1. © Copyright Well Test Knowledge Pty Ltd 1
The Management of Hazards during Pinned to Seabed Operations.
By: Paul Nardone, Graham Fraser, & Rita Painter. Revised 22 Aug 2016.
Supported by:
Abstract
This article presents a review of the current industry approach to the perception of risk and the managment
of the hazards on a floating rig or vessel connected at the seabed. The range of possible consequences covers
everything from minor operational delay to catastrophic failure of the workstring. This article includes two
first-hand accounts of events that resulted in severe damage to the rig structure and also incorporates feed-
back from a survey of subject matter specialists to gauge a wider understanding of industry incidents and
perception of risk.
Pinned to Seabed Operations
When conducting operations from a floating ves-
sel, certain tasks require the workstring (either a
landing string or open water workover riser) to be
physically attached at the seabed. Such tasks occur
during completions, well interventions, workovers,
and well testing operations. During these periods
the upper part of the workstring is pulled into ten-
sion by the draw-works, or in the case of an open
water workover riser, tension may be applied us-
ing a combination of the riser tensioners and the
draw-works. In all cases tension is applied primari-
ly to reduce cyclic fatigue on the various workstring
components. At the same time a device known as a
motion compensator absorbs the movement of the
rig or vessel, permitting the workstring to remain
stationary and under constant tension. For the pur-
poses of this article we will call these “pinned to
seabed” operations.
The duration of pinned to seabed operations
might vary considerably and is often measured
in days. Consider a typical completion after it is
locked to the wellhead. The range of commission-
ing tasks that follow might include fluid displace-
ment, setting a packer, pressure testing, wireline
activities, and flowing the well to surface for un-
loading and clean up. During this entire period the
rig may experience a wide range of sea states and
unpredictable motions. The reliability of the mo-
tion compensator system is therefore an important
safety consideration during these activities.
Certain failure modes in the motion compensa-
tor may result in a complete “lock up”, by which we
mean a complete and rapid loss of compensating
action. A lock up either in the riser tensioner sys-
tem or the travelling block compensator may re-
sult in a significant tension increase even for small
vessel motions. The consequences would depend
on water depth, sea state, and vessel heave. This
article focuses primarily on the hazards associat-
ed with the traveling block compensator, however
both traveling block and riser tensioner systems
present inherent hazards during pinned to seabed
operations.
One further general comment - we will focus on
the hazards associated with a loss of motion com-
pensation; one of the potential consequences of
which might be catastrophic failure of the work-
string. It is also possible that a similar consequence
might eventuate from a loss of station keeping. Al-
though station keeping issues are not the subject of
this article, they would certainly be included in any
comprehensive risk assessment study, in particular
with regard to dynamically positioned vessels.
Heave Motion
The rise and fall motion experienced by a rig is
its effective heave; this should not be confused with
pitch and roll or with wave height or other partic-
ular measures of sea state. The actual motion of the
rig at any given time is a function of several factors
including wave height, wave direction, wave period
and the swell motion of the sea. In practice it can be
“Experienced compensator lock up in 2008 when installing completions in well with water
depth approx. 700m. Lock up was due to problem in PLC Card associated with Active Heave.
No damage occurred but the draw-works were disabled due to lock up on Active Heave. Elec-
tronics Technician had to reset the PLC to re-enable AHC.” Survey Contributor

2. © Copyright Well Test Knowledge Pty Ltd 2
difficult to predict accurately how a floating vessel
will behave in any given sea state. Depending on rig
type and location, heave motion can vary between
fractions of a meter to over 6 meters. Weather fore-
casting, however accurate, will not always provide
an accurate prediction of rig heave because there
are many variables some of which are characteris-
tics of the rig itself. The unpredictability of these
motions and their potential magnitude has signif-
icant consequences for the safety of the rig and the
way that risk is assessed. An important control for
pinned to seabed operations is the predetermined
operating envelope that defines limitations for a
range of critical parameters; typically these include
vessel offset, wave height and compensator stroke
range.
Rig Motion Compensators
In general motion compensators fall into one of
two categories, passive or active. Within each cate-
gory there are further subdivisions, but for the pur-
poses of our discussion these two general categories
are adequate.
Passive Compensators
A Passive Compensator, in simple terms, plac-
es a piston cylinder between the hook supporting
the workstring and the rig derrick structure. The
tension applied to the workstring can be adjusted
by changing the air pressure acting on one side of
the piston. Hydraulic fluid on the other side of the
piston is regulated to and from an accumulator. As
the rig rises and falls with the motion of the sea the
tension on the hook changes. With each change in
tension, the piston moves inside the cylinder, the
corresponding change in pressure of the fluid acts
Survey Feedback:
Passive Compensator Failure Modes
Hydraulic/Pneumatic
Valve blockage or failure.
Poor fluid quality
Leak in pistons
Air entrained in hydraulic system
Loss of air/hydraulic supply due to hose or
pump failure
Reaction time with respect to sea state
Mechanical
Overload
Chain failure
Piston binding
Cable failure on riser tensioner
Human Error
Incorrect stroke adjustment - compensator
“bottoms out”
Incorrect accumulator pressure applied
Incorrect valve closure
Inadeqaute maintenance
Inadequate or failure to follow procedures
Survey Feedback:
AHC Failure Modes
Hydraulic
System override
Motion Reference Unit (MRU) failure
Software / Power
Loss of communication with MRU Synchro
issues
Logic control
Loss of power
Anti Collision System engages
Motion Sensor fault
PLC Module failure
Draw-works Motor failure
Encoder failure
Software bugs
Mechanical
Structural failure Frames/cylinders Control
Console
Wire Rope wear (Tonne Miles)
Human Error
Accidental manual activation of e-stop
Design
Over sensitive controls
Poor ergonomic layout of controls

3. © Copyright Well Test Knowledge Pty Ltd 3
to counteract the change in tension. In this way, the
movement of the rig is absorbed by the motion of
the piston inside the cylinder with fluid constantly
moving to and from an accumulator, the net effect
of which is a constant tension on the hook. A sim-
ple way to think about it is to imagine the compen-
sator acting like a spring expanding or contracting
with the motion of the rig to maintain a constant
tension on the workstring.
This type of compensator requires a reaction point,
consider that a spring cannot expand or compress
unless it is held at both ends, in other words, if the
workstring is not in contact with any fixed point in
the well there can be no change in tension on the
piston. The compensator doesn’t do anything until
the workstring is in contact with a reference point
such as the wellhead.
Passive Compensators were involved in the 3 sig-
nificant events documented in the IADC report ref-
erenced in this article.
Active Heave Compensators
With the introduction of modern generation
deep-water rigs, the draw-works technology
evolved to include electrically driven automated
motion compensators, referred to as Active Heave
Compensators (AHC). AHC technology has pre-
dominantly been applied to the traveling block sys-
tem, and not riser tensioners. AHC systems are
inherently complex, and dependent amongst other
things on the PLC logic programmed into the elec-
tronics. In one instance just a greasy smudge on a
touch screen resulted in the computer interpreting
the smudge as an instruction that resulted in a near
miss incident in 2014.
The AHC works by accurately measuring the ves-
sel motion in real-time using motion sensors. A
computer directs the electric motors on the draw-
works to pay out or take in wire in response to the
vessel motion. In a black out scenario (total loss of
electrical power), the system has no compensation
back up and the break engages automatically. Ad-
ditionally, a blackout would render the draw-works
inoperative, a situation that would leave crews pow-
erless to take any meaningful action. There may be
other failure modes associated with PLC control
failure that might result in similar consequences.
The authors are not aware of any catastrophic
loss of containment events associated with an ac-
tive compensator. However, this may not reflect on
their reliability but more on the fact that fewer op-
erators tend to use active heave compensators when
executing extended pinned to seabed operations.
Some new generation rigs have dual compensa-
tors, combining active systems which are useful for
precision control with passive systems which are
often perceived as better suited to extended pinned
to seabed operations.
The Hazard
Every motion compensator, whatever its design,
has some potential for failure during the period
the rig is pinned to seabed. There are failure-modes
whereby this can occur rapidly and in such a man-
ner that the compensator becomes rigidly locked.
Should personnel on the rig not respond appropri-
ately to early warning signs, the motion of the rig
would be transmitted directly to the workstring. If
the rig heave at the time were of sufficient magni-
tude, it is probable that such an event would result
in the catastrophic failure of the workstring either
in tension or compression. The consequence se-
verity is further increased if wireline or coil tubing
personnel happen to be working in the derrick at
the time.
Several holes in the Swiss cheese accident
causation model must line up for the above to oc-
cur, and whilst they may be infrequent, they have
happened; the paper IADC/SPE 59216 Uninten-
tional Compensator Lock up Risks, Consequences
and Measures, details three events of this nature
that occurred in the North Sea during the 1990’s.
Readers are also directed to the feedback from our
survey which details different failure modes and a
Glomar Coral Sea - Drillship - 1984
“...single Varco passive compensator 100 meters water depth, with large swells caused the
Olmsted valve to close. No damage, stopped drilling WOW.
Separate incident, same rig - Olmsted closed due to hose failure in the derrick. No Damage
to equipment replaced hose.
Separate incident, same rig - main air fluid float parted and caused the system to lock up.
No damage stopped drilling to repair float.” Survey Contributor

4. © Copyright Well Test Knowledge Pty Ltd 4
range of issues known to have occurred. Our sur-
vey has uncovered a number of events of varying
degrees of severity and it seems only too likely that
similar events must have occurred elsewhere. Be-
cause of the potentially catastrophic consequences
from this hazard, the risk must be analyzed in detail
during the planning phase.
The oil & gas industry does not widely publicize
and make available the data needed to quantify such
risks with precision. In the face of such uncertainty,
it is recommended that a conservative approach be
taken when developing safety strategies.
Tensile Failure
Rig heave cycles typically have periods ranging
between 8 and 30 seconds. If a compensator lock
up occurred at the bottom travel of a heave cycle, in
a matter of seconds the workstring would experi-
ence a significant increase in tensile stress as the rig
moved upwards. Without manual intervention, the
pipe would initially undergo elastic stretch followed
by a rapid increase in stress to yield point, failure
would occur at the weakest point in the workstring
at that instant; the location of the weak point how-
ever, is another question. If the workstring were a
free standing vertical pipe, the components near
the top would experience greater stresses as a re-
sult of the additional weight supported by the top
connections. In practice however, the weak point
may occur elsewhere as a result of stresses present
for other reasons. For example, a compression or
fatigue induced weak point, or stress arising from
contact between a landing string and the marine
riser; the magnitude of such stresses would be a
function of the offset of the rig from well center.
Riser analysis studies can be used to determine
where the weak point would occur at increasing
offset angles and operating conditions; such a study
provides input for establishing a project specific op-
erating envelope.
Understanding the weak point in the workstring
would also be helpful in assessing the full set of
consequences from such an event. As an example,
if the workstring did fail, then the shear joint at the
BOP, or point just above the emergency disconnect
package (EDP), would generally be the most desir-
able location for failure to occur in order to preserve
the availability of the well control equipment, BOP,
diverter etc. Depending on water depth, hydrocar-
bons escaping from a failed weak point might reach
the drill floor in a matter of seconds or minutes. In
some instances, it may be possible for the driller to
activate the diverter and reduce or possibly prevent
a release to the drill floor.
Recoil Damage
The energy released after the separation of the
workstring due to over-tension will act to generate
upward thrust in the workstring components. Fur-
thermore, any pressure contained in the workstring
provides an additional energy source. The released
pressure energy would be directed upwards to com-
bine with the recoil forces.
Depending on the adopted strategy, safety sys-
tems can be configured to contain the workstring
contents above the designated weak point using a
retainer valve arrangement. Experience has shown
that the damage caused by such an event might be
considerable with projectiles and dropped objects
falling onto the drill floor as the various compo-
nents dislodge and damage other structure in the
derrick. See the Deepsea Trym case study described
in this article.
The presence of hydrocarbons under pressure
would add an escalation hazard in the form of fire
and explosion. Though this is not known to have
occurred in any recorded event, the potential is
certainly there. The inventory of hydrocarbons
would include the contents of the workstring, to-
gether with additional hydrocarbons flowing from
the well up to the point where the subsurface safety
valve, the subsea test tree, or BOP was closed.
UK Sector North Sea 2006/2007 Water depth: 300-400 ft
“While hung off at the wellhead for weather, but still connected to the drill string and
passively compensating, carrying a portion of the string weight, a wave came through that
resulted in the semi-sub "dropping" fast into the "hole" in the sea. The rapid acceleration,
coupled to the residual wt. being carried resulted in the Olmsted valve locking up, losing
string compensation popping the connection on the hang off tool as the next wave came
through.” Survey Contributor

5. © Copyright Well Test Knowledge Pty Ltd 5
Compression Failure
Should a lock up event occur as the vessel was at
the top of a heave cycle, then the workstring would
experience compression and buckling forces, made
up from the weight of the string and the flowhead,
combined with any compression imparted to the
flowhead through the lifting bails, or tension frame
as the rig moved downwards.
A number of outcomes are possible; in the case of
the landing string, it may be that the entire landing
string would squat down inside the marine riser,
with helical buckling taking up most of the move-
ment and the flowhead held more or less vertical;
depending on the rigidity of the stick up joint and
on the amount of downward heave. In the case
of an open water work-over riser, the riser string
would buckle and likely suffer bending failure un-
der its own weight.
In both cases without suitable support the flow-
head is likely to fall over with the bail arms or
tension frame articulating to one side at an angle
corresponding to the amount of movement down-
wards. We are aware of at least one incident where
this type of failure has occurred without any loss of
containment.
Analysis of the workstring on a case-by-case basis
is recommended to evaluate what sort of buckling
forces the tubulars and components would toler-
ate before failure. Even if this event did not alone
cause a loss of containment, the stresses induced
during the buckling event might weaken compo-
nents which would subsequently fail on an upward
heave cycle when the same components went into
tension.
Without some kind of intervention, the work-
string will fail sooner or later. Therefore, the human
factors, whether as a contributing cause to a failure,
or as part of prevention and / or mitigation, must be
included in any comprehensive discussion of this
topic.
Human Factors
During a pinned to seabed operation, the role
of the driller is an important one because it is the
driller who operates, monitors, and directs the ad-
justment of the motion compensator according
to changing conditions. He is also responsible for
identifying early warning signs that the compen-
sator system is starting to deteriorate and for re-
sponding to those warning signals. It follows that
the driller should have a thorough understanding
of this system.
How well does the driller understand the motion
compensator system? Several incidents involving
active heave compensators have occurred directly
as a result of a misunderstanding about how the sys-
tem works. The complexity of the latest generation
of rigs contributes to the hazard. In one instance
a driller performing a maintenance function on
the drill floor was unaware that this action would
automatically retract the hydraulic riser tensioner
arms. At that time an individual was working in the
moonpool about to insert a pin to lock the tension-
er arm to the tension ring, the arm retracted auto-
matically and pinned the cherry picker in which the
worker was standing against the moonpool wall;
the worker had to be rescued using a man-riding
tugger.
Human factors extend to the thoroughness and
clarity of the work instructions and procedures de-
veloped for the operation. Personnel conducting
any kind of task during a pinned to seabed opera-
tion must follow clearly written work instructions
which have considered carefully all the hazards
specific to the task. Are task focused personnel ful-
ly aware of the criticality of the compensator sys-
tems? Does the work instruction include guidance
on monitoring and adjusting this system and the
various appropriate responses to any deviation in
compensator parameters, including emergency
response? Have simulation drills been conducted
to test the response of individuals to the range of
possible failures? Are personnel fully cognizant of
the operating envelope and who is monitoring the
conditions to ensure none of the parameters are ex-
ceeded?
The case studies show that the reaction of person-
nel to these types of emergency are crucial both for
prevention and mitigation.
Deep Water vs Shallow Water
The greater the depth between the rig and the an-
chor point on the seafloor, the more pipe stretch
and squat available before the workstring experi-
ences excessive stresses. Should a lock up occur in
moderate heave conditions, it is entirely possible
“Semi Submersible 2012: System lock up occurred during large swells in Bass Strait,
stuck in the well for 8 days with parted drill string” Survey Contributor

6. © Copyright Well Test Knowledge Pty Ltd 6
the workstring would not experience the kind of
stress that would cause an immediate failure; always
provided the driller responds straight away. Some
downsides in deep water are greater compressional
loads, and an increased inventory of hydrocarbons
in the workstring. There is also the potential to lose
a significant hydrostatic head should the riser be
evacuated by escaping gas after a landing string fail-
ure, perhaps leading to a well control event.
The opposite is true in shallow water, with very lit-
tle pipe elastic stretch or squat available, the work-
string would experience over-tension or compres-
sion to the point of failure rapidly.
Marine Riser vs Open Water Riser
With a conventional landing string inside a ma-
rine riser, a particular hazard is often identified by
which the marine riser could act as a conduit for
gas leaking from the landing string to the drill floor.
This may direct planners to consider an open water
riser intervention system. However, this assessment
may only be valid in deepwater where gas leaking
from the lower end of the open water riser might
be expected to go into solution or to disperse by
the time it reached the surface. In shallow water
this advantage is doubtful since gas leaking from an
open water riser at shallow depths would reach the
surface beneath the rig over an extended area ex-
posing the entire rig to a potentially explosive cloud
rendering evacuation, if required, very difficult or
impossible.
Non-Shearable Items
Assuming for a moment that a landing string parts
for one reason or another and a loss of containment
occurs:- The most important next step is to isolate
the well at the seabed. With a conventional marine
riser / BOP setup, there are two devices available to
achieve this, the first is the subsea test tree and the
second is the rig BOP. In the case of an open water
riser system, the EDP/LRP package provides the
same functionality. During completion operations
both systems typically have the subsurface safety
valve as a tertiary option.
Anything situated across any of these devices that
might compromise their ability to shear, close or
seal must be considered during planning; examples
of non-shearables might include wireline or slick-
line tools, coiled tubing, and in certain circum-
stances, perhaps hydrate.
Industry Codes & Standards
There is no uniformly followed international stan-
dard when it comes to completion & workover riser
design & specification. In part this might be due to
the fact that the International Maritime Organiza-
tion (IMO) stipulates that floating vessels must re-
fer back to flag classification standards.
However, useful guidance can be found in API-
RP-17G Recommended Practice for Completion/
Workover Risers, currently in working draft form,
which specifies the requirements for systems en-
gineering to ensure that the subsea well interven-
tion systems and components are fit for purpose.
Overarching is the requirement for the operator to
develop a safety strategy that provides system defi-
nition for the safety, design, and operational prin-
ciples of the system. This should include a summa-
ry of the recognized and potential hazards during
operations, and define the need for risk-reducing
measures.
The safety strategy typically includes key design
principles i.e. design should be fail-safe and be such
as to ensure that no single failure will cause an unac-
ceptable risk. “Common cause failures shall be iden-
tified and measures implemented to minimize their
probability of occurrence.” & “For all operations, the
system design shall account for the most unfavorable
combination of functional, environmental, and acci-
dental loads, which might occur simultaneously.”
Operating limitations for the system may be es-
tablished by global riser analysis and Failure Mode
Effects Analysis (FMEA). An FMEA is a study per-
formed to evaluate the credible failure modes that
might occur within a particular system. The study
would identify weak points both mechanical and
human factors together with characteristic early in-
dicators of deterioration. The output from such a
“Had various experience’s over 16 years in the industry with both active and passive
compensator lock up in the North Sea in varying water depths. In my experience the com-
pensator lock up is almost always caused by inexperience in use of the compensator by
todays drillers who are put in that role with no where near enough experience or training.”
Survey Contributor

7. © Copyright Well Test Knowledge Pty Ltd 7
study would typically include a range of measures
for example, a thorough service of the compensator
system, early replacement of critical components,
detailed inspections and a project specific set of
monitoring controls to aid the driller.
Engineered Controls
When taken as a safety critical item and a single
point of failure, many organizations determine
the need for an additional engineered safeguard to
provide redundancy or mitigation against compen-
sator lock up. There are a number of products on
the market that may fulfill this need, these fall into
two broad categories; redundant compensators and
telescopic bail arms.
Redundant compensator
The concept is simple enough; install an addition-
al compensator in series with the existing rig com-
pensator. If one fails, then the other can take over
This temporary system would be installed in the
derrick before the flowhead and may take the form
of a Compensated Tension Lift Frame (CTLF) or
an in-line compensator, both of which are passive
systems.
These have been used successfully in different
parts of the world and operate effectively as a pri-
mary or secondary compensating device. Some
additional hardware including accumulators, com-
pressors and control modules would occupy signif-
icant space on deck and will interface the derrick
mounted hardware through a network of umbil-
icals. A system of this sort will require a crew of
competent technicians to oversee installation and
operation.
One of the issues to consider during planning
when using a dual system is the transition between
systems during normal operations or in an emer-
gency.
Another consideratioin is the availability of both
systems throughout the pinned to seabed opera-
tion. It only requires that a control unit is unattend-
ed briefly, or for communications to be temporarily
unavailable to render this safeguard ineffectual. In
other words this engineered solution itself depends
to some extent on procedural controls to assure
availability.
A number of new generation rigs include a combi-
nation of both active and passive systems, which are
permanently installed and operate in parallel at all
times. The passive system provides back up during
power failure. As both systems run parallel, system
switching or transferring complexity is removed.
Telescopic Bail Arms
An alternative approach employs the use of tele-
scopic bail arms. Whilst these devices are not full
blown compensators, they offer some of the bene-
fits with reduced complexity. There are two general
designs of telescopic bails, the first is mechanical-
ly operated using shear pins and the second uses
sealed pressurised nitrogen cylinders.
Telescopic bails are installed in the derrick using
spreader beams making an arrangement very simi-
lar to the CTLF. Should the rig compensator system
fail the bail arms telescope to absorb the rig motion
and protect the landing string. The mechanical sys-
tem uses shear pins to prevent premature telescop-
ing of the bails and is limited to protection from
tensile loading only with little protection against
compression or against recoil damage. This system
has been used in service in a number of locations.
This system is self-contained with little or no addi-
tional deck located hardware required during oper-
ation. Similarly their reduced complexity involves
very little additional personnel at the wellsite.
The newer nitrogen spring design offers protec-
tion from both over-tension and compression using
sealed and pressurised nitrogen cylinders which
telescope only when a pre-set tension or compres-
sion has been exceeded, the nitrogen cylinders also
limit potential recoil damage from an over-tension
event. At time of writing this newer design has not
yet been used in service.
“Well Clean-up operation (ca. Fall 2012 timeframe) - Driller operated the wrong valve
when attempting to increase compensator pressure. String parted and oil rained down on
the drill floor. Layout and ergonomics of the panel was deemed the root-cause for the in-
cident. - Another recommendation (consequence reduction) was to place the Subsea &
ESD control panels away from the harms-way and to man these 24 / 7 during operations.”
Survey Contributor

8. © Copyright Well Test Knowledge Pty Ltd 8
Rig Selection
Suppose an operator determined that a particular
type of compensator was inappropriate for pinned
to seabed operations, it would follow from that de-
cision that rigs fitted with that type of compensator
system would be excluded from selection by the op-
erator. An engineered solution such as the addition
of a CTLF, may re-open the opportunity to select a
rig that would otherwise be disqualified.
Availability of Contingency System
Operators must also consider their response in
circumstances where the primary protection de-
vice, the rig compensator is fully functional, but
the back-up happens to be experiencing a problem.
Since the risk assessment identifies the secondary
system as a control, should it be unavailable for any
reason, the operator is faced with the possibility of
having to suspend operations even though the pri-
mary system is working fine.
Controlled & Emergency Unlatch
Every pinned to seabed operation will incorporate
some means to disconnect the workstring at the
seabed together with a means to isolate the well so
as to prevent a release to the environment following
disconnection. The interface between the drilling
rig and the wellhead connector at the seabed will
always include, either a hydraulic, or an electro-hy-
draulic disconnect feature.
For the landing string system in a marine ris-
er, this interface is the subsea test tree, and for
open-water operations this will be the lower riser
package (LRP) and Emergency Disconnect Package
(EDP). Both systems are typically configured with
push button ESD and EQD initiators, designed to
follow a logic sequence to close the subsea barri-
er elements at the subsea test tree or LRP and then
physically unlatch the system above the barrier ele-
ments so that the rig is no longer pinned to seabed.
This process may take anything from seconds to
minutes depending on the water depth and system
configuration.
The unlatch feature is certainly a safeguard avail-
able against compensator deterioration. However,
whether it might be considered a full safeguard
against every failure mode is a different question.
Activation of this function requires human inter-
vention, it does have some fail safe features, how-
ever, there are circumstances where these features
mightnotbetriggered.Arapidactivationtime,even
if only 10 seconds, may not be adequate to prevent
a catastrophic failure in circumstances where a sud-
den loss of compensation has occurred and the rig
is experiencing an upward heave at the same time,
or during a black out when using an AHC system,
although in both cases this will certainly isolate the
well quickly.
Conclusions
The consequences associated with compensator
lock up can and have been catastrophic, planning
should therefore be conducted accordingly. The as-
sessement of the risk together with the develope-
ment of controls is a complex process involving a lot
of variables many of which are operation specific, it
follows that there should not be a prescriptive one
size fits all solution. Based on what can be learned
from industry experience we would prioritise the
controls into the following order of importance:
1. Human Factors:
2. Design Specification:
3. Fit for Service Hardware:
4. Additional Engineered Controls:
Human Factors: Planning is an exercise in risk re-
duction, but is only effective to the extent that the
people on the rig, those who are actually exposed,
fully appreciate the nature of risks and have the re-
sources they need to control them. These resourc-
es include competent personnel, training, quality
procedures, supervision, briefings, together with
the drills and simulations performed to ensure that
personnel can recognize and respond to all of the
possible contingencies. The case histories show that
the role of the driller in particular is an essential
element in this equation.
Design Specification: By this we mean the un-
derstanding of the safe working limitations of the
entire system; including the tubulars, well control
equipment, mooring/station keeping system and
the compensator itself. Without thoroughly study-
ing how the components of the landing string inter-
act and what stresses they will experience in service,
then it is would be difficult to state precisely what
the safe operating envelope for the system will be.
Fit for Service Hardware: Why would you under-
take a risk which involved potentially catastrophic
conseqeunces with less than optimal hardware? It
is only common sense that prior to undertaking an
operation of this nature that all steps be taken to
ensure that the compensator system is fully func-
tional. Any planned maintenance or sub optimal

9. © Copyright Well Test Knowledge Pty Ltd 9
components should be addressed beforehand and
tested thoroughly before operations commence.
Additional Engineered Control: We place this at
the lowest priority, not because it is not important,
but because an additional engineered control, such
as a back up compensator, would only be required
as a mitigation measure. Since prevention is better
than cure, measures which prevent a situation from
escalating to the point where an emergency system
is required should be seen as preferred controls.
Ultimately inadequate perception of risk is likely
to result with inadequate planning and greater risk
during execution.
Supported by

10. © Copyright Well Test Knowledge Pty Ltd 10
Personal Account- Doug Low
Polar Pioneer Semi Submersible Norway 1994
Water Depth: 332m
Summary
During a DST, while flowing the well through the surface well test plant and flaring oil and gas, the heave-com-
pensator locked up and the test tubing parted below the flowhead at a pup joint connection about 2 meters
above the rotary table, resulting in an uncontrolled release of hydrocarbons onto the drill floor and into the
derrick.
The control lines to the Subsea Test Tree remained intact after the failure of the landing string and manual
activation of the Subsea Test Tree closure function was ultimately used to stop the hydrocarbon release. Rig
contingency procedures recovered the situation, enabling removal of the parted pipe and reconnection of the
flowhead.
Witness – Doug Low, Halliburton Senior Subsea
Specialist, was present on the drill floor during the
incident.
The compensator lock-up happened when the
driller was attempting to adjust the settings of the
compensator. I never actually saw clearly what hap-
pened just prior to the lock-up but I recall that he
said it locked up while (or just before) he was adjust-
ing the height settings. I am unsure if it is possible
to lock the compensator whilst altering its height
as this, to my knowledge, is achieved by adding or
removing pneumatic pressure to the compensator
cylinders or by raising or lowering the blocks using
the drawworks, and should have no effect on the
lock mechanism. However, as I am no expert in this
field the technical details should be verified on this
point.
We were flowing just over 6000 bopd through a
40/64 fixed choke, burning on one boom, when the
lock-up happened. Initially, we couldn’t get to the
SSTT panel as
the roller door leading through the heavy tool
store, which was the shortest and safest route to the
SSTT control panel, could not be opened from the
doghouse side and so we were forced to go out and
across the drill floor through the oil and gas which
was flowing freely through open ended tubing into
an enclosed derrick. The driller hit the Subsea Test
Tree (SSTT) shut-down button as we ran past the
panel to safety and the flow started to subside as the
SSTT closed. There was never, to my knowledge,
any attempt made to close the shear ram. I went
back up to the panel a minute or so later and closed
the Subsea Lubricator Valves (SSLVs) as an added
precaution. The personnel on the drill floor at the
time were extremely lucky to escape unharmed
from this incident; there were three of us, the drill-
er, Halliburton DST specialist and myself.
The incident did not make any headlines at the
time and the only reference I ever saw to it was a
very small column in the local Norwegian news-
paper. However, the Stat Pollution Authority had a
government plane out over the location, as soon as
it was light the following day, in order to quantify
and, presumably, photograph the oil spill.
In the aftermath of this incident, Norsk Hydro re-
quired that our SSTT control panels be fitted with
a low pressure pilot which would activate the clo-
sure of the SSTT in the event that flowline pressure
dropped below a predetermined value.

11. © Copyright Well Test Knowledge Pty Ltd 11
Feedback comments from 40 survey contributors.
The following list of comments are from our survey contributors responding to questions re-
garding their own experiences of compensator issues. This list serves to indicate the frequency
and variety of failure modes across different types of system.
“Crown Mounted Compensator (CMC) locked up due to deteriorated fluid condition and incorrect
precharge on pilot accumulators - incorrect maintenance.”
“...lack of experience in using the compensator that directly led to damage”
“Some electronic issues that had to be rectified”
“Issues with synchronisation on a re-coil incident, we had to repair mechanical damage and exchange
re-coil valves”
“Compensator or parts of top drive breaking up and falling to rig floor”
“Crown mounted active heave compensation system was programmed incorrectly and weight on bit
fluctuations were 60klbs.”
“Crown mounted passive system on another rig continually caused problems due to too much friction
in the system “experts” from supplier weren’t much help either”
“Drill String Compensator (single piston) developed leak during flow back / clean up of subsea de-
velopment well. Intent had been to support completion riser only on the drill string compensator.
However upper tension joint had been rigged up with lines from a tension ring to each of rig’s marine
riser tensions, and this was brought into service to relieve load on DSC.”
“Drill String Compensator Olmsted Valve needed to be replaced.”
“leaks - drop off of tension support from compensator, required continuous monitoring and system
re charging”
“Incorrect compensator operation leading to compensator stroking out fully and landing out on the
beams due to rig heave. This at a time when a landing string was connected to the wellhead system.”
“Problems with PLC Card associated with AHC failed and draw-works locked up few times and PLC
had to be reset every time compensator locked up. Damaged PLC Card was replaced and issue was
never encountered after.”
“As rig heaved up the compensator failed resulting in the landing string pulling ~250 klbs over string
weight”
“Seal leakage, position indication, lock bar indication and pressure sensor damage are the main fail-
ures”
“Had various experience’s over 16 years in the industry with both active and passive compensator
lock up in the North Sea in varying water depths. In my experience the compensator lock up is almost
always caused by inexperience in use of the compensator by drillers ...with nowhere near enough
experience or training.”
“Experienced compensator lockup in 2008 when installing completions in well with water depth ap-
prox. 700m. Lock up was due to problem in PLC Card associated with Active Heave. No damage
occurred but the draw-works were disabled due to lock up on Active Heave. Electronics Technician
had to reset the PLC to re-enable AHC.”
“Semi Submersible Water Depth: 165 m June 2011: Landing String locked to TH while performing
slickline operations Temporary failure while rig heaving up in min. swell (1-2m)” Landing string
experienced overtension but did not fail.

12. © Copyright Well Test Knowledge Pty Ltd 12
Personal Account - Graham Fraser
Deepsea Trym Semi-Submersible
1998 Compensator Lock-up Incident
Summary
On the Dec. 4 1998 at 18.21 the draw-works compensator system locked causing the landing string to
catastrophically fail. The 7” flowhead and 7” wireline pressure control equipment fell to the drill floor
causing significant damage to equipment, derrick structure and draw-works. The well flowed hydrocar-
bons through the open ended landing joint for a period of 17 secs until the SSTT closed and secured the
well. Fortunately no one was injured during the incident.
Operation Summary
The Deepsea Trym was in the process of complet-
ing an oil producer well in the Norwegian sector of
the North Sea. The rig was moored on location in
approximately 150m water. It was winter and the rig
was experiencing approximately 2-4m heave cycles
which is typical for that time of year. The well was
one of many already completed in the field of sim-
ilar design. The completions were standard for the
region which included a 5-1/2” completion string
and horizontal tree technology. The Completion
and tubing hanger system was deployed on a land-
ing string system configured with a direct hydraulic
7” Subsea Test Tree (SSTT), run on a heavy duty
production riser. The surface package included a 7”
flow head and 7” wire-line BOP’s suspended using
a 40’ bail arrangement.
The SSTT was the primary subsea well control de-
vice for the operation. The SSTT included dual ball
valves and an emergency unlatch system. . The BOP
Landing string stick up 5 m higher than its original
postion at an angle with master bushings dislodged
from recess.
Surface flow tree disconnected from landing string
and lodged in derrick.
Derrick equipment dislodged and dropped to the
drill floor

13. © Copyright Well Test Knowledge Pty Ltd 13
middle pipe rams were closed on the 9-5/8” ported
slick-joint located below the SSTT. The system also
included a shear sub positioned across the BOP
shear rams with a Retainer Valve positioned above
The instrument safety system included a PSD,
ESD and EQD configured with the IWOCS pack-
age. Upon activation the PSD was configured to
close the PWV, the ESD configured to close the
TRSSV, SSXT valve and SSTT. The EQD would ac-
tivate the ESD plus the RV close and unlatch func-
tion. A number of initiators were strategically lo-
cated around the rig.
Prior to the incident the well had been complet-
ed with the tubing hanger landed and locked in
the SSXT. The production packer had been set and
tested. The well had been cleaned up (flowed back).
The well was shut in at the well test choke manifold
at the time to investigate a tubing to annulus leak.
The incident
Throughout the afternoon the well was shut in at
the PWV (PDS) whilst troubleshooting was on-
going to determine the cause of leak between the
tubing and annulus. Lots of telephone calls ongo-
ing between the rig and town. The rig was in well
testing mode with an active ESD and EDQ safety
system, with well pressures being monitored from
the Workover Control System (WOC’s). During
this time drill-floor personnel were in a stand-by
mode, the ‘dog’ house was not manned full time,
and generally the crew were awaiting further direc-
tion on the way forward. I decided to head inside
the accommodation for dinner and shortly after
entering the accommodation I heard a sequence
of loud bangs which lasted about 3 seconds or so.
I also experienced the rig pitched or slew slightly.
This was followed almost immediately by a loud
high pitched gushing noise, much like a large air-
line breaking which lasted about 15 seconds.
I knew instantly something was seriously wrong
and was expecting alarms to sound any moment. I
made my way towards the company office when I
came across the driller and assistant drilling stand-
ing in the corridor of the accommodation soak-
ing wet and in a state of shock or disbelief. I im-
mediately put on my coveralls and went outside, I
could immediately smell hydrocarbon and see flu-
id dripping off the derrick. I made my way to the
IWOCS spooler to check the status of the SSTT. I
observed the SSTT ball open pressure was fluctuat-
ing, maybe indicating fluid flow from the IWOC’s
system, I suspected the ESD had not been activat-
ed, but couldn’t be sure To make certain the valves
The finger board located over 25 m in the derrick,
struck by falling equipment note the angle.
The lower sub of the surface flow tree, note the
deformation
The subsea test tree after recovery to surface

14. © Copyright Well Test Knowledge Pty Ltd 14
were closed I manually vented the open lines at
the IWOCS spooler. During this time the muster
alarm sounded so I promptly made my way to the
emergency muster point. The rig didn’t perform an
emergency evacuation, however down manned us-
ing helicopters to essential personnel only.
During the initial inspection of the aftermath I
could see the riser landing joint sticking out of the
rotary table on a 15deg angle. The master bushings
and been blown clear of the rotary table and were
lying beside the dog house. The flowhead swivel
was still attached to the landing joint, and I could
clearly see the large 10” connection had parted be-
low the flowhead, the stub-acme threads stripped
clean. The 7” flowhead and wire-line BOP were se-
riously damaged and other bits of debris scattered
across the drill-floor. I could also see a large sec-
tion of the rig derrick had been badly twisted due to
the impact forces. I hate to think what would have
happened if personnel were on the drill floor, or in
the derrick at the time. Very fortunately, no one was
injured or killed
Others I spoke with said they witnessed the ele-
vators detach from the bails in compression, and
the flowhead buckle in compression and free fall.
Another roustabout witnessed the landing string
shoot high into the derrick.
Findings
An examination of the hook load data revealed
the string had experienced two locked tension
and compression cycles prior to failure. The string
parted on the second upward heave cycle. The
down-hole gauge data indicated the well flowed for
around 20 seconds prior to closing in at the SSTT.
The stick up was measured approximately 5m high-
er than the original landing height, indicating that
the string had also parted in a second location be-
low the rotary table. Upon recovery it was found
that the SSTT had parted at the latch and also at
two other riser joint connections. The connections
were found to be elongated appearing to show signs
of compressional failure. Fortunately the SSTT
was failsafe closed and had vented pressure when
the latch parted. Interestingly no one activated the
ESD during the incident.
I wasn’t involved in the investigation. It took a
long time to complete. It appeared to be the result
of a hydraulic leak across a pilot valve (rubber di-
aphragm failure). The leak initiated an automated
PLC response to close hydraulic isolation valves
and stop the hydraulic pump. Over time the sys-
tem drained and the compensator piston bottomed
out, this resulted in a further PLC response to close
all isolation valves resulting in a pressure lock and
compensator lock.

15. © Copyright Well Test Knowledge Pty Ltd 15
Glossary
AHC: Active Heave Compensator is a motion
compensator system, using a computer to control
the draw works to pays out or draw in wire, in order
to compensate for rig motion.
API: American Petroleum Institute
Bails: Steel extension arms which form part of the
assembly used to support the work-string from the
top drive.
BOP: Blow Out Preventer is a safety critical com-
ponent of the drilling rig that sits on the wellhead
at the seabed and includes facility for isolating the
well, including a set of shear rams capable of cut-
ting pipe and a disconnect feature to release the rig
from the well at the seabed.
CTLF: Constant Tension Lift Frame, incorporat-
ing a passive compensator. This supports the com-
pletion work-string, facilitates pressure control
equipment installation and incorporates a passive
heave motion compensator.
Draw works: The winch mechanism operated by
the driller to raise and lower the main blocks (hook)
in the derrick.
EDP/LRP: Emergency Disconnect Package/Low-
er Riser Package, replace the drilling rig BOP. These
devices interface directly with a subsea tree and
provide much the same functionality as a drilling
rig BOP but do away with the need for a separate
marine riser.
EQD: Emergency Quick Disconnect - an auto-
mated sequence of valve and latch functions fol-
lowed by the subsea control equipment to isolate
and disconnect from the well in an emergency.
ESD: Emergency Shut Down refers to any auto-
mated or manual system which shuts off produc-
tion from the well. This may refer both to subsea
and / or surface shut down.
FMEA: Failure Modes & Effects Analysis, a spe-
cial study to examine a device or system in order
to better understand how it may fail in operation
and identify safeguards that can be implemented to
prevent those failures.
IADC: International Association of Drilling Con-
tractors
IWOCS: Integrated Work-Over Control System is
the temporary umbilical control system installed to
operate the functions on a subsea wellhead from a
drilling rig.
Marine Riser: A large diameter conduit, usually
low pressure, between the drilling rig and the BOP
on the sea bed. The completion and high pressure
landing string tubing are conveyed through the ma-
rine riser.
Moonpool: An opening through the lower deck of
the rig which allows access to the sea for the various
activities performed from the rig.
MRU: Motion Reference Unit the sensor which
detects rig motion. The draw works will be in-
structed to compensate based on the signal from
the MRU.
Open Water Riser: A particular form of inter-
vention which takes place without the drilling rig
BOP or marine riser. An EDP/LRP performs simi-
lar functions to that of the BOP and a high pressure
riser replaces both the marine riser and the landing
string.
Non-Shearables: Anything which cannot be cut
by the drilling rig BOP or EDP shear rams. These
should be identified in advance so that procedures
can be developed to minimize the time these may
be situated across shear rams.
Passive Compensator: A hydraulic / air system
designed to absorb rig heave motion in order to
prevent rig movement being transmitted to the
workstring.
PLC: Process Logic Card, a set of electronic com-
ponents including microchip(s) programmed with
a specific set of instructions which control the be-
haviour of a device such as the Active Heave Draw-
works.
PSD: Process Shut Down, is a switch or procedure
to shut off production to a system from the well.
Similar to an ESD, it may simply entail the activa-
tion of a single valve.

16. © Copyright Well Test Knowledge Pty Ltd 16
PWV: Production Wing Valve refers to the valve
on a production flowhead, or production tree,
through which fluid from the well flows to a pro-
duction system such as a well test package. This
valve is typically connected to the ESD system.
Shearables: Anything that can be cut by the drill-
ing rig BOP or the EDP shear rams e.g. pipe, wire,
coil tubing.
SPE: Society of Petroleum Engineers
SSTT: Subsea Test Tree is a special safety valve de-
signed to interface a drilling BOP situated on the
sea bed. The SSTT incorporates valves which iso-
late the well and a latch feature which provides rap-
id disconnect of the landing string at the sea bed.
SSXT: Subsea Production Tree refers to the man-
ifold of valves and controls situated on the seabed
through which production from the well is con-
trolled.
Unlatch: The ability of a subsea safety device to
separate into two parts, the lower part containing
well barriers whilst the upper part releases the up-
per workstring for recovery to surface.
WOW: Waiting On Weather
References
API-RP-17G Recommended Practice for Comple-
tion/Workover Risers (Currently working draft)
IADC/SPE 59216 Unintentional Compensator
Lockup Risks, Consequences and Measures
DNVGL-OS-E101, chapter 2, section 5, part 4 –
Heave compensation and tensioning system (techni-
cal requirements to compensation systems).
NORSOK D-001, chapter 6.7 (technical require-
ments to compensation systems).