB: S1 refers to the minor leak value (PS) value from sheet 1 (FTA Identifier: G).
38
6. Developing an Optimal Wellhead/Tree System Status
Having identified the hazards and assessed the functionality of the
wellhead, it is now of importance to determine the most effective way to operate and
manage the wellhead system as to mitigating and controlling the hydrocarbon hazard.
This section will seek to address challenges to safe operation.
Loss of well integrity/containment is by far the most hazardous potential

occurrence that could occur on the asset during well shut-in, as this represents a
considerable loss of inventory with a difficult recovery. Wells are generally controlled
via two permanent and independent barriers which can be of different types- shown in
table 5.
Table 7 - Typical Barriers in Wellhead Equipment23
Barrier Type Description Example
Operational A barrier that functions while the operation Drilling Mud, Stuffing
barrier is carried out. A barrier failure will be Box
observed when it occurs.
Active barrier An external action is required to activate the BOP, Christmas Tree,
(standby barriers) barrier. Barrier failures are normally SCSSSV
observed during regular testing
Passive barrier A barrier in place that functions continuously Casing, tubing, kill
without any external action fluid, well packer, deep
set plug
Conditional A barrier that is either not always in place or Stabbing valve (WR-
barrier not always capable of functioning as a SCSSSV)
barrier
Well System Pressure Monitoring
The most common method of detecting and monitoring the potential for blowout
and leaks is via pressure measurements. On a typical wellhead, pressure measurements
are made on the top of the tree (see figure 7) and within the annulus. During the
unmanned phase the following barriers will remain:
- Tree Structure- all associated valves and control functions
- SCSSSV
- Deep Set Plug
- Tubing and Casing
At this point there are a few options to operate the wellhead:
39
1. Leave valves on the tree open (upper/lower master production valves)/SCSSSV
and take measurement from the top of the tree
2. Close valves on the tree and SCSSSV, only opening the valves to take
intermittent measurements
3. Keep all valves closed on the tree and punch the production tubing (wireline
plug must be set below punch) and monitor pressure via annulus pressure
sensors
4. Use of permanent downhole measurement systems- allowing the closing of tree
valves and SCSSSV
Method 1 relies upon taking pressure measurements from the top of the tree
(refer to figure 7) to provide pressure monitoring. This leaves only the production wing
valve closed and hence preventing any well fluid flow. With regards to functional safety,
allowing well fluid into the wellhead and tree structure allows for more leak paths and
hence a lower overall reliability of the system. This is down to valves/seals/flange
fittings being susceptible to leaks, as well as any small boreholes for instrumentation
(such as the pressure gauge). Furthermore, downhole barriers such as the SCSSSV, and
tree valves will no longer prevent fluid flow. This presents a major problem since the
main goal is to prevent any releases over a long period of time in which corrosion and
component degradation could occur over more components simultaneously.
Method 2 requires the closing of the valves in the well system. In this setup, no
pressure reading on the tree will be possible. To monitor the pressure, intermittent
measurements would be necessary- which would require some form of intervention by
personnel. This unknown is potentially risky to the intervention team taking such
measurements- as it will expose them directly to the hydrocarbon hazard(s). Further,
any system abnormalities will be undetectable which could allow failures to occur with
no remediation until the next offshore trip by the intervention team.
Method 3 utilises the pressure monitoring present on the first annulus as a way
of monitoring well conditions downhole. This allows the prevention of hydrocarbon
inventory within the tree should the SCSSSV and deep-set plug leak, but still allows the
well to be continuously monitored. The B annulus however, is not rated for well
pressure and won’t be able to tolerate the MAASP. Removing the tubing barrier
40
therefore decreases system reliability. For this approach to be used, reliability must be
high enough to prevent inadvertent hydrocarbon leak into the B annulus (through the A
annulus) and risk well integrity loss- which is a highly undesirable outcome as
discussed in the hazard identification section.
Finally, method 4 utilises recent advances in permanent downhole gauges to

allow closing of well valves and maintain tubing/casing integrity whilst monitoring well
conditions. Recent advances are covered in comparative study done by Enyekwe24, and
its benefits are recognised in an industrial paper by Horng25. With many of these papers
there is an explicit focus on improving productivity during field life and not with this
paper’s focus on EOFL operating strategies. Thus, the financial justification for
investing and installing this technology needs to be considered.
Due to the generality of this report, it is not possible to recommend which

method is best to prevent LoC and monitor pressure in all cases- factors such as
integrity of components, and age/chemical impact on functionality must be considered.
With regards to this case study however, reducing leak paths- that were identified in the
FMEA procedure- would suggest method 4 is by far the preferred option as it allows
pressure monitoring without any significant changes/impairment of LoC barriers. Its
drawback lies however, with a costly instalment of new downhole tools. The most
simplistic strategy would be method 3, as it impairs 1 barrier (at 1 location) and allows
pressure monitoring. Thus, from a practicable cost stand point, method 3 would be the
preferred option in this case study.
Safety Management System for NNA Mode
Within NNA mode, occupational safety is not as large a concern due to the
unmanned operating status. Process Safety and Safety Engineering is however vital to
the success of such a project. The Energy Institute defines Process Safety as:
“a blend of engineering and management skills focused on

preventing catastrophic accidents and near misses, particularly
structural collapse, explosions, fires and toxic releases associated
with loss of containment of energy or dangerous substances such as
chemicals and petroleum products.”
41
Major accidents must be accounted for to achieve an effective Safety Management
System (SMS)- previous accident investigations (such as Macondo, BP Texas City etc.)
have shown that industry continue to rely on personal safety indicators as a measure of
SMS effectiveness. Previously in this paper, the major hazards have been identified (via
PHA) and assessed (via an FMEA-to give description and effect- and an FTA -to give a
probabilistic assessment of the risk). Having now developed an understanding of these
hazards and the impact they could have if realised, this sub-section will look at the
requirements of a SMS and how this might relate to the NNA mode in achieving an
optimal wellhead safety system.
For NNA status; a surface leak in the wellbay; and a casing shoe blowout on the
B annulus; are the most damaging scenarios. Barriers to major events typically include:
- People (not applicable during unmanned phase)
- Plant
- Processes
Plant and processes will present the barriers to any major accidents on a NNA platform.
Plant barriers will be reduced in comparison to a manned platform due to the reduced
MAH/MEI profile. It allows the simplification of the system and reduced maintenance-
which minimises risk exposure to intervention teams. The plant should still provide
barriers such as:
Proactive:
- Hydrocarbon Containment
- Structural Integrity
- Ignition Prevention
- Plant Integrity
And reactive (mainly for intervention):
- Life boats/rafts
- Fire and Gas Detection
- Fire Fighting Measures
- Relief Systems
Processes are also critical for this mode. Key parts to processes are:
- Management of Change:
42
Should any changes be made to operation these must be assessed for impacts
to safety and environmental protection
- Hazard & Consequence Analysis:
Previously explored in this paper however any major changes should follow
with an update in this analysis
- Safety Critical Maintenance
- Intervention Support Processes:
Such as Process Safety Culture, Safe System of Work, Procedures, and
Escape and Evacuation
A good SMS is not only needed to improve the work activities of offshore
operators but are also a requirement by law- see Regulatory background section. Above
presents the key needs of a SMS for the unmanned NNA mode. During intervention and
maintenance activities, further barriers in the people section are required- including
competence, procedural training, and emergency response.
Safety Critical Elements for NNA Mode Intervention
Safety & Environmental Critical Element (SECE) is a key part of achieving

ALARP risk level in offshore operations. During the unmanned phase these are likely to
be minimised as to lowering power demand, complexity and maintenance requirements.
During well intervention however appropriate SECE’s are needed and include:
- Fire/Gas Detection:
For unmanned phase it may be unnecessary and impractical to retain, thus
only during intervention ops will portable gas (hydrocarbon & H2S)/fire
detection
- Temporary (back-up) Power Supply:
During intervention activities, power demand will be considerably higher
and will likely require heavy duty/voltage power generators. It may also be
required to power other SECE and life support functions (accommodation
etc.)
- Emergency Lighting (not NAVAIDS):
Lighting on the asset will not be required in NNA mode, however any
intervention with overnight works will require this
43
- Communications
Reduced to any remaining DCS transmitting relevant data to shore during
NNA. Intervention will require portable radios and satellite links (note any
ATEX requirements)
- Temporary/Portable Equipment:
None needed in NNA mode, any facilities such as portable fire-fighting and
well intervention support equipment can be brought out with intervention
team
- Muster Areas:
Operation and Management Philosophy amended to reflect new NNA mode
- Helideck:
The helideck is likely to be retained for at least medical evacuations in the
event of a serious injury, and in response to an emergency evacuation. Must
comply with CAP437 regulations (discussed later)
- Life Rafts:
As noted in the reference by Alyafei26 there may be associated risk with
support vessel gangways/access routes and thus in an emergency it may be
required that life rafts are available for maximum expected personnel
- Designated Escape Routes:
Suitable access routes to muster areas required- guidance given by HSE
Inspection of Evacuation Escape and Rescue (EER) Operational Guidance
Document
- Personal Protective Equipment:
Lifesaving equipment for emergency scenarios
- Structures:
Maintain structural integrity of the facility
The SECE’s mentioned above are particularly required for any well intervention
teams working on the NNA facility. An excellent chapter (chapter 10) in the book by
Chakrabarti27 describes the layout of topsides and required safety systems for
background information. These SECE’s would need to be mothballed (if fixed) or
brought as portable equipment with the intervention team.
44
7. Transitioning toward a ‘Lighthouse’ Mode of Operation
The ability to operate offshore facilities remotely with minimal
intervention is a key goal within the industry- as it takes the workforce out of harm’s
way when working in the hydrocarbon producing environment. Whilst operating
production and drilling facilities have not necessarily achieved this fully, shut-down
assets (permanent) have the potential to be run in this way if managed correctly.
Lighthouse here refers to running the asset with basic functions still active such as the
navigation lighting- needed for all large vessels/structures offshore- which can remove
the need for a permanent base of personnel. This section will look to explore how this
can be achieved and further enhanced, having the knowledge of how the wellhead
equipment can be designed to allow this advantageous operating mode- whilst ensuring
the safety/integrity of the asset. Note this section will not use the case study to
determine the suitability of the concepts discussed- rather the concepts are areas that
should be explored to support the NNA mode.
Supporting the Unmanned Concept – Intervention Support and

Transport Arrangements
To maintain well integrity, the operator will be required to frequent well

intervention and maintenance operations. Evaluation of these operations in a facility
with a usually unmanned status presents a major challenge as to protecting personnel
during these visits26. The following areas will be addressed:
- Support Vessel Options and Weather Impact
- Transport (to asset)
Support vessels are typically needed when intervention and maintenance

operations are due on an unmanned facility. Regarding unmanned operation within the
scope of this work, the asset would typically have had life support facilities prior to the
EOFL which brings about a key decision for the operator- whether to mothball these
functions in the desired operational mode or decommission them entirely. If life support
functions have been decommissioned, then the support vessel will require more
facilities as to accommodate the offshore team selected and provide any safety related
systems- which may lead to higher costs to hire out such vessels. There are three
common types of vessel26:
45
1. Anchor Handler Tug (referred to as AHT)
2. DPII (Dynamic Position) Vessel
3. Jack-Up Barge/Lift Boats
Consult the reference for further merits/demerits of each (hiring/running costs increase
from 1-3)26. If the asset of interest has retained minimal life support functions and/or
weather conditions are (likely) poor, it is more likely that option three would be chosen
albeit at higher OPEX for the duration of the intervention. The advantage of minimal
retention is a smaller maintained equipment list which would in turn reduce time
offshore.
For many offshore operations, helicopter transport is the most common way due
to its convenience. However, it does entail a flying risk and due to the low number of
personnel tours to the asset it may be harder to justify as team visits will also require a
lot of intervention gear and safety equipment- which may not all fit in a single
helicopter. Thus, the use of support vessels is likely more convenient under these
circumstances. However, the helideck on the asset will need retained due to its
emergency functions (medical & general evacuations)- thus CAP43728 regulations must
be complied with. CAP437 sets out guidance to operators for the criteria assessed by the
Civil Aviation Authority (CAA) body in standards for offshore helicopter landing areas
for UK registered rotorcraft. In recent Safety Case Regulations (2015), there is the
requirement that offshore landing areas (and associated systems) be treated as a SECE
and thus be subject to verification and be maintained to be in good condition throughout
service life. Thus, for the NNA mode this will need to be covered in any offshore tours.
Further, requirements in other regulations including; The Offshore Installations
(Prevention of Fire and Explosion, and Emergency Response) Regulations 1995
(PFEER); The Offshore Installations and Pipeline Works (Management and
Administration) Regulations 1995 (MAR); and The Offshore Installations and Wells
(Design and Construction, etc.) Regulations 1996 must also be complied with and are
further detailed regarding helicopter operations in the CAP 437 document.
Due to the infrequent visits; support facilities on board support vessels; and
eliminating flying risk to personnel; it is of preference to use support vessel entry for
any offshore tours a maintenance crew need to undertake on the asset. As discussed
46
however, in the event of an emergency, helicopter support and access options are best
retained.
Supporting the Unmanned Concept – Remote Operational Control
In process safety, safety critical systems are hardwired by standard and it is seen
as unacceptable to consider alternative options29. The problems related to using the
wireless concept for such systems are; reliability of the technology- network availability
and transmission interference (structures, bodies, other wireless networks etc.); Security
(cyber) - preventing data altering during transmission leading to unwanted implications
(hacking); Adaptability- limitation of radio waves by hazard zones (area classification)
obstacles and distance; Integration- difficulty in setting up wireless tech. to cover entire
processes (associated sensors, controls etc.). These challenges – particularly reliability
and security – have been detrimental to systems being moved to the wireless platform
over hardwiring.
Regarding the topic of this paper, using such a facility with wireless technology
may not cause too much issue. The fact the only area that monitoring is needed is within
the wellbay, the rolling out of this technology and its integration may not be difficult or
expensive. Further, wireless applications can; be rated to transmit in hazardous zones
(flammable & explosive environments); warn of low power supply; use in-field
diagnostics to overcome issues; remove wire degradation problems; provide an easy
removal of sensors compared to wired sensors; reduces time offshore teams need to
spend on the asset- improving safety and reducing labour cost; reduction in installation,
testing and commissioning time.
Using remote operational control can enable operators to create for better
proactive maintenance and reduce reactive- which regarding the goal of this paper,
allows the asset to be unmanned for longer, not risk adverse environmental impact and
reduce risk an offshore response team must be put in harm’s way (should a LoC occur).
This is implemented via a software diagnostics system which can use data transmitted to
shore- as part of a remote system – and provide recommendations allowing engineers to
schedule maintenance more effectively. Further, monitoring via closed circuit cameras
(CCTV) will give an eyes-on benefit- to allow real-time visual aids on the asset. The
diagnostic system approach has been demonstrated in operational plants30 to great
47
OPEX benefit, but a more simplified system coupled with CCTV, could be implemented
to monitor well system health for the duration of the NNA operational phase, as well as
monitor for unauthorised intruders on the asset.
The papers referenced29,30 here specifically looks at the application of wireless

technology in NNA platforms, as well as using the internet of things concept in large
plants/operations. Thus, the concept can be made applicable to this paper with the
benefit of not having to actuate valves nearly as often as an active producing
wellhead/facility might do. For the mode of operation, this solution would be
(potentially) cost effective, be applicable to the brown field site, and most importantly
allow minimal exposure of offshore teams to risk, which could improve safety
markedly31.
Supporting the Unmanned Concept - Robotics
An unmanned facility is a futuristic concept for general application and

achieving this requires cutting edge technology and sound safety and operational
management. One key concept is the use of robotics. Robotics provides the opportunity
for the most dangerous and repetitive tasks to be done without putting operators in the
way of major hazards and remove the need to manage human factors. Robotics covers
many fields of application such as; drones; and remotely Operated Vehicles (ROV). The
application of these robots can be extensive, but in this paper its benefits could include:
- Inspection of difficult to reach/hazardous areas on the platform
- Inspection of the platform without the need for offshore team mobilisation
These concepts will be discussed below.
The unmanned drone/vehicle inspection of assets is not a futuristic concept and

has been applied in offshore applications32, with a North Sea example using inspection
in combination with maintenance served by robotic arms on the Mesa Verde unmanned
platform (Norwegian North Sea Sector)33. Inspection of hazardous zones by unmanned
aerial vehicles (UAV) was successfully carried out by Thailand’s PTT Exploration and
Production34 where the case study covered the hazardous inspection of an onshore flare
stack. The author described multiple benefits of the system, estimating around USD
60,000 saving (excluding savings from increased plant uptime) as well as eliminating
48
the need for personnel to inspect the system for faults and degradation, which is
inherently safer- removing persons from the hazard completely. To add to the usefulness
of the remote inspection ability of unmanned vehicles, various sensors can be installed
detecting fire, gas and sound anomalies, giving the same abilities of their human
counterparts33, but much more sensitive/accurate- which can be used to detect problems
in their infancy. This is potentially useful as it was noted in the optimal wellhead/tree
status section that the detection was challenging for LoC in the wellbay and by
implementing this technology could provide for detection and resulting action.
Regarding the unmanned concept, the following benefits could be realised:
- Reduction in offshore tour time via regular unmanned inspections allowing
asset status to be known prior to team arrival. Improves safety (less time
exposed to offshore hazards) and reduces OPEX
- Better Permit to Work system and administration compliance (with
regulations) due to the full planning ability prior to team arrival and smaller
likelihood of unexpected maintenance
- Improved Safety Management System due to complete assessment of
hazards in real-time, with risk management appropriately drawn up
- Allows engineers to schedule maintenance proactively and increases
likelihood of realising any leaks or accelerated degradation of safety critical
components.
It is true that to make use of these robotics will require an investment to reap the
benefits, and this may require some cost benefit analysis to justify. However, with
improving technology in the field any upfront cost will continue to fall which should
motivate operators to make this investment as to minimise OPEX and show the
regulator that the company is committed to show continuous improvement (as required
in regulations) in its safety management.
Supporting the Unmanned Concept - Offshore Power Generation
Power generation is important for a wide range of activities and processes done
in the offshore environment. High voltage power outputs are required for power hungry
processes such as drilling and production & export, however for the unmanned asset
with no treatment facilities, the power requirement is considerably lower. This presents
an opportunity to remove large diesel generators and gas turbines (commonly used) and
49
employ safer, low voltage options which in turn reduces hazards and maintenance of
such equipment. A recent case study by Shell Malaysia was presented for an unmanned
wellhead in Malaysian waters35. In this development, a satellite wellhead (dry) was
setup to produce oil and export it towards a host facility. This is a slightly different case
compared to what this paper is exploring, however both cases only require low power
for control and monitoring systems for the wellhead which makes this a useful real-life
case study. Several options are available to power such facilities:
- Microturbines
- Diesel Generators
- Fuel Cells
- Solar Voltaic Generation
- Wave and Wind Power
Options such as microturbines36, diesel, and fuel cell37 all require a fuel source utilising
chemical energy to generate the electrical power required by the asset. This represents a
considerable disadvantage for reasons such as; fuel storage and hazard management;
fuel supply can be costly (if not readily available, must be transported to the asset); and
rotating equipment is prone to breakdown (hence more maintenance). Microturbines
further lose efficiency in comparison to their commercial and industrial scale counter-
parts.
Renewable options such as solar, wind and wave generated power have the
advantage of sourcing power from the environment and in some cases require less man-
hours for maintenance- with less exposure of personnel to hazards presented by the
asset. The major drawback however, is where sources of energy from the environment
are insufficient (no wind/sunshine and calm seas). To use renewable sources, a charger
must be used to regulate power flow and ensure that control systems are continuously
powered- which represents an extra cost in investment. This is known as an
uninterruptable power source (UPS). These renewable options will be summed up.
There is a large tidal/wave energy potential in the UK, seeing up to 11,400MW

(Mega Watts)38. In the paper referenced, the target is to power active production
facilities – as part of a hybrid system. However, for this paper the extent of the power
requirement would be much less thus, the investment would not be as large- being a
power source for an unmanned asset with minimal power requirements, it would be
50
easier to implement. It does however present challenges with regards to requiring
marine surface area (collision and mooring/positional) and due to the relative infancy38
in this application, this technology may require further demonstration.
Wind Energy is another potential option in providing asset power needs. With
the implementation of the carbon tax in the European Union, operators have explored
methods of reducing emissions39- one key project being the Beatrice Field utilising two
wind turbines for asset power (for a producing facility). A case study provided by Shell
(Southern North Sea) has demonstrated the feasibility of this option with an unmanned
asset. Moreover, the diversification of the renewable energy source was also
implemented using both wind and solar40 power to enable the facility functionality. This
is a useful concept for assets in high latitudes and/or areas with considerable weather
impact, which limits solar energy. However, as noted earlier one clear disadvantage of
turbines is the moving parts which in comparison to static (relative) panels for solar
requires more maintenance work.
Returning to the Shell Malaysia case study, a decision was made to install solar voltaic
cells on the asset during unmanned phases and rely upon diesel generators during
intervention/maintenance operations. On this asset it was challenging due to the
minimal structure requirement (hence area) which lead the operator to actively
minimising power consuming systems. However, this concept would be potentially
more applicable to a larger, originally manned facility as the area available would be
much greater. Taking account of the discussion given, power requirements supplied via
solar energy harvesting is by far the preferred option- on account of its simple
installation, low maintenance and ability to perform the required function considered in
the scope of this paper. Power requirements must be assessed (and minimised) when
moving into the unmanned phase35 and the system assessed for reliability to ensure
power can be continually supplied under all feasible circumstances. However, it could
be worth diversifying power supply (such as the Shell case study40) to increase power
supply reliability.
51
8. Recommendations for achieving Optimal Operation for Facilities
at End of Field Life
At this stage, this paper has presented a novel case study and demonstrated how
an operator may look to transition a manned EOFL offshore facility to a Not Normally
Attended (NNA) facility by:
- Identifying and assessing hazards (via a Preliminary Hazard Assessment)
present on the reduced operation facility (due to oil flushing within the
reservoir)
- Identifying and assessing Loss of Containment (LoC) pathways and their;
local effect; system effect; effect severity; likely causality; and probability of
minor/major leaks
- Using the above to give reason and options to develop an optimal well
system status by monitoring tubing/casing pressure, describing the key
requirements of a Safety Management System (SMS) during NNA mode,
and providing a Safety and Environmental Critical Elements (SECE’s) list to
maintain well system safety during intervention/maintenance operations
- Providing concepts and technologies that can support the success of the
NNA mode project by implementing; remote operation; robotics; and low
voltage power supply during the NNA mode.
For operators considering this transition to NNA mode, the following is recommended
to be implemented:
- Pressure monitoring on the A/B/C annulus to allow detection of well system
degradation, as well as monitoring the production tubing head pressure
during intervention work
- Provide a relief/blowdown system to vent excess pressure to a blowdown
drum and vent system
- Review the safety management system to include new process barriers and
manage existing plant barriers that are retained
- Provide appropriate SECE’s (whether mothballed or portable) for
intervention and maintenance activities
- Explore technologies and operational concepts that could support an optimal
NNA mode of operation:
52
o Use boat access (support vessels) as primary transportation for
offshore teams, only maintaining helicopter access for emergency
events
o Implementation of remote operating systems such as wireless (4G)
monitoring, maintenance data gathering, and the internet of things to
improve maintenance efficacy and efficiency
o Using robotics as a means of inspecting assets and detecting faults, to
minimise offshore deployment to when necessary
o Providing a low voltage, minimal maintenance power supply such as
wind and solar power to provide navigation lighting and data
transmission (for pressure monitoring and any remote
operation/robotics data)
These recommendations should provide operators with a model in which to

develop a transitional plan to bring EOFL manned facilities towards the NNA mode- to
reduce OPEX, increase safety (process and inherent) and support project sustainability
& regulatory compliance.
53
9. Recommendations for Future Work
This paper has investigated EOFL process risk management and detailed; the
hazards and their effect and likelihood; ways to achieve optimal well status;
technologies which can support the transition to a minimum NNA facility;
recommendations as to how operators may look to achieve the desired NNA mode for
facilities. Whilst this work has covered many key topics in optimal process risk
management, further work could:
- Investigate gas/oil release scenarios and model dispersion to determine if
explosions/fires are credible under any circumstances, to better understand
the effect of LoC and recommend any further measures (if not already
covered in this paper)
- Investigate optimal relief systems so that any sustained casing pressure
events are managed with minimal negative impact to the facility
- Investigate process risk management on several differing case studies of
EOFL assets to widen applicability to more facilities
Further, the operating strategy used here could benefit from research looking into:
- The economics of the cost benefit of technologies which could support the
NNA phase whilst maintain a practicable cost
- Detection methods for LoC events that are effective, require minimal power
and have a practicable cost
If the above are further investigated, and ways are found to make the NNA mode
work, then confidence could be built within the industry and further reduce the costs
associated with EOFL life and the decommissioning phase.
54
10.References
1 S. Chandrasekaran, Health, Safety, and Environmental Management in Offshore and

Petroleum Engineering, John Wiley & Sons, Incorporated, New York, 2016.
2 Rice Owen Staff, P. Owen and T. Rice, Decommissioning the Brent Spar, Chapman
and Hall/CRC, London, 2003.
3 Oil and Gas Law: Current Practice & Emerging Trends, Edinburgh University Press,
2010.
4 United Nations (UN) Divison of Ocean Affairs and Law of the Sea, United Nations
Convention on the Law of the Sea, Montego Bay, Jamaica, 1982.
5 Offshore Decommissioning Unit, Guidance notes : Decommissioning of Offshore Oil

and Gas Installations and Pipelines, Offshore Decommissioning Unit, Department of
energy and Climate Change; Great Britain. Department of Energy and Climate Change.
Offshore Decommissioning Unit, 2018.
6 North Sea decommissioning will cost taxpayers billions – here’s a better idea, The
Conversation, https://theconversation.com/north-sea-decommissioning-will-cost-
taxpayers-billions-heres-a-better-idea-69509, (accessed 03/08 2018).
7 I asked UK government why it’s spending £25 billion dismantling oil platforms –
here’s the reply, The Conversation, https://theconversation.com/i-asked-uk-government-
why-its-spending-25-billion-dismantling-oil-platforms-heres-the-reply-94786, (accessed
03/08 2018).
8 P. C. Desai, S. Hekelaar and L. Abshire, Offshore Well Plugging and Abandonment:

Challenges and Technical Solutions, Offshore Technology Conference, Houston, Texas,
USA, 2013.
9 M. D. Day and A. Gusmitta, in Environmental Technology in the Oil Industry, ed. S.

Orszulik, Springer International Publishing, Cham, 2016, p. 257-283.
10 D. G. Gorman and J. Neilson, Decommissioning Offshore Structures, Springer, 1998.
11 Oil & Gas UK, DECOMMISSIONING INSIGHT 2017 - found

at https://oilandgasuk.co.uk/wp-content/uploads/2017/11/Decommissioning-Report-
2017-27-Nov-final.pdf (Accessed 11/06/18), Oil & Gas UK, 2017.
12 Y. Bai and Q. Bai, Chapter 2 - Subsea Field Development, Gulf Professional

Publishing, Boston, 2010.
13 B. Gordon and R. Duncanson, Managing Uncertainty to Deliver Sustainable

Unmanned Operations, Society of Petroleum Engineers, Aberdeen, Scotland, UK, 2015.
14 Marine Board, Board on Environmental Studies and Toxicology, National Academy

of Engineering and National Research Council, Macondo Well Deepwater Horizon
55
Blowout : Lessons for Improving Offshore Drilling Safety, National Academies Press,
Washington, D.C., 2012.
15 Health and Safety Executive, The Offshore Installations (Offshore Safety

Directive)(Safety Case etc) Regulations 2015. Guidance on Regulations, Health and
Safety Executive, 2015.
16 J. Vinnem, Offshore Risk Assessment: Principles, Modelling and Applications of

QRA Studies, Springer London, London, 2007.
17 Y. Bai and Q. Bai, Chapter 22 - Subsea Wellheads and Trees, Gulf Professional
Publishing, Boston, 2010.
18 N. N. Samie, in Practical Engineering Management of Offshore Oil and Gas

Platforms, ed. N. N. Samie, Gulf Professional Publishing, Boston, 2016, p. 213-346.
19 British Standards Institution, BS EN 60812:2006 Analysis techniques for system

reliability. Procedure for failure mode and effects analysis (FMEA), British Standards
Institution, 2006.
20 T. Stålhane, in Ontology Modeling in Physical Asset Integrity Management, ed. V.

Ebrahimipour and S. Yacout, Springer International Publishing, Cham, 2015, p. 45-85.
21 S. Mannan, Lees' Loss Prevention in the Process Industries : Hazard Identification,

Assessment and Control, Elsevier Science & Technology, Oxford, 2012.
22 US Department of Defence, MIL-STD-1629A, US Department of Defence,

Washington DC, USA, 1977.
23 P. Holand, Chapter Three - Blowout Barriers and Analyses, Gulf Professional

Publishing, Burlington, 1997.
24 A. E. Enyekwe and J. A. Ajienka, Comparative Analysis of Permanent Downhole

Gauges and their Applications, Society of Petroleum Engineers, Lagos, Nigeria, 2014.
25 C. J. Horng, N. S. Nordin, M. A. Nuriyadi, N. Samsudin, A. Kasim, C. W. Hoe and

R. A. Rahman, Permanent Downhole Gauge: A Need or A Luxury?, Society of
Petroleum Engineers, Jakarta, Indonesia, 2009.
26 O. Alyafei, Well Services Operations in Offshore Unmanned Platform; Challenges

and Solutions, International Petroleum Technology Conference, Doha, Qatar, 2014.
27 S. Chakrabarti, Handbook of Offshore Engineering, Elsevier Science & Technology,

St. Louis, 2005.
28 Civil Aviation Authority Safety Regulation Group, Standards for offshore helicopter
landing areas (CAP 437), CAA, 2016.
56
29 R. K. Mahadevan, Capex and Opex Benefits of Wireless Instrumentation in Not-
Normally Manned Wellheads, Offshore Technology Conference, Kuala Lumpur,
Malaysia, 2018.
30 P. Zornio, The Control Room is Anywhere and Everywhere: Putting the Industrial
Internet of Things to Work Offshore and Beyond, Offshore Technology Conference,
Houston, Texas, USA, 2018.
31 R. Cramer, H. Hofsteenge, F. I. Akpoghiran, T. A. Moroney and A. Murthy, Remote

Operations-A Remote Possibility, or the Way We Do Things, Society of Petroleum
Engineers, Aberdeen, UK, 2011.
32 H. D. Nayar, Field Applications for Advanced Robotics, Offshore Technology

Conference, Houston, Texas, USA, 2015.
33 E. Kyrkjebø, P. Liljebäck and A. A. Transeth, in , ed. nonymous , 2009.
34 L. Kridsada, L. Chatchai, C. Manop and S. Thana, Sustainability Through the Use of

Unmanned Aerial Vehicle for Aerial Plant Inspection, Offshore Technology
Conference, Kuala Lumpur, Malaysia, 2016.
35 J. S. A. Jalil, L. B. Hwa, N. Chan and A. Jeran, Automation Solutions for a Minimal

Facility Offshore Wellhead Platform – Low Cost Low Power Concept, Offshore
Technology Conference, Kuala Lumpur, Malaysia, 2018.
36 P. Breeze, in Gas-Turbine Power Generation, ed. P. Breeze, Academic Press, 2016,

p. 77-82.
37 C. G. Frederiksen and M. Andersen, The Use of Fuel Cells for Power Generation at
Off-Shore Normally Unmanned Installations, Offshore Technology Conference,
Houston, Texas, USA, 2016.
38 S. P. Singh, T. Singh and V. Kunal, Alternative Energy Generation for Offshore Rig
Power Requirements, Offshore Technology Conference, Kuala Lumpur, Malaysia,
2018.
39 A. R. Aardal, J. I. Marvik, H. Svendsen and J. O. G. Tande, Study of Offshore Wind

as Power Supply to Oil and Gas Platforms, Offshore Technology Conference, Houston,
Texas, USA, 2012.
40 K. Mundheim, Monotower Platform With Renewable Power, Offshore

Mediterranean Conference, Ravenna, Italy, 2007.
41 O. Paramor, K. A. Allen, M. Aanesen, C. Armstrong, T. Hegland, W. Le Quesne, G.

Piet, J. RaakjÃ¦r, S. Rogers, R. Hal, L. Van Hoof, H. M. J. van Oversee and C. Frid,
North Sea Atlas, 2009.
42 L. E. Mendez, M. P. Coronado and D. J. Holder, Field Use of Thru-Tubing Electric

Wireline Set Bridge Plug System, Offshore Technology Conference, Houston, Texas,
1990.
57
11.Appendix A – Spider Diagrams of Operational Mode Base Requirement
58
59

Process Safety Sample Dissertation

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Process Safety Sample Dissertation

Uploaded by

Copyright:

Available Formats

Process Risk Management of Offshore Oil Production Facilities at Near End

Smith, Brendan M, BEng (Hons) in Chemical Engineering, AMIChemE

A dissertation submitted in partial fulfilment of the requirements of the award of Master

Keywords: Decommissioning, End of Field Life, Not Normally Attended,

2. Review of Near-End of Life Operating Strategies ..................................... 6

3. Regulatory Background on the UK Continental Shelf ............................... 8

4. Hazard Identification and Assessment Related to Shut in Wells .............. 10

5. Functionality and Reliability Analysis of a Typical Plugged Wellhead ... 18

6. Developing an Optimal Wellhead/Tree System Status ............................. 39

7. Transitioning toward a ‘Lighthouse’ Mode of Operation ......................... 45

8. Recommendations for achieving Optimal Operation for Facilities at End

9. Recommendations for Future Work.......................................................... 54

10. References ................................................................................................ 55

11. Appendix A – Spider Diagrams of Operational Mode Base Requirement 58

“Any installations or structures which are abandoned or

This is enforced by the Petroleum Act 19985. Removal is expected to occur

Decommissioning is a great technical challenge8 with the well Plugging &

Figure 1 – Basic Cement Plug and Performance Requirements8

Figure 2 – Example of a Temporary Well

Further to the Oil & Gas UK Decommissioning Insight Report, 46% of

Figure 3 – North Sea Water Depth Chart41

The challenge of decommissioning with its long timeline of

- Review and discuss possible operating strategies regarding EOFL facilities

Manned Platform Retention

Not Normally Attended (NNA) Transition

“…the duty on the employer to ensure, so far as reasonably

Offshore Facility Case Study Description

As mentioned in the operating strategy review, a real-life case study was

Hazard Identification for Shut-In Wells

Loss of Containment (LoC) presents a potential hazard to facilities in NNA

Figure 4 - Natural Reservoir Gravity Separation Process

Figure 5 – Typical Shut-In Well Schematic (Annulus

Figure 6 – Unstable Displacement of Oil and

Preliminary Hazard Analysis Method

The PHA assessment is commonly used in front end engineering design

Hazard Location Hazard Assessment Severity (MAH/MEI) Remarks/Further Actions

Results and Discussion

Wellheads are required to have the following functions for satisfactory

FMEA Procedure for Analysis of a Shut-in & Plugged (Temporary) Wellhead

The purpose of this FMEA is to:

- Provide methods of detecting the failure or stating it is an unrevealed failure

FTA Method for Probabilistic Analysis

Fault Tree Analysis (FTA) is a common method used to represent system

Further Notes for the Assessment

The analysis presented in this paper supports highlighting the importance of

This section gives graphical detail as to the potential pathways hydrocarbons

Initial Wellbore Loss of Contain ment

Figure 9 – LoC Pathways (Initial Events)

Loss of Containment into the B-Annulus and Resultant Events

Figure 10 – LoC Pathways into the B annulus

Figure 11 – LoC Pathways of the B annulus at the Wellhead

Loss of Containment in the Production Tubing/Casing (A annulus) at

Figure 12 – LoC Pathways of the Tubing/A annulus at the Wellhead/Tree

Table 3 – Probabilities used for the Fault Tree Analysis

Failure Event LoC Probability of Failure (leak. year-1)

Table 4 – FMEA Procedure for Well System LoC Analysis

A release to the environment is a potentially hazardous occurrence as found in

To conclude, the likelihood of a major leak at the surface is minimal and a

Examples are given below:

A P5*P3 0.005 1.00E-07

Loss of well integrity/containment is by far the most hazardous potential

Well System Pressure Monitoring

Finally, method 4 utilises recent advances in permanent downhole gauges to

Due to the generality of this report, it is not possible to recommend which