Improving operational safety on subsea wells with quantative and dynamic risk assessment

FLAVIA PETERSEN, KAZUO MIURA, TIAGO DA FONSECA, Petrobras; JOSE RICARDO MENDES, University of Campinas; IVAN RIZZO GUILHERME, Paulista State University; CELSO MOROOKA, University of Campinas

Offshore operations, such as that on Petrobras’ P-56 platform, require high levels of safety, given the complexity of equipment, challenges in drilling to deeper water depths and the remoteness of operations from additional safety sources.

Given recent events in the Gulf of Mexico involving the Macondo well blowout, safety has become a major concern for the activities involving well construction. Safety assessment is not a trivial issue. Available risk evaluation approaches are based on static analyses of existent systems, not allowing a dynamic evaluation of the risk at each alteration of circumstances.

This article proposes the use of quantitative and dynamic risk assessment (QDRA) to assess the degree of safety of each planned job. The QDRA is a type of "safe job analysis" approach, developed to quantify the "degree of safety" in the entire well construction process, as well as during maintenance activities. The proposed methodology presents the definitions of "barrier" and "integrated barriers set (IBS)," as well as the modeling technique showing their relationships and comparing them with the analysis presented at Norwegian standard NORSOK D-010.¹ This technique has been applied not only during the planning stages of well construction, but also during workover to analyze the number of available IBS’s for each operation. The greatest advantage of this technique is that it can be applied during the planning stages of well construction and maintenance, where the effects of hazards on the job sequence are important unknowns.

BARRIER CONCEPT

Barrier is one of the most important concepts when analyzing operational safety. Although it seems  simple, it has been a subject of debate among experts on well engineering and construction. There is great doubt as to which items can be considered well barriers for a specific scenario and its involved operations.

Norwegian standard NORSOK D-010, developed by local petroleum industry associations, focuses on well integrity and defines many terms related to safety, including “barrier”. Furthermore, it gives examples of barrier schemes for a variety of scenarios (38 scenarios have been mapped with primary and secondary barriers in each, as well as 50 well barrier elements (WBE) with their acceptance criteria). These scenarios include drilling, formation evaluation, completion, workover, suspension and abandonment. The barrier concept defined by NORSOK D-010, however, is quite different from the one typically used by the rest of the world.

While NORSOK D-010´s barrier concept looks for the entire container that keeps reservoir energy, the rest of the world considers barrier as a restriction in mainly two paths: string, and annulus between string and casing. Concepts adopted in this article are the result of a study matching those two opposite concepts. They have proven useful when applied to the proposed quantitative analysis, which quantifies the safety degree for each planned well construction or well maintenance activity.

BARRIERS, PATHS, SHORTCUTS, IBS AND INDEPENDENCE CONCEPTS

NORSOK D-010 defines “well barrier” as “an envelope of one or several dependent barrier elements which prevent fluids or gases flowing unintentionally from the formation into another one or to surface.” This definition doesn’t deal with the issue of mutual independence. Therefore, it does not allow barrier quantification, although it can be useful in qualitative analyses.

Defining safety barriers for wells as “physical separations composed of one or more elements, capable of preventing unintentional flow from a permeable interval (formation or pay zone) to the surface through one specific path,” sounds like a meaning suited for the rest-of-the-world concept of barrier. Path concepts, however, need to be expanded. Instead of the two usual paths (string and string annulus inside wellbore), we shall consider four main paths, which are: string, string annulus (or wellbore), outside casing annulus (named annulus) and rock.

In analyzing the path concepts, shortcuts are defined as path junctions that allow communication between independent paths. Considering an open hole, a cement plug could be an example of a safety barrier, and a related shortcut could be a formation fracture that might occur during the plug back execution, due to excessive pressure.²

To solve shortcut problems, the IBS concept can be defined as a “set of one or more barriers and elements that link those barriers with the aim of preventing the undesirable top event, considering all possible paths between permeable interval (formation or pay zone) and the environment.”3 In practical comparison, what the rest of the world calls a well barrier is the well barrier element in the NORSOK D-010 definition, and what we are defining as IBS is equivalent to the well barrier concept defined in NORSOK D-010.

Another important issue is the quantitative assessment of operational well safety. To reach this assessment, a clear understanding is needed of the independence of two barriers or IBS’s. The IBSs’ independence can be defined as “the failure of one IBS (or barrier) to not influence another independent IBS (or barrier).” In mathematical terms, the intersection of two independent IBS’s (or barriers) is a null set. This means that in two independent IBS’s, there is no common element.

Based on these definitions, all 50 WBE’s defined on NORSOK D-010 as barriers can now be quantified. However, explicit analysis about the relationship between barriers that compose one IBS is needed. Furthermore, analysis is needed for the relationship between elements to compose barriers that are discussed in the next section.

BARRIERS AND IBS REPRESENTATION

In a similar fault tree analysis (FTA) diagram, FTA is used to represent IBS’s and barriers.4 The difference in how the diagram is used is in the definition of the top event. For the FTA, a most undesirable event is defined as the “top event” (in most of cases this is defined as being an oil or gas leakage to the environment, or blowout.) However, in the present study, top event is defined as the most desirable result, either IBS or a barrier itself. Then, this process could also be named as a success tree analysis. Figure 1  shows the scheme for a well-known subsea BOP as an example of a barrier. Figures 2 through 6 show how BOP components can be represented in the analysis.

Fig. 1. Subsea BOP scheme: 1) Wellhead connector; 2) BOP housing; 3) Pipe rams; 4) Blind shear rams; 5) Annulus BOP; 6) LMRP connection profile; 7) Kill line; 8) Kill line valves; 9) Choke line; and 10) Choke line valves.

The subsea drilling BOP is composed of four components: the BOP housing, wellhead connector, supply and control lines component (DRLG_BOP_X_HSG); the blind and shear rams component (DRLG_BOP_X_BLND); the pipe rams and annular BOP component (DRLG_BOP_X_RAM); and the lower marine riser package, drilling riser and diverter component (DRLG_BOP_SS_LMRP). Further, to have a subsea BOP operational (activated), one should forcibly activate the DRLG_BOP_X_HSG component, but only one of three other components (DRLG_BOP_X_BLND; DRLG_BOP_X_RAM; or DRLG_BOP_SS_LMRP) has to be activated to complete the entire subsea BOP activation.

In a graphic representation of the BOP barrier, it should be observed that the “V” character means that the component is activated, Fig. 2. It would assume “F,” if the component is disabled. The blue “E” node means the AND gate. The blue “+” node means the OR gate, with both AND and OR gates having the same meaning in FTA analysis.

Fig. 2. Representation of the BOP barrier as a chart

Figures 3 to 6 represent the graphs for each portion of the BOP barrier. In Fig. 2, they are indicated by yellow. The BOP housing, wellhead connector, supply and control lines component (DRLG_BOP_X_HSG) is composed by ten barrier elements: BOP housing (BOP_X-HSG); BOP wellhead connector (BOP_X_WH_CONN); blue control pod (BOP_X_CL_POD_BLU); yellow control pod (BOP_X_CL_POD_YLW); kill line valves near the BOP rams (BOP_X_KILL_VLV); kill line from the rig to BOP (BOP_X_KILL_LINE); stand pipe manifold at the rig (BOP_X_STDPP_MNFD); choke line valves near BOP rams (BOP_X_CHOKE_VLV); choke line from the rig to BOP (BOP_X_CHOKE_LINE); and choke manifold at the rig (BOP_X_CHOKE_MNFD). One should forcibly have BOP_X-HSG and BOP_X_WH_CONN activated; either BOP_X_CL_POD_BLU or BOP_X_CL_POD_YLW activated; either BOP_X_KILL_VLV or BOP_X_KILL_LINE and BOP_X_STDPP_MNFD activated; and either BOP_X_CHOKE_VLV or BOP_X_CHOKE_LINE and BOP_X_CHOKE_MNFD activated to have the entire DRLG_BOP_X_HSG activated.

The BOP component represented in Fig. 3 contains the kill-and-choke valves and lines, yellow and blue pods, and rig standpipe and choke manifolds, which will be used if well control is needed.

Fig. 3. BOP housing chart

The blind and shear rams section (DRLG_BOP_X_BLND) is composed of three barrier elements: shearable string or no string at all in front of the shear ram (BOP_X_STRG_SHRBL); super shear ram (BOP_X_RAM_SP_SHR); and blind and shear ram (BOP_X_RAM_BLDSHR). One should forcibly have BOP_X_STRG_SHRBL activated and either BOP_X_RAM_SP_SHR or BOP_X_RAM_BLDSHR activated to ensure that the entire DRLG_BOP_X_BLND’s activated. It can be seen in Fig. 4 that not only must the rams be activated, but the string must also be shearable.

Fig. 4. Shear and blind rams chart

The pipe rams and annular BOP portion (DRLG_BOP_X_RAM) is composed of four barrier elements: the annular BOP (BOP_X_AN); upper pipe ram (BOP_X_PIPERAM_UP); middle pipe ram (BOP_X_PIPERAM_MD); and lower pipe ram (BOP_X_PIPERAM_LW). Only one of those four components should be activated to ensure that the entire DRLG_BOP_X_RAM activated. The annulus between string and casing can be closed by using pipe rams or annular BOP, Fig. 5.

Fig. 5. Pipe and annulus rams chart

The lower marine riser package, drilling riser and diverter component (DRLG_BOP_SS_LMRP) is composed of seven barrier elements: the lower marine riser package housing (LRP_HSG); the lower marine riser package connector (LRP_WH_CONN); two annular BOPs—upper (LRP_BOP_AN_UP) and lower (LRP_BOP_AN_LWR); marine drilling riser from subsea BOP to rig (DRLG_RSR); slip joint for compensating rig heave (SLIP_JT); and diverter just below the rotary table (DIVERTER). One should forcibly activate both LRP_HSG and LRP_WH_CONN, and either LRP_BOP_AN_UP or LRP_BOP_AN_LWR, or both DRLG_RSR and SLIP_JT and DIVERTER activated to ensure that the entire DRLG_BOP_SS_LMRP is activated. The lower marine riser package is used in case of an emergency disconnection, Fig. 6.

Fig. 6.Low marine riser package component chart

The last five figures (Figs. 2 to 6) illustrate how a subsea BOP can be represented by the relationships between its components. If these diagrams are examined, one can verify whether the failure of one component could or not bring down an entire barrier. The subsea BOP has many redundancies (control pod; pipe rams and annular BOP), but some components are unique, and the entire subsea BOP is dependent on these unique components. This means that, in spite of many redundancies, which make the subsea BOP more reliable, the BOP is only one barrier.

Beginning with 50 barriers (WBEs) from NORSOK D-010, we have actually mapped 37 additional barriers for four paths, creating a library with 87 barriers.

The IBS’s can be represented by similar diagrams used on barriers. In Fig. 7, we illustrate one example of secondary IBS for a drilling scenario. The secondary IBS for this drilling scenario is composed of 11 sections, some already described: drill pipe string inside the well (DP); top drive on rig connected to drill pipe (DP_TOP_DRV); surface stab-in safety valve (DP_SFT_VLV); bottomhole float valve (BHA_FLT_VLV); BOP housing, wellhead connector, supply and control lines (DRLG_BOP_X_HSG); blind and shear rams  (DRLG_BOP_X_BLND); pipe rams and annular BOP (DRLG_BOP_X_RAM); lower marine riser package, drilling riser and diverter (DRLG_BOP_SS_LMRP); free production casing, its casing hanger, pack-off (CH_PROD_TOC); part of cemented production casing just above the uppermost top of reservoir (CMT_AN_PROD_LWR); and the deep natural barrier in front of same cemented production casing (BRR_NTRL_DEEP). Also, one should have BRR_NTRL_DEEP, CMT_AN_PROD_LWR, CH_PROD_TOC and DRLG_BOP_X_HSG all activated, either DRLG_BOP_X_RAM or DRLG_BOP_SS_LMRP activated, either (both DP and (DP_TOP_DRV, DP_SFT_VLV or BHA_FLT_VLV)) activated or both DRLG_BOP_X_BLND and DRLG_BOP_X_HSG activated to have entire secondary IBS for drilling scenario activated.

Fig. 7. Subsea BOP IBS

In Fig. 7, the BOP barrier, as illustrated in Fig. 2, is represented by two paths: COLUNA (STRING) and POÇO (WELLBORE).

The IBS’s are defined according to the scenario. NORSOK D-010 also defines the concepts of primary and secondary barriers as first and second object that prevents flow from a source, respectively. These concepts are also applied for IBS’s. A total of 48 IBS’s have been mapped, and divided in the following scenarios: five for drilling; three for formation testing; 26 for completions; three for production; five for workover; and six for suspension and abandonment.

QUANTITATIVE DYNAMIC RISK ASSESSMENT

To quantify the IBS’s for a specific well construction or maintenance plan, it is necessary to define which of those 48 IBS’s are being activated before each planned operation.

Defining barriers involves carefully analyzing the system configuration, including casing and cement program, tubing components, etc., relating it to the paths, Fig. 8. Boxes represent the entities, and the arc represents relationships between two linked entities. All relationships modeled in the diagram are of the one-to-many type, i.e., for each instance or element on the “one” side of the relationship, it is possible to find several instances on the “many” side of the relationship. The circle end of the arc represents the “one” side of the relationship, and the crowfoot end of the arc represents the “many” side of it.2 An operation can activate, disable or cause no impact on one barrier. Furthermore, one operation can impact more than one barrier, and one barrier may be impacted by several operations. It is not difficult to conclude how laborious it can be to analyze a whole well construction or maintenance plan with hundreds of planned operations. Actually, we have mapped 212 operations and more than 3,500 relationships between operations and barrier components.

Fig. 8. Relationships between barriers, IBS’s and operations, modeled as an entities and relationships diagram (ERD).

Fig. 9.  Oil well scheme

The QDRA method, using proper software, is an easy approach to quantify the available IBS’s before each planned operation of a well construction or maintenance plan. It is easy because it relies on entire operations, barrier components, barriers, IBS’s and their relationships that are mapped and stored in a database. The approach sets binary values (0 and 1) to define a barrier component, barrier or IBS availability. The value “1” is used to indicate an active element, and the value “0” is used to indicate a disabled element. These values correspond respectively to “V” or “F” used in barrier or IBS graphs.

The software used in the QDRA method can automatically do the laborious task of activating or disabling the barriers followed by the IBS’s, according to the related operation planned for well construction or maintenance. For example, when the barrier to killing a well is completion fluid, the state is activated. Likewise, when the barrier to conducting a tubing-conveyed perforating operation is casing, the state is disabled.

ACCEPTANCE CRITERIA

In the oil industry, two-barrier safety criteria seem to be the most acceptable standard. Applying the same concept for IBS’s defined in this article means that safety can be guaranteed, if there are two IBS’s.

CASE HISTORY

The following case is a real well workover analyzed with the methodology presented in this article. This safety assessment is about replacing a conventional Christmas tree without filling the annulus between tubing and casing with completion fluid.

Scenario: Workover
Equipment: Conventional x-tree with A5-S adapter.
Normal operation sequence, i.e., filling the annulus:

• Kill the well.
• Install standing valve.
• Close DHSV.
• Install BPV in extended neck.
• Fill the annulus.
• Nipple down conventional x-tree with adapter.
• Nipple up conventional x-tree with adapter.
• Gains without filling the annulus:
• Oil well kickoff time
• Time (logistics, slow operation, etc).

Question: Is it necessary to fill the annulus?
Basic Scheme:
See Fig. 10.

Fig. 10. Kill fluid IBS

Defining IBS’s:
The IBS’s used in this analysis are separated below by operation:

1. Kill the well, Fig. 10. Observe that the DPLTD_WELL assumes “F”, once the well is not depleted.
2. Install standing valve, Fig. 11.
3. Close DHSV and install BPV, Fig. 12.
   After nippling down the x- tree, a secondary IBS will have been activated.

Fig. 11. Primary IBS graph

Fig. 12. IBS with BPV and DHSV

QDRA PROCESS

CSB1_KILL_FLUID is the primary IBS shown in Fig. 10; CSB_DC_BPV_DHSV is the secondary IBS shown in Fig. 13; CSB1_PR_PKR&STV is the primary IBS shown in Fig. 11; and CSB2_ANC is the secondary IBS not shown. Although DHSV is installed, the CSB2_DC_BPV_DHSV (Fig. 12) is disabled, because a junk basket is not being used. After setting the standing valve, the status of IBS’s becomes as illustrated in Fig. 14.

Fig. 13. Initial status of IBS’s.

Fig. 14. Status of IBS’s after setting standing valve.

The BPV (back pressure valve) can also actuate as a junk basket and the CSB2_DC_BPV_DHSV IBS (Fig. 12) will be activated. Then, after nippling down the x-tree (disabling CSB2_ANC IBS) there still will be two IBS’s activated. Comparing it to the defined acceptance criteria, the operation can be safely performed.

CONCLUSIONS

NORSOK D-010 applies formal reliability engineering concepts to define barriers and the concept to analyze operational well safety with all the paths together through  one container. In this article, we’ve introduced the concepts of interdependent primary and secondary barriers. Applying the container concept to look for the failure mode is, however, time-consuming and a never-ending process that is qualitative in nature.

The QDRA approach with a database containing all mapped information about barrier components, barriers, IBS’s, operations and their relationships can be automated to make safety assessments of the well construction or maintenance plan. Although the case study used as an example of application of the proposed methodology is simplified, the presented methodology can be applied on complex well construction or maintenance plan safety assessments.

LITERATURE CITED
1. NORSOK Standard, “D-010: Drilling and well operations”, D010, Rev. 3, Oslo, Norway, Norwegian Technology Standards Institution, August,2004.
2. Miura, K., Morooka, C.K., Guilherme I.R. and J.R.P Mendes. “2006 study and characterization of operational safety in offshore oil wells,” Journal of Petroleum Science and Engineering 51, 2006, pp. 111-126.
3. Miura, K. “A study on safety of construction and repair in offshore oil and gas wells,” Doctorate thesis, Department of Petroleum Engineering, UNICAMP, Brazil (in Portuguese), 2004.
4. Vesely, W. E., Goldberg, F. F., Roberts, N. H. and D.F. Haast.  1981  Fault Tree Handbook. Nuclear Regulatory Commission. NUREG–0492.