Well Control Barriers

Discussion on Suitability of Barriers (well control)

this article discuss the suitability of barrier for the following:

1. Fluids
2. Mechanical Barriers in completed Wells
3. Sub-surface Safety Valve
4. Sustension of a perforated well (with xmas tree)
5. Sub Sea Well Suspensions
6. Two Way Check Valve (TWCV)

1. Fluids as a Barrier

Only drilling mud can be defined as a truly independent fluid well barrier. It has the fundamental requirements of both overbalance and a method of sustaining the fluid column by means of the mud cake preventing the overbalance pressure injecting the fluid into the formation.

Brine (or other non-particulate fluids),on the other hand ,cannot be said to be an independent  barrier. Brine is designed not to damage the perforation/formation and cannot "Pack off" in the same manner as mud.

When brine is used as the column of fluids which provides hydrostatic overbalance , the brine requires to be isolated from the perforations to prevent it dissipating into the formation ,and thus reducing the hydrostatic head.

For this reason, brine and plug (mechanical or cement) which retains the brine cannot be considered as two independent pressure barriers ,as the brine is completely dependant on the plug not leaking.

The brine can only be said to provide a true barrier it its level can be observed continuously to ensure maintenance of the hydrostatic head. In practice this is not normally possible , especially when an upper mechanical barrier encloses the brine column.

Discussion fluids as a barrier

Consider the case of a lower and upper pressure tested barrier with a column of overbalanced brine held in place between the two barriers by the integrity of the lower barrier ;If the lower barrier should leak then hydrostatic overbalance pressure will cause the brine to dissipate beneath this barrier towards the formation .The head of brine will continue falling until the hydrostatic overbalance disappears .It is not possible to detect /observe this fall in level without disturbing the integrity of the upper barrier.

Once of the overbalance has disappeared, then the leak allows hydrocarbons to percolate past the lower pressure barrier. Trapped below the upper pressure barrier, the only way the hydrocarbons can expand as they travel up through the brine is to displace more brine through the leaking lower barrier, exacerbating   the fall in level of brine .Ultimately pressurised hydrocarbons build up undetected underneath the upper barrier.

The brine is thus completely dependent upon the lower mechanical barrier not leaking. If this lower barrier remains leak tight then it contains the well pressure satisfactorily and there is no need for a supplementary barrier.

Taking the argument to its extreme, the brine in this situation appears not to provide any significant increase in safety benefits above the existing mechanical barriers.

In evaluating the role of brine as a barrier, the main argument in its defence is that the leakage past the lower plug would probably take some considerable time before overbalance was lost. Certainly this timescale could have consequences for the integrity of Sub-sea barriers, where by the very nature of the operation all barriers shall be capable of providing long term integrity.

A certain "level of comfort" appears to be derived by having circulated an annulus and tubing contents to brine. From the above argument brine is clearly not an independent barrier and thus does not provide a "third" barrier as is often suggested.

If only the tubing contents were to be displaced to brine, leaving the annulus remaining with, say inhibited sea water , then this would be a clear case of dual standards in respect of barriers for the tubing annulus.

A justification exists for using overbalanced brine with some wireline plugs to assist the lower mechanical barrier in the tubing, as there may be the need to energise the "Vee" packings in wireline plugs. The latter require a differential pressure to maintain the seal is energised in the opposite direction to the formation, i.e.from above only. Secondly the seal systems on these plugs are not symmetrical and thus sealing from above is not a good indication of pressure integrity from below.

2. Mechanical Barriers (Completed Well)

Only the deepest set mechanical barrier can be truly leak tested in the direction of formation pressure .The upper , mechanical barrier therefore can only be tested  from above, unless tubing/annulus communication exists above the bottom barrier.

In the case of only being able to pressure test the upper barrier from above, the sealing mechanism between the mechanical barrier and the tubing (and the sealing mechanism between any bleed-off device and the mechanical barrier) shall have symmetrical seals so that a pressure test from above is a good indication of pressure integrity from below.

NOTE: A two way check valve should not be used in this case as a test from above does not indicate that it will hold pressure from below, the sealing faces being different for each direction of flow. (See section 6.)

Discussion mechanical barriers

The mechanical pressure barriers in the annulus consist of the lower packer and upper tubing hanger/ wellheads   seal .These mechanical barriers(packers) are set under as near ideal conditions as can be achieved down hole. Tubing hanger seals /wellhead seals are now designed to provide metal to metal sealing as the primary seal. There is a high level of confidence in both barriers ability to contain well pressure and remain leak tight as during the operation of the well they have been tested (monitored) over a considerable length of time.

The "quality" of the mechanical pressure barriers set in the tubing should ideally give the same degree of confidence in their ability to remain leak tight and contain well pressure.

There appears to be no documented evidence on the subject of long term integrity of wireline plugs for use as mechanical pressure barriers in tubing and therefore personal experience, etc has been used in any discussion on the subject to date.Subsequently this topic was reviewed during two QRAS on barriers Requirements , and subjective reliability figures used. The result of these QRAs was to convince the HSE (who had queried our adoption of two barriers as our standard, instead of their stated requirement for three),that indeed two independent barriers, if properly tested, was the optimum.

For general purposes, and longer term suspension programmes in particular ,especially in sub-sea wells, a retrievable packer/bridge plug system is preferred , as with these systems energy is locked into the seal system by virtue of the setting operation .A standard wireline plug system using Vee  packings, relies on the seal being maintained by pressure differential .Wireline plugs using modulec seals are available for TFL completions, but require pressure assistance to install. The seal still relies on differential pressure and may be difficult to retrieve.

Retrievable bridge plugs have been developed and used successfully as both a lower and upper mechanical pressure barrier in the tubing string. These retrievable plugs are considered to be capable of providing a long term barrier.

Communication between anulus and tubing in a completed well

If the integrity of the bottom pressure barrier is confirmed then communication between annulus and tubing above this bottom barrier does not require any extra barrier over and above the second upper barrier.

The concept of "two pressure vessels" is maintained with reservoir pressure contained by :

1. The lower line of defence comprising the integrity of both the packer in the annulus and the mechanical pressure barrier in the tubing.
2. The upper line of defence comprising the tubing hanger/ wellhead seals (and side outlet valves) in the annulus and the upper mechanical pressure in the tubing

In this case the upper mechanical pressure barrier in the tubing can be pressure tested from below via the communication with the annulus.

3. Sub-surface Safety Valve as a Well Barrier

A Subsurface Safety Valve (SSSV) may be used as a well barrier provided

1. the SSSV is leak tested and confirmed leak tight.
2. the tubing integrity from the packer to the SSSV is satisfactory and confirmed leak tight, and
3. the SSSV is inhibited from opening by isolation of the hydraulic control and balance lines.

This implies that Ball Valve type  SSSVs are superior as a barrier (see below)

The SSSV is designed to retain the maximum differential pressure across the valve that may be generated in a well .This differential is normally seen during routine testing. Prior to being installed in a well ,the SSSV is tested onshore to its working pressure.

Having proved the SSSV to be leak tight in the well, then should pressure increase below the SSSV this will assist the sealing mechanism of the valve.

The SSSV is designed to retain pressure across the range of temperatures observed in a well. This is applicable to both the metallic parts and the elastomers.

In the case of a wireline Retrievable SSSV  of a wireline Retrievable SSSV, the mode of retention of the SSSV in the nipple is fundamentally the same at the mechanical retention of a wireline plug set in a nipple .The ability to remain set in the nipple is tested during the leak test .A Tubing  Retrievable SSSV  is designed and installed as a part of production tubing completion .Thus there is no potential to move up-hole under application of differential pressure.

The type of SSSV (Ball or Flapper) has a bearing on the reability of the valve to remain sealing:

Ball Valve

In the case of a Ball Valve isolating the accumulator from the balance line positively prevent the ball rotating and hence maintains the seal integrity .Any flow of fluid down through the valve ,lifting it off its seat, will be temporary ,and any reversal of flow /pressure will immediately reseat the ball.

Flapper Valve

In the case of flapper valve, unlike the ball, there is no certainly that the flapper will remain our reseat once differential pressure is removed – The spring which induces flapper closure can not be relied on the same way. Thus, a flapper valve should not relied on as a barrier where there is the possibility of it being unseated, e.g. by pressure reversal or a dropped object.

The argument that a flapper valve is of  no use as an emergency device(its prime function in life), does not follow , as the valve will close an a flowing well situation irrespective of spring action ,where fluid dynamics will ensure the flapper moves the closed position once the protective sleeve moves up. This is also the case for a well suspended with the Xmas Tree installed (See section 5) , where a flapper valve is the normal safety device that would be installed during the production phase of the well.

In considering the case of an SSSV that is used as a barrier, the problem that arises of how one can leak test the surface barrier,e.g .the tree or a retrievable bridge plug, This arises as once can not easily trap pressure between the SSSV and surface with a chance of observing meaningful flow through the barrier, except in a gas environment. In this case its considered acceptable to adopt the following procedures:

1. If a Xmas Tree Valve is to be used as the surface barrier , then first leak test the Tree Valve , open it close and leak test the SSSV ,and then close the Tree valve. Due to the high reliability of gate valves this procedure is acceptable (See 4 and 5 below)
2. If a plug is to be used as a surface barrier , it must be of a type that a pressure test from above gives assurance that the plug will hold pressure from below First  close and leak test SSSV, and then set and pressure test the plug.

In both cases, leave the pressure differential across the SSSV,i.e, do not equalise. This ensures that work is carried out in a situation where there is no pressure below the top barrier.

If the SSSV is found not to be leak tight when tested, then either a replacement SSSV may be run and tested, or a wireline plug may be set in the nipple profile ,in that its seal bore is know to be in good shape( being in continual use for the SSSV) and that the condition of this upper nipple profile with regards to erosion and sealing is generally found to be significantly better than on deeper nipples.

Using the SSSV as the top (secondary) Barrier

When proposing/ accepting an SSSV as a barrier ,one must consider the potential mode of failure in the particular application. Unseating and re- sealing of the valve has been considered above . The other prime failure mode is due to impact  of a dropped object. Primarily a wireline toolstring past the Xmas Tree valves with the BOP/ Lubricator removed) , then the valve is directly exposed to the possible impact if the string were to be dropped . This possibility is real , and it has happened , even recently.

The consequences  are likely to be different for Ball and Flapper types valves .A flapper valve is likely  to shatter , and toolstring  and debris will fall into the lower plug, not only causing and awkward fishing problem, but possibly compromising the integrity of the lower barrier. For this reason a flapper valve is not generally acceptable in this relative position ( but see  below).

On the other hand a valve type SSSV is known to be extremely robust, and attempting to shatter the ball in a failed valve to gain access to the lower part of the well has caused great difficulty .The  sealing ability of the ball  after such as impact  is likely to have been impaired , but it will still provide an availability of the tree valves this provides sufficient confidence to consider the arrangement acceptable practice. Use of the technique should still be treated with caution, especially in high pressure situations, and in particular gas wells.

In order to use a Flapper type SSSV as the top barrier when removing the BOPs / tree , it is therefore necessary to use , e.g.a TWCV , as a debris barrier. This is also good practice for Ball type SSSVs in that  any debris that would otherwise fall into the well during the Tree/Bop removal process may be recovered easily, as well protecting SSSV from impact damage .Note that the TWCV may provide additional isolation security but it can NOT be relied on formally to act as a barrier (See Note 6).

4. Suspension of a perforated well (with xmas tree)

a perforated well may be suspended if the completion and Xmas tree has been run, utilising  the Sub-Surface  Safety Valve (SSSV) to provide the primary well barrier in the tubing. This is conditional on the integrity of the packer and the tubing from the packer  to the SSSV having been tested as leak tight.

The SSSV shall be leak tested to confirm it as being leak tight ( and set in its nipple if wireline retrievable ). Do not equalise pressure across the SSSV prior to closing  the surface (Tree) valve  (see below).

If the SSSV is not leak tight, then it can either be replaced with a new valve, or a wireline plug set above it and tested.

If the tubing from packer to SSSV is leaking then a wireline plug shall be set below the packer (in the tailpipe) and leak tested.

The second barrier is provided by the tested casing , the integrity of tubing hanger seals in the wellhead and the Xmas tree.

The Xmas Tree is considered to be a single barrier with redundancy. It is good practice to consider the tree outer valves as the working  barrier , with the UMGV and LMGV remaining open and providing redundancy should a problem develop .This will not be possible if the purpose of the suspension is to repair a tree valve , in which case the next lower valve may be used. The benefit of this is that is possible to monitor the status of the lower barrier by measuring the pressure in the tree, either using SCADA ( e.g. CAPO) or by attaching a pressure gauge to the tree cap and cracking the swab valve.

In this case the integrity of the valve(s) to hold pressure from below shall be ascertained prior to setting the primacy barrier ( closed SSSV or wireline plug) The valve then has to be opened to allow setting /testing of the primacy barrier .The design of the tree valves is such that there is high confidence in their ability to maintain an effective barrier after single open/ close operation .

However it must also be realised that that with these valves ( both split gate and slab gate styles ) a pressure test from above is not a satisfactory indication of the valves ability to hold pressure from below.

In the case of long term isolation , it may be considered appropriate to close the UMGV to minimise potential leak paths. However, should the UMGV prove to be leaking (across the valve) and unable to be leak tested satisfactory , then the LMGV may be used to provide the well barrier.

On Platform wells the integrity of the barriers in the suspended well shall be monitored at advised intervals via the Xmas tree and annulus side outlets.

Leaking packer

If the packer is leaking then a cement plug shall be set below the packer to isolate the annulus from well communication.

This may be achieved by a cement plug set a cross the perforations or by a column of cement set above an expandable , mechanical "through tubing bridge plug"; In both cases the integrity and position of the TTBP/ Cement plug must be properly ascertained before proceeding to use this as the barrier.

For Subsea Well Suspensions, refer to section 5

5. Sub Sea Well Suspensions

Sub sea wells may be suspended following completion and perforation / production testing utilising the principle of two mechanical barriers.

The primary barrier is provided by the packer , tubing and TRSSSV ,which are leak tested as being leak tight.

The secondary barrier is provided by the pressure tested casing, the tubing hanger seals in the wellhead and the sub-sea Xmas tree valves(FWV, SWAB, ANSWAB,ASV) previously tested leak tight.

A further, dependent barrier exists within the Xmas tree ,i.e a previously tested UMGV and AMGV.

The use of the TRSSSV, completion and Xmas tree valves to provide well barriers in a suspended sub-sea well are considered effective and minimise the need for further intervention ( and exposure to risk) to either install or remove additional mechanical or fluids barriers.

Suspension after flow test without monitoring facilities

A Sub-sea well will be suspended as such after production testing via the vertical riser system, and prior to the flowline and monitoring facilities being hooked up/ commissioned at the platform .The condition of the valves (TRSSSV and Xmas Tree Valves) and tubing is therefore expected to be at their best , and the well will not be suspended ( and the rig move of location) before these valves have been satisfactorily leak tested.

It has to be assumed that the design of the Xmas tree valves, having been previously tested immediately prior to leak testing of the TRSSSV will ensure repeated confidence to hold pressure from below after their further operation to perform the leak test of the TRSSSV.It must be noted that the design of the Xmas tree valves does not allow a pressure test from above to indicate the valve's ability to hold pressure from below.

The possibility of hydrocarbon leakage past valves must always be assumed to exist , which could result in pressure developing under the tree cap or to the flowline isolation valve.

Pressure developing under the tree cap would prevent its removal and the gaining of vertical entry until the well could be "killed". Direct vertical entry of a sub-sea well provides the normal route by which such a well would be "killed". If vertical  entry is inhibited by internal Xmas tree valve leakage then a kill facility other than by direct vertical entry shall be provided. This shall be by providing the guide base. A bleed/ monitoring facility shall be provided between the Xmas tree and the FIV if the flowline is left suspended .

Access to the flowline downstream of the FIV may be via a number of methods .Usually this would be by gaining vertical access to an adjacent well, where the flowlines are already manifold together .The kill path would then be across the top of this well to the adjacent tree. Access to the flowline then allows both the tubing and the annulus, via the annulus cross –over valve , to be squeeze killed . If the flow line is suspended downstream of the Flowline Isolation Valve, then should the well need to be killed it will be necessary to provide a flexible riser connection from the flowline  to the rig .

If vertical re-entry is required to such a suspended well, then pressure monitoring facilities shall be re-established, before removal of the tree cap. If it not possible to re-establish pressure monitoring facilities, then the well shall be "killed" prior to the vertical re-entry.

Flowline tie-in

The preferred option regarding flowlines and suspended wells is to have the flowline installed (to the manifold) and hooked up to the Xmas tree prior to production flow testing , their by avoiding heavy lifting/ pull-in work in the vicinity of a 'live 'Xmas tree.

Pump out plugs

The use of pump out plugs with an under balanced fluid column in the tubing for long duration sub-sea suspensions has been considered. Gas migration past the plug would be excepted , which may induce pressures that could exceed the shear rating of the plug .Also , thermal effects may give rise to significant pressures that could exceed the shear rating of the plug. Their use, including the use of Pressure Cycled Plug (which in sub-sea applications gives rise to concerns about the fluid contents in both the flowline and the well , and hence the pressures that are actually being exerted on the plug when trying to cycle it) is not supported for long term isolation.

Control system hook-up

There is considerable risk in hooking up and testing of the control system to a suspended sub-sea well. There is a risk that the TRSSSV and Xmas tree valves could end up simultaneously in the open position.

The preferred option is therefore to suspend wells with the control and monitoring systems hooked up and fully commissioned .If this is not possible , then during hook up of the control system , the manually operated LMGV shall be closed to provide and additional barrier in the tubing. The annulus is protected by the packer and tubing integrity.

6. Two Way Check Valve (TWCV)

The use of TWO-WAY Check Valves (TWCV) as a means of providing an upper mechanical barrier in the completion tubing gives rise for concern , primarily in regard to the setting method .Furthermore  TWCV can only  be tested properly, if annulus / tubing communication exists , and even then , dirt ingress could prevent the check  from reseating if there is a pressure reversal across the valve. A test from above a TWCV does not indicate that it will hold pressure from below , as the sealing faces are different for each direction of flow.

The TWCV should be set properly in a profile within hanger pressure control equipment .i.e. a Back Pressure Lubricator consisting of a 2'' polished solid rod and "Palmer Lee" Wrenches to grip and apply torque through the pressure retaining body /system. The Back Pressure Lubricator is a cumbersome device and has a poor  operability record.

The main concern in setting a TWCV with this equipment is that the 2" polished rod, passing through all the Xmas tree valves renders the Xmas tree inoperable as a pressure control device and hence as a well barrier .There is a high potential for becoming stuck with an improperly seated TWCV and unable to release the polished rod from the TWCV .

In many instances the TWCV as the upper mechanical barrier has been secured without the use of pressure control equipment (B.P.L).This has been achieved by the use of a lower mechanical barrier and a column of brine above. This practise is considered inappropriate.

The development of wireline set tubing hanger plugs   and wireline retrievable bridge plugs have now provided a safer alternative upper tubing barrier.

The TWCV can still perform a useful role as a debris barrier, and may provide additional security against pressure , but it should not be used as a pressure barrier in its own right.