WELL BARRIERS

WELL BARRIERS
Aim:
• To fully understand Well Barrier philosophy in Drilling,
Coring & Tripping operations.
Objectives:
• State the Primary Barrier in normal Drilling operations.
• Identify Secondary Barrier elements.
• Describe a Barrier envelope.
• List what Barrier test documentation should contain.
 Well Barriers
Primary well barrier:
• This is the first object that prevents flow
from a source.

Secondary well barrier:

• This is the second object that prevents
flow from a source.
 What are Well Barriers
• Well barriers are envelopes (something that
surrounds or encloses something else) of one or
more dependent WBE’s (well barrier elements)
to prevent fluids or gases from flowing
unintentionally from a formation, into another
formation or back to surface.
• Well barrier(s) shall be defined prior to
commencement of an activity or operation by
description of the required WBE’s to be in place
and the specific acceptance criteria.
 Well Barrier Element Examples
1. Fluid Barriers
2. Casing and Cement
3. Drill string
4. Drilling, Wireline, Coil Tubing, Workover BOP’s
5. Wellhead
6. Deep set tubing plug
7. Production Packer
8. Stab-in Safety Valves
9. Completion String
10. Tubing Hanger

* Barrier elements in red denote other operations in a well

 Well Barriers Drilling, Coring, Tripping

Primary well barrier: AP

This is the first object that SSR

prevents flow from a source.
UPR
MPR
Drilling
LPR BOP

Drilling Fluid Formation Pressure

(Fluid) Barrier:
The hydrostatic head of the wellbore fluid is greater than the formation pressure.
 Well Barriers Drilling, Coring, Tripping

Primary well barrier:

This is the first object that
prevents flow from a source.

Secondary well barrier:

This is the second object that
prevents flow from a source.
SOME OF THE (ELEMENTS) THAT FORM THE BARRIER ENVELOPE

BOP

Tubulars
Rams

Wellhead
Casing
Formation Pressure

Cement Safety Valves

Choke/Kill line valves

SOME OF THE (ELEMENTS) THAT FORM THE BARRIER ENVELOPE

Safety Valves Wellhead

Rams
BOP Cement
Tubulars

Casing
Choke/Kill line valves
 Barrier Components and Associated Equipment

• A barrier may need several components to be considered a barrier.

• A BOP has multiple components and associated equipment such as control

systems, hydraulic power supply etc.

• A BOP is therefore considered a single barrier.

• A single point failure (of the wellhead/BOP connection) will negate the
barrier.

• Associated equipment such as control systems, hydraulic power supply

needed to activate the barrier should be considered ‘safety critical elements’
as much as the BOP.
 Well Barrier Acceptance Criteria.

• Well barrier acceptance criteria are

technical and operational requirements that
need to be fulfilled in order to qualify the
well barrier or WBE for its intended use.
 Acceptance Criteria
Function and number of well barriers
The function of the well barrier and WBE shall be clearly defined.

• One well barrier in place during all well activities and operations,
including suspended or abandoned wells, where a pressure
differential exists that may cause uncontrolled cross flow in the
wellbore between formation zones.

• Two well barriers available during all well activities and operations,
including suspended or abandoned wells, where a pressure
differential exists that may cause uncontrolled outflow from the
borehole/well to the external environment.
 Well Barrier Acceptance Criteria Example Drilling BOP
Features Acceptance Criteria See
A.Description The element consists of the wellhead connector and drilling BOP with kill/choke line valves.
B. Function The function of wellhead connector is to prevent flow from the bore to the environment and to provide a mechanical connection
between drilling BOP and the wellhead. The function of the BOP is to provide capabilities to close in and seal the well bore with or
without tools/equipment through the BOP.

C. Design 1. The drilling BOP shall be constructed in accordance with !!!!! standards. API
construction 2. The BOP WP shall exceed the MWDP (maximum well design pressure) including a margin for kill operations. RP53
selection 3. It shall be documented that the shear/seal ram can shear the drill pipe, tubing, wireline, CT or other specified tools, and seal the
well bore thereafter. If this can not be documented by the manufacturer, a qualification test shall be performed and documented.
4. When running non shearable items, there shall be minimum one pipe ram or annular preventer able to seal the actual size of
the non shearable item.
5. For floaters the wellhead connector shall be equipped with a secondary release feature allowing release with ROV.
6. When using tapered drill pipe string there should be pipe rams to fit each pipe size. Variable bore rams should have sufficient
hang off load capacity.
7. There shall be an outlet below the LPR. This outlet shall be used as the last resort to regain well control in a well control
situation.
8. HTHP: The BOP shall be furnished with surface readout pressure and temperature.
9. Deep water:
9.1. The BOP should be furnished with surface readout pressure and temperature.
9.2. The drilling BOP shall have two annular preventers. One or both of the annular preventers shall be part of the LMRP. It should
be possible to bleed off gas trapped between the preventers in a controlled way.
9.3. Bending loads on the BOP flanges and connector shall be verified to withstand maximum bending loads (e.g. Highest
allowable riser angle and highest expected drilling fluid density.)
9.4 From a DP vessel it shall be possible to shear full casing strings and seal thereafter. If this is not possible the casings should
be run as liners.
D. Initial test See Example, Table A
and
verification
E. Use The drilling BOP elements shall be activated as described in the well control action procedures.

F. Monitoring See Example, Table A

G. Failure Non-fulfillment of the above mentioned requirements. See Example, Table B

modes
 Table A. Routine leak testing of drilling BOP and well control equipment
Before Drilling out Periodic
Frequency Casing Before
Stump Deeper Well Each
Testing Each 6
Surface Casing & Weekly 14
Element Months
Liners Days
Annulars MWDP 1) Function MSDP 1) TSTP 1) Function MSDP 1) WP x 0.7
Pipe Rams MWDP Function MSDP TSTP Function MSDP WP
Shear Rams MWDP Function MSDP TSTP Function WP
BOP
Failsafe Valves MWDP Function MSDP 3) TSTP Function MSDP 3) WP
Wellhead Connector MWDP MSDP TSTP MSDP WP
Wedge Locks Function
Choke/Kill Lines MWDP MSDP MSDP TSTP MSDP WP
Choke/Kill line Manifold MWDP MSDP MSDP TSTP MSDP WP
and Manifold Valves Function Function Function Function Function
Remote Chokes
Kill Pump WP 2) MSDP MSDP WP
Inside BOP MWDP 2) MSDP TSTP MSDP WP
Other Equipment Stabbing Valves MWDP 2) MSDP TSTP MSDP WP
Upper Kelly Valve MWDP 2) MSDP MSDP WP
Lower Kelly Valve MWDP 2) MSDP MSDP WP
Legend NOTE 1 All tests shall be 1,5 MPa (200 psi) to 2 MPa (300 psi) for 5 min and
WP Working Pressure high pressure for 10 min.

MWDP Maximum Well Design Pressure

NOTE 2 If the drilling BOP is disconnected/re-connected or moved between
MSDP Maximum Section Design Pressure wells without having been disconnected from its control system, the initial leak
Function Function Testing shall be done from alternating test of the BOP components can be omitted. The wellhead connector shall be
panels/pods leak tested.
TSTP Tubing String Test Pressure
1) Or Maximum 70% of WP NOTE 3 The BOP with associated valves and other pressure control equipment
on the facility shall be subjected to a complete overhaul and shall be recertified
2) Or at initial installation
every five years. The complete overhaul shall be documented.
3) From above if restricted by BOP arrangement
 Table B - Failure of drilling BOP and control systems

Barrier
Actions to be taken when failure to test
element/equipment

Annular Repair immediately.

Shear ram If WBE, repair immediately.

If WBE, repair immediately if no other pipe rams is available for that pipe size.
Pipe ram (upper, middle, lower)
Rams that failed to test to be repaired at a convenient time.

Choke valves, inner/outer If both valves in series have failed, repair immediately. If one valve in series has failed,
Kill valves, inner/outer repair after having set casing.

Marine riser choke and kill line * If one has failed, repair immediately.

Yellow and blue pod * If both have failed, repair immediately. If one has failed, repair at a convenient time.

Acoustic – shear ram * Same as for shear ram.

If one or more have failed, repair after having set casing if size is covered by another
Acoustic – pipe rams *
ram. If not, repair immediately.
Immediately: Stop operation and temporary abandon well. After having set casing:
*Floating Installations
Carry on with the operation and repair after having set the next casing.
Nomenclature :
Convenient time: Applicable for WBE’s that are not required.
 Pressure direction
• The pressure should be applied in the flow direction.
If this is impractical, the pressure can be applied against
the flow direction, providing that the WBE is constructed
to seal in both flow directions or by reducing the
pressure on the downstream side of the well barrier to
the lowest practical pressure (inflow test).
 Documentation of leak and function testing of well barriers

All well integrity tests shall be documented and accepted

by an authorized person. This authorized person can be
the driller, tool-pusher, drilling and well intervention
supervisor or the equipment and service provider's
representative.
The chart and the test documentation should contain
• Type of test,
• Test pressure,
• Test fluid,
• System or components tested,
• Estimated volume of system pressurized,
• Volume pumped
 ‘Swiss Cheese Model’

• What Is Human Error?

Human error is an imbalance between what the situation requires, what the
person intends, and what he/she actually does.

• Human error happens when people:

Plan to do the right thing but with the wrong outcome (e.g., misdial a correct
telephone number; give the correct instruction but to the wrong person)

Do the wrong thing for the situation (e.g. turn an alarm off)

Fail to do anything when action is required (e.g. fail to report faulty

equipment)
 ‘Swiss Cheese Model’

• Why do Errors Happen?

As imperfect humans, we have inherent limitations in our abilities. We will

make mistakes. To answer the question of “why do errors happen?” or “why
did the error happen?” it is necessary to look beyond the person who made
the error.

Simply put, errors happen when multiple factors come together to allow
them to happen. What we usually call “human error” is really “system error”.
People are one part of a system that includes all of the other parts of the
organization or work environment – equipment, technology, environment,
organization, training, policies, and procedures. Human error is rooted in
failure of the system or the organization to prevent the error from
happening, and if an error happens, failure to prevent the error from
becoming a problem.
 ‘Swiss Cheese Model’
The concept of ‘defenses’ against human error

Examples of defenses:
• Checking drilling mud weights.
• Challenging response procedures (being told to do something you
know is wrong).
• Setting alarms correctly.
• Following correct testing procedures.

• It is when these defenses are weakened and breached that human

errors can result in incidents or accidents.

• These defenses can be portrayed diagrammatically, as several

slices of Swiss cheese (and hence the model has become known
as Professor Reason’s “Swiss cheese” model)
 ‘Swiss Cheese Model’

• Some failures are ‘latent’, meaning that they have been made at
some point in the past and lay dormant.

• This may be introduced at the time a well barrier was designed or

may be associated with management decisions and policies.

• Errors made by front line personnel, such as Supervisors, Drillers

etc, are ‘active’ failures.

• The more holes in a system’s defenses, the more likely it is that

errors result in incidents or accidents.

• In certain circumstances, when all holes ‘line up’, blowouts occur.

 Simple ‘Swiss Cheese Model’ explaining how a blowout could happen
Shear rams fail to shear pipe causing escape of hydrocarbons and explosion on rig floor.

Latent & Active Failures. Secondary barrier element breached due

to incorrect procedures (Tool joint across pipe rams).

Latent & Active failures: Delayed detection. Well monitoring not

done resulting in increased kick size. Annular Fails to seal.

Active failure: Fluid barrier breached when pulling pipe too fast
Reservoir reduced hydrostatic pressure and allowed the well to flow.
Hydrocarbons

Latent failure: Inadequate mud checks failed to pick up on reduced mud weight?