OTC-28011-MS

WSOG and Emergency Disconnection Guidelines

Daniel Ferreira Cruz and Diogo da Rocha Fonseca, Petrobras

Copyright 2017, Offshore Technology Conference

This paper was prepared for presentation at the Offshore Technology Conference Brasil held in Rio de Janeiro, Brazil, 2426 October 2017.

This paper was selected for presentation by an OTC program committee following review of information contained in an abstract submitted by the author(s). Contents of
the paper have not been reviewed by the Offshore Technology Conference and are subject to correction by the author(s). The material does not necessarily reflect any
position of the Offshore Technology Conference, its officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written
consent of the Offshore Technology Conference is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may
not be copied. The abstract must contain conspicuous acknowledgment of OTC copyright.

Abstract
Dynamic Positioning (DP) systems are becoming more and more used in the Oil and Gas Industry. Over
the last decades, the escalation in deep-water exploration and development resulted in an increased number
of dynamic positioned rigs. But despite the increasing improvements in technology and capability, there
is always a risk of a loss of position due to equipment failures or human errors. In consequence of such
event, the DP drilling unit must be able to rapidly shut in the well and disconnect the BOP. Failure during
an emergency disconnect procedure may result in damages to the rig, riser, wellhead, and, in worst case,
an uncontrolled subsea blowout.
Emergency disconnection may occurs at any time in dynamic positioning drilling rigs, as a result of a
sudden blackout or by a quick drive-off, for instance. Because of that, all emergency procedures should be
well understood by both DP and drill floor personnel. It is imperative that the risks of a position loss are
previously assessed in order to reduce the potential damage caused by a disconnection.
The two most relevant tools for reducing the impact related to the DP System failure are the Well
Specific Operating Guidelines (WSOG) and the Emergency Disconnection Guidelines. The WSOG defines
four diferent DP Status associated to a specificrig executing a specific operation and using specific
equipments and its performance limits - "Normal Status," "Advisory Status," "Yellow Status" and "Red
Status". The Emergency Disconnection Guidelines establish the actions in case of reaching each of these
status. Emergency Disconnection Guidelines were established for various drilling, completion and workover
operations, to be studied and discussed previously activities with BOP / Christmas Tree connected to the
wellhead.
The main goal of this paper is to present how the WSOG and the Emergency Disconnection Guidelines
work together, bringing statistics and lessons learned of loss of position and emergency disconnections.
Additionally, this work suggests emergency disconnect sequence (EDS) options for different operations and
BOP configurations (number/type of shear rams available).

Introduction
The largest Oil and Gas fields in Brazil are located in deep and ultra-deep waters. For Drilling, Completion
and Workover operations, DP (Dynamic Positioning) rigs are mostly requested, despite the intrinsic risk of
2 OTC-28011-MS

losing position. The consequences of anunsuccessful disconnection during a loss of position incident can
be catastrophic, such as the loss of the well, damages to the rig or even a blowout.
All the operations should be planned prior the execution considering the risk of a loss of position.
The planningshould consider, among others, the well design, rig EDS modes, Riser Analysis and WSOG.
Petrobras also uses flowcharts for the main types of well operations defining the course of actions on the
rig in case of DP incidents, called Emergency Disconnection Guidelines.
Petrobras started using DP rigs in1978. The usage of this type of rig by the company increased rapidly
over the years. A DP incident database was created to register the most relevant information of each event.
It was observed that the average time between the Yellow Alert and Red Alert is shorter than the time to
do the Prepare for Disconnection standard procedure (hang-off). Analyzing this incident databank, it was
verified that performing hang-off in Yellow Alerts can bring additional risks. The DP Red Watch Circle can
be reached during the stripping of the string, by the time thatthe tool joint crosses BOP shear rams. Driven
by this concern, Petrobras created the CSP (Clear Shear Procedure) to provide a faster and safer procedure
as the Prepare for Disconnection during a DP Yellow Alert.

Choosing EDS Modes

The process of well construction using DP rigs is more and more usual due a lot of factors. Working with
Dynamic Positioning Rigs is always challenging and must be kept in mind that an emergency disconnection
can occur at any time once that DP rig is connected to the well head. Therefore, everything must be thought
and planned in the course of its activities taking this into account.
The selection of the best emergency disconnection sequence (EDS mode) from those available on the
rig, considering the operation in progress, is an essential factor for successful disconnection and isolation of
the well in case of threat or serious loss of position, thus ensuring the safety of the well, of the vessels and
of the subsea equipments, and avoiding catastrophes such as environmental pollution, loss of the well, etc.
The appropriate EDS modemust be selected before the beginning of each operation because there will be
no time for discussion in case of an emergency disconnection. The preselected EDS mode will be executed
immediately in case of red alarm.
Some variables should be considered in decision making;
a. Blind / Casing shear ram's arrangement;
b. EDS modes available;
c. Type of heave compensator (passive/active);
d. Shear capacity of rams.
Just to illustrate, Table 1 is showing different combination of EDS modes for three types of BOP shear
rams configurations. The cells highligted in gray represent most typical EDS modes found at offshore DP
rigs. Despite the wide-ranging sequence of actions, the different EDS options available in the driller panel
are related only to the shear rams to be closed in order to cut some element in front of BOP rams, if necessary,
and isolate the well. The most appropriate EDS choice is the one that isolates the well closing at least one
blind ram without cutting any element in the shortest period of time [2]. It's very important to have one
blind shear ram closing without shearing any element to increase sealing chances.
OTC-28011-MS 3

Table 1EDS options for different types of Shear Rams configuration

A wide diversification of available EDS modes makes it possible to select the most appropriate sequence
for an emergency scenario. However, the EDS modes available on the rigs do not always cover all possible
modes for a particular BOP arrangement. In this way, the EDS mode available on the rigs that best fits the
scenario must be selected according to the premises listed below:
1. Isolation of well is priority at EDS choice;
2. Set EDS mode "No-rams" when a non-shearable element is running in / out of hole (ex.: tripping BHA
in front of BOP). The idea is preserve the blind shear run to try closing the well using a backup system;
3. The Heave Compensator will act after the element cut by one of the rams and will upraise the upper
part of string, high enough to permit the blind ram to close against nothing.
The correct selection of EDS modes starts during well design period (see Figure 1), onceit is known
what rig is going to drill the well. During implementation of project, the drilling supervisor onboard should
discuss every drilling program (operational sequence) with the people involved and signalize what mode of
EDS is selected and when one change is needed, he should mention this in the program.

Figure 1Basic Process of preparation to drilling in a DP rig.

Table 2 show some examples of scenarios and when to select each kind of EDS mode [2].
4 OTC-28011-MS

Table 2Scenarios examples for EDS modes options for each BOP configuration.

The EDS Mode #9 was considered a very useful option for BOP with 2 shear rams (CSR + UBSR). If
the passing element is shearable by the CSR and not by the BSR, this delay would increase the chances of
closing blind shear ram against no tubular element. That is because BSR would start closing only after the
LMRP disconnection, because the rig would already be moving due to the drift.
However, some BOP configurations don't have available EDS #5 or EDS #9. It is common to run casing
in scenarios where the CSR is the only option to cut the string. When this happens the BOP may not have the
appropriate EDS mentionedon Table 2. When this happens there are risks involved during this job that were
not. For a scenario like this, according to Table 1, blowout preventers with configuration 2 (UBSR + CSR)
should use the EDS mode #4 (CSR + BSR). But, when the casing is being run in the well most of the time
it is on the slip or on the spider elevator, therefore, there is no compensation (DSC) and if a disconnection
occurs, there is no guarantee that the cutted casing will rise enough to allow the closure of the UpperBlind
Shear Ram (UBSR) against no element. What could be done to increase safety of these operations if they
occur and the reservoir is exposed? Which one of the EDS modes would be the best one?
OTC-28011-MS 5

Below, there is a suggestion and recommended actions to take when tripping casing and an advisory alarm
occurs at the rig. Considering a BOP configuration #2 with EDS modes available, the ones highlighted in
Table 1 (grey cells):
EDS preset: "NO SHEAR".
1. Incident progressing from the ADVISORY Status to the YELLOW ALARM and later to the
RED ALARM.
In case of ADVISORY Status:immediately stop running casing and start the compensation.
Change the EDS Mode to "CSR + BSR". Reassess risk together with people onshore.
If the advisory status evolves to YELLOW ALARM: if the recommended actions during
ADVISORY have been completed, remain compensation and monitor offset. Note: The selected
EDS Mode is "CSR + BSR".
If RED ALARM is reached: Activate EDS "CSR + BSR"
2. Straight YELLOW Alarm evolving to RED ALARM
In the occurrence of the DIRECT YELLOW ALARM: manually operate the CSR in high
pressure mode by a qualified and dedicated professional throughout the exposure period of this
operation;
If there is RED ALARM: Activate EDS "NO SHEAR". Activate BSR via acoustic after
disconnection.
3. Straight RED ALARM
If there is a Straight RED ALARM: manually actuate the CSR in high pressure mode
by a qualified professional dedicated exclusively to perform this operation. After verifying
CSR closure, press EDS button "NO SHEAR". Activate BSR via acoustic system, after
disconnection.

It is important to mention that in cases where the EDS "NO SHEAR" is executed, considering acoustic
system to close the well, the back-up system becomes the main system. Therefore, it's important to
point out that it is not possible to plan this specific type of operation without the acoustic system being
fullyoperational.

Well Specific Operating Guidelines (WSOG)

Well Specific Operating Guidelines has a widespread use nowadays as the chosen tool to limit DP settings
in the offshore drilling industry. The WSOG document is used to determine the actions to be taken in the
event of certainchanges in the DP unit capability, in a tabular format.
In 1992, motivated by a great number of incidents at that time, Petrobras created the DPPS ("Dynamic
Positioning Safety Program") [8]with the intent to stablisha proactive policy to avoid and minimize the
consequences of such events. Historically, Petrobras developed many procedures and guidelines due to lack
of better alternatives at that period. The tool "Degraded Status Criteria" has been developed to evaluate the
minimum allowable redundancy to safely operate a DP drilling vessels. This document, elaborated for each
rig, is now used as an input for the WSOG.
Petrobras philosophy for WSOG differs somehow of the international guidelines, as IMCA (International
Marine Contractors Association). At IMCA M 103 (The Design and Operation of Dynamically Positioned
Vessels) is stated that a Yellow Alert should be triggered when the DP System has its redundancy
compromised. For Petrobras, Yellow Alert should be triggered only in cases of critical situation for the
station keeping by parameters such as offset, riser angle, or any other high-risk predefined event. A loss
6 OTC-28011-MS

of DP redundancy, listed on the document "Degraded Status Criteria," is mapped as Advisory Status on
Petrobras WSOG model.
On Table 3 is possible to see the definitions taken from API and IMCA. In the authors point of view,
API and IMCA perspective together would bring two distinct circumstances for Yellow Alert: in case of an
undesired vessel offset (loss of position) API or in case of a loss of redundancy (even if the rig maintains
position) IMCA. Petrobras concept is aligned with the perspective shown in API recommended practice.

Table 3DP Yellow Alert perspectives for API and IMCA

Petrobras clearly considers two different situations: the degraded condition (tagged as Advisory Status),
defined by loss of redundancy in any equipment or component of the DP System, and the Yellow Status,
meaning that the rig has already lost its safe station keeping capability since abnormal offset or riser angle
has already overstepped predefined parameters, although, eventually, it may be still possible to recover safe
positioning. For Petrobras, "vessel in position with no redundancy" and "vessel drifting" are two different
conditions (Status), which should be reflected in the WSOG.
For instance, many contractors suggested triggering the Yellow Alert either for total Blackout or for
loss of one DP Network. In Petrobras point of view, these two scenarios are very distinct so they should
not be reflected in the same DP alert.
For Petrobras, a degraded condition (Advisory Status) allows time for decisions, which can be seen on
the Emergency Disconnection Guidelines flowcharts. In some cases, it allows the driller to take actions
to put the well in a safer condition than the immediate Yellow Alert procedure. Once the Yellow Alert is
sounded, the EDS has great chances to take place. At this stage, there is no time for discussions or doubts.
Rig floor personnel cannot hesitate on doing pertinent procedures since they have limited time for a potential
disconnection.
DP MODU have some peculiarities when compared to other DP Units. Ondrilling vessels, immediately
halting operation may not be thesafest decision. Petrobras procedure in degraded conditions(Advisory
Status) allows all personnel in charge to analyse the situation and take theappropriate course of action, based
on how "critical" the situation is in terms of risk to the well, the people, the rig and the environment.
Also, reaching the Yellow Alert in every loss of DP redundancy could lead to a saturation of the alert
by the driller. Although they have proper training and understanding, having several alerts in case of
degradation may remove their sense of urgency in case of real loss of position.(Emphasis added)
By Petrobras procedures, the Yellow Alert means critical situation which needs to be rapidly handled
as the full station keeping capability has already been lost. Rig personnel clearly know that, once sounded
the Alert, they have a limited amount of time for a potential disconnection and to prepare for the needed
procedures in case of an eminent disconnection.
Petrobras Definitions of DP Alert Status for Drilling Vessels

Normal Status
State in which the DP unit operates with all systems and equipment fully operationals, online or in standby
and with negligible risk of collision. The unit should work within its envelope of weather conditions (i.e.
without exceeding power or thrust demand) and without reaching any positioning reference parameter
(offset, riser angle etc.).
OTC-28011-MS 7

In short, there is no risk or evidence of loss of position and all operations scope of contract should be
performed without problems regarding positioning.

Advisory Status
For international alignment with WSOG procedures, the concepts of Petrobras "Degraded Status" came to
be considered as Advisory Status.
The Advisory Status states that the main positioning parameters (offset, riser angle etc.) reached
"advisory" limits established in WSOG orthat rig lost redundancy in some equipment or system related to
its dynamic positioning capabilities (generation, propulsion, controllers, sensors, position reference systems
etc.). Onboard crew (Driller, Company Man, Captain, OIM, whomever is in charge) must be immediately
informed so that the risks can be assessed and actions taken as soon as possible.
This status marks the beginning of concerns about a possible emergency disconnection, since an
additional failure can lead to loss of position. It is referred to as the ideal time for decision making regarding
operational safety, taking in to account how critical the degradation, the operation and risksare, (risks to the
well, the people, the equipment and the environment).
It is recommended that the details and risks of the operational solutions be discussed in advance,
during the well planning and on the daily operational meeting, involving all relevant personnel who will
participate in the job execution. Parameters related to the rig(such as the WSOG, the DP and the BOP system
maintenance status, the weather forecasting, the BOP EDS modes)and to the well (on-going and planned
operations, tools in the well, Emergency Disconnect flowcharts etc.)must be taken into account.

Yellow Status
The Yellow Status is triggeredwhen the main positioning parameters (offset, riser angle etc.) reach the
"yellow" limit established in WSOG, indicating that there is an actual loss of position or there is a high-
risk event. From this moment on, well operations must be suspended and preventive measures must be
immediately taken, preparing for a possible emergency disconnection.
Yellow Alarm must be triggered by DP operators or Captain of the vessel. This alarm shall be audible and
visual. The Yellow Alarm is to be taken as a "prepare to disconnect" order, following procedures previously
established and well understood by the crew, once there is no more time for discussions or to deliberate
what to do, even though eventually there may be a possibility of recovery.
The Yellow Alarm should also be immediately triggered in the event of a complete loss of propulsive
power (caused by a blackout or loss of all thrusters).

Red Status
The Red Status begins when the main positioning parameters (offset, riser angle etc.) reached the "red" limit
established in the WSOG, indicatinga seriouslossof station keeping capability or a high-risk event. There's
no more time for any mitigating action and from this moment on immediate emergency disconnection from
the well must take place. Failure or delay in proceeding may result in severe damage to the well, equipment,
the environment or people.
The Red Alarm must be triggered by DP operators or Captain. The alarm shall be audible and visual.
The Red Alarm is understood as a situation in which the vessel must disconnect immediately, following
procedures previously established and well understood by the crew.
Petrobras Generic Format of WSOG
The forms below were filled in for a generic rig, making a particular operation, on a specific location.
Values presented here are for illustrative purpose only and should be used only as a guideline. The WSOG
must be customized according to the specific job and risks involved.
Attached to this document, there is a table with weather condition and vessels movement limits for
specific operations that is not in this paper.
8 OTC-28011-MS

Recently, due to contractors feedback and in order to align itself to the format used in the oil industry
Petrobras adopted the conventional four status format for WSOG. However, the philosophy still differs from
the conditions of "vessel in position with no redundancy" and "vessel drifting".

Table 4Petrobras model of WSOG

OTC-28011-MS 9
10 OTC-28011-MS

Riser Analysis, DP Watch Circles and WSOG Online

Riser Drift-off Analysis of a drilling riser system (or completion/workover riser system) is used to
determine disconnect limits for DP vessels. Specifically, this analysis is used to determine or verify the
suitability of limits on vessel offset known as DP watch circles, which are very important for WSOG. The
yellow watch circle indicates the largest offset at which preparations for an emergency disconnect should
begin. The red watch circle indicates the largest offset at which an emergency disconnect sequence (EDS)
should be started. Both determinations rely on many assumptions about the vessel's trajectory (change in
offset and heading versus time) as well as the time required to recognize and respond to the drift-off, prepare
for emergency disconnect, for the emergency disconnect to complete, and for the LMRP to separate from
the lower stack prior to reaching a maximum allowable point of disconnect (POD). This point is the first
point reached where mechanical damage to the riser is considered to occur and will depend on water depth,
mud weight, riser tension, stroke of telescopic joint, etc.
The drift off study will provide, among other things, rig movement from the wellhead measured in time
after loss of all propulsion power in a number of environmental conditions. The one year return condition
is typically used as the environmental criteria in the WSOG, considering collinearity. In some cases, where
the one year return environmental conditions produces a very tight red watch circle or, where even a red
watch circle is not possible even after offsetting the rig into the environment, then consideration could be
given to reducing the environment criteria to 99% or even 95% of the one year return values accepting the
potential consequences of increased non-productive time.
In the authors point of view, this environmental approach is very conservative, especially when
correlating with the probability of a total loss of propulsive capacity. Excessively conservative choices can
drive against safety. Tight watch circles may increase a chance of an emergency disconnection (for instance,
this could withdraw the blackout recovery sequence the opportunity to bring the thrusters back on line).
Also, it may lead to operational complications to minimize riser angle due to restrict window to offset the
vessel.
An incident happened in February 2016 is a good example of this. Due to a fail on the synchronization of
one generator connection, the rig lost its station keeping capability. Until DP operator turn thrusters on line
and recover position on Joystick Mode, the rig drifted-off around 38 meters (riser angle reached around 1
degree). Red alert was not activated and there was no disconnection. If there was a tight red watch circle,
an EDS would have happened important to consider that every emergency disconnection has an intrinsic
process safety risk.
From this perspective, the authors believe in periodic simulations to provide "WSOG Online," based
on prevailing conditions (and also forecast) and actual vessel and riser data. Especially in locations with
harsh environment or shallow water, this solutions will improve the productive time with safety, reducing
conservatism from a shore analysis. This would also help positioning the rig in the optimum positionaiming,
among other things, todecrease riser angle. There are already field proven technology solutions for that
purpose. In future technical specifications, Petrobras will probably require this type of technology.
Riser Drift-off Analysis became also a requirement for Petrobras well design. In short, Petrobras wants
to project wells in which a generic rig could drill with a comfortable DP watch circle, as bending moment
of well head and Von Mises stress on conductor can be the limiting factors in the analysis, for example.

DP Incident Statistics, Emergency Disconnection Drills and Clear Shear

Procedure
Petrobras have a data base to record incidents with DP rigs, called BDIP. The goal is to catalog the DP
incidents occurred in Petrobras in order to provide guidance on the actions to be performed by DPPS in its
pursuits of operational safety of DP rigs. There are registered incidents of almost four decades with more
than a thousand events. All information presented at this topic were taken from this data base.
OTC-28011-MS 11

To be more realistic with the actual rig fleet, there will be considered only events since 2011. The Figure
2 shows the percentage of incidents of Advisory Status (considering Petrobras degraded status), Yellow
Status and Red Status. In total, there was 211 incidents.

Figure 2Incidents from BDIP January 2011 to January 2017. 211 Events in total.

As seen above, most of degraded conditions does not evolve to Yellow Status. Important to mention that
some of the Yellow registered at this period was different from Petrobras concepts due to conflicts between
Petrobras and contractors at some period. Note: The event is only registered once as the most severe status.
In other words, if a Yellow Status progress to a Red Status, this event would be registered once as Red.
The Table 5 below register Red Alerts incidents at Petrobras in the last two years.

Table 5Recent Red Alerts at Petrobras

It can be seentwo types of incident at this table:

1. Critical events/failures causea sudden drift;
2. Progressive events/failures escalate to a drift.
In the type 1, there is no time for any decision and the driller have limited time to proceed toprepare for
disconnection and EDS (e.g.: Dec 2016 incident).
In type 2, there is an advisory condition before the drift and there is time for verbal communication with
the driller and take the appropriate course of actions to minimize the consequences of an eventual EDS
(e.g.: May 2017 and Apr 2016 incidents). Once in advisory condition, it is difficult to determine if, and how
12 OTC-28011-MS

long it will take, for a drift-off to happen. This highlights the importance of discussing about the Emergency
Disconnection flowcharts prior from operations. (Emphasis added)
It can also be noted that the period between the Yellow Alarm and Red Alarm was really reduced,
inferiorto five minutes. In a recent study of the incidents, it was verified that the evolution time between
Yellow and Red presents a high probability of being shorter than the time for the driller to conclude the
hang-off (standard procedure for yellow status with drill pipe across the BOP). Therefore, it was verified
the risk of EDS in the middle of the hang-off procedure, during the stripping of the pipe and in the moment
when thetool joint (non-shearable) crosses the BOP shear rams.
For that reason, Petrobras is proposing another procedure called Clear Shear Procedure (CSP). The CSP
objective is to be a fast and safe procedure in order to avoid a non-shearable element passingin front of the
BOP shear rams during a Yellow alert, mainly due to uncertainties in the evolution time of the DP incident.
As time is a mandatory factor, Petrobras started making drills to check personnel knowledge, ability
and velocity to do the predefined contingency procedures, aiming to minimize human errors during real
cases of emergency. Hang-off drills started in 2016 and have more than 150 records up to now. Pioneer
CSP drills were made in July 2017. Although the procedure is still under evaluation and feedbacks are still
beinganalyzed, the first exercise revealed good results - CSP consists in the following steps: position string
at required space-out (by tally), close upper pipe ram with full operating pressure, open CMC to mid stroke.
In the Table 6, we can see that the hang-off procedure is considerablylonger than the CSP.

Table 6Duration of Hang-off and Clear Shear Procedure Drills

Considering the average time the driller spend to do the hang-off procedure and adding the fact of
stripping the string, passing the tool joint in front of BOP shear rams, the authors consider that perform a
hang-off is not adequate during Yellow Alert Status. CSP revealed to be more adequate for this purposenot
only due to the time, but also due to the risk of reaching the red alarm and having a tool joint passing in
front of blind shears rams. (Emphasis added)

Emergency Disconnection Guidelines

The Guidelines were established to help in the decision making, describing possible and necessary actions
when a threat (advisory) or serious loss of positioning occurs. These actions thought previously increase the
probability of secure both the well andpeople's life, also avoiding environmental pollution. The Emergency
Disconnection Guidelines are intended at achieving that objective by presenting viable alternatives to be
analyzed by on-board personnel, or in some cases strict recommendations to be followed, in order to permit
a safe emergency disconnection.
Before initiating any drilling or completion operation, the Company Man must consult the Emergency
Disconnection Guidelines and discuss with the technicians involved in the operation, such as the
Contractor's representatives (Captain, DP Operator, OIM, Tool Pusher, Driller, Subsea), service companies
professionals, etc., in order to identify the specific guideline (or similar) to the operation. After that
it's important to discuss the strategies described for the possible scenarios (from a unit's DP absence of
redundancy to the extreme case of an emergency disconnection)in order to evaluateif the generic guidelines
are appropriate, customizing them to the specific situation of the well, the rig, and the tools to be used in
the intervention. [2]
OTC-28011-MS 13

It's crucial tokeep in mind that the main difference between an anchored rig and a DP rig is that the latter is
always subjected to the possibility of an emergency disconnection due to equipment failure or malfunction,
blackout, adverse environmental conditions that surpass the unit's ability to maintain aposition at the well
head location. All operations must therefore be thought out, planned, set up, and carried out with this premise
in mind, and this includes the equipment that connects the rig to the well.
Using Emergency Disconnection Guidelines
The EDG embrace operations of drilling, completion / workover and drill stem test. All the flowcharts
initiate considering a scenario of regular operation (Green). The first thing to analyze is to define if the
operation is critical or not. Some critical operations are listed in Table 7 below.

Table 7Some Critical Operations examples

Critical Operation, from the point of view of DP rigs, is any operation that, in case of a disconnection,
directly or indirectly consist of a high risk for the operation itself (loss of the well, for instance),
environmental pollution, reservoir contamination, or a blowout. Example: Passage of a non-shearable
element through the BOP (BHA, non-shearable casings, etc.) or reservoir logging with a radioactive source.
The main point is that a critical operation must not be initiated if the rig is already in Advisory Status.
If Advisory Status occurs after the beginning of this class of operation, proceed as quickly and safely as
possible as indicated by the Emergency Disconnect Guideline in order to minimize the consequences of a
possible disconnection. There is a stamp on the flowcharts when the operation is considered critical (see
Figure 5).
According the Figure 3 below, despite having four operational status, the normal status can evolve straight
to yellow or red alert. All criteria for each status are defined on the WSOG. The EDS modes for each
operation are defined during well design stage, once the rig was defined. In the course of well construction
itself, the operations are developed with people on board discussing EDS modes and guidelines.
14 OTC-28011-MS

Figure 3Gradual evolution scheme of Operational Status

Once the Advisory Status is reached, whetherby DP problems or weather conditions, analyzing blue
areaof the guidelines, one or more action options appear under the DECISION box (see Figure 4). These
options generally alternate between "Evaluate risk to proceed to continue with operation" to "interrupt
operation and prepare for disconnection". Information such as the history DP incidentsof the rigs, causes that
led to the Advisory and operation criticity(from a safety and operational point of view) should be taken into
consideration by the drilling supervisor, Company Man, OIM, Captain, DP Operator and other technicians
involved.
The decision to carry on the job should be based on risk analysis by a team taking into account the
degradation stage of the DP system and the operations occurringin the well. In order to help which way to
go, some premises can be adopted:
A. (Main) Guarantee an EDS mode that closes blind ram against "no element";
B. Have "'Set of well barrier" established;
C. Risk exposure duration;
D. Have a riser safety margin.
In some cases one or more assumptions can be guaranteed. Do not interrupt or continue some specific
job will notcompromising operational safety. In some cases, finishing the operation can add more safety to
the well without compromising a planned and safe disconnection.
At the bottom of each guideline (see Figure 4 dashed text box), observations are included to support
decision making or reminders to be included in the operational sequences. Often the comments are of
technical nature, as in the example in Figure 3 above, there is note warning to beware of a reversing
circulation which can cause pressurization of the well or simply reminders to make sure that there is no tool
joint in front of BOP during the cement job.
As the choice of EDS varies according to the BOP configuration and availability of EDS modes of each
rig, the EDS mode indicated in red alert status ("EDS" box) should be associated with the available by the
rig (NO SHEAR, CSG + UBSR etc.) by considering the element in front of the BOP shear ram for each
situation.
During the advisory status, if the decision made has led to change the scenario, for example putting
the string in compensation or releasing a running tool and pulling above the BOP, the selected EDS mode
should be changed as illustrate in Figure 5, where the act of landing casing hanger into well head, the heave
compensation is required. So after landing, a different EDS should be selected.
OTC-28011-MS 15

Figure 4Guideline example for liner cementing

16 OTC-28011-MS

Figure 5Guideline example for running non-shearable casing

Table 8 below lists all the guidelines used at Petrobras. If any operation not listed in the index is to occur,
although it does not have a specific flow chart, the same methodology should be applied.
OTC-28011-MS 17

Table 8Index of Operations - Emergency Disconnection Guidelines

Conclusion
Despite the high reliability of dynamic positioning systems, there is always a chance of a loss of position to
occur in a rig. Thus, it is important to discuss, prior the operations, possible courses of action in case of a DP
incident, taking into account the BOP configuration, EDS Modes available and itscorrect pre-selection. It's
recommended the rig to have a wide diversification of available EDS modes, which would bring operational
flexibility and safety. The risk of any loss of DP redundancy must be assessed to stablish what can be done
to execute a safe and properly done disconnection.
18 OTC-28011-MS

According to Petrobras procedures WSOG and Emergency Disconnect Guidelines are key for
improvement of operational safety on DP rigs. Basically, the WSOG presents the requests for triggering the
DP Alerts and the Emergency Disconnect Guidelines help people in charge to make decisions once each
DP status is reached.
By Petrobras DP Incidents Database, it is possible to conclude that:

Loss of station keeping can evolve rapidly to a red alert.

A fast and clear communication between DP Bridge and drill floor is essential for operational
safety.
All pertinent procedures, such as WSOG and EDG, must be well understood by the crew.

The chance of human errors can be reduced by periodic drills.

Acknowledgement
The authors would like to thank Petrleo Brasileiro S.A. (Petrobras) for the growing efforts to provide safer
operations and for the continuous support to this work. Additionally, the authors acknowledge the effort of
all Petrobras workgroup responsible for the continuous revisions and construction of procedures, especially
Mr. Ronaldo Freitas Spinelli, Mr. Paulo Fragomeni Simon, Mr. Curt Max de Avila Panisset and Mr. Marcus
Vinicius Giollo Cesar.

Nomenclature
AST (SSTT) Subsea Test Tree
BDIP Dynamic Positioning Rig Incident Data Base
BOP Blowout Preventer
CSR Casing Shear Ram
DPPS Dynamic Positioning Safety Procedures
DP Dynamic Position
EDG Emergency Disconnection Guidelines
EDS Emergency Disconnection Sequence
IMCA International Marine Contractors Association
LBSR Lower Blind Shear Ram
MODU Mobile Offshore Drilling Unit
NR No Rams
TH Tubing Hanger
UBSR Upper Blind Shear Ram
WSOG Well Specific Operating Guidelines

References
1. Cruz, D.F. New Petrobras Procedures for WSOG. Presented in MTS DP Conference, Houston,
USA. October, 2014.
2. Fonseca, D., & PaulaR. R.Junior, (2013, October 29). Emergency Disconnection Guidelines.
Offshore Technology Conference. doi:10.4043/24418-MS
3. Pallaoro, A.A. WSOG (Well Specific Operating Guidelines) Concepts. Presented in 1st Brazilian
Conference on Dynamic Posicioning, Rio de Janeiro, Brazil. April, 2013.
4. API RP 16 Q, Recommended Practice for Design, Selection, Operation and Maintenance of
Marine Drilling Riser Systems.
5. IMCA M 220, Guidance on Operational Activity Planning, November 2012.
OTC-28011-MS 19

6. IMCA M 103, Guidelines for the Design and Operation of Dynamically Positioned Vessels,
April 2016.
7. DNV-RP-E307, DYNAMIC POSITIONING SYSTEMS - OPERATION GUIDANCE, January
2011;
8. Cordeiro, A., Pashoalin, R., & Fartes, E. (1996, January 1). DP-PS: A Safety Program for DP
Operations. Offshore Technology Conference. doi:10.4043/8113-MS