[mudman]

https://elginblowout.com/hse-report-on- ... -redacted/

It’s over six years since the G4 well on the Elgin platform on the North Sea was allowed to blow out, endangering the lives of the 238 men on board the complex.

For those 6 years, I’ve been trying to get my head around how the blowout was allowed to happen. I’m trying to make sure that eventually the lessons learnt are set down in a language accessible to non-specialist oil workers and then shared widely amongst the workforce.

It’s been a rocky road and I’ve had a lot of communications with the HSE, the Information Commissioner, the relevant Minister of State (UK) - not all of it edifying. There will be a “first-tier” tribunal hearing sometime soon, where a judge will make a decision about the “plausibility” or otherwise of the HSE’s responses to me when I asked for a copy of oil company Total’s report of their internal investigation into the near disaster. After initially telling me they had the report but were withholding it because of the pending prosecution of Total, they subsequently told me they did not have a copy and had never asked Total for a copy.

I’m making available on this board, a heavily redacted (by HSE) copy of the HSE’s report into their investigation. HSE has no plans to publish it. Anyone with any acquaintance at all with the blowout will notice that there is no mention made of the naked flame that burned in the flare stack about 100 m from the blowout at the wellhead throughout the emergency. The report asks as many questions as it answers.

I really need some support from informed oilfield engineers. I know that at the time, ROCKMAN, who uses this forum, wrote very perceptively about the blowout on “The Oil Drum” forum which has since been archived. If he or anyone else is prepared to have a look at the report posted I’d be obliged. That the lessons are not out there is a disgrace. But I need help. My MP (Member of Parliament - UK) and I will meet with the HSE sometime in the not too distant future. I need to be as clear as possible about what happened and why if I have any hope of persuading them to prepare a document and circulate it throughout the industry.

[ROCKMAN]

Mudman - Sorry for the delay getting back to you. Had started an answer and then had computer problem. Read the report twice. A lot of what I would call legal filler space. I'm not sure I can tell exactly what happened. but I'll guess it was related to some sort of failure of the surface casing. Can you tell me what happened? By coincidence I watched the movie of BP's Deep Water Horizon accident a second time a few nights ago. Still impressed with how much correct detail they went into. But even understanding drilling dynamics one could not tell what the primary cause of the blow out was. But that sort of detail couldn't be done in a movie: no one would watch it. But the movie did make it clear what was BP's decision led to the disaster: trying to save money. A small amount compared to the total cost of the well.

If you never read the details: they displaced a large amount of heavy mud with sea water to move as they were going to move off. Thus the column they planned to leave while waiting for the completion rig was less then the bottom hole/reservoir pressure. So with the poor cement job across the reservoir the well flowed down the annulus and back up the casing. That was the one huge error in the movie: stating there were no mud returns with the pumps off. Apparently no one was watching the pits and the monitoring system wasn't working. The only one that had a hint was the boat captain taking on the heavy mud: his tanks were full when their should not have been that much available to offload. Just my guess but as mud was downloaded to the boat the well was keeping the pits full.

But I'm sure you know how it goes when the shut down phase begins: everyone focused on getting off the rig and not paying much attention to what they were told was a stable well. In reality it seems like the entire mud column was displaced by the flowing oil/gas.

As I said I'm glad to offer an opinion but at least need to know what failed. How it happened would take even more details.

[mudman]

Thanks for getting back to me Rockman. There’s no great rush, so no apologies needed. Are you still in touch with Toolpush? You and he bounced ideas off one another back in 2012 on TOD. He might be interested in this. He would certainly understand it better than me. And sorry about the length of this post.

Still not a cheap out of the guys who were caught up in this near disaster. Not much self respect there I guess. They all couldn’t have been completely ignorant of what was really going on.

In the six years since Elgin there have been at least another 12 major hydrocarbon releases which “have come perilously close to disaster”. One every six months or so. That’s the verdict of Chris Flint the Director of the HSE’s Energy Division. On Elgin, the Regulator seems not to have been able to intervene once in the 8 years, from gas entering the G4 ‘A’ annulus to the blowout endangering 238 lives.

As I said, the most glaring fact about this HSE report is that there is no mention of the flame burning in the flare stack 100m from the wellhead for five days as the well blew out. There's no self-criticism by HSE in the report so presumably HSE are claiming that they did everything bythe book. But if this is the case, and a safety failure of Piper Alpha proportions can occur, then the entire regulatory system is called into question, because that’s what we had here. Only luck stopped it going up as far as I can see.

Here’s a cut back, and annotated “version” of the first part of the HSE report. I’ve tried to cut the bullshit. I’ve arbitrarily cut off the action on March 16, 9 days before the blowout, to make this readable. If you do get interested, later we can look at what happened after March 16.

According to the HSE;

The G4 well was drilled in 1997 and began producing in 2001. By April 2004, the 'A' annulus of the G4 well had SCP (sustained casing pressure).

From 2001, Total had experienced an increasing problem of high pressure gas from the 'Hod' chalk formation (situated above the ‘Fulmar’ production reservoir) leaking into well annuli.

The gas was “known”/“thought” to be entering the annuli via failures in the casing cement and in the production casing. (a hole in the casing since 2004 and left untreated? - and how else could Hod gas get into the production casing when the shoe was set below the Hod?)

Total bled off pressure to maintain these annuli within defined “safe” operating windows. This involved operators manually bleeding gas from annuli by opening wellhead valves in response to high-pressure alarms, to maintain the pressure within defined pressure limits. (Did this not just suck in more gas?)

From August 2009, there was an increasing influx of Hod gas into the 'A' annulus of G4 and other Elgin/Franklin wells. This appeared to mark a change in the behaviour of the Hod, which was previously considered to be a 'tight formation'

In response, Total repeatedly increased the G4 'A' annulus high-pressure alarm setting, which was the trigger point for bleeding pressure from the annulus. On 26 February 2007, high-pressure alarm was set at 200 bar. By 18 January 2012, the pressure alarms had been inhibited and the maximum operating pressure had been increased to 650 bar.

In March 2010, Total attempted to reduce the influx of 'Hod' gas into the 'A' annulus by pumping heavy weight (1.7 SG calcium bromide brine) into the annulus. (bullheading? - how else do you get fluid into the ‘A’ annulus?) This process, known as a volumetric kill, (how would you get gas out of the annulus, which is what I understood was a volumetric kill, while bulheading brine into the annulus?) appeared to stabilise the annulus pressure at 280bar until July 2010, when the pressure began to build again at a rate of 1-2 bar per day.

On 17 February 2011, production was lost from G4 due to the collapse of the production liner. As a result, the well was shut-in and the production tubing plugged above the collapse. The collapse of the liner is likely to have been a consequence of the 'compaction' process as the Fulmar reservoir was depleted and the formations through which the well passed subsided.

Between October 2010 and October 2011, the G4 'A' annulus was being bled down increasingly frequently to maintain it within its operating window of 300-380 bar.

In June and December 2011, Total Geosciences carried out tests on the 'A' annulus of Franklin wells F2 and F3 respectively, in an attempt to understand the increasing influx of Hod gas. (how was Hod gas getting into the ‘A’ annuli of F2 and F3 unless their production casings were also holed?) The results showed that they were unable to deplete the flow of Hod gas from well F3 and that their previous assumption that the Hod could not flow large volumes of gas (ie it was a tight formation) no longer held true. Given the significance of these findings, Total planned to carry out similar tests on the Elgin wells with 'A' annulus SCP (G4, G5 & G8) to identify whether they could also flow larger than anticipated volumes of gas.

In September 2011, it was decided to shut-in G4 and stop bleeding from the 'A' annulus and allow pressure to rise to and equalise against the Hod formation pressure. Following the cessation of bleeding, the pressure stabilised at 490 bar for three to four days before beginning to rise again.

By November 2011, the pressure had increased to 513 bar.

On 18 January 2012, to allow for the increasing 'A' annulus pressure, the maximum operating pressure (MOP) was increased from 550 to 650 bar. The 'A' annulus MOP was 405 bar above the maximum allowable pressure for the 'B' annulus. (245 bar - is that usual for intermediate casing?)

This meant that any failure of the 'A' annulus would immediately threaten to over pressurise the ‘B' and then 'C' annulus. However, there is no evidence that Total formally risk assessed the decision to increase the 'A' annulus operating window, despite the known degraded condition of the 'A' annulus production liner (leakage from Hod), and known pressure communication between the 'B' and 'C' annulus (at the mud line hanger?)

Total's failure to risk assess their decision to increase the 'A' annulus MOP was further evidenced by their belated discovery (when?) that, should there be a need to bleed the 'A' annulus, the integrity of the downstream plant and equipment could be compromised (how?). To overcome this risk they were forced to install a temporary bleed route through the G9 well's Xmas Tree. (?)

On Saturday 25 February 2012, (at what time?) the production and intermediate casings of well G4 failed, allowing pressure and fluids to 'communicate' across the A, B and C annuli, jeopardising the integrity of the surface casing of the 'C' annulus and creating a significant blowout risk.

The casing failures were evidenced by a drop in the 'A' annulus pressure from 563 to 440 bar in two minutes at 11:20hrs. Coincidentally the 'B' annulus increased from 33 bar to 263 bar, exceeding its maximum allowable pressure of 245 bar. Then at 16:45hrs the 'A' and 'B' annuli pressures dropped to 317 and 149 bar respectively whilst the 'C' annulus pressure increased suddenly from 29 to 79 bar, exceeding its maximum allowable pressure of 76 bar.

The Wells Department management monitored these events onshore. They were concerned that the rate of pressure increase in the 'C' annulus was such that it gave them only 100 minutes before a blowout could occur, and were considering down manning the Elgin and Viking. When operators on the Elgin were able to avert a blowout by bleeding down and stabilising the 'C' annulus pressure, Total decided not to down-man or halt production. There is no evidence recording the reasons for these decisions or suggesting they were supported by a formal risk assessment of the condition of G4.

Due to the seriously degraded condition of G4, Total began developing a well kill plan as a matter of urgency on 26 February (at what time?). The well-kill plan was shared with the Total Head Office and Blowout Taskforce in France.

On Monday 27 February (at what time?), a G4 well kill task force, consisting of Wells Construction and Maintenance Department personnel, was convened to plan and manage the well-kill process. As the need to kill the well was considered urgent (?), the Taskforce chose to base the plan on immediately available resources and recent interventions on wells G8 and F3

Although the function of the task force was to manage the well kill there is no evidence that records were kept of how they accomplished this, or of the decisions they made during the well-kill. Significant decisions supported by the Taskforce included:

To expedite the G4 well kill by using an existing well kill programme for well G8 (bonkers).
To continue production from other Elgin/Franklin wells during the well-kill; (criminal)
To continue with full manning of the Elgin and Viking throughout the well kill operation;(even more criminal)
That the Hod remained a tight formation and would not flow large volumes of hydrocarbons; and(despite what their testing had shown?)
That a surface blowout could not occur, as the well was designed to prevent such an event. (?) (never in all my life heard of this one)

These decisions were not supported by any formal risk assessments.

There is no evidence that the well-kill plan itself was developed from a suitable and sufficient risk assessment specifically for G4, using known information about the design and current condition of the well and the associated below ground conditions. Equally, there is no evidence that known uncertainties were adequately considered, such as the:

strength and condition of the mud line suspension system (what was the known uncertainty here? - they didn’t bring over the BOP from G8 onto G4. Why not? Did the know there was communication here and that the BOPs would have been useless)

the integrity of production casing and liner (was there some doubt about how the ‘A’ annulus got pressured?)

the integrity of the intermediate (they were still uncertain that this had burst?) and surface casing (has this something to do with the strength and condition of the mud line suspension system?)

cause of the SCP (was their an uncertainty about where the gas had come from and how it got into the annuli?)

the ability of the Hod to flow large volumes of gas

the ability of the un-cemented surface casing below the 20-inch shoe to prevent a surface blowout. (this seems incredible)

Three of the well kill specific risk assessments concluded that an over-pressurisation of the 'C' annulus would result in a failure of the un-cemented surface casing below the 20-inch shoe. This would relieve pressure into the Nordland formation and prevent a surface blowout. However, this conclusion was contradicted by the findings of the 'Annulus Management Failure Mechanism Risk Assessment’. This highlighted the need to "prove access from the 20-inch shoe to the formations below", and to, "better understand the likely route for any sustained flow from the 20-inch shoe".

Despite the apparently contradictory conclusions of these risk assessments, the Taskforce based their approach to the G4 well kill on the assumption that a surface blowout could not occur in the event of the 'C' annulus being over-pressurised. This assumption underpinned decision making up to and including actions taken as the blowout was in progress.

In conclusion, two key assumptions made by the Taskforce appear to have been critical in their failure to adequately assess the risks presented by G4. These were that:

in the event of a loss of well control the well could be shut-in (how? - they hadn’t installed a BOP on G4) and the 20-inch shoe would prevent a surface blowout by providing a safe subsea relief route; (never in my life heard this one before) and

the Hod could not flow large volumes of gas into well G4. (they already knew it could)

Total's well-kill plan involved a two-stage 'wait and weight' method.

The first stage was to pump a heavy-weight (1.2 SG) Calcium Bromide solution (i.e. brine) into the production tubing and out of the 'A' annulus, to remove hydrocarbons and other fluids from the well.

The second was to replace the brine by circulating a kill weight mud into the well, creating a sufficient hydrostatic head of pressure to balance against the formation influx pressure, thereby killing the well.

The basic principle of 'wait and weight' is to initially shut-in the well and allow pressures to stabilise. A series of calculations are then made to identify Bottom Hole Pressure [BHP] and the weight of kill fluid required to balance against the influx pressure.

However, the condition of G4, and source of the influx meant it was not suited to the 'Wait & Weight' method.

Firstly, Total was unable to shut-in the well for fear of over-pressurising the surface casing. (because they knew the mud line hanger wouldn’t hold? - and therefore they hadn’t bothered even to skid the BOP over G4? How do you shut in the well with no BOP deployed? Close valves on the Xmas tree?

Secondly, the influx was not from the bottom of the hole into the production tubing, but from the Hod formation into the well annuli at some 544 metres above the bottom of the well. (The bottom of the well being where the production tubing had been plugged. And how did they know the casing was ruptured 544 ft above there?)

Thirdly, there were communication pathways between all (?) the well annuli making it more complex to circulate out an influx using just the production tubing and 'A' annulus. In effect, Total used a conventional well kill method for what was an unconventional situation.

When the G4 production and intermediate casings failed on 25 February 2012, Total was in the process of abandoning the G8 well which was deemed to have a more significant SCP problem than G4. The Rowan Viking drilling rig was being used to intervene on G8. Before commencing the G4 well kill the G8 work had to be suspended to allow access to G4.

Total decided to leave the blowout preventer suspended on G8 (?) to allow them to skid the Viking away from the EWHP as quickly as possible and give access to G4 well kill. Leaving the BOP on G8 also meant they could return to the abandonment of G8 without delay once G4 was killed. (so this had nothing to do with the “strength and condition of the mud line suspension system”. Could it be that they didn’t bother skidding the BOP over because they already knew that there was communication all the way into the ‘D’ annulus?)

The G4 well kill operation started on 15 March 2012, nineteen days after the failure of the production and intermediate casings. (urgent indeed! - 19 days to skid the rig over G4 - and that’s without having to move the BOP)

The first stage of the well-kill involved punching the production tubing at a measured depth of 4904-4907m, to enable brine (1.2 SG) to be circulated into the 'A' annulus. The purpose of the brine circulation, which began on 15 March, was to remove hydrocarbons and other well fluids from G4 and to create a more stable environment (more stable ?) in which to circulate kill weight mud.

Brine returning from the 'A' annulus was routed to the process facilities to allow the separation and flaring of hydrocarbons. Total deemed this stage of the well-kill to have been a success.

[ROCKMAN]

Mudman – Very much appreciate all the details. I doubt most here could. LOL.

Haven’t see the Pusher post here in many months. I think he was working with the Aussies last I knew. OK, “shooting from the hip” as we say in Texas. IOW just my opinions:

“…the G4 'A' annulus was being bled down increasingly frequently to maintain it within its operating window of 300-380 bar.” That’s just bullshit. If pressure builds after bleeding it down that’s a live well producing hydrocarbons. And then knowing they definitely had potential failed csg up shallow the potential of a blowout was very likely. Following those lines: an uncemented surface csg??? Did I read that right? You can’t do that in Texas or Louisiana. I also suspect same true offshore. Not only cmted it but proved BY A THIRD PARTY to the regulators. Doesn’t matter if the shoe tests OK: easy enough for a kick to blow past shoe.

A live flare near producing wells is often a sad necessity. But offsetting a well with a “sustained pressure build” that can’t be killed is a kick that isn’t being killed. And an uncontrolled kick ALWAYS precedes a blow blow out. Maybe only by seconds but as you and I know a blow out is just a kick that breaches the surface. And no BOP on that well? I don’t really care: activating the BOP is a HUGE well failure even if it contains the kick. And half the time it doesn’t.

From what I gather all 200+ souls were still onboard when the kill effort began? No fucking way on one of my jobs…nor on the rigs of any of the operators I’ve worked with. Just Wild Well and the minimum number of essentials. Absolutely no non-essentials. Bottom line: I don't think our govt regulators would have allowed most of those operations to have been conducted. In fact if the situation gets too bad they just take over operations and then just bill the company. A very expensive move and the very last thing any operator wants to happen.

As I mentioned re-watched the Hollywood movie of the BP blow out. Had to wait till the wife went to bed. Had a few moments of bad shakes and others with a few tears. Never told the wife or young daughter about my near misses…no need for extra worries. In fact, when she was 8, after the father of one of her friends was killed in an oil field accident, I lied and told her I would stop working offshore when she asked me to do so. Worked since she spent most of her time with my ex-wife.

For the last 10 years I was VP of operations. And never hesitated to run off any unsafe hand or vendor. Had one hand I think would have taken a swing at me had I not been on crutches. LOL. What part of the world are you working in these days?

[mudman]

Hi Rockman,

Thanks for having had a look at this stuff and getting back to me again. I appreciate it. It's been kinda lonely given that not one swinging dick on Elgin or the Viking has come out in the open and made any attempt to ensure that the rest of us find out what really happened. I just don't understand that. Every one of them could have died. People undoubtedly will if the lessons are not learnt. So despite what I understand from the report (and it's not everything by any means), it's kinda difficult to trust my judgement when I’ve been so isolated. Especially when that "judgment" tells me that the UK regulator is broken and useless.

I was in Norway for nigh on 20 years till I retired 3 years ago. I was mud engineer and a safety rep on the Viking’s near-identical sister rig Rowan Norway. We were on Ekofisk doing abandonments and sidetracks. Couldn’t get even the basics about Elgin. Just kept at it after I retired. It’s getting interesting now with a tribunal about to make a decision on HSE’s plausibility when they dealt with my requests for information. Also, my MP (Member of Parliament - UK) and I are going to a meeting with the HSE it seems. May well be the new year also.

This is a big deal. I can’t see how the safety failure here was any less than it was on Piper Alpha. On Elgin it just didn’t ignite. Pure chance!

Total left a hole in their G4 production casing since 2004 and was increasingly bleeding off pressure (and gas/fluids?) from the 'A' annulus, and pulling more and more gas and condensate into the well. The HSE seems to not have been able to intervene at any level in those eight years. And the behaviour of Total in the last month, after they lost the production and intermediate casings, is just incredible. Did HSE know what was going on? Surely not! But then why not? Were they even informed by Total of what was going on and of their "plan" to kill G4? And if HSE were informed did they agree with how Total was handling the situation? It's bonkers.

I had heard that there was a rumour going about in certain circles, that the HSE had given Total permission to produce the well through the casing. I thought that that was just so outrageous that it was obviously bullshit. But was that not in fact pretty much what was going on here? Could it possibly be that what they were regularly bleeding off at surface from the ‘A’ annulus was gas and formation fluids and routing it through the production process? What would have been in that annulus 8 years down the line from the breach in the completion casing and repeated bleeding of the annulus? And could HSE have known about this and given the go-ahead to keep doing it?

Mind you at one point Total seem to have tried to bullhead brine into the ‘A’ annulus.

I can see why you might be wondering if you read correctly the bit about the 20” casing being un-cemented, I was certainly confused. The report says;

"Three of the well kill specific risk assessments concluded that an over-pressurisation of the 'C' annulus would result in a failure of the un-cemented surface casing below the 20-inch shoe."

Who writes this shit? There is no un-cemented surface casing below the 20-inch shoe. The only casing below the 20” shoe is the 13 3/8”. I’m guessing they’re trying to say that in the event of a failure of the 20” casing, formation fluids/gas would vent to the formation below the 20” shoe.

But if this is what they mean I’ve never heard anything like it in my life. Why would gas breaching the 20” casing (specially if that breach was at the mud line hanger), head south and enter a rock formation when it could head north following the un-cemented 20” casing, and blown out from the ports in the 30” casing anyway? And why would someone design a well that ensured an underground blowout rather than a surface blowout. How would they have killed this well had it blown out underground and the gas had made it’s way up to the seabed and created a crater

Total didn’t take over the BOP from the G8 to the G4 well. HSE say,

“Total decided to leave the blowout preventer suspended on G8 to allow them to skid the Viking away from the EWHP as quickly as possible (my emphasis) and give access to G4 well kill.”

But it seems that there were

“known uncertainties”

about

“the strength and condition of the mud line suspension system”

. There was

“known pressure communication between the 'B' and 'C' annulus”

from at least as far back as January 2012. I’m guessing this mud line suspension system was a riser tieback system for a well that had been drilled on the Elgin template before the platform was put in place and was subsequently tied back to the production deck on the EWHP. But I’ve been told that the real reason they didn’t take the BOP onto G4 was because they already knew there was communication all the way through to the ‘D’ annulus and that the BOP would have been useless.

And what is this about allowing them

“to skid the Viking away from the EWHP”

? How would you “skid” a jackup away from a platform? And why if you could, would you in this case? Surely they just skidded the cantilever to position the rig over the G4 well. The G8 and G4 wellheads would have just been meters apart. And it does make you wonder what they were up to that it took so long to start the intervention on G4.

On February 25, Total’s Wells Department management, monitoring event on the rig from shore

“ . . . were concerned that the rate of pressure increase in the 'C' annulus was such that it gave them only 100 minutes before a blowout could occur”

. It didn’t happen and a G4 well kill task force was convened on Monday 27 - wouldn’t want to ruin peoples week-ends would we? At this point the fuck-ups begin to come thick and fast. In the end it took them 19 days to “suspend” work on G8 and skid the rig over to G4. Mind you they though before February 25 that G8 was the more dangerous of the two wells. They must have had a good deal of work before they could leave G8 and go over to G4. Maybe they couldn’t risk taking the BOP off G8.

Not an easy story you tell about your daughter and her fears for your life. I’ll be honest, I got into a few situations which were potentially life, or at least limb, threatening, but the last 20 years or so I spent in Norway I didn’t come anywhere near to a situation comparable to Elgin. Maybe in the early seventies when I really didn’t know much at all about what was going on around me, or what the implications were. But now the HSE openly admit that since Elgin there has been roughly one hydrocarbon release every six months which have come

“perilously close to disaster”

in the UK sector. A world class regulatory regime indeed! A fucking shambles more like.