PROCESS SAFETY SERIES 7 Total ELGIN

Sharing the experience

TOTAL ELGIN PLATFORM- Incident Summary
Operated by Total for 8 x JV partners
Elgin PUQ (Production Utilities Quarters ) & wellhead platforms linked
by 90m bridge
High Temperature/High Pressure fields
Elgin produced about 130kboe/d at the time of the incident
25 March 2012 surface blowout occurred at the wellhead on Elgins
G4 well releasing Gas & Condensate
No-one was injured
Complex SD for just under a year

2
 Incident Timeline
25 Feb
Sudden decrease of A annulus pressure and rapid increase in B and then C annulus
G4 Task Force established: well intervention program with Rowan Viking rig support

15 March
Tubing and A annulus contents displaced to 1.2sg brine

22 - 25 March: Well intervention

Start pumping 2.05sg NABM down tubing & up A annulus B & C annuli pressure increase
C annulus bled o through WHP process
B annulus opera ng window increased
after 172m operation suspended as mud returns to the process via C annulus
attempt to re-route C annulus returns line to surge tank
sudden unsustainable C & B annuli pressure increase
gas release at well head D annulus.

25 March:
12.30: gas & condensate leak confirmed at the wellhead on Elgins G4 well
13.30: evacuation begins of Elgin and the adjacent Rowan Viking drilling rig
16.40: 219 people have been evacuated, leaving 19 still on the complex
01.45: Elgin OIM decides to fully abandon Platform, rig & wells shut down ,Export pipelines isolated
02.30: the last 19 people are evacuate
Slide 3
Main lessons from incident
Since 2001, Total had experienced an increasing problem of high pressure gas from the HOD formation leaking into well annuli [i.e. the
voids between the concentric well casings] of wells
In 2004, as a result of cement and casing failures , the frequency of bleeding from the 'A' annulus increased and was a threat to the
integrity of G4, Total decided to stop all bleeding and to allow the 'A' annulus pressure to rise to and balance against the influx pressure
from the HOD, however no RA was carried out, in particular the potential consequences of a failure in the production casing on the integrity
of the well.
Total managed the risk from 'live annuli' through an annulus management system, this involved operators 'manually bleeding gas from
annuli by opening wellhead valves in response to high pressure alarms, to maintain the pressure within defined pressure limits.
High frequency of bleed-offs was in breach of the Total company rule, 'Operations of wells with abnormal behaviour' and was thought to be
an increasing risk to the integrity of well G4
The 'A' annulus MOP was 405 bar above the maximum allowable pressure for the 'B annulus. This meant that any failure of the 'A' annulus
would immediately threaten to over pressurise the 'B' and then 'C' annulus. However, there is no evidence that Total formally risk assessed
the decision to increase the 'A' annulus operating window, despite the known degraded condition of the 'A' annulus production
Well team were concerned that the rate of pressure increase in the 'C' annulus was such that it gave them only 100 minutes before a
blowout could occur and were considering down manning the Elgin and Viking, however when operators on the Elgin were able to avert a
blowout by bleeding down and stabilising the 'C' annulus pressure, Total decided not to down man or halt production , no evidence
recording the reasons for these decisions or to suggest they were supported by a formal risk assessment of the condition of G4
To expedite the G4 well kill they used an existing well kill programme for well G8Y, not taking into consideration the known information
about the design and current condition of the G4 well and the associated below ground conditions.
Well kill team failed to adequately assess the risks presented by G4. These were that:
in the event of a Joss of well control the well could be shut-in and the 20 inch shoe would prevent a surface blowout by providing a
safe subsea relief route; and
the HOD could not flow large volumes of gas into well G4
There is no record of an annual examination of well G4 taking place in 2010, 2011 or up to March 2012. There is a record (dated 28.1.13) for
an annual examination of well G4 after the blowout.
Total's 'Well Integrity Management System' (WIMS) recorded the integrity status of G4 as, "Well integrity reduced, escalation risk high,
major measures required" on seven occasions between 20th May 2004 and 4th June 2011
4
 Swiss Cheese Failures

Effective
Relief and Blowdown Operations Supervision / Audit & Self Active & Passive Fire Rescue & Investigation &
System Learning from the Procedures Leadership Regulation Communication Protection Recovery Lessons Learned
Past

Work Control Training & Management of Escape / Support to Next of Kin

Inherent Design Control, Alarm & Maintenance & Competency Access & Injured
Change
Plant Layout Shutdown system Inspection
HAZARD
HAZARD REALIZATION
Normal
Hydrocarbon Blow out
Inventory in
Reservoir

Loss of
containment

No fatalities
and injuries
No plant
layout issues No issues
Changing
Inadequate Risk
established No issues
No issues assessment carried No No issues
operating
out communication
envelope
issues
No issues
No issues
No issues Investigation
No issues carried out
No issues
No issues No issues

Slide 5
 EXAMPLE OF PS EXPECTATIONS FROM ALL
Operator Level
Participate in Risk Analysis
(HAZOP, What if, HAZID,
constructability review.);
Check on a regular basis that
Safety Critical Measures are in
place in the process unit (valves
/ locked open or close, Restricted
Orifices);
Check on a regular basis that
equipments for fire protection
are operational;
Check the date of validity of PPE
(included specific PPE like
Breathing Apparatus);
Check the date of validity of
different equipments like hoses;
Check the cleanliness of bunds
(absence of water, );
Participate in test of critical
instruments;
Participate in test of gas
detectors;
Check that the list of
(instrumented) Safety Critical
Equipment bypassed is in
agreement with the reality;
Report possible process safety
improvements to management.
Engineer / Supervisor
Participate in Risk Analysis
(HAZOP, What if, HAZID,
constructability review.);
Collect / organize lessons
learned and explain to
operators;
Elaborate lists of items that
must checked by operators
(valves, blinds, RO, safety
valves, rupture disc,);
Review emergency
procedures;
Participate in Risk
Assessments for
Modifications;
Test / Check all
communications equipment
used for emergency plan;
Check that all document /
relevant information is up to
date in the emergency crisis
room;
Implement best practices on
process safety developed on
corporate level;
Management Level
Participate in a HAZOP study (e.g. 1/2
day participation) and discuss with the
team about your findings (e.g. quality
of the team);
Present Safety Case finding to the
team offshore;
Elaborate / Approve a five year plan of
Process Safety Studies;
Understand status of all recs from
process safety studies
Analyse lesson learned to prevent re-
occurrence of accident;
Ensure that all modifications are
properly analysed in term of risks;
Elaborate action plan after audits, risk
analysis,
Elaborate Process Training Session for
Intermediate Management;
Ensure that all people who have PS
Expectations are trained for this
specific job;
Organize and participate in
Emergency Management Exercise drill;
Enforce best practices on process
safety developed on corporate level;
Ensure that the Process safety
systems in place meet the
expectations of new regulatory/legal
requirements
Slide 6
PROCESS SAFEY CULTURE where are YOU!!!!!!!
is a continuum of behaviors with increasing levels of safety awareness and activity

Generative - Chronic unease (Mindfulness)

Safety is how we do business - Safety is seen as good business
around here - New ideas are welcomed

Proactive - Resources are available to fix things before an accident

We work on problems that - Management is open but still obsessed with statistics
we still find - Procedures are owned by the workforce

Calculative - We have our HSE-MS nailed!

We have systems in place to - Lots and lots of audits
manage all hazards - We collect lots of statistics

Reactive - We are serious, but why dont people do as they are told?
Safety is important we do a lot of - Lots of discussions to re-classify accidents
it every time we have an accident! - You have to consider the conditions under which we are working.

- The lawyers said it was okay.

Pathological - Ive done my part for HSSE this year.
who cares so long as were - Of course we have accidents; its a dangerous business
not caught! - Fire the person who had the accident! 7