Well Integrity Technical Section

Hi Ksenia,

You seem to be asking something like "can I use a barrier element with a non-zero leak rate?", instead of the more common question "do I really, really have to install a SSSV in my well?".

Both NORSOK D-010 and ISO 16530 forbid "uncontrolled" leaks: you're not allowed to have a continuous release of hazardous fluids out of your well envelope.

ISO 16530 9.3.3 further recommends you to define performance standards for each barrier element based on risk. Part of the performance is the maximum available leak rate. Mind that "leak" past a barrier doesn't mean "leak" from the well: both barriers must fail for a release to happen.

So far so pure. Some people of an integralist penchant may think: "hey, the SSSV is there to shut the well in if the well head and X-mas tree are blown up by an invading army, so tolerating a leaky SSSV is like tolerating a leak out of the well". Or not?

API 14B limits are there to reduce the potential severity of a failure from a major accident to something that can be easily mitigated. They focus on a jet fire as the worst-case scenario, but short, small leaks can be easily contained to avoid all sorts of losses. Just bear in mind that mitigation barriers are as much a part of your well integrity management system as the two prevention barriers mandated by NORSOK D-010. The issue is not whether you can tolerate a continuous spill of 6.34 gallons per hour of oil, but that this spill is very easy to control while you restore full barrier functionality. The first would be the "uncontrolled" leak the standards preach against.

Mind that your ability to control a release and avoid damage depends on the leak rate. In engineering there is no "in for a penny, in for a pound". People helplessly watching the Aliso Canyon leak wished that an SSSV had been installed. Even if in that case it may not have helped, that was the beginning of a resurgence of SSSV usage in the US.

So, should you set a zero-leak target for the SSSV? If you're a service company replacing valves, yes. If you actually plan on using the well for production (or injection? That's another question), you will tolerate an increasing leak rate so you can (safely) predict failure and do preventive maintenance.

Best regards,

Hello Ksenia.

Agreed, there doesn't need to be a consensus, and it can sometimes lead to confusion. Re: your question and specifically barrier, I would make a distinction on "barrier" and what you need it for (regulators usually won't go to that level of details... and many legislations use different definitions to Norsok D-010).
If what is needed is a "barrier" for breaking containment and address an integrity issue at a Xmas Tree for instance... then usually it will not be an acceptable barrier, though in very limited cases we have occasionally used a DHSV as an "intervention barrier" only once this had been extensively tested... (leak tight ideally) and risk-assessed for a specific operation (time-limited).
For other uses (other than... short-term intervention), this would be suspensions or what D-010 now calls Temporary Abandonment (I hate the contradiction)... or possibly also general risk assessment? (Evaluating risk profiles between wells, to rank them?). I guess this is where the critical difference would be... in the temporary nature of the proposed use?
For short-term suspensions or TA, I think it wouldn't be unreasonable to consider a DHSV would perform the service required... for any longer periods, I'm much more suspicious. DHSV's are usually not designed to be tight, which could move a pressure envelope higher (and flow-wet elements above).

If you pushed the logic that barriers don't need to be fully pressure-sealing (or can expect to be for the limited duration of the proposed use) then you can end up (I've seen that in some areas) with fluid being considered as Barrier 1 (very dubious) and DHSV being used as Barrier 2... for what would be consider in many legislations as a well simply S/I at the XT (and basically ready to flow).

In any case D-010 "Barrier elements" must be verified as per Annex C (C.8 for DHSV's - you know that). Requirements are those of API14B, and those do not call for perfect pressure seal...

Should a specific revision to API14B be tackled for DHSV qualified to higher standards? ;)

Cheers.

Hello,

Great to see the replies coming through.

just to clarify a bit more. The cases I have seen and found interesting to discuss were involving installation of the SSSV, but not defining it as a barrier element as per NORSOK D-10 (definition I am using in my messages). The primary barrier was drawn up to PMV or UMGV (making a secondary barrier not independent from the way I see it). It resulted in a certain set up of the reliability model, where a SSSV leak was not leading to repair requirement as a non barrier element. 

SSSVs were first patented in 1972, at the same time, in 1972-1974 API 14 B was issued. After Santa Barbara blowout. So, subsea wells were commonly equipped since then. Aliso Canyon gas leak (2015) is onshore event. Agree, SSSVs are getting more common onshore since then.

The interesting fact is that the wells I am talking about were subsea wells. 

Pierre-Edouard, I always found it interesting that in conversation with Wells engineering, we tend to confuse production and well intervention barriers. ISO 16530 tried to bring clarity in definitions, but I still find discrepancies in design criteria and barrier testing, especially during well handover. 

regards,

Ksenia

Hello Ksenia.

Agreed, there doesn't need to be a consensus, and it can sometimes lead to confusion. Re: your question and specifically barrier, I would make a distinction on "barrier" and what you need it for (regulators usually won't go to that level of details... and many legislations use different definitions to Norsok D-010).
If what is needed is a "barrier" for breaking containment and address an integrity issue at a Xmas Tree for instance... then usually it will not be an acceptable barrier, though in very limited cases we have occasionally used a DHSV as an "intervention barrier" only once this had been extensively tested... (leak tight ideally) and risk-assessed for a specific operation (time-limited).
For other uses (other than... short-term intervention), this would be suspensions or what D-010 now calls Temporary Abandonment (I hate the contradiction)... or possibly also general risk assessment? (Evaluating risk profiles between wells, to rank them?). I guess this is where the critical difference would be... in the temporary nature of the proposed use?
For short-term suspensions or TA, I think it wouldn't be unreasonable to consider a DHSV would perform the service required... for any longer periods, I'm much more suspicious. DHSV's are usually not designed to be tight, which could move a pressure envelope higher (and flow-wet elements above).

If you pushed the logic that barriers don't need to be fully pressure-sealing (or can expect to be for the limited duration of the proposed use) then you can end up (I've seen that in some areas) with fluid being considered as Barrier 1 (very dubious) and DHSV being used as Barrier 2... for what would be consider in many legislations as a well simply S/I at the XT (and basically ready to flow).

In any case D-010 "Barrier elements" must be verified as per Annex C (C.8 for DHSV's - you know that). Requirements are those of API14B, and those do not call for perfect pressure seal...

Should a specific revision to API14B be tackled for DHSV qualified to higher standards? ;)

Cheers.

Hello Ksenia.

Agreed, there doesn't need to be a consensus, and it can sometimes lead to confusion. Re: your question and specifically barrier, I would make a distinction on "barrier" and what you need it for (regulators usually won't go to that level of details... and many legislations use different definitions to Norsok D-010).
If what is needed is a "barrier" for breaking containment and address an integrity issue at a Xmas Tree for instance... then usually it will not be an acceptable barrier, though in very limited cases we have occasionally used a DHSV as an "intervention barrier" only once this had been extensively tested... (leak tight ideally) and risk-assessed for a specific operation (time-limited).
For other uses (other than... short-term intervention), this would be suspensions or what D-010 now calls Temporary Abandonment (I hate the contradiction)... or possibly also general risk assessment? (Evaluating risk profiles between wells, to rank them?). I guess this is where the critical difference would be... in the temporary nature of the proposed use?
For short-term suspensions or TA, I think it wouldn't be unreasonable to consider a DHSV would perform the service required... for any longer periods, I'm much more suspicious. DHSV's are usually not designed to be tight, which could move a pressure envelope higher (and flow-wet elements above).

If you pushed the logic that barriers don't need to be fully pressure-sealing (or can expect to be for the limited duration of the proposed use) then you can end up (I've seen that in some areas) with fluid being considered as Barrier 1 (very dubious) and DHSV being used as Barrier 2... for what would be consider in many legislations as a well simply S/I at the XT (and basically ready to flow).

In any case D-010 "Barrier elements" must be verified as per Annex C (C.8 for DHSV's - you know that). Requirements are those of API14B, and those do not call for perfect pressure seal...

Should a specific revision to API14B be tackled for DHSV qualified to higher standards? ;)

Cheers.

Pierre- Edouard,

you brought something interesting her: whether standards should be increased. To be honest, I think leak rate should be revisited. Initial definition within API14 B was based on a person in a normal PPE should be able to extinguished the 1 m flame with the fire extinguisher. Subsea wells also have dispersion. SINTEF modelled it several times for us. Has disperses quite quickly and with lesser risk the deeper the well. Only oil remains to be a risk, but the dispersion model indicates that the leak rate can be 10 times higher. 

So, on one hand, I see SSSV as a barrier, but I find the 15 scf/min for gas too stringent.

Hello Ksenia.

Agreed, there doesn't need to be a consensus, and it can sometimes lead to confusion. Re: your question and specifically barrier, I would make a distinction on "barrier" and what you need it for (regulators usually won't go to that level of details... and many legislations use different definitions to Norsok D-010).
If what is needed is a "barrier" for breaking containment and address an integrity issue at a Xmas Tree for instance... then usually it will not be an acceptable barrier, though in very limited cases we have occasionally used a DHSV as an "intervention barrier" only once this had been extensively tested... (leak tight ideally) and risk-assessed for a specific operation (time-limited).
For other uses (other than... short-term intervention), this would be suspensions or what D-010 now calls Temporary Abandonment (I hate the contradiction)... or possibly also general risk assessment? (Evaluating risk profiles between wells, to rank them?). I guess this is where the critical difference would be... in the temporary nature of the proposed use?
For short-term suspensions or TA, I think it wouldn't be unreasonable to consider a DHSV would perform the service required... for any longer periods, I'm much more suspicious. DHSV's are usually not designed to be tight, which could move a pressure envelope higher (and flow-wet elements above).

If you pushed the logic that barriers don't need to be fully pressure-sealing (or can expect to be for the limited duration of the proposed use) then you can end up (I've seen that in some areas) with fluid being considered as Barrier 1 (very dubious) and DHSV being used as Barrier 2... for what would be consider in many legislations as a well simply S/I at the XT (and basically ready to flow).

In any case D-010 "Barrier elements" must be verified as per Annex C (C.8 for DHSV's - you know that). Requirements are those of API14B, and those do not call for perfect pressure seal...

Should a specific revision to API14B be tackled for DHSV qualified to higher standards? ;)

Cheers.

Hello Rafael. 
thank you for this addition.

a bit of a different spin on the question: if you harvest a tree, and you have a deepset plug and a shallow plug. Is it enough? We normally make sure that the tree is not harvested unless the producing reservoir is squeezed with cement. But I came across wells in another country where it was not the case. The tubing was pulled. Curios to hear your thoughts. 

Ksenia

Hello Rafael. 
thank you for this addition.

a bit of a different spin on the question: if you harvest a tree, and you have a deepset plug and a shallow plug. Is it enough? We normally make sure that the tree is not harvested unless the producing reservoir is squeezed with cement. But I came across wells in another country where it was not the case. The tubing was pulled. Curios to hear your thoughts. 

Ksenia

I have always struggled with the TRSSV as a barrier but over the years but I have seen it perform its function when all hope is lost. Grudgingly, after several blowouts, I am now a believer of its use, my comments below are only for the production operations. (Drilling tends to get confused between intervention and production barrier requirements).

TRSSV

•  It inherently leaks (even more when its self equalizing…)
•  It takes a lot of personnel training, testing and monitoring…..

Then again, API 14B is quite specific as to what is a tolerable leak. So at least, we have a guidelines for that, its better than nothing and requires the operator to fix a TRSSV when it leaks beyond these specifications. If we did not have this specification, operations will use the TRSSV until it completely fails to pieces 😊.

The TRSSV is the only viable deepset isolation barrier for the tubing. The A annulus has a production packer for that purpose, the other casing's have cement for the same reasons. So, all the HC flowpaths are covered.

Assume that an event has damaged the tree at surface. Regardless of weather is on land (truck running into the tree) on subsea (underground earthquake) or an offshore platform. (ship surface attack).
In this scenario, the barrier's still left in place are TRSSV and Production packer.

Yes, its a pain to consider a primary barrier, its mechanical, downhole and leaks quite often. But I think its real function like the production is to prevent a catastrophic uncontrolled hydrocarbon exposure when all your normal barriers at surface are lost..  If it leaks but still stops blowout, it's the lesser of all the evils.

In fact, the number of O&G companies, do not consider the production packer and TRSSV as part of the barrier system. Their barriers, testable/independent are all at the tree and flowline. The TRSSV and packer are the last line of defense and is completely independent of normal barrier component's.

There has been significant controversy between barrier envelopes, barrier elements in the flowpath or in the envelope.
In fact that's a never ending discussion......
I try to keep it simple. Two testable/monitorable barrier in every possible flowpath direction and no single point failures. The TRSSV and production packers are the final barriers that is independent of all of the above.

As for the land wells, TRSSV is still not common, production packers are starting to be more common.
There is still no hard and fast regulations for this…..

Hope that helps

Hello Rafael. 
thank you for this addition.

a bit of a different spin on the question: if you harvest a tree, and you have a deepset plug and a shallow plug. Is it enough? We normally make sure that the tree is not harvested unless the producing reservoir is squeezed with cement. But I came across wells in another country where it was not the case. The tubing was pulled. Curios to hear your thoughts. 

Ksenia

What is the alternative for a production well if you do not consider the SSSV a barrier?  If the SSSV is not a barrier, there is no way to have two independent barrier envelopes.  Having a shared barrier element should lead you to compensating measures, which usually is increased inspection, testing and maintenance.  Increased ITM is a little challenging on subsea wellheads.....

SSSV are known to have reliability issues/small leaks, which is why we typically have an aggressive testing schedule for installed SSSV's, with the accompanied data collection to drive the selection of SSSV's.

I wouldn't count on a SSSV as a long-term T&A barrier as it is likely to have a small leak, which turns into a large volume/high pressure under the next barrier over time.  I have used it as a barrier for workovers in the past as a short-term barrier for nippling up on a well (right after testing the SSSV).  We would install a BPV with the external seals removed as a debris catcher to make sure nothing was dropped into the well, opening the SSSV.

To me, a tested SSSV is a barrier.

I have always struggled with the TRSSV as a barrier but over the years but I have seen it perform its function when all hope is lost. Grudgingly, after several blowouts, I am now a believer of its use, my comments below are only for the production operations. (Drilling tends to get confused between intervention and production barrier requirements).

TRSSV

•  It inherently leaks (even more when its self equalizing…)
•  It takes a lot of personnel training, testing and monitoring…..

Then again, API 14B is quite specific as to what is a tolerable leak. So at least, we have a guidelines for that, its better than nothing and requires the operator to fix a TRSSV when it leaks beyond these specifications. If we did not have this specification, operations will use the TRSSV until it completely fails to pieces 😊.

The TRSSV is the only viable deepset isolation barrier for the tubing. The A annulus has a production packer for that purpose, the other casing's have cement for the same reasons. So, all the HC flowpaths are covered.

Assume that an event has damaged the tree at surface. Regardless of weather is on land (truck running into the tree) on subsea (underground earthquake) or an offshore platform. (ship surface attack).
In this scenario, the barrier's still left in place are TRSSV and Production packer.

Yes, its a pain to consider a primary barrier, its mechanical, downhole and leaks quite often. But I think its real function like the production is to prevent a catastrophic uncontrolled hydrocarbon exposure when all your normal barriers at surface are lost..  If it leaks but still stops blowout, it's the lesser of all the evils.

In fact, the number of O&G companies, do not consider the production packer and TRSSV as part of the barrier system. Their barriers, testable/independent are all at the tree and flowline. The TRSSV and packer are the last line of defense and is completely independent of normal barrier component's.

There has been significant controversy between barrier envelopes, barrier elements in the flowpath or in the envelope.
In fact that's a never ending discussion......
I try to keep it simple. Two testable/monitorable barrier in every possible flowpath direction and no single point failures. The TRSSV and production packers are the final barriers that is independent of all of the above.

As for the land wells, TRSSV is still not common, production packers are starting to be more common.
There is still no hard and fast regulations for this…..

Hope that helps

Hello Rafael. 
thank you for this addition.

a bit of a different spin on the question: if you harvest a tree, and you have a deepset plug and a shallow plug. Is it enough? We normally make sure that the tree is not harvested unless the producing reservoir is squeezed with cement. But I came across wells in another country where it was not the case. The tubing was pulled. Curios to hear your thoughts. 

Ksenia

Hans-Jacob,

I agree and it depends on the actual operation.  I have issued dispensations on a tested and leak tight SSSV to perform work on the barriers (tree valves) above with people exposed to possible hazard. But the SSSV controls are locked out and a plug installed to provide two barriers.  Once the SSSV is opened again the dispensation is cancelled and the valve is no longer a barrier for tree work. But it is still a possible barrier in an emergency situation to limit the potential impact of a disaster with some minimal flow rate that can be manged.

Barrier for working on equipment with exposure to people is a different barrier than one trying to limit consequences of a major event. Each situation requires it's own criterai after risk assessment. 

What is the alternative for a production well if you do not consider the SSSV a barrier?  If the SSSV is not a barrier, there is no way to have two independent barrier envelopes.  Having a shared barrier element should lead you to compensating measures, which usually is increased inspection, testing and maintenance.  Increased ITM is a little challenging on subsea wellheads.....

SSSV are known to have reliability issues/small leaks, which is why we typically have an aggressive testing schedule for installed SSSV's, with the accompanied data collection to drive the selection of SSSV's.

I wouldn't count on a SSSV as a long-term T&A barrier as it is likely to have a small leak, which turns into a large volume/high pressure under the next barrier over time.  I have used it as a barrier for workovers in the past as a short-term barrier for nippling up on a well (right after testing the SSSV).  We would install a BPV with the external seals removed as a debris catcher to make sure nothing was dropped into the well, opening the SSSV.

To me, a tested SSSV is a barrier.

I have always struggled with the TRSSV as a barrier but over the years but I have seen it perform its function when all hope is lost. Grudgingly, after several blowouts, I am now a believer of its use, my comments below are only for the production operations. (Drilling tends to get confused between intervention and production barrier requirements).

TRSSV

•  It inherently leaks (even more when its self equalizing…)
•  It takes a lot of personnel training, testing and monitoring…..

Then again, API 14B is quite specific as to what is a tolerable leak. So at least, we have a guidelines for that, its better than nothing and requires the operator to fix a TRSSV when it leaks beyond these specifications. If we did not have this specification, operations will use the TRSSV until it completely fails to pieces 😊.

The TRSSV is the only viable deepset isolation barrier for the tubing. The A annulus has a production packer for that purpose, the other casing's have cement for the same reasons. So, all the HC flowpaths are covered.

Assume that an event has damaged the tree at surface. Regardless of weather is on land (truck running into the tree) on subsea (underground earthquake) or an offshore platform. (ship surface attack).
In this scenario, the barrier's still left in place are TRSSV and Production packer.

Yes, its a pain to consider a primary barrier, its mechanical, downhole and leaks quite often. But I think its real function like the production is to prevent a catastrophic uncontrolled hydrocarbon exposure when all your normal barriers at surface are lost..  If it leaks but still stops blowout, it's the lesser of all the evils.

In fact, the number of O&G companies, do not consider the production packer and TRSSV as part of the barrier system. Their barriers, testable/independent are all at the tree and flowline. The TRSSV and packer are the last line of defense and is completely independent of normal barrier component's.

There has been significant controversy between barrier envelopes, barrier elements in the flowpath or in the envelope.
In fact that's a never ending discussion......
I try to keep it simple. Two testable/monitorable barrier in every possible flowpath direction and no single point failures. The TRSSV and production packers are the final barriers that is independent of all of the above.

As for the land wells, TRSSV is still not common, production packers are starting to be more common.
There is still no hard and fast regulations for this…..

Hope that helps

Hello Rafael. 
thank you for this addition.

a bit of a different spin on the question: if you harvest a tree, and you have a deepset plug and a shallow plug. Is it enough? We normally make sure that the tree is not harvested unless the producing reservoir is squeezed with cement. But I came across wells in another country where it was not the case. The tubing was pulled. Curios to hear your thoughts. 

Ksenia

Hi All,

I think we can take it that, if it is tested then we can consider a SSSV as a primary barrier. It also qualifies few definitions of WBEs, but I think it is cumbersome to maintain a test schedule for a SSSV (like we do in case of a BOP) especially if it a critically producing well.

Also, a barrier is required to be tested at its installed location. So, we can test the SSSV at surface and RIH to set position, however, to test on depth especially in its direction of flow, I believe the well will need to be flowed, but will it really qualify for '0' leaks would be a challenge to ascertain. How would we infer it as a primary barrier in this case?

Open to corrections please.

------------------------------
Udai A. Dutta
Chief Engineer (Production)
Oil India Limited
As, IN.
------------------------------


Original Message:
Sent: 11-01-2023 12:03 PM
From: Dan Gibson
Subject: SCSSV - a primary barrier or not?

Hans-Jacob,

I agree and it depends on the actual operation.  I have issued dispensations on a tested and leak tight SSSV to perform work on the barriers (tree valves) above with people exposed to possible hazard. But the SSSV controls are locked out and a plug installed to provide two barriers.  Once the SSSV is opened again the dispensation is cancelled and the valve is no longer a barrier for tree work. But it is still a possible barrier in an emergency situation to limit the potential impact of a disaster with some minimal flow rate that can be manged.

Barrier for working on equipment with exposure to people is a different barrier than one trying to limit consequences of a major event. Each situation requires it's own criterai after risk assessment. 

------------------------------
Dan Gibson
aka The Well Doctor
Completion & Well Integrity Advisor
Houston, Texas


Original Message:
Sent: 10-24-2023 08:37 AM
From: Hans-Jacob Lund
Subject: SCSSV - a primary barrier or not?

What is the alternative for a production well if you do not consider the SSSV a barrier?  If the SSSV is not a barrier, there is no way to have two independent barrier envelopes.  Having a shared barrier element should lead you to compensating measures, which usually is increased inspection, testing and maintenance.  Increased ITM is a little challenging on subsea wellheads.....

SSSV are known to have reliability issues/small leaks, which is why we typically have an aggressive testing schedule for installed SSSV's, with the accompanied data collection to drive the selection of SSSV's.

I wouldn't count on a SSSV as a long-term T&A barrier as it is likely to have a small leak, which turns into a large volume/high pressure under the next barrier over time.  I have used it as a barrier for workovers in the past as a short-term barrier for nippling up on a well (right after testing the SSSV).  We would install a BPV with the external seals removed as a debris catcher to make sure nothing was dropped into the well, opening the SSSV.

To me, a tested SSSV is a barrier.

------------------------------
Hans-JacobLundConocoPhillips CoPrincipal Well Integrity Engineer


Original Message:
Sent: 10-23-2023 02:01 PM
From: Basker Murugappan
Subject: SCSSV - a primary barrier or not?

I have always struggled with the TRSSV as a barrier but over the years but I have seen it perform its function when all hope is lost. Grudgingly, after several blowouts, I am now a believer of its use, my comments below are only for the production operations. (Drilling tends to get confused between intervention and production barrier requirements).

TRSSV

•  It inherently leaks (even more when its self equalizing…)
•  It takes a lot of personnel training, testing and monitoring…..

Then again, API 14B is quite specific as to what is a tolerable leak. So at least, we have a guidelines for that, its better than nothing and requires the operator to fix a TRSSV when it leaks beyond these specifications. If we did not have this specification, operations will use the TRSSV until it completely fails to pieces 😊.

The TRSSV is the only viable deepset isolation barrier for the tubing. The A annulus has a production packer for that purpose, the other casing's have cement for the same reasons. So, all the HC flowpaths are covered.

Assume that an event has damaged the tree at surface. Regardless of weather is on land (truck running into the tree) on subsea (underground earthquake) or an offshore platform. (ship surface attack).
In this scenario, the barrier's still left in place are TRSSV and Production packer.

Yes, its a pain to consider a primary barrier, its mechanical, downhole and leaks quite often. But I think its real function like the production is to prevent a catastrophic uncontrolled hydrocarbon exposure when all your normal barriers at surface are lost..  If it leaks but still stops blowout, it's the lesser of all the evils.

In fact, the number of O&G companies, do not consider the production packer and TRSSV as part of the barrier system. Their barriers, testable/independent are all at the tree and flowline. The TRSSV and packer are the last line of defense and is completely independent of normal barrier component's.

There has been significant controversy between barrier envelopes, barrier elements in the flowpath or in the envelope.
In fact that's a never ending discussion......
I try to keep it simple. Two testable/monitorable barrier in every possible flowpath direction and no single point failures. The TRSSV and production packers are the final barriers that is independent of all of the above.

As for the land wells, TRSSV is still not common, production packers are starting to be more common.
There is still no hard and fast regulations for this…..

Hope that helps

------------------------------
Basker Murugappan
Principal Production Technologist
Villalbilla, Spain
+34 644485970

Three basic rules:
1) Change is inevitable.
2) Everybody resists change.
3) You cant stop change


Original Message:
Sent: 10-15-2023 09:14 PM
From: Rafael Purificacao
Subject: SCSSV - a primary barrier or not?

Ksenia,

The scenario described is usually ALARP (deep and shallow set plugs) for a
well without Xmas Tree, provided the plugs are leak tight verified. This is
actually the "by the book" suspension method most engineers would suggest
as base-case.

Plugs are usually considered pressure containing devices.
Obviously, this assumes the other well barrier elements of your envelope
are verified, too.

Rafael Augustinis Purificação
+55 21 998073094



Original Message:
Sent: 10/15/2023 2:53:00 PM
From: Ksenia Arkhipova
Subject: RE: SCSSV - a primary barrier or not?

Hello Rafael. 
thank you for this addition.

a bit of a different spin on the question: if you harvest a tree, and you have a deepset plug and a shallow plug. Is it enough? We normally make sure that the tree is not harvested unless the producing reservoir is squeezed with cement. But I came across wells in another country where it was not the case. The tubing was pulled. Curios to hear your thoughts. 

Ksenia

Original Message:
Sent: 10-15-2023 09:47 AM
From: Rafael Purificacao
Subject: SCSSV - a primary barrier or not?

Ksenia Arkhipova,

Very good topic!

Usually, the subsurface safety valve is considered an element fromthe
primary well barrier envelope as long as there's a pressire containing
element downstream.

i.e., It is OK to consider the subsurface safety valve as an element of the
primary barrier envelope if the Xmas Tree is installed, provided the valve
was verified according to the applicable criteria. By another hand, it is
NOT OK to consider the same valve as a valid barrier element if there's no
Xmas Tree installed, or any other Plug.

Therefore, most operators do NOT consider as an ALARP scenario to suspend
the well usingbthe Safety Valve as one of the barriers.

Conceptually, we always need to have pressure containing devices in your
setup. Valves in general, are pressure controlling, with an allowable leak
rate. This is also the reason why we need to install a Tree Cap or Crown
Plug, above the Swab Valve, on the Conventional Xmas Trees.

Rgds,
Rafael Augustinis Purificação
+55 21 998073094

Hi All,

I think we can take it that, if it is tested then we can consider a SSSV as a primary barrier. It also qualifies few definitions of WBEs, but I think it is cumbersome to maintain a test schedule for a SSSV (like we do in case of a BOP) especially if it a critically producing well.

Also, a barrier is required to be tested at its installed location. So, we can test the SSSV at surface and RIH to set position, however, to test on depth especially in its direction of flow, I believe the well will need to be flowed, but will it really qualify for '0' leaks would be a challenge to ascertain. How would we infer it as a primary barrier in this case?

Open to corrections please.

Hans-Jacob,

I agree and it depends on the actual operation.  I have issued dispensations on a tested and leak tight SSSV to perform work on the barriers (tree valves) above with people exposed to possible hazard. But the SSSV controls are locked out and a plug installed to provide two barriers.  Once the SSSV is opened again the dispensation is cancelled and the valve is no longer a barrier for tree work. But it is still a possible barrier in an emergency situation to limit the potential impact of a disaster with some minimal flow rate that can be manged.

Barrier for working on equipment with exposure to people is a different barrier than one trying to limit consequences of a major event. Each situation requires it's own criterai after risk assessment. 

What is the alternative for a production well if you do not consider the SSSV a barrier?  If the SSSV is not a barrier, there is no way to have two independent barrier envelopes.  Having a shared barrier element should lead you to compensating measures, which usually is increased inspection, testing and maintenance.  Increased ITM is a little challenging on subsea wellheads.....

SSSV are known to have reliability issues/small leaks, which is why we typically have an aggressive testing schedule for installed SSSV's, with the accompanied data collection to drive the selection of SSSV's.

I wouldn't count on a SSSV as a long-term T&A barrier as it is likely to have a small leak, which turns into a large volume/high pressure under the next barrier over time.  I have used it as a barrier for workovers in the past as a short-term barrier for nippling up on a well (right after testing the SSSV).  We would install a BPV with the external seals removed as a debris catcher to make sure nothing was dropped into the well, opening the SSSV.

To me, a tested SSSV is a barrier.

I have always struggled with the TRSSV as a barrier but over the years but I have seen it perform its function when all hope is lost. Grudgingly, after several blowouts, I am now a believer of its use, my comments below are only for the production operations. (Drilling tends to get confused between intervention and production barrier requirements).

TRSSV

•  It inherently leaks (even more when its self equalizing…)
•  It takes a lot of personnel training, testing and monitoring…..

Then again, API 14B is quite specific as to what is a tolerable leak. So at least, we have a guidelines for that, its better than nothing and requires the operator to fix a TRSSV when it leaks beyond these specifications. If we did not have this specification, operations will use the TRSSV until it completely fails to pieces 😊.

The TRSSV is the only viable deepset isolation barrier for the tubing. The A annulus has a production packer for that purpose, the other casing's have cement for the same reasons. So, all the HC flowpaths are covered.

Assume that an event has damaged the tree at surface. Regardless of weather is on land (truck running into the tree) on subsea (underground earthquake) or an offshore platform. (ship surface attack).
In this scenario, the barrier's still left in place are TRSSV and Production packer.

Yes, its a pain to consider a primary barrier, its mechanical, downhole and leaks quite often. But I think its real function like the production is to prevent a catastrophic uncontrolled hydrocarbon exposure when all your normal barriers at surface are lost..  If it leaks but still stops blowout, it's the lesser of all the evils.

In fact, the number of O&G companies, do not consider the production packer and TRSSV as part of the barrier system. Their barriers, testable/independent are all at the tree and flowline. The TRSSV and packer are the last line of defense and is completely independent of normal barrier component's.

There has been significant controversy between barrier envelopes, barrier elements in the flowpath or in the envelope.
In fact that's a never ending discussion......
I try to keep it simple. Two testable/monitorable barrier in every possible flowpath direction and no single point failures. The TRSSV and production packers are the final barriers that is independent of all of the above.

As for the land wells, TRSSV is still not common, production packers are starting to be more common.
There is still no hard and fast regulations for this…..

Hope that helps

Hello Rafael. 
thank you for this addition.

a bit of a different spin on the question: if you harvest a tree, and you have a deepset plug and a shallow plug. Is it enough? We normally make sure that the tree is not harvested unless the producing reservoir is squeezed with cement. But I came across wells in another country where it was not the case. The tubing was pulled. Curios to hear your thoughts. 

Ksenia

Greetings Ksenia,

Great question and thankfully some excellent replies from some very capable and respected engineers.  I'll add a few points, most of which echo previous comments.

An SCSSV that tests is part of a barrier, inclusive of tubing and packer below it.  Brand new SCSSVs tend to be jug-tight and that's why many (most?) operators will use these as one of two suspension barriers that we rely on when pulling BOPs prior to installing vertical subsea trees.

I get a bit more wary when returning to a well for a workover.  Tolerance for a leak is very low during a workover, and a used valve may have scale or other solids that can impair the seal.  More critical is leak detectability.  The first difference is the test media: during initial installation, we're usually conducting the test in single-phase, relatively incompressible brine and the well should be more or less in thermal equilibrium.  Leaks are very detectable.  In contrast, after production we'll have produced fluids, possible gas (re)solubility, and temperature changes (usually a cooling well), etc.  All of these can mask a leak.  For these reasons some operators will not allow an SCSSV to be used as a workover barrier, regardless of how it tests.  Personally, I think we could use the SCSSV as a workover barrier (and I have) but need to be very aware and skeptical of the test conditions.  A long shut-in to allow the well to thermally stabilize is a "must", in my opinion.  

A last thought on a point you raised, regarding allowable leak rates.  I would hate to initiate an expensive, emissions-generating, and potentially risky subsea workover just to replace an SCSSV that's barely exceeding the API allowable leak rate.  To your point, consequence is far lower in some wells than others, and we should be able to conduct risk assessments to determine which path forward actually poses the least risk to safety, the environment, and reputation.  I'm intentionally not listing cost.  There's nothing we do in deepwater that's inconsequential and you don't undertake an operation like this unless its truly necessary.  

That's my ten cents anyway.  Good luck and thanks again for starting this dialogue!

R

------------------------------
Ron Nelson
Subsea Completion Consultant
ron@deep-blue.ca
------------------------------

Good morning Nelson, 

Thank you for these clarification. I totally agree for the temperature. it is what we are doing for our wells, we close the wells for an hour before inflow test the Sub surface safety valve. 

Regards

AMARA adlane

Well Integrity & intervention supervisor

Good morning Nelson, 

Thank you for these clarification. I totally agree for the temperature. it is what we are doing for our wells, we close the wells for an hour before inflow test the Sub surface safety valve. 

Regards

AMARA adlane

Well Integrity & intervention supervisor

Greetings Ksenia,

Great question and thankfully some excellent replies from some very capable and respected engineers.  I'll add a few points, most of which echo previous comments.

An SCSSV that tests is part of a barrier, inclusive of tubing and packer below it.  Brand new SCSSVs tend to be jug-tight and that's why many (most?) operators will use these as one of two suspension barriers that we rely on when pulling BOPs prior to installing vertical subsea trees.

I get a bit more wary when returning to a well for a workover.  Tolerance for a leak is very low during a workover, and a used valve may have scale or other solids that can impair the seal.  More critical is leak detectability.  The first difference is the test media: during initial installation, we're usually conducting the test in single-phase, relatively incompressible brine and the well should be more or less in thermal equilibrium.  Leaks are very detectable.  In contrast, after production we'll have produced fluids, possible gas (re)solubility, and temperature changes (usually a cooling well), etc.  All of these can mask a leak.  For these reasons some operators will not allow an SCSSV to be used as a workover barrier, regardless of how it tests.  Personally, I think we could use the SCSSV as a workover barrier (and I have) but need to be very aware and skeptical of the test conditions.  A long shut-in to allow the well to thermally stabilize is a "must", in my opinion.  

A last thought on a point you raised, regarding allowable leak rates.  I would hate to initiate an expensive, emissions-generating, and potentially risky subsea workover just to replace an SCSSV that's barely exceeding the API allowable leak rate.  To your point, consequence is far lower in some wells than others, and we should be able to conduct risk assessments to determine which path forward actually poses the least risk to safety, the environment, and reputation.  I'm intentionally not listing cost.  There's nothing we do in deepwater that's inconsequential and you don't undertake an operation like this unless its truly necessary.  

That's my ten cents anyway.  Good luck and thanks again for starting this dialogue!

R

------------------------------
Ron Nelson
Subsea Completion Consultant
ron@deep-blue.ca

There has been some very good replies by some very respected engineers on this thread.

We all tend to look at this problem with our own experiences and they are all valid and needs to be accounted for.

I have this conversation in BP, Shell and Chevron…. All have varied opinions depending on the needs at the moment!
Sometime, we take risks because its resonable or risk assessments are biased to our experiences.

The examples below are specifically for a live well scenario during production operation. (not a killed well)
I will fall back to my own PT/Completions/Interventions experience for this and it has been ugly, with one mess and one close call.
In one case, we had a blowout at surface during a coiled tubing operation (a dropped object that damaged the TRSSV, the well flow jammed the dropped object in the CT PCE/Xtree open), we had an controlled flow to surface.

And in another case, a TRSSV, after we tested it (zero flow/pressure for 1 hr), gave a dispensation to use it because the well was a non eruptible well and we did not have a TWCV on location) and were in the process of removing the Xtree, and the well started to flow….. we were lucky to get the tree back on before the mess got worse.

I could write a book about both instances as to why they happened but these types of events tend to make you go to the root cause of why the event took place. In both cases, it was uncontrolled flow to surface by using the TRSSV as a primary barrier.

My old mentor (who has since passed away), once told me to consider the TRSSV as a one way check valve.
Compared to other barriers (ex tree valves), where they can be tested and verified in both direction, TRSSV's were always designed stop flow only in one direction and its integrity is ONLY in that direction.
and yet, given the situations and pressures, I did not listen to his advice and got myself into the two above examples of an uncontrolled flow to surface.

If you go back to surface piping system (facilities), they will NEVER repair a pipeline (downstream) with pressure on the other side of a checkvalve.
Its simply too dangerous, they will almost certainly depressurize both sides of a check valve before going to repair the pipeline. They would never rely on a check valve as a barrier.
They have a longer history of bad experiences with checkvalves, we must be able to absorb this experience.

I guess, it takes closes calls to shape ones experience.
As for mine, I will never use a TRSSV for a primary barrier during normal production operations, the risks are simply too great.
You might get lucky and nothing happens in one instance but it can always go the other way and develop into a unmitigated disaster.

Good morning Nelson, 

Thank you for these clarification. I totally agree for the temperature. it is what we are doing for our wells, we close the wells for an hour before inflow test the Sub surface safety valve. 

Regards

AMARA adlane

Well Integrity & intervention supervisor

Interesting approach, Justin, and a great contribution to this long-needed debate.

There are three points I don't necessarily agree with:

• You mention wells "capable of natural flow", but this is not a helpful nor practical definition - you could produce a trickle of water, or milk and honey after all. The most effective condition to decide when two independent barriers are required can be borrowed from process safety: whenever unrestricted flow (loss of primary containment) would lead to a major accident scenario. Most well operators know how to judge the severity of LOPC on people, environment, assets or reputation - the PEAR.
• If you close your primary barrier on surface, at the master valves, your wellhead and part of the tree will be common barrier elements. That is unfortunate, since the SSSV was introduced precisely to have a fallback option if somebody drives into the well (or a vessel drags an anchor over its subsea cousin). Mind that all other tree vales are backups to the master valves, and thus SECE (safety & environmental critical element), as well as part of the secondary barrier.
• Any barrier element is in fact a SECE. As you point out, this definition requires us to prevent failure (since they would increase risk of a major accident to unacceptable level) through planned maintenance. This maintenance will be based on function testing, detection of aging, and hopefully predictive replacement of the SECE if failure is incipient. This is exactly what we do for SSSV's. In fact, API 14B sets minimum requirements for SECE maintenance, which complement the usual reliability-centered maintenance (RCM) approach.

So I guess what you're saying is that we still need to maintain the SSSV to prevent failure, with frequent testing. Might as well call it a barrier element too.

Unless you suggest that we grow up and do proper RCM of SSSV, which I would fully support.

Best regards,

Hi Justin,

I work with onshore wells as well.

I do like your idea of considering a TRSSV a ESD device. That would solve the "leaky" problem and we dont have worry about a valve that leaks in the primary barrier envelope. However, some questions to consider.

1. As Matteo has pointed out, all our Xtree valves are on the same tree (PMV, SMV, FWV, KWV etc...)
   They all are in the same single point failure ...which is the Xtree.
   Damage the tree significantly enough and you have lost all your barriers in your primary envelope.
   
   That leaves your TRSSV as your last defence. (Along with your production packer).
   So considering them as your ESD devices makes sense.
   
   But , now...if you take out the TRSSV and production packer as part of an independant ESD system, how do you comply with the the dual independant, testable barrier requirement in the tubing and annulus flowpaths??
   The land wells use API which has no such definition, but Norsok and ISO do have such a definition clearly stated for compliance.
   (This is probably the reason, TRSSV are not commonly used on land wells)
   
   
2. As Matteo has stated, there is ambiguity in the definition of " natural flow".
   But my interaction with management is very clear, the loss of company cost and reputation of a uncontrolled flow or blowout on an well outweighs the risk of not installing a TRSSV. If the well is "self erupting", I have never been able to get an exception NOT to install a TRSSV when working for a sizeable O&G company, no matter how small the flowrate.

I really wish API did go the extra step and resolve this issue on land wells, but they have not, so, we will have to wait for the next major HSE event before API gets enough traction to resolve this problem.

Interesting approach, Justin, and a great contribution to this long-needed debate.

There are three points I don't necessarily agree with:

• You mention wells "capable of natural flow", but this is not a helpful nor practical definition - you could produce a trickle of water, or milk and honey after all. The most effective condition to decide when two independent barriers are required can be borrowed from process safety: whenever unrestricted flow (loss of primary containment) would lead to a major accident scenario. Most well operators know how to judge the severity of LOPC on people, environment, assets or reputation - the PEAR.
• If you close your primary barrier on surface, at the master valves, your wellhead and part of the tree will be common barrier elements. That is unfortunate, since the SSSV was introduced precisely to have a fallback option if somebody drives into the well (or a vessel drags an anchor over its subsea cousin). Mind that all other tree vales are backups to the master valves, and thus SECE (safety & environmental critical element), as well as part of the secondary barrier.
• Any barrier element is in fact a SECE. As you point out, this definition requires us to prevent failure (since they would increase risk of a major accident to unacceptable level) through planned maintenance. This maintenance will be based on function testing, detection of aging, and hopefully predictive replacement of the SECE if failure is incipient. This is exactly what we do for SSSV's. In fact, API 14B sets minimum requirements for SECE maintenance, which complement the usual reliability-centered maintenance (RCM) approach.

So I guess what you're saying is that we still need to maintain the SSSV to prevent failure, with frequent testing. Might as well call it a barrier element too.

Unless you suggest that we grow up and do proper RCM of SSSV, which I would fully support.

Best regards,

Hi Basker/Justin.

For me, DHSV's naturally fall in the the ESD systems philosophy (last resort). As you know in API they are part of the safety systems... And they are not required to be perfectly "tight" (0 leak) but rather perform a shut-off function where consequences of a resulting leak/fire would remain limited.

Many DHSV's today are reliable over time as long as you treat them with care. Following OEM recommendations, field best practices, leassons learned... I'd say it would also make sense to limit the "stress" placed on DHSV's in order to limit their chances of failure in service... for instance it would not be advisable to recommend that DHSV's are routinely tested in the worst-possible scenario (slam shut-in against full flow) just to be sure they would perform then. Doing this over and over would likely result in damage and reduced field life.

I like the proposition of Matteo for RCM... in fact I would also mention that the DHSV is part of an entire ESD system and that DHSV failures very often come from improper operation (more often than not, very high - and unnecessary - pressure kept in the CL's "just to be sure the valve is open..."). Sadly, DHSV failures in the field have therefore driven some operators to justify we're better off without them (because they fail, you see the logic...). A famous NOC in South America argued and justified that because DHSV's would fail and then force a heavy workover... since the probability of having a well control incident during workover would be higher than that of having a complete failure of a well without DHSV, hence in certain circumstances it would be more reasonable not to use DHSV's. The logic isn't bad in itself... it can be defended in a "system", using the caveats and assumptions made for the estimate. Certainly not as a blanket statement, ignoring the premises of the analysis... Otherwise with shortcuts you'd end up with a simple statement that we're better off without DHSV's, which I would certainly disagree with.

Now back to your land wells. If the discussion would be, in a regulatory vacuum, about a decision to run - or not - DHSV's... then we should elevate the discussion to risks and mitigations against appetite for risk-taking for a given oeprator. HPHT project in the middle of an urbanization? Run DHSV's... Low pressure oil wells in a remote (and non environmentally-sensitive) area? Perhaps in that case you're more comfortable running some probabilities... install concrete blocks to protect your pads/cellars, be more stringent with your surface WHM program... in short, with a commitment to having controls in place it is a lot easier justifying not having DHSV's.

From a regulator's standpoint though, this is much harder to evaluate... and so forcing all operators to have DHSV's makes more sense as this is much easier to enforce.

As you rightly pointed out... big organizations with a reputation arguably have more to lose than smaller ones... Regulating a variety of very different operators is a big challenge. Simpler standards and regulations are a way to address this... the argument then often being placed on where the bar should be set (high or low)

Hi Justin,

I work with onshore wells as well.

I do like your idea of considering a TRSSV a ESD device. That would solve the "leaky" problem and we dont have worry about a valve that leaks in the primary barrier envelope. However, some questions to consider.

1. As Matteo has pointed out, all our Xtree valves are on the same tree (PMV, SMV, FWV, KWV etc...)
   They all are in the same single point failure ...which is the Xtree.
   Damage the tree significantly enough and you have lost all your barriers in your primary envelope.
   
   That leaves your TRSSV as your last defence. (Along with your production packer).
   So considering them as your ESD devices makes sense.
   
   But , now...if you take out the TRSSV and production packer as part of an independant ESD system, how do you comply with the the dual independant, testable barrier requirement in the tubing and annulus flowpaths??
   The land wells use API which has no such definition, but Norsok and ISO do have such a definition clearly stated for compliance.
   (This is probably the reason, TRSSV are not commonly used on land wells)
   
   
2. As Matteo has stated, there is ambiguity in the definition of " natural flow".
   But my interaction with management is very clear, the loss of company cost and reputation of a uncontrolled flow or blowout on an well outweighs the risk of not installing a TRSSV. If the well is "self erupting", I have never been able to get an exception NOT to install a TRSSV when working for a sizeable O&G company, no matter how small the flowrate.

I really wish API did go the extra step and resolve this issue on land wells, but they have not, so, we will have to wait for the next major HSE event before API gets enough traction to resolve this problem.

Interesting approach, Justin, and a great contribution to this long-needed debate.

There are three points I don't necessarily agree with:

• You mention wells "capable of natural flow", but this is not a helpful nor practical definition - you could produce a trickle of water, or milk and honey after all. The most effective condition to decide when two independent barriers are required can be borrowed from process safety: whenever unrestricted flow (loss of primary containment) would lead to a major accident scenario. Most well operators know how to judge the severity of LOPC on people, environment, assets or reputation - the PEAR.
• If you close your primary barrier on surface, at the master valves, your wellhead and part of the tree will be common barrier elements. That is unfortunate, since the SSSV was introduced precisely to have a fallback option if somebody drives into the well (or a vessel drags an anchor over its subsea cousin). Mind that all other tree vales are backups to the master valves, and thus SECE (safety & environmental critical element), as well as part of the secondary barrier.
• Any barrier element is in fact a SECE. As you point out, this definition requires us to prevent failure (since they would increase risk of a major accident to unacceptable level) through planned maintenance. This maintenance will be based on function testing, detection of aging, and hopefully predictive replacement of the SECE if failure is incipient. This is exactly what we do for SSSV's. In fact, API 14B sets minimum requirements for SECE maintenance, which complement the usual reliability-centered maintenance (RCM) approach.

So I guess what you're saying is that we still need to maintain the SSSV to prevent failure, with frequent testing. Might as well call it a barrier element too.

Unless you suggest that we grow up and do proper RCM of SSSV, which I would fully support.

Best regards,

All,

A common theme is the "last resort" requirement for a DHSV due to collision damage etc with little thought on why it may be required without that level of incident occurring.

Yes the actuated tree valves can be initiated as required in an ESD event but it is often overlooked that there are at least 6 potential tree assembly leak paths below a closed production master valve which in the event of failure would provide provide an uncontrolled flow scenario without the availability to isolate the wellbore below the tree, albeit at reduced rate compared to losing full bore containment.

Reliance on check valves is also discussed and regarded negatively but we rely on them solely when carrying out wellhead maintenance greasing operations but as time has progressed the management of that operation has developed checks and operational requirements to minimise the risk. Use of the DHSV is no different and may be accepted as part of a two barrier system as long as the valve can be verified as a barrier, nothing can be dropped on top of it and there is also a plug to provide the second barrier and act as a debris barrier.

For hanger plugs I much prefer a spring loaded check valve type over a two way check valve for sealing capability and would back that up as the spring loaded version is still utilised in drill pipe Inside BOPs.

Routine test leak rates are a contentious subject both for DHSVs and tree valves so my preference is to set a much lower allowable leak rate than API 14B as a routine test to assess the valve condition and only allow leakage up to maximum following risk assessment. 

In answer to the original question I very much see the DHSV as a required barrier and likewise an Annulus Safety Valve or check valves on gas lifted wells for that matter. 

Hi Basker/Justin.

For me, DHSV's naturally fall in the the ESD systems philosophy (last resort). As you know in API they are part of the safety systems... And they are not required to be perfectly "tight" (0 leak) but rather perform a shut-off function where consequences of a resulting leak/fire would remain limited.

Many DHSV's today are reliable over time as long as you treat them with care. Following OEM recommendations, field best practices, leassons learned... I'd say it would also make sense to limit the "stress" placed on DHSV's in order to limit their chances of failure in service... for instance it would not be advisable to recommend that DHSV's are routinely tested in the worst-possible scenario (slam shut-in against full flow) just to be sure they would perform then. Doing this over and over would likely result in damage and reduced field life.

I like the proposition of Matteo for RCM... in fact I would also mention that the DHSV is part of an entire ESD system and that DHSV failures very often come from improper operation (more often than not, very high - and unnecessary - pressure kept in the CL's "just to be sure the valve is open..."). Sadly, DHSV failures in the field have therefore driven some operators to justify we're better off without them (because they fail, you see the logic...). A famous NOC in South America argued and justified that because DHSV's would fail and then force a heavy workover... since the probability of having a well control incident during workover would be higher than that of having a complete failure of a well without DHSV, hence in certain circumstances it would be more reasonable not to use DHSV's. The logic isn't bad in itself... it can be defended in a "system", using the caveats and assumptions made for the estimate. Certainly not as a blanket statement, ignoring the premises of the analysis... Otherwise with shortcuts you'd end up with a simple statement that we're better off without DHSV's, which I would certainly disagree with.

Now back to your land wells. If the discussion would be, in a regulatory vacuum, about a decision to run - or not - DHSV's... then we should elevate the discussion to risks and mitigations against appetite for risk-taking for a given oeprator. HPHT project in the middle of an urbanization? Run DHSV's... Low pressure oil wells in a remote (and non environmentally-sensitive) area? Perhaps in that case you're more comfortable running some probabilities... install concrete blocks to protect your pads/cellars, be more stringent with your surface WHM program... in short, with a commitment to having controls in place it is a lot easier justifying not having DHSV's.

From a regulator's standpoint though, this is much harder to evaluate... and so forcing all operators to have DHSV's makes more sense as this is much easier to enforce.

As you rightly pointed out... big organizations with a reputation arguably have more to lose than smaller ones... Regulating a variety of very different operators is a big challenge. Simpler standards and regulations are a way to address this... the argument then often being placed on where the bar should be set (high or low)

Hi Justin,

I work with onshore wells as well.

I do like your idea of considering a TRSSV a ESD device. That would solve the "leaky" problem and we dont have worry about a valve that leaks in the primary barrier envelope. However, some questions to consider.

1. As Matteo has pointed out, all our Xtree valves are on the same tree (PMV, SMV, FWV, KWV etc...)
   They all are in the same single point failure ...which is the Xtree.
   Damage the tree significantly enough and you have lost all your barriers in your primary envelope.
   
   That leaves your TRSSV as your last defence. (Along with your production packer).
   So considering them as your ESD devices makes sense.
   
   But , now...if you take out the TRSSV and production packer as part of an independant ESD system, how do you comply with the the dual independant, testable barrier requirement in the tubing and annulus flowpaths??
   The land wells use API which has no such definition, but Norsok and ISO do have such a definition clearly stated for compliance.
   (This is probably the reason, TRSSV are not commonly used on land wells)
   
   
2. As Matteo has stated, there is ambiguity in the definition of " natural flow".
   But my interaction with management is very clear, the loss of company cost and reputation of a uncontrolled flow or blowout on an well outweighs the risk of not installing a TRSSV. If the well is "self erupting", I have never been able to get an exception NOT to install a TRSSV when working for a sizeable O&G company, no matter how small the flowrate.

I really wish API did go the extra step and resolve this issue on land wells, but they have not, so, we will have to wait for the next major HSE event before API gets enough traction to resolve this problem.

Interesting approach, Justin, and a great contribution to this long-needed debate.

There are three points I don't necessarily agree with:

• You mention wells "capable of natural flow", but this is not a helpful nor practical definition - you could produce a trickle of water, or milk and honey after all. The most effective condition to decide when two independent barriers are required can be borrowed from process safety: whenever unrestricted flow (loss of primary containment) would lead to a major accident scenario. Most well operators know how to judge the severity of LOPC on people, environment, assets or reputation - the PEAR.
• If you close your primary barrier on surface, at the master valves, your wellhead and part of the tree will be common barrier elements. That is unfortunate, since the SSSV was introduced precisely to have a fallback option if somebody drives into the well (or a vessel drags an anchor over its subsea cousin). Mind that all other tree vales are backups to the master valves, and thus SECE (safety & environmental critical element), as well as part of the secondary barrier.
• Any barrier element is in fact a SECE. As you point out, this definition requires us to prevent failure (since they would increase risk of a major accident to unacceptable level) through planned maintenance. This maintenance will be based on function testing, detection of aging, and hopefully predictive replacement of the SECE if failure is incipient. This is exactly what we do for SSSV's. In fact, API 14B sets minimum requirements for SECE maintenance, which complement the usual reliability-centered maintenance (RCM) approach.

So I guess what you're saying is that we still need to maintain the SSSV to prevent failure, with frequent testing. Might as well call it a barrier element too.

Unless you suggest that we grow up and do proper RCM of SSSV, which I would fully support.

Best regards,

All,

A common theme is the "last resort" requirement for a DHSV due to collision damage etc with little thought on why it may be required without that level of incident occurring.

Yes the actuated tree valves can be initiated as required in an ESD event but it is often overlooked that there are at least 6 potential tree assembly leak paths below a closed production master valve which in the event of failure would provide provide an uncontrolled flow scenario without the availability to isolate the wellbore below the tree, albeit at reduced rate compared to losing full bore containment.

Reliance on check valves is also discussed and regarded negatively but we rely on them solely when carrying out wellhead maintenance greasing operations but as time has progressed the management of that operation has developed checks and operational requirements to minimise the risk. Use of the DHSV is no different and may be accepted as part of a two barrier system as long as the valve can be verified as a barrier, nothing can be dropped on top of it and there is also a plug to provide the second barrier and act as a debris barrier.

For hanger plugs I much prefer a spring loaded check valve type over a two way check valve for sealing capability and would back that up as the spring loaded version is still utilised in drill pipe Inside BOPs.

Routine test leak rates are a contentious subject both for DHSVs and tree valves so my preference is to set a much lower allowable leak rate than API 14B as a routine test to assess the valve condition and only allow leakage up to maximum following risk assessment. 

In answer to the original question I very much see the DHSV as a required barrier and likewise an Annulus Safety Valve or check valves on gas lifted wells for that matter. 

Hi Basker/Justin.

For me, DHSV's naturally fall in the the ESD systems philosophy (last resort). As you know in API they are part of the safety systems... And they are not required to be perfectly "tight" (0 leak) but rather perform a shut-off function where consequences of a resulting leak/fire would remain limited.

Many DHSV's today are reliable over time as long as you treat them with care. Following OEM recommendations, field best practices, leassons learned... I'd say it would also make sense to limit the "stress" placed on DHSV's in order to limit their chances of failure in service... for instance it would not be advisable to recommend that DHSV's are routinely tested in the worst-possible scenario (slam shut-in against full flow) just to be sure they would perform then. Doing this over and over would likely result in damage and reduced field life.

I like the proposition of Matteo for RCM... in fact I would also mention that the DHSV is part of an entire ESD system and that DHSV failures very often come from improper operation (more often than not, very high - and unnecessary - pressure kept in the CL's "just to be sure the valve is open..."). Sadly, DHSV failures in the field have therefore driven some operators to justify we're better off without them (because they fail, you see the logic...). A famous NOC in South America argued and justified that because DHSV's would fail and then force a heavy workover... since the probability of having a well control incident during workover would be higher than that of having a complete failure of a well without DHSV, hence in certain circumstances it would be more reasonable not to use DHSV's. The logic isn't bad in itself... it can be defended in a "system", using the caveats and assumptions made for the estimate. Certainly not as a blanket statement, ignoring the premises of the analysis... Otherwise with shortcuts you'd end up with a simple statement that we're better off without DHSV's, which I would certainly disagree with.

Now back to your land wells. If the discussion would be, in a regulatory vacuum, about a decision to run - or not - DHSV's... then we should elevate the discussion to risks and mitigations against appetite for risk-taking for a given oeprator. HPHT project in the middle of an urbanization? Run DHSV's... Low pressure oil wells in a remote (and non environmentally-sensitive) area? Perhaps in that case you're more comfortable running some probabilities... install concrete blocks to protect your pads/cellars, be more stringent with your surface WHM program... in short, with a commitment to having controls in place it is a lot easier justifying not having DHSV's.

From a regulator's standpoint though, this is much harder to evaluate... and so forcing all operators to have DHSV's makes more sense as this is much easier to enforce.

As you rightly pointed out... big organizations with a reputation arguably have more to lose than smaller ones... Regulating a variety of very different operators is a big challenge. Simpler standards and regulations are a way to address this... the argument then often being placed on where the bar should be set (high or low)

Hi Justin,

I work with onshore wells as well.

I do like your idea of considering a TRSSV a ESD device. That would solve the "leaky" problem and we dont have worry about a valve that leaks in the primary barrier envelope. However, some questions to consider.

1. As Matteo has pointed out, all our Xtree valves are on the same tree (PMV, SMV, FWV, KWV etc...)
   They all are in the same single point failure ...which is the Xtree.
   Damage the tree significantly enough and you have lost all your barriers in your primary envelope.
   
   That leaves your TRSSV as your last defence. (Along with your production packer).
   So considering them as your ESD devices makes sense.
   
   But , now...if you take out the TRSSV and production packer as part of an independant ESD system, how do you comply with the the dual independant, testable barrier requirement in the tubing and annulus flowpaths??
   The land wells use API which has no such definition, but Norsok and ISO do have such a definition clearly stated for compliance.
   (This is probably the reason, TRSSV are not commonly used on land wells)
   
   
2. As Matteo has stated, there is ambiguity in the definition of " natural flow".
   But my interaction with management is very clear, the loss of company cost and reputation of a uncontrolled flow or blowout on an well outweighs the risk of not installing a TRSSV. If the well is "self erupting", I have never been able to get an exception NOT to install a TRSSV when working for a sizeable O&G company, no matter how small the flowrate.

I really wish API did go the extra step and resolve this issue on land wells, but they have not, so, we will have to wait for the next major HSE event before API gets enough traction to resolve this problem.

Interesting approach, Justin, and a great contribution to this long-needed debate.

There are three points I don't necessarily agree with:

• You mention wells "capable of natural flow", but this is not a helpful nor practical definition - you could produce a trickle of water, or milk and honey after all. The most effective condition to decide when two independent barriers are required can be borrowed from process safety: whenever unrestricted flow (loss of primary containment) would lead to a major accident scenario. Most well operators know how to judge the severity of LOPC on people, environment, assets or reputation - the PEAR.
• If you close your primary barrier on surface, at the master valves, your wellhead and part of the tree will be common barrier elements. That is unfortunate, since the SSSV was introduced precisely to have a fallback option if somebody drives into the well (or a vessel drags an anchor over its subsea cousin). Mind that all other tree vales are backups to the master valves, and thus SECE (safety & environmental critical element), as well as part of the secondary barrier.
• Any barrier element is in fact a SECE. As you point out, this definition requires us to prevent failure (since they would increase risk of a major accident to unacceptable level) through planned maintenance. This maintenance will be based on function testing, detection of aging, and hopefully predictive replacement of the SECE if failure is incipient. This is exactly what we do for SSSV's. In fact, API 14B sets minimum requirements for SECE maintenance, which complement the usual reliability-centered maintenance (RCM) approach.

So I guess what you're saying is that we still need to maintain the SSSV to prevent failure, with frequent testing. Might as well call it a barrier element too.

Unless you suggest that we grow up and do proper RCM of SSSV, which I would fully support.

Best regards,

Hi Stephen,

You're bringing good points to this discussion, thereby demonstrating that it's hard to boil things down to a single approach.

I like your comment on why a DHSV might actually be needed... Field experience shows that we very often take "liberties" with a number of our barriers (this is the essence of Well Integrity management) with risk assessments, additional controls, etc... If you leave that to the Well Integrity team, it might not be so bad... if you leave that to the Management team, perhaps different lol

So as you rightly mentioned I also see situations where we could have gradually ventured onto thin ice and the DHSV de facto becomes a very valuable "last resort". Not the initial justification to run it... but very valuable as a trump-card when things degrade in the real world.

All,

A common theme is the "last resort" requirement for a DHSV due to collision damage etc with little thought on why it may be required without that level of incident occurring.

Yes the actuated tree valves can be initiated as required in an ESD event but it is often overlooked that there are at least 6 potential tree assembly leak paths below a closed production master valve which in the event of failure would provide provide an uncontrolled flow scenario without the availability to isolate the wellbore below the tree, albeit at reduced rate compared to losing full bore containment.

Reliance on check valves is also discussed and regarded negatively but we rely on them solely when carrying out wellhead maintenance greasing operations but as time has progressed the management of that operation has developed checks and operational requirements to minimise the risk. Use of the DHSV is no different and may be accepted as part of a two barrier system as long as the valve can be verified as a barrier, nothing can be dropped on top of it and there is also a plug to provide the second barrier and act as a debris barrier.

For hanger plugs I much prefer a spring loaded check valve type over a two way check valve for sealing capability and would back that up as the spring loaded version is still utilised in drill pipe Inside BOPs.

Routine test leak rates are a contentious subject both for DHSVs and tree valves so my preference is to set a much lower allowable leak rate than API 14B as a routine test to assess the valve condition and only allow leakage up to maximum following risk assessment. 

In answer to the original question I very much see the DHSV as a required barrier and likewise an Annulus Safety Valve or check valves on gas lifted wells for that matter. 

Hi Basker/Justin.

For me, DHSV's naturally fall in the the ESD systems philosophy (last resort). As you know in API they are part of the safety systems... And they are not required to be perfectly "tight" (0 leak) but rather perform a shut-off function where consequences of a resulting leak/fire would remain limited.

Many DHSV's today are reliable over time as long as you treat them with care. Following OEM recommendations, field best practices, leassons learned... I'd say it would also make sense to limit the "stress" placed on DHSV's in order to limit their chances of failure in service... for instance it would not be advisable to recommend that DHSV's are routinely tested in the worst-possible scenario (slam shut-in against full flow) just to be sure they would perform then. Doing this over and over would likely result in damage and reduced field life.

I like the proposition of Matteo for RCM... in fact I would also mention that the DHSV is part of an entire ESD system and that DHSV failures very often come from improper operation (more often than not, very high - and unnecessary - pressure kept in the CL's "just to be sure the valve is open..."). Sadly, DHSV failures in the field have therefore driven some operators to justify we're better off without them (because they fail, you see the logic...). A famous NOC in South America argued and justified that because DHSV's would fail and then force a heavy workover... since the probability of having a well control incident during workover would be higher than that of having a complete failure of a well without DHSV, hence in certain circumstances it would be more reasonable not to use DHSV's. The logic isn't bad in itself... it can be defended in a "system", using the caveats and assumptions made for the estimate. Certainly not as a blanket statement, ignoring the premises of the analysis... Otherwise with shortcuts you'd end up with a simple statement that we're better off without DHSV's, which I would certainly disagree with.

Now back to your land wells. If the discussion would be, in a regulatory vacuum, about a decision to run - or not - DHSV's... then we should elevate the discussion to risks and mitigations against appetite for risk-taking for a given oeprator. HPHT project in the middle of an urbanization? Run DHSV's... Low pressure oil wells in a remote (and non environmentally-sensitive) area? Perhaps in that case you're more comfortable running some probabilities... install concrete blocks to protect your pads/cellars, be more stringent with your surface WHM program... in short, with a commitment to having controls in place it is a lot easier justifying not having DHSV's.

From a regulator's standpoint though, this is much harder to evaluate... and so forcing all operators to have DHSV's makes more sense as this is much easier to enforce.

As you rightly pointed out... big organizations with a reputation arguably have more to lose than smaller ones... Regulating a variety of very different operators is a big challenge. Simpler standards and regulations are a way to address this... the argument then often being placed on where the bar should be set (high or low)

Hi Justin,

I work with onshore wells as well.

I do like your idea of considering a TRSSV a ESD device. That would solve the "leaky" problem and we dont have worry about a valve that leaks in the primary barrier envelope. However, some questions to consider.

1. As Matteo has pointed out, all our Xtree valves are on the same tree (PMV, SMV, FWV, KWV etc...)
   They all are in the same single point failure ...which is the Xtree.
   Damage the tree significantly enough and you have lost all your barriers in your primary envelope.
   
   That leaves your TRSSV as your last defence. (Along with your production packer).
   So considering them as your ESD devices makes sense.
   
   But , now...if you take out the TRSSV and production packer as part of an independant ESD system, how do you comply with the the dual independant, testable barrier requirement in the tubing and annulus flowpaths??
   The land wells use API which has no such definition, but Norsok and ISO do have such a definition clearly stated for compliance.
   (This is probably the reason, TRSSV are not commonly used on land wells)
   
   
2. As Matteo has stated, there is ambiguity in the definition of " natural flow".
   But my interaction with management is very clear, the loss of company cost and reputation of a uncontrolled flow or blowout on an well outweighs the risk of not installing a TRSSV. If the well is "self erupting", I have never been able to get an exception NOT to install a TRSSV when working for a sizeable O&G company, no matter how small the flowrate.

I really wish API did go the extra step and resolve this issue on land wells, but they have not, so, we will have to wait for the next major HSE event before API gets enough traction to resolve this problem.

Interesting approach, Justin, and a great contribution to this long-needed debate.

There are three points I don't necessarily agree with:

• You mention wells "capable of natural flow", but this is not a helpful nor practical definition - you could produce a trickle of water, or milk and honey after all. The most effective condition to decide when two independent barriers are required can be borrowed from process safety: whenever unrestricted flow (loss of primary containment) would lead to a major accident scenario. Most well operators know how to judge the severity of LOPC on people, environment, assets or reputation - the PEAR.
• If you close your primary barrier on surface, at the master valves, your wellhead and part of the tree will be common barrier elements. That is unfortunate, since the SSSV was introduced precisely to have a fallback option if somebody drives into the well (or a vessel drags an anchor over its subsea cousin). Mind that all other tree vales are backups to the master valves, and thus SECE (safety & environmental critical element), as well as part of the secondary barrier.
• Any barrier element is in fact a SECE. As you point out, this definition requires us to prevent failure (since they would increase risk of a major accident to unacceptable level) through planned maintenance. This maintenance will be based on function testing, detection of aging, and hopefully predictive replacement of the SECE if failure is incipient. This is exactly what we do for SSSV's. In fact, API 14B sets minimum requirements for SECE maintenance, which complement the usual reliability-centered maintenance (RCM) approach.

So I guess what you're saying is that we still need to maintain the SSSV to prevent failure, with frequent testing. Might as well call it a barrier element too.

Unless you suggest that we grow up and do proper RCM of SSSV, which I would fully support.

Best regards,

Good morning,

I've followed the discussion for a while now.

A barrier has to be tested and be verifiable. In drilling we have drilling fluid which is only a barrier if we can determine its density and level in the well. The BOP forms the secondary barrier. In MPD, SBP and drilling fluid density is the primary barrier. Barrier envelopes are shared between the two as both rely on formation, LOT/FIT, casing, and the BOP-wellhead connector.

For production, there is one barrier to the environment and it is essentially only one barrier wherever you look: gaskets, single wall pipe, valves, etc. Shutting in a well due to surface production issues is a different kettle of fish. Your FWV can be sufficient, followed by the UMV, and maybe the SSSV. However, at that point you don't know if the SSSV is actually sealing as the well conditions are pretty much steady state. That is, until you're bleeding off the well at which point you are testing the SSSV.

During workover and interventions, the well is pumped (SS or CT) or bullheaded dead providing the first barrier. There may be losses but as long as the level can be maintained and is overbalanced, a barrier exists. This is going back to first point of it being verifiable and tested. The second barrier is a deep-set plug in the production packer and the third barrier is a plug in the tubing head or somewhere below the production tree. Only, when those barriers are in place can the tree be removed. Any intervention on the tree should equally consider the number of required barriers: tubing hanger plug and closed LMV for any work above the LMV. I would not consider the SSV a barrier to work on the LMV, there must to be a plug in the tubing hanger and even then you have only ONE barrier.

With a well circulated dead, the SSSV will be neutral and not experience any differential pressure which it often needs to close and/or effect a seal.

In my experience, DHSV (SCTRSSV) are part of the ESD but are generally not a barrier as such. This is because something unexpected happened and there is no time to bullhead anything dead or run plugs.

To answer the question: SSSV are not a barrier.

I found it important to highlight those distinctions.

Original Message:
Sent: 01-17-2024 04:33 AM
From: Justin Parker
Subject: SCSSV - a primary barrier or not?

P-E,

I agree that the points raised (both this time and last time) all have merit - but are we any closer to answering the question posed in title of the thread? And this was the main point I was trying to address, and the responses seem to validate, is there needs to be a clear, consistent frame of reference on the how the SSSV/DHSV is primarily viewed with respect to well integrity.

At a practical level, what most people want is a defined framework in how to carry out their job, and this starts at the top with Standard Agencies the Regulator's.

If Well Integrity Regulations/Policies/Standards adhere to the approach of reducing the risk to ALARP through a minimum of two independently tested barrier envelopes, then the starting point should be a SSSV/DHSV is a required element of a primary barrier envelope.

If not installed, companies have to demonstrate why they deem the risk acceptable - and from some of the responses, the justifications are varied.

And to draw in one of the other areas of apparent debate, one of, if not, the mitigating factor(s) has to be along the lines of - if the XT is removed (by fair means or foul) and without any other devices downhole, am I going to regret not having a SSSV/DHSV installed?

Whether this is termed natural flow or eruptive flow, following on from the above, most people just want a clear and consistent definition adopted across the board, so we are all speaking the same language - again, step in Standards Agencies and Steering Committees.

But like any rule, the consistency of how it is regulated, and the penalties imposed for not complying will have a major impact on its effectiveness.

However, the first step is coming to a decision on the starting point through whatever means is considered most effective, otherwise one aspect of the future of well integrity will be an ongoing conversation revolving around SSSV's - unlike one I am pretty sure we are not having on the terminology and use of blowout preventers during specific phases of the well's life cycle (.......... at least I hope we're not).

Justin Parker CEng FIMechE
Well Integrity
Occidental
Email: justin_parker@oxy.com

I have been following this discussion from many esteemed colleagues. Thanks for sharing your thoughts.

Another option is not to consider the SCSSV as a barrier. Essentially, conceptualizing an SCSSV as a light switch that functions on demand is an expectation beyond what an SCSSV can deliver. Leaks can escalate faster than anticipated through erosion, complete seal failure, lack of maintenance, fluid effects etc. numerous possibilities.

It may be more reasonable to consider an SCSSV as part of the mitigation system to reduce the outcome of a catastrophic event. With a discussion in this mindset, it may be more difficult to challenge whether a SCSSV should be utilized or not. API allows for some leakage which in essence suggests a workover is not imminent however monitoring and workover plans can be drafted for maintenance on the well as there may be more going on than what is perceived. Example chemicals for corrosion program are incorrect, etc....

I agree with Dan that a tested, verified SCSSV with a BACKUP plug may reduce the risk to ALARP, allowing a workover to proceed. 

I agree with the analogy of working on a pipeline with pressure on one sie of a check valve is taboo and not allowed.

Cheers

There are different types of barriers, and these behave differently and should be treated differently.  Casing, tubing, and wellheads are what I call "fixed mechanical barriers" in my classes.  These are always acting as a barrier (until they fail).  A SCSSV is what I call an "activated mechanical barrier".  For these to be functional barrier elements, we must detect the need to activate it, it has to close/activate when signal is sent, and it has to hold pressure once it closes.  Testing fixed mechanical barriers is easy, and we trust that test for a long time.  Activated mechanical barriers require much more extensive verification than the initial pressure test upon installation.  BOP's are an example of activated mechanical barriers.  Although they are open in their normal operating state, I don't think there is a debate about whether or not BOP's are barriers.  We perform pit drills to verify the ability to detect the need to activate the BOP's.  We perform function drills to verify the activation mechanism, and BOP tests to verify it will hold pressure.  However, none of these steps guarantees the BOPs will close and hold pressure when called upon (as evident by failed BOP tests).  The BOP elements are exposed to mechanical forces, hydraulic flow, and debris (similar to an SCSSV), all of which can damage the BOP, causing it to fail next time it is called upon.  Just like we consider the BOP a barrier element, we consider SCSSV's barrier elements.

It is important to understand the barrier elements you rely on.  The first concern with any activated barrier element is that it may not hold pressure next time: you have to rely on testing statistics for comfort.  The SCSSV has some design functions that also are concerning when relying on them as barriers.  The main concern is that they can be forced open by an object falling from above.  This is not a concern during production, so I am totally comfortable with SCSSV as a barrier during production.  When removing the well head or running wireline, there is a chance of dropping objects into the well and I become less comfortable with SCSSV as my barrier.  To manage that risk, I have performed wellhead work using a BPV with the seals removed to function as a junk catcher to protect my SCSSV we used as a barrier element. 

Acceptable leak rate is also a conditional issue.  We talk about acceptable leak rates all the time, but there is an important caveat:  there is generally zero acceptable leak rate to atmosphere.  Your SCSSV can have an acceptable leak rate, but your wellhead cannot.  A valve can have an acceptable leak rate past the gate, but not through the stem packing (and to atmosphere).

My overall rule is that if it holds pressure, it can be used as a barrier.  However, we must understand the limitations of that barrier elements and how the barrier is to be used (production, well work, or P&A)

I have been following this discussion from many esteemed colleagues. Thanks for sharing your thoughts.

Another option is not to consider the SCSSV as a barrier. Essentially, conceptualizing an SCSSV as a light switch that functions on demand is an expectation beyond what an SCSSV can deliver. Leaks can escalate faster than anticipated through erosion, complete seal failure, lack of maintenance, fluid effects etc. numerous possibilities.

It may be more reasonable to consider an SCSSV as part of the mitigation system to reduce the outcome of a catastrophic event. With a discussion in this mindset, it may be more difficult to challenge whether a SCSSV should be utilized or not. API allows for some leakage which in essence suggests a workover is not imminent however monitoring and workover plans can be drafted for maintenance on the well as there may be more going on than what is perceived. Example chemicals for corrosion program are incorrect, etc....

I agree with Dan that a tested, verified SCSSV with a BACKUP plug may reduce the risk to ALARP, allowing a workover to proceed. 

I agree with the analogy of working on a pipeline with pressure on one sie of a check valve is taboo and not allowed.

Cheers

There are different types of barriers, and these behave differently and should be treated differently.  Casing, tubing, and wellheads are what I call "fixed mechanical barriers" in my classes.  These are always acting as a barrier (until they fail).  A SCSSV is what I call an "activated mechanical barrier".  For these to be functional barrier elements, we must detect the need to activate it, it has to close/activate when signal is sent, and it has to hold pressure once it closes.  Testing fixed mechanical barriers is easy, and we trust that test for a long time.  Activated mechanical barriers require much more extensive verification than the initial pressure test upon installation.  BOP's are an example of activated mechanical barriers.  Although they are open in their normal operating state, I don't think there is a debate about whether or not BOP's are barriers.  We perform pit drills to verify the ability to detect the need to activate the BOP's.  We perform function drills to verify the activation mechanism, and BOP tests to verify it will hold pressure.  However, none of these steps guarantees the BOPs will close and hold pressure when called upon (as evident by failed BOP tests).  The BOP elements are exposed to mechanical forces, hydraulic flow, and debris (similar to an SCSSV), all of which can damage the BOP, causing it to fail next time it is called upon.  Just like we consider the BOP a barrier element, we consider SCSSV's barrier elements.

It is important to understand the barrier elements you rely on.  The first concern with any activated barrier element is that it may not hold pressure next time: you have to rely on testing statistics for comfort.  The SCSSV has some design functions that also are concerning when relying on them as barriers.  The main concern is that they can be forced open by an object falling from above.  This is not a concern during production, so I am totally comfortable with SCSSV as a barrier during production.  When removing the well head or running wireline, there is a chance of dropping objects into the well and I become less comfortable with SCSSV as my barrier.  To manage that risk, I have performed wellhead work using a BPV with the seals removed to function as a junk catcher to protect my SCSSV we used as a barrier element. 

Acceptable leak rate is also a conditional issue.  We talk about acceptable leak rates all the time, but there is an important caveat:  there is generally zero acceptable leak rate to atmosphere.  Your SCSSV can have an acceptable leak rate, but your wellhead cannot.  A valve can have an acceptable leak rate past the gate, but not through the stem packing (and to atmosphere).

My overall rule is that if it holds pressure, it can be used as a barrier.  However, we must understand the limitations of that barrier elements and how the barrier is to be used (production, well work, or P&A)

I have been following this discussion from many esteemed colleagues. Thanks for sharing your thoughts.

Another option is not to consider the SCSSV as a barrier. Essentially, conceptualizing an SCSSV as a light switch that functions on demand is an expectation beyond what an SCSSV can deliver. Leaks can escalate faster than anticipated through erosion, complete seal failure, lack of maintenance, fluid effects etc. numerous possibilities.

It may be more reasonable to consider an SCSSV as part of the mitigation system to reduce the outcome of a catastrophic event. With a discussion in this mindset, it may be more difficult to challenge whether a SCSSV should be utilized or not. API allows for some leakage which in essence suggests a workover is not imminent however monitoring and workover plans can be drafted for maintenance on the well as there may be more going on than what is perceived. Example chemicals for corrosion program are incorrect, etc....

I agree with Dan that a tested, verified SCSSV with a BACKUP plug may reduce the risk to ALARP, allowing a workover to proceed. 

I agree with the analogy of working on a pipeline with pressure on one sie of a check valve is taboo and not allowed.

Cheers

Hans-Jacob,

I can see why you have come up with the concept of activated and fixed mechanical barriers as a way to distinguish and develop separate treatment criteria. This does make sense, to a certain extent, and at the same time adds another layer of complexity. The only two barriers while drilling are the drilling fluid (with SBP when MPD) and the BOP (secondary). Casing, wellheads, BOP body, riser (between WH and BOP, BOP and RCD), spools, etc. are well barrier elements and most of them are shared between the primary and secondary barrier.

The SSSV is part of the primary and secondary barrier envelope. I have a hard time to regard anything as a barrier that has an allowable leak rate. When we test a BOP ram or annular, and it leak, we repair it. The SSSV leaks and we are OK with it. Your cement plug leaks, you squeeze until it stops. A bridge plug that won't hold gets replaced or another one added until there is zero leak. A leaking SSSV, no replacement, until it gets too bad. I do not think that the SSSV should be the primary barrier by default. During any workover or planned intervention, a tested plug is the only primary barrier. That must be the default position. We can then go and challenge that position by showing the well condition (water injector, subhydrostatic dead oil, etc.) is non-conducive to natural flow of HC to surface. A risk assessment will then allow to consider alternatives and the SSSV (or FIV) may suffice.

Another issue with a SSSV is its position in the well. Tubing may be corroded to such an extent that production pressures are contained but, shut-in on the SSSV may increase the pressure to rupture the tubing below and lead to collapsing the tubing above. Therefore, plugs in the production packer are ideal and tubing head plugs prevent any bypassing of the SSSV even with ruptured tubing. Concluding that the SSSV is a bad choice as a primary barrier for planned well intervention, especially work on the wellhead or production tree.

For almost any work on the production tree, I would not sign off on that work if I knew that the only barrier is a potentially leaking SSSV. Installing a BPV with removed seals as a debris barrier and relying on the SSSV as your only barrier is more than pushing the envelope. Unless, we are talking some very specific risk-assessed cases such as water injectors open to the water zone only, tar sand wells that have not been on production, underpressured dead oil, water producers for water injection, proven subhydrostatic reservoir, etc. (non-exhaustive list) that can be under a single barrier.

I very much see the SSSV as a mitigation to a fully developed blow-out, only. Like a run-flat tire, I won't win a race but am not stranded by the side of the road hoping for help.

Cheers,

Matthias

There are different types of barriers, and these behave differently and should be treated differently.  Casing, tubing, and wellheads are what I call "fixed mechanical barriers" in my classes.  These are always acting as a barrier (until they fail).  A SCSSV is what I call an "activated mechanical barrier".  For these to be functional barrier elements, we must detect the need to activate it, it has to close/activate when signal is sent, and it has to hold pressure once it closes.  Testing fixed mechanical barriers is easy, and we trust that test for a long time.  Activated mechanical barriers require much more extensive verification than the initial pressure test upon installation.  BOP's are an example of activated mechanical barriers.  Although they are open in their normal operating state, I don't think there is a debate about whether or not BOP's are barriers.  We perform pit drills to verify the ability to detect the need to activate the BOP's.  We perform function drills to verify the activation mechanism, and BOP tests to verify it will hold pressure.  However, none of these steps guarantees the BOPs will close and hold pressure when called upon (as evident by failed BOP tests).  The BOP elements are exposed to mechanical forces, hydraulic flow, and debris (similar to an SCSSV), all of which can damage the BOP, causing it to fail next time it is called upon.  Just like we consider the BOP a barrier element, we consider SCSSV's barrier elements.

It is important to understand the barrier elements you rely on.  The first concern with any activated barrier element is that it may not hold pressure next time: you have to rely on testing statistics for comfort.  The SCSSV has some design functions that also are concerning when relying on them as barriers.  The main concern is that they can be forced open by an object falling from above.  This is not a concern during production, so I am totally comfortable with SCSSV as a barrier during production.  When removing the well head or running wireline, there is a chance of dropping objects into the well and I become less comfortable with SCSSV as my barrier.  To manage that risk, I have performed wellhead work using a BPV with the seals removed to function as a junk catcher to protect my SCSSV we used as a barrier element. 

Acceptable leak rate is also a conditional issue.  We talk about acceptable leak rates all the time, but there is an important caveat:  there is generally zero acceptable leak rate to atmosphere.  Your SCSSV can have an acceptable leak rate, but your wellhead cannot.  A valve can have an acceptable leak rate past the gate, but not through the stem packing (and to atmosphere).

My overall rule is that if it holds pressure, it can be used as a barrier.  However, we must understand the limitations of that barrier elements and how the barrier is to be used (production, well work, or P&A)

I have been following this discussion from many esteemed colleagues. Thanks for sharing your thoughts.

Another option is not to consider the SCSSV as a barrier. Essentially, conceptualizing an SCSSV as a light switch that functions on demand is an expectation beyond what an SCSSV can deliver. Leaks can escalate faster than anticipated through erosion, complete seal failure, lack of maintenance, fluid effects etc. numerous possibilities.

It may be more reasonable to consider an SCSSV as part of the mitigation system to reduce the outcome of a catastrophic event. With a discussion in this mindset, it may be more difficult to challenge whether a SCSSV should be utilized or not. API allows for some leakage which in essence suggests a workover is not imminent however monitoring and workover plans can be drafted for maintenance on the well as there may be more going on than what is perceived. Example chemicals for corrosion program are incorrect, etc....

I agree with Dan that a tested, verified SCSSV with a BACKUP plug may reduce the risk to ALARP, allowing a workover to proceed. 

I agree with the analogy of working on a pipeline with pressure on one sie of a check valve is taboo and not allowed.

Cheers

I have been following this discussion for a while, a discussion that I feel has been there for ages, without us really getting anywhere?

I think this happens because we are trying to consider the SCSSV as a primary barrier both from a production and a construction/intervention perspective.

Primary barrier is the "first well barrier envelope that prevents undesired flow from a source of inflow/reservoir" as defined in Norsok D-010. For practical purposes you may say "the components being in direct contact with the pressure source".

When we started drawing well barrier schematics back in the 90's, the fundamental was drilling operations with overbalanced fluid as primary barrier and the casing/wellhead/BOP as secondary barrier. Further to this the production operation was shown as packer/tubing/SCSSV as primary barrier and the casing/wellhead/x-mas tree being the secondary barrier.

In hindsight this is possibly where the "problem" started;

• Drilling fluid is clearly a primary barrier when drilling, and we close the BOP as part of a secondary barrier envelope if we have an issue in the well.
• During production, the primary barrier is really the tubing and x-mas tree (and subsequently the pipe leading to the consumers), if anything happens, we will shut a valve on the x-mas tree. But we did realize the vulnerability of the wellhead and x-mas tree (offshore platform and subsea installation) and seeing the frightening pictures of wells being blown up in Kuwait in 1990/91, thus the SCSSV became a remedial solution to this vulnerability. As such the SCSSV could have been considered as secondary barrier, but that would include the wellhead as a common barrier and thus not really fulfilling the ambition.

The only way we can principally accept a two-barrier philosophy with the SCSSV as a primary barrier is if we consider the well barrier schematic to be drawn in a "shut-in" state – this is what the situation will look like when we have stopped operation and secured any situation – this is then a fundamental we must accept to leave us with a clean two barrier envelope illustration.

Further to this, once the need or desire for a SCSSV was established people wanted to show it's significance during construction and intervention, and this is when the next "problem" starts; This has never been the intended purpose of the SCSSV, it is there for production safeguarding. We should point blank ban it from being used as a well barrier element in construction/intervention mode. It is too vulnerable for this purpose, with its permitted small leak, qualification hurdles etc.

To me the initial question is raised because of a desired construction/intervention use that SCSSV has never been intended for, thus;

• Never use the SCSSV as a barrier element for construction/intervention
• Use the SCSSV as a primary barrier element in an eruptive production well to show the well barrier envelopes for a secured shut in well 

Hans-Jacob,

I can see why you have come up with the concept of activated and fixed mechanical barriers as a way to distinguish and develop separate treatment criteria. This does make sense, to a certain extent, and at the same time adds another layer of complexity. The only two barriers while drilling are the drilling fluid (with SBP when MPD) and the BOP (secondary). Casing, wellheads, BOP body, riser (between WH and BOP, BOP and RCD), spools, etc. are well barrier elements and most of them are shared between the primary and secondary barrier.

The SSSV is part of the primary and secondary barrier envelope. I have a hard time to regard anything as a barrier that has an allowable leak rate. When we test a BOP ram or annular, and it leak, we repair it. The SSSV leaks and we are OK with it. Your cement plug leaks, you squeeze until it stops. A bridge plug that won't hold gets replaced or another one added until there is zero leak. A leaking SSSV, no replacement, until it gets too bad. I do not think that the SSSV should be the primary barrier by default. During any workover or planned intervention, a tested plug is the only primary barrier. That must be the default position. We can then go and challenge that position by showing the well condition (water injector, subhydrostatic dead oil, etc.) is non-conducive to natural flow of HC to surface. A risk assessment will then allow to consider alternatives and the SSSV (or FIV) may suffice.

Another issue with a SSSV is its position in the well. Tubing may be corroded to such an extent that production pressures are contained but, shut-in on the SSSV may increase the pressure to rupture the tubing below and lead to collapsing the tubing above. Therefore, plugs in the production packer are ideal and tubing head plugs prevent any bypassing of the SSSV even with ruptured tubing. Concluding that the SSSV is a bad choice as a primary barrier for planned well intervention, especially work on the wellhead or production tree.

For almost any work on the production tree, I would not sign off on that work if I knew that the only barrier is a potentially leaking SSSV. Installing a BPV with removed seals as a debris barrier and relying on the SSSV as your only barrier is more than pushing the envelope. Unless, we are talking some very specific risk-assessed cases such as water injectors open to the water zone only, tar sand wells that have not been on production, underpressured dead oil, water producers for water injection, proven subhydrostatic reservoir, etc. (non-exhaustive list) that can be under a single barrier.

I very much see the SSSV as a mitigation to a fully developed blow-out, only. Like a run-flat tire, I won't win a race but am not stranded by the side of the road hoping for help.

Cheers,

Matthias

There are different types of barriers, and these behave differently and should be treated differently.  Casing, tubing, and wellheads are what I call "fixed mechanical barriers" in my classes.  These are always acting as a barrier (until they fail).  A SCSSV is what I call an "activated mechanical barrier".  For these to be functional barrier elements, we must detect the need to activate it, it has to close/activate when signal is sent, and it has to hold pressure once it closes.  Testing fixed mechanical barriers is easy, and we trust that test for a long time.  Activated mechanical barriers require much more extensive verification than the initial pressure test upon installation.  BOP's are an example of activated mechanical barriers.  Although they are open in their normal operating state, I don't think there is a debate about whether or not BOP's are barriers.  We perform pit drills to verify the ability to detect the need to activate the BOP's.  We perform function drills to verify the activation mechanism, and BOP tests to verify it will hold pressure.  However, none of these steps guarantees the BOPs will close and hold pressure when called upon (as evident by failed BOP tests).  The BOP elements are exposed to mechanical forces, hydraulic flow, and debris (similar to an SCSSV), all of which can damage the BOP, causing it to fail next time it is called upon.  Just like we consider the BOP a barrier element, we consider SCSSV's barrier elements.

It is important to understand the barrier elements you rely on.  The first concern with any activated barrier element is that it may not hold pressure next time: you have to rely on testing statistics for comfort.  The SCSSV has some design functions that also are concerning when relying on them as barriers.  The main concern is that they can be forced open by an object falling from above.  This is not a concern during production, so I am totally comfortable with SCSSV as a barrier during production.  When removing the well head or running wireline, there is a chance of dropping objects into the well and I become less comfortable with SCSSV as my barrier.  To manage that risk, I have performed wellhead work using a BPV with the seals removed to function as a junk catcher to protect my SCSSV we used as a barrier element. 

Acceptable leak rate is also a conditional issue.  We talk about acceptable leak rates all the time, but there is an important caveat:  there is generally zero acceptable leak rate to atmosphere.  Your SCSSV can have an acceptable leak rate, but your wellhead cannot.  A valve can have an acceptable leak rate past the gate, but not through the stem packing (and to atmosphere).

My overall rule is that if it holds pressure, it can be used as a barrier.  However, we must understand the limitations of that barrier elements and how the barrier is to be used (production, well work, or P&A)

I have been following this discussion from many esteemed colleagues. Thanks for sharing your thoughts.

Another option is not to consider the SCSSV as a barrier. Essentially, conceptualizing an SCSSV as a light switch that functions on demand is an expectation beyond what an SCSSV can deliver. Leaks can escalate faster than anticipated through erosion, complete seal failure, lack of maintenance, fluid effects etc. numerous possibilities.

It may be more reasonable to consider an SCSSV as part of the mitigation system to reduce the outcome of a catastrophic event. With a discussion in this mindset, it may be more difficult to challenge whether a SCSSV should be utilized or not. API allows for some leakage which in essence suggests a workover is not imminent however monitoring and workover plans can be drafted for maintenance on the well as there may be more going on than what is perceived. Example chemicals for corrosion program are incorrect, etc....

I agree with Dan that a tested, verified SCSSV with a BACKUP plug may reduce the risk to ALARP, allowing a workover to proceed. 

I agree with the analogy of working on a pipeline with pressure on one sie of a check valve is taboo and not allowed.

Cheers