1

L. BERG ANDERSEN, G. VEIRE, B. RKKE

SPE 46613

SPE 46613 A New Method for Well Specific Risk Analysis in Drilling Operations
Lasse Berg Andersen, SPE, Alliance Technology, and Gunnar Veire, and Borgar Rkke, Statoil

Copyright 1998, Society of Petroleum Engineers, Inc. This paper was prepared for presentation at the 1998 SPE International Conference on Health, Safety and Environment in Oil and Gas Exploration and Production held in Caracas, Venezuela, 710 June 1998. This paper was selected for presentation by an SPE Program Committee following review of information contained in an abstract submitted by the author(s). Contents of the paper, as presented, have not been reviewed by the Society of Petroleum Engineers and are subject to correction by the author(s). The material, as presented, does not necessarily reflect any position of the Society of Petroleum Engineers, its officers, or members. Papers presented at SPE meetings are subject to publication review by Editorial Committees of the Society of Petroleum Engineers. Electronic reproduction, distribution, or storage of any part of this paper for commercial purposes without the written consent of the Society of Petroleum Engineers is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not be copied. The abstract must contain conspicuous acknowledgment of where and by whom the paper was presented. Write Librarian, SPE, P.O. Box 833836, Richardson, TX 75083-3836, U.S.A., fax 01-972-952-9435.

of experience, creates a well structured analysis process that is suitable for direct decision making, and it promotes efficient communication between drilling engineers and risk analysts. Introduction When planning the drilling of an offshore exploration well on the Norwegian shelf, the identification and evaluation of risk contributing factors, together with the preparation of plans for emergency preparedness procedures, is an important part of the work. According to internal Statoil requirements, as well as Norwegian governmental requirements as issued by the Norwegian Petroleum Directorate (NPD), operators are required to utilize risk analysis as a tool for strengthening the basis for decision making in the planning and the execution of drilling projects. The risk evaluation process consists of several parts, with an increasing level of detail as the start date of the drilling operation approaches. A major concern in the company was the lack of experience transfer from one part of the risk evaluation process to another. The need for a more systematic risk evaluation process was recognized, to ensure the execution of appropriate analyses at different stages of the drilling project. Moreover, it was recognized that the risk evaluations related to drilling procedures were too general and thus, were missing a satisfactory focus on well specific hazards. Finally, the applied check list based risk analysis techniques were found inappropriate with respect to evaluation of the effect of risk reducing measures. Based on the above findings Statoil decided to initiate an update of their steering documentation concerning risk and emergency preparedness analyses related to drilling and well operations. The main objectives were to optimize the existing analysis process with respect to creating a sound basis for decision making in the planning and execution of drilling projects. A thorough review of todays practices lead to the conclusion that the majority of the in house analysis techniques solely required to be incorporated in an overall analysis framework. The overall analysis framework aimed to ensure efficient communication and experience transfer between each stage in the analysis process and between the operators HSE and Drilling departments. However, the development of a new method for well specific risk analysis was required to replace the existing checklists. The following methodology attributes were found necessary n order to reach

Abstract This paper presents the development and the application of a new method for well specific risk analysis. The methodology development is a part of an overall company strategy that aims to optimise the risk management process in order to strengthen the basis for decision making and promote the application of the ALARP principle in the planning phase of drilling projects. The first step in the methodology development process consisted of decomposing a set of predefined hazards on the basis of a thorough understanding of the phenomenon physics. The second step was to systematise all influencing parameters and establish a quantitative system that provides an overall numerical risk factor related to the hazards. Finally, a user friendly computer program was developed and the new methodology tested and calibrated. The critical factors of the drilling operation are systematically reviewed and evaluated quantitatively by an expert panel consisting of drilling engineers, contractor representatives, and risk analysts. Instant visualisation of critical factors in response to the expert panel's risk evaluations contributes to promote discussions on risk reducing measures and alternative solutions. Over a period of time the operating companies that apply this tool will build up a database of risk evaluated drilling operations that will form the basis for in situ comparison of the risk level associated with new drilling projects. Moreover, the database records will strengthen the basis for formal development and re-evaluation of the risk acceptance criteria in order to help reaching the overall company safety goals. Experiences with this new method shows that it is easy to understand and apply, pinpoints critical factors and parameters, secures the transfer

L. BERG ANDERSEN, G. VEIRE, B. RKKE

SPE 46613

the above objectives:
Easy to understand and simple to carry out

analysis are required. Methodology Development Decomposing. The first step in the methodology development process consisted of decomposing predefined hazards on the basis of a thorough understanding of the phenomenon physics. The causal mechanisms related to the overall hazard loss of well control were divided into before and after installation of the blowout preventer (BOP) on the well head, i.e. separating shallow gas and deep blowouts. The decomposition reflects the causes of kicks and blowouts. As an example the following five causes were identified for loss of well control after installation of the BOP: 1. 2. 3. 4. 5. Too high pressure in well Equipment failure Casing failure Weak formations and reactive clays External events

Fit in the overall analysis framework Based on expert panel discussions including personnel from the HES dept., Drilling dept., Drilling contractor, and relevant subcontractors Promote discussions concerning risk factors, risk reducing measures and alternative ways to carry out the drilling operation in a specific well Quantify risk and thus, visualised changes in risk when recommended alternative measures and solutions are implemented in the model Promote risk reduction in line ALARP-principle.

As the last, and the most detailed analysis in the overall process, the new method should ensure that results and conclusions from analyses at earlier stages were still valid. The Overall Analysis Process Figure 1 shows the overall analysis process including the risk and emergency preparedness analyses performed at different stages in the planning of a new drilling operation. Safety Case Evaluation: The first step in the analysis process aim to review and evaluate the Safety Case performed by the rig owner in order to verify whether the safety level on the rig, independent of the location and well specific conditions, is acceptable with respect to personnel, the environment and material assets. The Environmental Risk Analysis constitute step no. two where an early stage location and well specific analysis of acute oil spill frequencies provide input to a thorough analysis of environmental consequences. The Area Specific Risk and Emergency Preparedness Analyses aim to identify and evaluate hazards specific to the region in which the rig will be operating (climatic conditions, water depth, ship traffic, distance to land etc.). The Activity Specific Risk Evaluation constitute the last and most detailed step in the analysis process. This analysis is carried out on the basis of a draft drilling program and aim to establish a shaded well specific risk picture of the current drilling operation. The new method for well specific risk analysis presented in this paper is one of several other tools that can be applied in relation to the Activity Specific Risk Evaluation, e.g. the HAZOP and HAZID techniques. Any risk reducing measures identified during the Activity Specific Risk Evaluation should be implemented according to the ALARPprinciple (As Low As Reasonably Practicable). At an early stage it was decided that the new method should be developed to serve as a tool for detailed analysis of well specific risk related to kick and loss of well control. These two overall hazards constitute, however, no limitation for the application of this method. The same basic methodology can be applied to any overall hazard where visualization of causal mechanisms and a detailed level

These overall causal mechanisms are further decomposed as shown by Figure 2. High pressure in the well leading to loss of well control may be initiated by a special well geometry, large kick volumes, high kick intensity and wrong choice of kill procedure. In principle, we may continue decomposing the causal mechanisms of blowout and kick as long as one pleases, and thereby constructing a detailed tree of causes. It was, however, decided that a second level of causes with corresponding influence factors represented a sufficient level of detail for our purpose, i.e. to visualize and generate a discussion on the different ways to trigger off the overall hazard. When decomposing the overall hazard to lower level causal mechanisms, one will ultimately end up with initial causes such as physical well parameters, choice of procedures, choice of equipment systems etc. These influence factors are the initial triggers for one or several chains of events. As an example, the parameters deemed influential for the sub-cause kill procedure were: ambiguous procedures/guide lines, human error/low training level, and communication failure. Causal mechanisms at two different levels and parameters affecting the sub-cause level are made out for each of the events Kick, Blowout before installation of BOP, and Blowout after installation of BOP. Quantification. When the causal mechanisms are established, a method of evaluating the criticality of each of the possible chains of events is necessary. A quantitative evaluation was required in order to make evaluation of the effect of alternative risk reducing measures possible. Quantification may be performed in several ways. The methods considered were: 1. 2. Assigning frequencies/probabilities to low level input parameters Weighting of causal mechanisms and assignment of frequencies/probabilities to low level input parameters

SPE 46613

A NEW METHOD FOR WELL SPECIFIC RISK ANALYSIS IN DRILLING OPERATIONS

3.

Weighting of branches in the causal mechanisms, and subjectively assigning general, semi-quantitative values to well parameters.

Due to the relative coarse decomposition of the event chain, the two first possibilities were ruled out. They both call for an extensive decomposition, high level of detail, and to some extent drilling experts with risk analysis competence. The third option, however, is feasible, and can be adjusted to a suitable level of modeling detail. The quantification is split in two: Firstly, the causes and sub-causes are assigned weights, based on their relative significance leading to the overall hazard. The weights may be based on historical blowout and kick data, given that information about the chain of events leading to the kicks or the blowouts are available. Another approach is to have drilling experts assigning weight factors that reflects the relative importance of causes and sub-causes. Either way, a number between 0 and 1 is assigned to each cause/sub cause, such that all of the causes sum up to 1, and each set of sub causes sum up to 1. These weighted causal mechanisms are fixed and will normally not be changed during the analysis of a specific well. The second part of the quantification is, however, well specific. As a part of the analysis session an expert panel assigns criticality values to each of the pre-defined parameters that affects the outcome of events at the sub-cause level. The parameter criticality is defined as: The ability to trigger off the sub-cause under which it its listed given the conditions for the well in question. To simplify the quantification, a set of integers between 0 and 6 is used. The value 0 means that the parameter has absolutely no ability to initiate the corresponding chain of events whilst the value 6 means that the parameter is extremely critical. The criticalitys related to sub causes, causes and the overall hazard are calculated as the low level parameters are assigned criticality values. The criticality notion related to the overall hazard must be interpreted as a measure of risk expressed by experts involved in the planning and execution of a specific drilling operation. Calculation. The criticality of the overall hazards are calculated through the pre-defined weighted causes and subcauses and the criticality values assigned to the lower level influence parameters. Mathematically, the criticality of an overall hazard, C(Event) is defined as

i,j,k, k=1.ri,j denote the ri,j parameter criticality values for each of the j sub-causes. The well parameter criticality values are squared in the summation formula. This is but one of several ways to bias the summation formula. We find that a reduction of a parameter criticality value from 6 to 5 reduces the overall hazard criticality 11 times as much as a reduction from 1 to 0 of the same parameter (62 - 52 = 11). A formula with this bias has been chosen to ensure relatively higher effect on risk reducing measures related to the most critical low level parameters Further, the summation of the squared parameter criticality values is divided by the number of low level parameters, to make the calculated results less sensitive to changes in the number of parameters. Dividing by the number of parameters is particularly important when further low level parameters are added in the analysis session and we still want the results to be comparable to earlier analyses.
Methodology Application Application. The experts assigning criticality values to the low level parameters have thorough knowledge of the well in question. The composition of the expert panel can not be fixed since it depends on the distinctive characteristics of the well in question. As criticality values are assigned to the parameters, the calculation of the hazard criticality is continuously updated by means of a simple spreadsheet model. The results are visualized and the expert panel will see which of the well parameters and event chains contributing the most to the overall hazard criticality. Perhaps the most important part of this evaluation is the documentation of the reasons and arguments related to the chosen parameter criticality values. Thus, the decision makers can study the arguments supporting the risk figures. Moreover, comparison of arguments related to other similar wells in previous analyses make a significant contribution to experience transfer. The commenting of each parameters criticality value is not only a way of documenting the risk evaluation, it is actually one of the key issues in the application. Through the commenting, the members of the expert panel are forced to come to an agreement. The discussion among the experts in reaching an agreement on formulating the comments is an excellent way to bring forth new aspects, thus assuring that the risk evaluation is as complete as possible. New comments/arguments are recorded when risk reducing measures are discussed in order to explain why a specific parameter criticality value has been changed. The main contribution of the method presented in this paper is given by the detailed and thorough discussion of risk factors and the effect of risk reducing measures. Hence, the criticality quantification is just a way of highlighting the effect of risk reducing measures and visualizing the relative importance of causes and influence factors. Experience database. As more and more wells are evaluated with this method, the experience database increases in size and

C = i
i=1

i,j
j=1

mi

k=1

r i,j

2 i,j,k r i,j

(1.1)

where: i, i=1.n denotes the weight of the n causes, i,j j=1.mi denotes the weight of the mi sub-causes

L. BERG ANDERSEN, G. VEIRE, B. RKKE

SPE 46613

value. Wells may be categorized according to water depth, geography, pressure, temperature, geological complexity etc. When new wells are considered, it is possible to find wells with similar properties, and at an early stage in the planning phase address potential problem areas that may lead to an overall hazard. The overall hazard criticality values can be included in the basis for the development of acceptance criteria for this type of detailed analysis. As an example we may require that the calculated criticality value for a specific well must be less than the average criticality value of all previous wells in the same category. It is, however, necessary to have a firm foundation for the acceptance criteria, i.e. a number of wells must be evaluated and recorded in the database before any substantial conclusions can be made regarding an acceptable criticality level. Case Study The new method for well specific risk analysis has been tested on a high pressurehigh temperature well (HPHT), and a thorough risk evaluation was required. Valuable experience with the method was gained from this work. The participants in the expert panel were drilling supervisor, drilling engineers, driller, mud engineer, well control expert, and geologists. The analysis session was facilitated and recorded by risk analysts. All personnel except the risk analysts were unfamiliar with the new risk analysis method. The potential problem sections of the well had been identified by the facilitator and a drilling engineer prior to the analysis session. For instance, the overall hazard Blowout before installation of BOP was dismissed since no shallow gas warnings were given by the geologists. The individual parameter criticality values together with the calculated criticality for the different parts of the event chains were displayed during the evaluation session. The highest criticalitys related to blowout were kick-volume, killprocedure and casing setting depth. Bearing in mind that this was a HPHT well, the high criticality related to high kick volumes was not surprising. Further, unambiguous procedures related to killing the well are always an important aspect in HPHT wells. The high criticality for casing setting depth reflects the small pressure margin available and thus the need for setting casing prior to penetrating the top of the reservoir. The time required to go through all event chains and low level parameters was longer than first expected. This was partly due to unfamiliarity with the method, but also the fact that the event chains/causal mechanisms were adjusted during the session. The feedback from the expert panel on the new approach to well specific risk evaluation is summarized below:

The problematic aspects of the well were thoroughly examined. The overall critical aspect should be identified prior to the actual risk evaluation session in order to increase efficiency. Some of the causal mechanisms and low level parameters needed adjustment. However, the decomposing of events made it easier to systematically focus on the core of the problem, and it corresponded to the drilling experts way of thinking. Unfamiliarity with the use of the concept of criticality instead of frequencies and consequences.

Conclusions and Further Work Experiences. The session leader needs a certain phenomenal knowledge to drilling operations, geological features etc. to be able to guide the discussion and communicate efficiently with the drilling experts. The conditions for the discussion and assignment of well parameter criticality values must be clearly stated. For instance, are HPHT-procedures to be regarded as standard procedures or as a risk reducing measure? It seems reasonable to believe that several parameter criticality values will differ strongly in the two cases. However, the nature of the method, having personnel come to an agreement about a parameters criticality value, will soon bring forth any discrepancies in their comprehension of the presuppositions. Benefits. The method is effective in triggering off detailed discussions about drilling and safety procedures, and about the drilling and safety equipment. As a spin-off during the discussion, several non-safety aspects of the drilling procedure was identified for which changes were recommended to optimize operational efficiency. The session leader will have to consider whether time should be spent on such aspects, but during the case study it was considered a benefit. It made the evaluation even more thorough, and increased the motivation of the participants. Other benefits:

The use of event chains stimulates creativity. This is, however, strongly influenced by the session leader, and how he/she manages to provoke the expert panels active participation Transfer of experience was ensured both with respect to operators, rig owners, and sub-contractors organisation Risk reducing measures were evaluated, and the effect of specific measures could be compared to other alternative measures Incorporates human and organisational/procedural risk factors. Human error and procedural safety measures were thoroughly discussed

Very thorough, at times too detailed. Would be an overkill if used on a simple, non-problematic well Time-consuming. It was agreed, though, that this was much due to unfamiliarity with the methodology and the lack of comparison data from other wells

Weaknesses and further work. The method was found to have some minor weaknesses. As it is newly developed, adjustments must be made on the basis of practical experiences gained over some period of time. The weaknesses

SPE 46613

A NEW METHOD FOR WELL SPECIFIC RISK ANALYSIS IN DRILLING OPERATIONS

with the method in its present form, and suggestions for further work are listed below:

The session leader needs to firmly guide the session in order to avoid time consuming discussions on each causal mechanism and each low level parameter. The level of detail far exceeds what is judged to be fruitful when evaluating simple, non-problematic drilling operations, e.g. low pressurised wells. The principle of using event chains is, however, judged to be a valuable tool when evaluating less complex operations. A coarser version of the methodology should be adopted for standard low complexity drilling operations. It must be noted that the calculated criticality values related to the different overall hazards, e.g. Kick and blowout, are not directly comparable. However, e.g. the kick criticality related to two different wells can be compared.

References
Statoil 1997: Risk and Emergency Preparedness Analyses in Drilling and Well Operations, B&B-TB-02-02, rev.1 01.06.97 L. Berg Andersen: Stochastic Modeling for the Analysis of Blowout Risk in Exploration Drilling, Ph.D. Thesis, Robert Gordon University, Aberdeen, UK, 1995.

L. BERG ANDERSEN, G. VEIRE, B. RKKE

SPE 46613

Safety Case Contractor

Overall Hazard Cause (1)

Statoil

Control of Safety Case

Method Quality Results

Sub-Cause (1,1) Low Level Parameters (1,1,1) (1,1,2) (1,1,k)

Updating

Accept?
Yes

No

Mitigating Measures Re-evaluation

Sub-Cause ( 1,2) Low Level Parameters (1,2,1) (1,2,2) (1,2,k)

Environmental Risk Analysis
Blowout frequency Consequence evaluation

Area Specific Risk Evaluation Activity Specific Risk Evaluation

Sub-Cause ( 1,j) Low Level Parameters (1,j,1) (1,j,2) (1,j,k) Cause ( 2) Sub-Cause (2,j) Low Level Parameters (2,j,1) (2,j,2) (2,j,k)

Updating Accept?
Yes No
Mitigating Measures Re-evaluation

Area Specific Emeregency Prep. Analysis

Accept?

No

Updating
Mitigating Measures Re-evaluation

Cause ( i) Sub-Cause ( i,j)

Yes

Area Specific Cont. Plan

Low Level Parameters (i,j,k)

Figure 1. - The overall Analysis Process

Figure 2. Decomposing the causal mechanisms