Patent Description:
A subsea well for oil or gas production comprises a number of concentric casings which are installed and cemented into the seabed from a drilling rig. Typically, a subsea well would comprise an outer conductor string of <NUM>" diameter, an inner surface casing string of <NUM>" diameter, an intermediate casing string of <NUM>- <NUM>/<NUM>" diameter and a production casing string of <NUM>-<NUM>/<NUM>". The well would be drilled in that order, in which holes for each casing string are drilled to progressively greater depths at diameters large enough to allow cement slurry to be pumped into the space between the casing string and the formation. Sometimes but not always, the cement can extend upward into the previous casing string for a distance of about <NUM> (<NUM> ft). Once set, the cement secures the casing into the formation and forms impenetrable barriers to prevent migration of well fluids into the environment.

When the well is no longer commercially viable many governments expect redundant wellhead systems to be removed from the seabed. A tested, permanent barrier must be established prior to the wellhead being severed and removed. A permanent barrier is normally defined as being a continuous plug within the well and the plug should seal within the production bore (production tubing) and extend radially outwards at the same elevation through all annuli between tubing and casings. A cement plug of about at least <NUM> (328ft) in length is typically required.

For safety and environmental reasons it is desirable and increasingly mandated by legislation that a so called 'category <NUM>' well status is achieved before wellhead removal. A category <NUM> well has a tested barrier within the production bore and tested barriers across all annuli.

Current practice to obtain category <NUM> wells is to use cement slurry which is pumped into the production bore and into each annulus, as required, to establish a plug with a minimum required length not less than <NUM> metres. When set, the cement is accepted as providing a suitable permanent barrier.

As a typical initial step in sealing an out of use well, the production bore is filled with a cement plug at depth below the wellhead. This cement plug is placed in the production zone, typically extending for a depth of at least <NUM> above the highest point at which well fluid would enter the production conduit. Such an arrangement secures leakage from the production bore in the event of failure of containment at the well head, for example if the well head is damaged or dislodged from its position on the seabed.

However, this may not always be adequate. In the event that the casing annuli are not adequately sealed the well would be classed as a 'category <NUM>' well. Category <NUM> wells are not considered to be safely sealed for abandonment. They do not have the required permanent barrier to allow safe removal of the well head. Leakage paths can exist via annuli between casings/tubing.

A subsea wellhead may not be removed unless the well can be classed as a category <NUM> well, in which case equipment and methods for conversion of a category <NUM> well into category <NUM> well are required.

Cementing a well bore across its width, including each annulus presents a number of challenges. For subsea operations it is highly desirable to minimise the number of operations that require fitting and removal of equipment to the wellhead or into the well bore. Equipment and methods that can carry out a number of operations in a 'single trip' to the well head are desired.

<NPL> describes a Wellhead Abandonment Straddle Packer, known as "WASP" where engagement of the tool with the wellhead is by 'hang off in moonpool" (see page <NUM>) followed by inflation of upper and lower packers (seals) to seal the WASP to the inside of a wellbore before perforating and cementing annulus or annuli.

According to the present invention there is provided a tool for cementing an annulus in a subsea oil or gas well according to claim <NUM>.

Advantageously, the diversion means comprises a valve in the supply fluid flow path, operable to redirect fluid supplied to the supply fluid flow path to a space in-between the upper and lower seals. In use of the tool the space defined between the upper and lower seals is a space between the seals and the casing to which the seals engage.

Such a 'cross-over' valve may be mounted between the upper and lower seals and operable to redirect fluid. The valve may be a sliding sleeve valve provided in piping of the supply fluid flow path. The valve may be hydraulically operated. When operated the valve allows fluid communication between the supply fluid flow path and to between the upper and lower seals. When operated, the valve may redirect all of the fluid in the supply fluid flow path to between the upper and lower seals. Alternatively, when operated the valve may redirect only a portion of the fluid in the supply fluid flow path to between the upper and lower seals. Fluid redirected to between the upper and lower seals may continue along the return fluid flow path to the safety module and (via an umbilical) to a surface vessel. It will also be appreciated that the operation of the valve can allow fluid flow in the opposite direction when desired, from between the upper and lower seals to the supply fluid flow path.

As an alternative to a valve mounted between the upper and lower seals, the diversion means may comprise a valve mounted at the lower seal. The valve at the lower seal is operable redirect fluid flow of the supply fluid flow path from below the lower seal to pass to the space in-between the upper and lower seals, by bypassing the lower seal.

Alternatively, or additionally the diversion means may be provided by having a lower seal that takes the form of an inflatable or expandable packer, where controlled hydraulic or mechanical action is used to expand sealing members into sealing engagement with casing walls. The diversion means can comprise the lower seal. The lower seal can then act as a diverter when required by deflating or retracting the packer, to allow fluid supplied via the supply fluid flow path to pass back up past the lower seal and to the space in-between the upper and lower seals.

The safety module provides a mechanical lock connection to the wellhead, and so may avoid difficulties following axial movement of the tool in the wellbore, which may happen with tools relying on friction forces to grip to the inner surface of a casing in the wellbore. The mechanical lock secures the tool to the well head by movement of parts into locking engagement with the wellhead, for example with an abutment profile inside the main bore of the wellhead or on the external surface of the wellhead mandrel. The abutment profile may comprise one or more groove, typically circumferential grooves. The lock does not rely on friction to prevent movement, in particular axial movement, of the tool from the desired location.

Thus, a portion of the mechanical lock may engage with the well head by overlapping, in at least the radial direction with one or more features such as; a groove; a protrusion; a change in diameter of the well head exterior; or a change in diameter of a bore within the interior of the well head; thereby acting against axial movement.

Alternatively, the mechanical lock may engage with the well head without a portion overlapping in the radial direction with one or more features of the well head as discussed above. This can be achieved by an engagement which has sufficient force to indent ("bite into") the exterior surface and/or an interior bore of the wellhead. Such arrangements may rely more on frictional forces, but still provide a mechanical locking effect in at least the axial direction.

The mechanical lock may be hydraulically operated.

The mechanical lock may be formed and arranged to make a clamping engagement to an abutment profile on the inside surface of the well head.

The mechanical lock formed and arranged to make a clamping engagement to an inside surface of the well head e.g. to a surface in the bore leading to the wellbore itself can leave access to the outside surface of the well head available for use, even an emergency use. For example to allow fitting of a Blow Out Preventer (BOP).

The safety module will typically include passageways for several fluid flows, valving and controls for sealing or redirecting those. Appropriate sealing to the wellhead can be provided to prevent leakage of fluid into the environment.

The safety module allows fluids provided via the umbilical, to be passed into the perforation and circulation module and back into the umbilical when desired. The umbilical will typically comprise at least two conduits for flow into the supply fluid flow path and return from the return fluid flow path. Conduits for supply of hydraulic fluids, to allow hydraulic control of features of the tool; and wiring for sensor signals and/or electrical control signals may also be provided in the umbilical.

The mechanical lock may comprise a plurality of dogs, typically distributed circumferentially about a surface of the tool and operable, for example by means of an axially moving cam ring, to move outwards to engage an inner surface of a well head. In the alternative, where an outer surface of a wellhead is engaged the dogs can be arranged to move inwards for locking engagement. The axially moving cam ring may be hydraulically operated by a hydraulic system.

The dogs of a mechanical lock may engage with the well head by overlapping in at least the radial direction with one or more features of the wellhead. As an alternative an expanding split ring may be employed, to expand into locking engagement within a bore of the wellhead, or even to contract into locking engagement with the exterior of a well head. As a yet further alternative a set of radially outwards moving balls may be employed in a mechanical lock, to move into engagement with a feature provided within a bore of the wellhead.

Alternatively, engagement with a well head may be by a portion of the mechanical lock indenting ('biting') into the wall of a bore or an exterior surface of the wellhead. For example, the mechanical lock may comprise one of:.

The mechanical lock may include a secondary unlocking arrangement. The secondary unlocking arrangement may comprise a separate hydraulic system, or a separate part of a hydraulic system, that powers the mechanical lock, for example in the event of failure of the hydraulic system that is normally employed to operate it. The secondary unlocking system may be employed after the disconnection system discussed below has been operated.

The secondary unlocking arrangement may comprise an unlocking ring that can be operated to move an axially moving cam ring of the mechanical lock in the event that it cannot be moved by the intended power source. The unlocking ring moves axially. The unlocking ring may be powered by a separate hydraulic system, or a separate part of a hydraulic system from that used with the axially moving cam ring of the mechanical lock.

The safety module may comprise further features. The safety module provides fluid communication between an umbilical and the perforation and circulation module. In normal use the umbilical provides connection to above the water surface, typically to a floating vessel. This allows supply and return of fluids, supply of hydraulic and/or electrical power and control and sensor data.

Operations from a floating vessel such as, in particular, a dynamically positioned ship prevents the risk of a "drive off", where the vessel accidentally moves away from the wellhead or is forced to move away due to an incident. Such a situation requires emergency disconnection of the vessel from the subsea tooling system, e.g. by severing the umbilical or by severing a connection such: as umbilical to equipment on the vessel; or umbilical to the safety module. Re-establishing a severed connection can be difficult and time consuming.

Conveniently the safety module includes a disconnection system that can allow disconnection and reattachment of an umbilical to the tool without breakage of component parts. Thus, the safety module may comprise two parts: a disconnection part and a base part. The disconnection part connects to an umbilical and has a quick release coupling for connecting to the base. The base accepts the quick release coupling from the disconnection part, includes the mechanical lock and connects to the perforation and circulation module. The disconnection part will contain passages for flow and return of fluids, together with control lines (e.g. electrical and/or hydraulic) to allow operation of the tool as described herein. Appropriate valves (that close on disconnection and are openable on reconnection) can be provided on the base part and the disconnection part. Thus, the disconnection system can allow disconnection without breakage of components, at least on the base part. Preferably disconnection can be without breakage of components on either the base part or the disconnection part. Reconnection of the original disconnection part (and associated umbilical) to the base part can then be readily achieved. Alternatively, a new disconnection part and associated umbilical can be connected to the base part for resumption of operations. For example, if the disconnection part or its associated umbilical has been damaged in a "drive off" incident,.

The quick release coupling may be hydraulically operated from a floating vessel, via the umbilical. The quick release coupling may comprise a plurality of dogs, typically distributed circumferentially about a surface and operable, for example by means of an axially moving cam ring, to move inwards to engage an outwards directed surface of the base. The axially moving cam ring can be powered hydraulically by a hydraulic system.

The axially moving cam ring and dogs may be formed so that on axial movement of the cam ring to disengage the dogs, the cam ring engages with a hook feature on each of the dogs to positively hold the dogs in the disengaged state. This aids in ensuring successful disconnection in an emergency.

In an alternative arrangement, where an inner surface of the base is to be engaged, the dogs can be arranged to move outwards for locking engagement.

Sealing may be provided between the ends of fluid passageways of the disconnection part and the base that are in fluid communication when the safety module is assembled. Similarly shut off valves may be provided in the base and in the disconnection part, to operate on disconnection, preventing fluids leaking out from the wellbore and supply and return hoses.

For ease of reconnection subsea (for example by use of an ROV), the safety module may include one or more alignment features on at least one of the disconnection part and base part. Alignment features allow fitting of the disconnection part and base part only when in the desired orientation with respect to each other. For example, a projection or "finger" on one part may fit into a corresponding slot or groove in the other.

As a yet further safety feature the safety module may include a secondary disconnection arrangement. The secondary disconnection arrangement may comprise a separate hydraulic system, or a separate part of a hydraulic system, that powers the secondary disconnection arrangement, for example in the event of failure of a hydraulic system that is normally employed to operate it.

The secondary disconnection arrangement may comprise a disconnection ring that can be operated to move the axially moving cam ring of the disconnection system in the event that it cannot be moved by the intended power source. The disconnection ring moves axially. The disconnection ring may be powered by a separate hydraulic system, or a separate part of a hydraulic system from that used with the axially moving cam ring.

After disconnection of the disconnection part of the safety module the remainder of the tool remains mechanically locked into the wellhead. Where reconnection of the disconnection part is not desired, or not possible, the remainder of the tool can still be retrievable from the well head.

For example, where the mechanical lock engages an inside surface (e.g. an abutment profile in the form of grooves) of the well head a Blow Out Preventer (BOP) can be fitted, locking on to an external abutment profile of the wellhead. The base part of the safety module may include a connection that accepts a drill pipe end allowing fluid access to the interior of the tool. In a convenient arrangement, a secondary unlocking system of the mechanical lock can be activated by fluid pressure applied via the drill pipe. A bursting disc or other mechanism that opens under the application of excess pressure can be used to provide access to a separate hydraulic system or part of a hydraulic system from that normally employed to operate the mechanical lock. If an unlocking ring is employed, the fluid pressure may power an unlocking ring that moves an axially moving cam ring to disengage dogs. The fluid may act on the unlocking ring via one or more fluid passageways in the tool that is/are opened following rupture of one or more bursting discs (or opening provided by operation of another pressure operated mechanism) caused by the fluid pressure.

The perforation and circulation module has upper and lower seals for sealing to the inner surface or casing or tubing, typically sealing will be to the inside surface of production casing in an abandoned well. (For convenience the term casing is used generally throughout this document to refer to any tubing located as part of a well bore structure for normal operations.

The seals are spaced apart and will typically be mounted about a mandrel, or each may be mounted to separate mandrels. The mandrel or mandrels comprise piping of the fluid flow paths. The seals can be passive cup type seals or of the various other known 'packer' types used in retrievable downhole tools. For example, inflatable or expandable packers, where controlled hydraulic or mechanical action is used to expand sealing members into sealing engagement with casing walls.

The tools of the present invention include a mechanical lock to the well head. Therefore the upper and lower seals do not have to serve in preventing axial movement of the tool in the wellbore. Operations using the tool (described hereafter) do not require deflation of one or more of the seals to allow fluid passage in the tubing. It can be convenient to make use of seals with reduced mechanical complication, even passive seals that operate without control from above. The known cup seals comprising a resiliently deformable cup shaped member mounted on a mandrel can serve. Two cups, with open ends facing in opposite axial directions, may be provided for each of the upper and lower seals, so that the bi-directional nature of such a seal facilitates the ability to seal and/or test from above and below.

The perforation and circulation module has a supply fluid flow path through the upper and lower seals. In use this can supply fluid to the wellbore below the seal made to the production casing by the lower seal. The return fluid flow path is provided from between the upper and lower seals. Conveniently the supply and return fluid flow paths can include a pipe in pipe arrangement within a mandrel mounting the upper seal. For example an outer pipe terminating between the upper and lower seals provides return fluid flow from between the seals. An inner pipe extends further, continuing through a mandrel mounting the lower seal to provide supply fluid flow.

The perforation and circulation module has at least one upper perforating device, mounted between the upper and lower seals. The upper perforating device or devices can be of the conventional type, perforating 'guns' mounting explosive charges that are activated to make holes through tubing or a casing into one or more annuli but alternative devices which perforate casing or casings may be provided. Where 'guns' are used these may be detonated electrically but preferably hydraulically, and the tool will include porting for this purpose.

At least one lower perforating device, is provided, below the lower seal. Lower perforating devices can be of the same type as used for the upper perforating devices e.g. perforating guns. The at least one lower perforating device is mounted below the lower seal. For typical operations making use of the tool the lower perforating device(s) is/are mounted at some distance below the lower seal, typically at least <NUM> below the lower seal. This can be arranged by suspending the lower perforating device(s) on flexible lines) from a fitting at or near the lower seal. Typically wire ropes suspend the devices and hydraulic control tubing conveys fluid to activate the detonation but alternative electrical means may also be used via electrical conductors.

The tool of the present invention may comprise other features. For example the tool may be provided with a cement wiper system. The cement wiper system may comprise a wiper plug, detachably mounted below the lower seal of the perforation and circulation module. In use the wiper plug detaches from the tool and descends in advance of a flow of cement slurry, clearing fluid and debris from the bore (casing) the tool has been inserted into. The wiper plug avoids dilution or "fingering" (the cement separating into flows that are separated by well fluids such as water). The wiper plug can be sized to wipe or to pass close to the walls of the production casing as it descends. The wiper plug can make use of one or more resiliently deformable members, for example circumferential ribs, to provide good contact with the walls as it descends.

The wiper plug may be attached to the tool by a frangible connection, that breaks when the wiper system is operated. Alternatively, the wiper plug may be held in position by a mechanical connection that releases on receipt of a control signal or when pressure of descending fluid in the tool causes release of the mechanical connection.

In a convenient arrangement the wiper plug has a passage therethrough that forms part of the supply fluid flow path. The wiper system may be operated by a dropping ball mechanism. The passage forming part of the fluid supply path may include a seat for a ball. In such an arrangement a ball is provided, for example within the safety module, or in a ball holding unit attached to the safety module. On operation of a signal such as a hydraulic control signal, the ball is released to fall through the tool, typically along the supply fluid flow path, and pushed by fluid being pumped from above. The ball rests in the seat of the wiper plug resulting in a build up of pressure until the wiper plug detaches and descends.

The tool according to the present invention is for cementing an annulus in a subsea oil or gas well. Typically the well will be sealed in the production bore by a deep cement plug. The rest of the production bore and annuli surrounding it will be filled with fluid (water, well products and/or fluids from well operations).

A method for cementing an annulus in a subsea oil or gas well, may comprise:.

Where the diversion means comprises a valve in the supply fluid flow path, it is operated to redirect fluid supplied to the supply fluid flow path to the space in-between the upper and lower seals at step i) above.

Where non passive seals are employed the method will also include operating the seals when the tool is deployed into the wellbore (e.g. at step b) above), to provide sealing to production tubing or casing before the seals are required to direct fluid flow.

The method may also include pressure testing for safety reasons at various stages of the operation. For example, after the lower perforation devices have been operated the annulus may be pressurised (by a fluid such as water) pumped down the umbilical and through the supply fluid flow path. A loss of pressure would indicate the annulus has a leak path and so is not suitable for the proposed cementing operation. Pressure testing may also be carried out between the upper and lower seals (e.g. making use of the return fluid flow path to supply fluid pressure). After cement has set in the annulus, pressure testing can show that the barrier of cement is complete, without a leakage path.

In general pressure testing can be carried out by applying fluid pressure from a surface vessel or rig down a conduit in the umbilical and monitoring for a loss of pressure at the vessel or rig. Alternatively, or additionally, the tool may be provided with pressure sensors and signal means to measure downhole pressures.

The charge of cement slurry is typically calculated on the basis of the anticipated volume of the annulus being filled, between the lower and upper perforations made by the respective lower and upper perforation devices. Typically a length of about <NUM> (500ft) may be provided between the sets of perforations and the cement slurry charge is intended to fill about at least <NUM> (328ft). The cement slurry charge is delivered into the annulus by following it with a suitable 'tail fluid'. The tail fluid and fluids used before or after the cement slurry for cleaning or flushing operations are typically water or water based, e.g. seawater.

Where the tool is provided with a cement wiper system as described herein then step g) in the method as described above can be carried out by passing cement slurry charge and tail fluid from the surface vessel or rig through the umbilical, the supply fluid flow path and into the annulus. The cement wiper plug is deployed ahead of the charge of cement slurry to avoid dilution and clear a path for the cement. The wiper plug will descend to the level of the apertures through tubing or casing made by the lower perforating device(s) and allow the cement to pass into the annulus and fill it to the extent desired.

The method of cementing an annulus is typically employed when a well is to be sealed closed for permanent abandonment. The method of cementing is typically carried out in well with a cement plug already present at depth in the production bore, allowing insertion of the tool without substantial loss of fluid from the production casing. In such situations a cement plug across all the layers of casing is mandatory.

Cementing to form a barrier in the central casing (production bore) can be carried out as follows.

After the cement charge in the annulus is set and either before or after the space between the upper and lower seals has been cleaned, a further charge of cement slurry followed by a tail fluid can be pumped down the umbilical and through the supply fluid flow path into the production casing that forms the central bore of the well. As an alternative a single charge of a cement slurry sufficient to fill both the annulus and the central bore of the well to the desired extent may be supplied. i.e. the charge delivered is calculated to fill the production casing up to a desired level below the lower seal of the tool. Where such an arrangement is used, pressure testing of the cement plug in the annulus and the cement plug in the central bore can be carried out together.

Cementing a subsea oil or gas well can provide a permanent barrier across the well before wellhead removal and abandonment.

To assist in avoiding dilution of the cement by fluid in the umbilical, the valve in the supply fluid flow path can be set to direct redirect fluid supplied to the supply fluid flow path to between the upper and lower seals, allowing the bulk of the fluid passing down the umbilical, in advance of the cement slurry charge, to pass down the umbilical and be redirected back up the umbilical via the return fluid flow path. This may be a substantial length e.g. a water depth of <NUM> to <NUM> (<NUM> to 600ft) is typical in the UK sector of the North Sea. The valve is set to allow normal flow down the fluid flow path to below the lower seal before cement slurry arrives at the tool. The desired quantity of cement slurry is then charged into the central bore of the well. As the fluid remaining in the central bore may not have an escape route, forming a satisfactory plug of cement may be aided by removing the tool from the wellbore as this final charge of cement slurry is delivered. Alternatively where an expandable packer is used at the lower seal a return path may be established by deflating or retracting the lower seal.

Where the tool has a lower seal that employs inflatable or expandable packers (actively controllable by the operator of the tool) then the cleaning following the charge of cement slurry may be achieved in an additional or alternative fashion. After deflating or collapsing the lower seal, cleaning fluid can be circulated through the supply fluid flow path to below the lower seal (above the cement in the production casing) with a return to the surface available past the lower seal and via the return fluid flow path in the tool. The use of a lower seal that can be deflated or collapsed in this way can aid in avoiding cementing the tool into the production casing.

Pressure testing of the cement plug in the production casing and/or the central bore of the well can then be carried out. The wellhead may then be removed, typically the casings are severed at some depth, typically about <NUM> (15ft) below the seabed surface to leave no structure vulnerable to damage by collision with e.g. fishing gear.

The methods described above can extend to cementing more than one annulus in a wellbore. When a second annulus is to be cemented, the tool according to the present invention can be fitted with:.

These second perforating devices can be used after cementing the first annulus to perforate through to a second annulus, outside the first and allow a cementing operation such as described in steps f) to h) above. Appropriate pressure testing can be carried out at each stage, for example after se of the second lower perforating device to determine that the second annulus does not have a leak path that would allow loss of cement slurry to the surroundings.

To avoid the second perforating devices having to cut through cement in the first annulus both the upper second perforating device may be positioned above the first and the second lower perforating device may be positioned below the first.

After cementing a second annulus the cleaning and unlocking operations i) and j) described above may be carried out, or more typically cementing the central tubing or casing is carried out as described above for obtaining a cement barrier across the whole of a well.

In a preferred sequence of operations when two annuli and the central bore of a well are to be cemented the cementing procedures of the method may be carried out by using the following particular options for the method steps.

After the first annulus has been cleaned (e.g. as in step f) above), the charge of cement slurry is delivered by passing cement slurry followed by a tail fluid from the surface vessel or rig through the umbilical, the return fluid flow path and into the annulus. The cement slurry charge is held in position within the annulus by controlling (balancing) the fluid pressure in the production casing via the supply fluid flow path. Supplying the cement charge in this way allows use of a cement wiper system as discussed below:-
After cleaning between the upper and lower seals making use of the diversion means and allowing the cement to set (as in steps h), i) above) the pressure in the first annulus can be tested.

The second perforating devices are used in the same way as the first, to establish a flow path through the second annulus.

The second charge of cement slurry is delivered by passing cement slurry followed by a tail fluid from the surface vessel or rig through the umbilical, the return fluid flow path and into the second annulus. The charge delivered is calculated to be sufficient not only to fill the second annulus to the desired extent but also to fill the production casing up to a desired level below the lower seal of the tool. Where the tool is fitted with a cement wiper system the wiper plug is deployed in front of the second cement slurry charge.

After cleaning between the upper and lower seals making use of the diversion means and allowing the cement to set (as in steps h), i) above) the cement is allowed to set.

Pressure in the second annulus and production casing can then be tested.

Conveniently the diversion means employed comprises a valve in the supply fluid flow path, operable to redirect fluid supplied to the supply fluid flow path to the space in-between the upper and lower seals. In an alternative arrangement, where the tool has a lower seal that employs inflatable or expandable packers (actively controllable by the operator of the tool) then the cleaning following the second charge of cement slurry may be achieved in a different fashion. After deflating or collapsing the lower seal, cleaning fluid can be circulated through the supply fluid flow path to below the lower seal (above the cement in the production casing) with a return to the surface available past the lower seal and via the return fluid flow path in the tool. The use of a lower seal that can be deflated or collapsed in this way can aid in avoiding cementing the tool into the production casing.

A tool for cementing an annulus and for methods of cementing a subsea oil or gas well to provide a permanent barrier is shown in schematic elevation in <FIG>. Umbilical connection from the top of the tool to a surface vessel or rig are not shown, for clarity. Breaks are shown between parts <NUM>, <NUM> and the lower end of part <NUM>, to allow showing the whole tool in one view.

The tool <NUM> includes a safety module <NUM> and a perforation and circulation module <NUM>. The perforation and circulation module <NUM> includes upper and lower seals <NUM>,<NUM> each having two passive cup seal members <NUM>,<NUM> in this example. Upper perforating devices, in this example perforating guns <NUM> (only one visible in this view) are mounted between seals <NUM>,<NUM>. Lower perforating devices in this example perforating guns <NUM> are suspended (at some distance) below the lower seal <NUM> by cables and/or hydraulic control lines <NUM>.

A cross-over valve <NUM> (in this example a sliding sleeve valve) is mounted between the seals <NUM>,<NUM> and has apertures <NUM> that can allow passage of fluid when the valve is opened. Also visible in <FIG> is a ball holding unit <NUM> which is part of a cement wiper system that includes wiper plug <NUM>.

In this example the safety module includes a disconnection part <NUM> joined to a base part <NUM>. The base part <NUM> includes a wellhead connector section <NUM>. The wellhead connector section <NUM> includes a mechanical lock whose retractable dogs <NUM> are visible in an expanded (locking) position in this figure.

The disconnection part <NUM> includes alignment projections <NUM> (only one visible in this view, typically at least two are used). The projection <NUM> sits in a groove of the base part <NUM>.

<FIG> shows in schematic cross section the interior of the safety module <NUM> of the tool depicted in <FIG>. Parts are numbered the same as in <FIG>.

Visible in the interior of the safety module <NUM> is a bore <NUM> leading to a central bore <NUM> that passes down the centre of the tool and continues to the perforation and circulation module (not shown in this figure). These bores <NUM>, <NUM> are part of the supply fluid flow path for supply of fluid, including cement slurry, from an umbilical, in use of the tool. The normal direction of flow is suggested by arrows S, but as described herein the flow direction may be reversed in some operations. Ball holding/releasing unit <NUM> is in communication with the supply fluid flow path so that a ball released from the unit <NUM> will pass down the supply fluid flow path.

Also shown is a bore <NUM> that constitutes part of a return fluid flow path, for return of fluids back up through an umbilical in use. The flow path from bore <NUM> continues as an outer pipe <NUM> surrounding an inner pipe <NUM> that is a continuation of bore <NUM>. The normal direction of flow is indicated by arrows R, but as described herein the flow direction may be reversed in some operations.

Outer pipe <NUM> ends at upper seal <NUM> (<FIG>) whilst inner pipe <NUM> extends to below lower seal <NUM> (<FIG>).

As depicted in <FIG> the dogs <NUM> of a mechanical lock are engaging with corresponding grooves on the interior bore of a typical subsea well head housing <NUM>, positively locking the tool <NUM> to the wellhead <NUM>, in particular acting to prevent upwards or downwards (i.e. axial) movement. The dogs are operated by a hydraulically driven cam ring <NUM>, and are releasable if the ring moves upwards.

In this figure the disconnection part <NUM> of the safety module is shown unlatched and ready for release from the base part <NUM>. Dogs <NUM> are shown held away from engagement with circumferential groove <NUM> by hydraulically driven cam ring <NUM> which includes a projection <NUM> engaging with hook features <NUM> on the dogs <NUM>. (See magnified part view <FIG>). On separation of the disconnection part <NUM> from the base part, appropriate fail-safe closed valves <NUM> will act to seal the fluid flow paths and non-return valves will act to seal hydraulic control lines where required. In this example, in the base disconnection part <NUM>, two tandem fail-safe valves are provided in each flow-path.

In normal use the cam ring <NUM> is in a lowered position to force dogs <NUM> into groove <NUM>, as shown in magnified detail of <FIG>.

<FIG> shows in schematic perspective the parts of disconnection part <NUM> and base part <NUM> separated from each other. In this view the projections <NUM> of disconnection part <NUM> and corresponding grooves <NUM> on base part <NUM> can be seen. On connection or reconnection of parts <NUM> and <NUM> the projections <NUM> and grooves <NUM> ensure fitting together in the correct orientation to allow alignment of parts such as the bores for fluids shown in <FIG>. Pad eyes <NUM> are shown in this figure, for use in connecting lifting members, e.g. ropes constructed from wire or other materials, cables etc. for lifting and lowering the tool.

<FIG> show in schematic perspective the major part of the perforation and circulation module <NUM> of the tool depicted in <FIG>. The part in <FIG> is rotated with respect to the view of <FIG> to provide two viewing angles.

As can be seen in <FIG> two upper perforating guns <NUM> (the perforating devices employed in the example) are mounted between seals <NUM>,<NUM>. The guns <NUM> include a number of apertures <NUM> for directing products and energy from detonation of explosives outwards to perforate casings downhole. As can be seen more easily in <FIG> a pipe section <NUM>, which is a continuation of pipe <NUM> shown in cross section <FIG> passes by the upper perforating guns <NUM> and through the mandrel mounting lower seal <NUM>. Pipe section <NUM> is part of the supply fluid flow path and is in fluid communication with outlets <NUM> of cross-over valve <NUM>, when the valve is opened. Hollow studs <NUM> connect the upper and lower parts of the perforation and circulation module <NUM> and one or more can carry hydraulic lines. For example, for operating cross-over valve <NUM> and lower perforation guns (not shown in these figures). In general, the hollow studs <NUM> may carry hydraulic lines, electrical signal and/or power lines in some examples of the tool.

<FIG> shows in cross section schematic detail a wiper plug arrangement typically made of flexible, e.g. elastomeric, material fitted below the lower seal <NUM> of a perforation and circulation module. Wiper plug <NUM> is attached by a frangible connection <NUM> to the bottom end of the perforation and circulation module <NUM>. Hydraulic control lines <NUM> and <NUM> (for firing lower perforation guns - see <FIG>) pass through the body of the wiper plug <NUM>. Only line <NUM> is fully shown in <FIG> but both are shown in <FIG> (see detail in <FIG>). The lines <NUM> and <NUM> include some "slack" <NUM> to accommodate axial travel of couplings <NUM> that will release when the wiper plug <NUM> detaches and descends away from the perforation and circulation module <NUM>. Passing through the wiper plug <NUM> is a passage <NUM>, part of the supply fluid flow path S, through which fluids, including cement slurry can pass. The passage <NUM> includes a seat <NUM> for a ball that is dropped from ball holding/releasing unit <NUM> (<FIG>).

Detail view <FIG> shows a ball <NUM> that has been dropped from ball holding/releasing unit <NUM> situated in seat <NUM>. The ball <NUM> seals passage <NUM>. Therefore, when fluid flow S is supplied the pressure causes wiper plug <NUM> to detach and descend (direction D). The circumferential ribs <NUM> are flexible and sized to fit close to/in contact with the inner surface of a production casing. Thus, when the plug <NUM> descends in the casing driven by the cement slurry or other fluid above it, it sweeps debris out of the way and acts to avoid unwanted mixing between fluid being delivered and fluid already in the bore of a well.

<FIG>, <FIG>, <FIG>, and <FIG> show schematically in cross sections flow paths for cementing operations and fluid circulating procedures. The well casing lengths are not to scale, but are greatly shortened to allow viewing of lower perforations in the figures.

In <FIG> a tool <NUM> (like that of <FIG>) is located in a production casing <NUM> of a well with two further casings <NUM> and <NUM> creating two annuli, inner annulus <NUM> and outer annulus <NUM>. One or more lower perforating guns <NUM> have made lower perforations <NUM> in casing <NUM>. One or more upper perforating guns (not shown for clarity, but located between upper and lower seals <NUM>,<NUM>) have made upper perforations <NUM> in casing <NUM>. The perforations <NUM> and <NUM> allow fluid circulation. As indicated by arrows in <FIG> a supply fluid flow path allows fluid flow S (of cleaning fluid such as seawater) to be sent from an umbilical through the supply fluid flow path in the tool <NUM>, including through wiper plug <NUM>, down the production casing <NUM> and through lower perforations <NUM>. The fluid returns in flow R as suggested by arrows from the lower perforations <NUM>, up through inner annulus <NUM>, through upper perforations <NUM> to between seals <NUM>,<NUM> and back toward the surface by the route through the upper part of tool <NUM> depicted in <FIG>. When carrying out a cleaning operation the fluid flows depicted can be reversed.

In <FIG> the same fluid flow paths depicted in <FIG> are used to deliver cement to the inner annulus <NUM>, which is filled with a cement slurry charge <NUM> to a maximum height level L below that of the upper perforations <NUM>. The production casing <NUM> is substantially freed of cement by following cement charge <NUM> with a tail fluid (such as seawater). Cement charge <NUM> is allowed to set following which pressure testing can be undertaken. If the outer annulus <NUM> is not present, or if filling it with cement is not required, then cementing operations can continue by supplying a further charge of cement slurry followed by a tail fluid pumped down an umbilical and through the supply fluid flow path into the production casing that forms the central bore of the well.

As an alternative (the flow path used to fill the inner annulus can be the reverse of that depicted, with cement charge <NUM> supplied in the direction R.

In <FIG> the cementing of the second annulus <NUM> is depicted. After perforating through both the casings <NUM> and <NUM> with one or more second lower perforating gun(s) the perforations <NUM> allow access to the second annulus <NUM>. Similarly, one or more second upper perforating gun(s) have made perforations <NUM> through to the second annulus between the seals <NUM>,<NUM>. Cementing in the second annulus <NUM> is made, in this example, with the use of the cement wiper plug <NUM>. After dropping a ball (<FIG>) to sit in the seat of the wiper plug <NUM> a second charge of cement slurry has been passed down the supply fluid flow path. This flow S has detached the wiper plug which is pushed to below perforations <NUM>, cleaning the bore of the production casing <NUM>. The second cement charge <NUM> fills second annulus <NUM> up to level L2 below upper perforations <NUM>. Conveniently cementing the bore of production casing <NUM> is carried out by applying a cement <NUM> charge that also fills that bore, at least below the bottom seal <NUM> of the tool to maximum height level L3.

In <FIG> the use of the cross-over valve <NUM> in cleaning or flushing the production bore of casing <NUM> is illustrated. Operating cross-over valve <NUM> diverts some fluid flow back into the space between seals <NUM> and <NUM>. In this example as well as diverted flow <NUM> from supply fluid flow S, the valve <NUM> also continues to allow flow <NUM> to below lower seal <NUM>. This arrangement of flows cleans between seals <NUM> and <NUM> and prevents debris such as set/setting cement slurry obstructing removal of the tool upwards.

If the lower seal <NUM> in <FIG> is an expandable packer having an expandable seal element, the seal element can be relaxed to allow flow past the seal to wash out cement from below seal <NUM>. Such an arrangement of flows can clean between seals <NUM> and <NUM> and below seal <NUM>. This can prevent debris such as set/setting cement obstructing removal of the tool upwards.

<FIG> shows in schematic cross section the interior of a safety module <NUM>, similar to that shown in <FIG>, <FIG>.

In <FIG> the dogs <NUM> are held in the locked position by axially moving cam ring <NUM>. Therefore, the disconnection part <NUM> is in locking engagement with the base part <NUM>. In this example the quick release coupling of the disconnection system also includes a secondary disconnection arrangement including disconnection ring <NUM> placed around the circumference of axially moving cam ring <NUM>.

In the event that the movement of cam ring <NUM> fails due to e.g. failure of a hydraulic circuit, then disconnection ring <NUM> can be operated (by its own hydraulic system) to move axially in direction D. (Hydraulic fluid is pumped in below the ring <NUM>. ) The motion of ring <NUM> engages circumferential rib <NUM> driving cam ring <NUM> upwards and thereby causing dogs <NUM> to disengage to the unlocked position depicted in <FIG>. Thus disconnection of disconnection part <NUM> and the base part <NUM> can be achieved.

<FIG> shows in schematic cross section a view of the well head connector section <NUM> of a tool similar to that depicted in <FIG>, <FIG> and connected to a subsea well head housing <NUM>. The dogs <NUM> of the mechanical lock are shown in locking engagement with subsea well head housing <NUM>, held in place by axially moving cam ring <NUM>. The dogs <NUM> overlap in the radial direction with the subsea wellhead housing <NUM>, preventing movement in the axial direction.

In this example, the axially moving cam ring <NUM> is moveable by hydraulic fluid pressure applied vie passage way <NUM> to below an inwards projecting rib <NUM>. Fluid pressure applied via passage way <NUM> causes upwards motion (suggested by arrow U) of the cam ring <NUM>, allowing the dogs <NUM> to disengage from subsea well head housing <NUM>.

<FIG> shows the arrangement of <FIG>, but through a different cross section and with more of the base part <NUM> of the safety module depicted. This cross-section allows viewing of a separate hydraulic arrangement, that constitutes a secondary unlocking arrangement. Where valves <NUM> are closed, fluid pressure applied via supply fluid flow path S acts on bursting disc <NUM> (shown in <FIG>) in hydraulic fluid passageway <NUM>. Hydraulic fluid can then proceed down passageway <NUM> to lift axially moving cam ring <NUM> by pressure applied to beneath an outwards projecting rib <NUM>.

<FIG> shows and arrangement where a Blow Out Preventer (BOP) <NUM> is fitted to a well head housing <NUM>. A base part <NUM> and lower parts of a tool such as depicted in the preceding figures is still in the well bore.

As depicted in this figure a section of drill pipe <NUM> is screwed into fitting <NUM> provided in the base part <NUM> of the tool, after a disconnection has occurred, such as discussed above with reference to <FIG>.

The dogs <NUM> of the mechanical lock are still engaged. To release the mechanical lock the secondary unlocking system as discussed above and with reference to <FIG> and <FIG> is employed. Fluid pressure applied via drill pipe <NUM> proceeds through bursting disc <NUM> and enters passageway <NUM> (<FIG>) to cause lifting (U) of cam ring <NUM> allowing disengagement of dogs <NUM> as suggested by arrows D. At this time the tool can be withdrawn (W) from the well bore and the BOP <NUM>.

As an alternative, the tool may be removed in a similar fashion in situations where a BOP has not been fitted. An ROV can be used to insert a stab into the central bore (instead of drill pipe <NUM> shown in <FIG>). Fluid pressure applied via the stab can be used to operate the secondary unlocking system.

Some cementing operations making use of tools and methods described herein will now be described by way of example. Where perforating guns are referred to, it will be understood that other perforating devices may be employed.

Claim 1:
A tool (<NUM>) for cementing an annulus in a subsea oil or gas well, the tool comprising:
a safety module (<NUM>) and a perforation and circulation module (<NUM>);
wherein the safety module (<NUM>) provides fluid communication between an umbilical and the perforation and circulation module (<NUM>), and includes a mechanical lock formed of moving parts that are movable outwards into contact with an inside surface of a well head (<NUM>) and wherein the moving parts are arranged to move into locking engagement with the inside surface of the well head (<NUM>) in use; and
wherein the perforation and circulation module (<NUM>) is mounted below the safety module (<NUM>), and comprises:
i) upper and lower seals (<NUM>, <NUM>) for sealing to the inner surface of a casing inside a wellbore;
ii) at least one upper perforating device (<NUM>), mounted between the upper and lower seals (<NUM>, <NUM>), for perforating casing;
iii) at least one lower perforating device (<NUM>), mounted below the lower seal (<NUM>), for perforating wellbore casing;
iv) a supply fluid flow path to supply fluid from the safety module (<NUM>) through the upper and lower seals (<NUM>, <NUM>) to below the perforation and circulation module (<NUM>);
v) a return fluid flow path from between the upper and lower seals (<NUM>, <NUM>) to the safety module (<NUM>); and
vi) a diversion means (<NUM>) in the supply fluid flow path, operable to redirect fluid supplied to the supply fluid flow path to a space defined between the upper and lower seals.