7/28/2019 00035038.pdf

1/9

7/28/2019 00035038.pdf

2/9

2 APPLYING QUANTITATIVE RISK ASSESSMENT TECHNIQUES TO CASING DESIGN SPE 35038

QRA: The Basics.This seetion will describe the basic tenets of reliability the-ory used by QRA3, and contrast them with deterministicdesign.Conventional Design. Conventional casing design tech-niques developed over the last 50 years or so relied on theuse of poorly estimated subsurface load data, including geo-pressured, mud backups, influx behaviour and rock forma-tion loads such as salt squeezing. Material properties werepredicted from equations derived from a limited set of ex-perimental data$, and the data themselves referred to alimited number of grades and did not address special gradesor duplex steels,

Due to the above uncertainties, it became common prac-tice when designing casing to assume maximum well load-ing and minimum material resistance. This assumptionignores Lhe majority of loads and resistance combinationsthat occur most of the time by assuming a worst case. Obvi-ously, it would be beneficial to quantifi and make use ofthis redundancy in the design process without compromis-ing safety,

Recently, designers using a deterministic approach haverecognised the inadequacy of the SF,, and attempt to rectifythis by including as many of the load variables as can bepredicted, together with the operational consequences ofeach, The latter is particularly significant in designs basedon given kick volume, where the kick detection time istaken into consideration. QRA offers an explicit and scien-tific way of carrying out this operation.

If a deterministic design is executed correctly, the resis-tance will exceed the load, and the relative magnitude ofthe difference between the two values will represent thesafety factor (see Figure 1). However, this safety factor isnot a direct measure of safety or risk. The satety factor as astand-alone design basis is becoming increasingly out-moded in the structural industry More designers are choos-ing (or are forced to adopt) risk-based design criteria. Forexample, a passenger would not board an aeroplane if told:

Ladies and Gentlemen, we are proud to announcethat this plane has a safety factor of 1,5!.In reality, that maximum load is seldom reached (e.g. en-

tire casing filled with gas). It is also a relatively rare occur-rence for the yield strength of the casing to fall as low as itsSpecified Minimum Yield Stress (SMYS). Equally, how-ever, there will be occasions on which the yield strengthfalls below the SMYS.

Randomly Distributed Variables. The real case of manyvariables is one whereby there is no absolute and simpleway of predicting the outcome in any single case, Takingyield stress as an example again, if a tensile test was per-formed on one steel sample, a single value for yieldstrength would be produced (see Figure 3.). However, if thesame test was performed on an ostensibly identical speci-men, it would yield at a different value. If this process wereto be repeated, a large range of values would be obtained,

In the case of yield stress, this would produce a distribu-tion of possible yield strengths, each one having a differentfrequency of occurrence. This behaviour characterises anunderlying Normal Distribution (see Figure 3), This is anexample of a Probability Density Function (PDF), A PDFshows which values are more likely to occur by represent-ing that higher probability through a larger area under thegraph over that range. Thus, the median yield strengthwould have a higher frequency of occurrence than theSMYS, and therefore a higher probability density (a higherpoint on a PDF).

Each of the input variables in a casing design has a PDFassociated with it. For example, on the load side, there is apore pressure (predicted against actual) distribution, a kicksize and intensity distribution. Also, when predicting casingresistance, Diameter, thickness and yield strength are notsingle-valued quantities, but also have distributions associ-ated with thcm,QRA Using Randomly Distributed Variables, Once theinput PDFs have been defined, it is then necessary to beginthe design process, This, perhaps surprisingly, can be car-ried out in almost the same way as a standard design. Thesame equations may be used: the crucial difference is thatthe input variables have changes from assumed nominalvalues to more realistic random distributions,

QRA uscs probabilistic mathematics and statistics to fac-tor together the load and resistance variables into two dis-tributions (see Figures 2 and 4.). The first defines all thepossible values that a load case can have, For a kick loadcase, this would cover the surface pressure experiencedfrom a 1-2 bbl condensate kick, right through to a verylarge gas kick at surface, Each different severity level willalso have a probability of occurrence attached to it, The sec-ond distribution will govern casing resistance. The dataspace will cover the range in which all the input variablesconspire to produce, for example, a very low collapse value(reduced yield strength, thinner wall thickness, ovality, etc.)to the equally unlikely situation where all those variablescombine to give the casing a very high collapse resistance.The result will be two opposing distributions: load andresistance,

62

7/28/2019 00035038.pdf

3/9

SPE35038 KEILTY, RABIA 3

Figure 2 illustrates the point that despitea safety factorand good design practices, there will be a few times in alarge number of applications of a particular design, inwhich load exceeds resistance. This is almost inevitable, butrather than ignoring the possibility, it is far more sensibletocngineer thedesign toensurc that this failure rate isre-duced to an economic level. This can be done by examiningthe casing parameters governing resistance, and adjustingthem to reduce the proportion of the data space for whichthe load exceeds the resistance. This relative area will de-termine failure rate (e.g. a value of 104would mean onefailure in every 10,000 applications)Tolerable Risk Levels (TRLs). A failure rate can be usedin two ways, It is possible to execute a QRA on a particularcasing, designed in the standard way, and then accept or re-ject it, based on the failure rate obtained. A more consistentmethod is 10 set a Tolerable Risk Level (i.e. maximum ac-ceptable failure rate) and choose the casing parameters toensure that the failure rate is below this Icvel.Setting of TILLs. The Cullcn report was issued after the

Piper Alpha disaster in the United Kingdom, and it recom-mended the principle of ALARP for UK offshore opera-tions. This means that the risk of failure of any engineeringdesign should be As I.OWAs is Reasonably Practicable.This principle requires that every engineering design musthave an ALARP failure rate, given current lCVCISof tech-nology and knowledge, as well as all reasonable expendi-ture to make the design safe.

Risk in an cngincermg sense can be detincd as:RISK FAILURE M W X CONSEQUENCES ( 1)The TRL thresholds identified by the report range from

104to 106.The higher bound is broadly acceptable for mostoperations, whereas a risk Ievcl towards the 10-4end of theband must be investigated and, if possible, Iowcred.

British Gas have not yet assigned Tolerable Risk Levels toany casing failure modes. This will depend principally onthe guidance provided by the UK regulatory and legislativeauthorities.

Thus, QRA involved not only an assessment of the likelyprobability of failure, but also consideration of ihc effects(severity) of each type of failure. For example, a casing col-lapse at depth may not involve the cost or safety risks of ablowout. It may, therefore, be acceptable to assign a lowerTRL to this failure type - say 104- than for a blowout. Nonsafety-risk events could be left to the discretion of the com-pany, and based on the cost implications for this t}-pc offailure

63

Different QRA Levels and MethodsThere are several different levels and methodologies avail-able when adopting a QRA approach] b8,and this sectionwill give a brief qualitative description of each.Revised Single Factors. Historical data and improved de-sign equations can be used to update an operators currentsafety factors through a one-off QRA. The analysis is alsolikely to highlight the inadequacy of using a single SafetyFactor for each load case, no matter what the well condi-tions QRA will demonstrate that the probability responsewill not bc flat across the full range of wells designed for.For example, it is common sense that a wildcat well mayrequire more redundancy than a development well that ismore of a known quantity. This kind of contingency built into cope with the unexpected will almost certainly bc de-signed in by experienced designers (e.g. through more con-servative load cases), However a QRA analysis processwould ensure that any conservatism were explicit, andconsummate with whatever increased risks might bc pre-sent in critical wells. It would also support the case for us-ing different safety factors for different well t3-pes in orderto achieve a flat risk response, i.e. equal risk levels.

However, the benefits from such an approach would belimited. It would be diftlcult to winkle out the variables onwhich it would be possible to reduce conservatism, due tothe need to maintain safety levels and contingency on othervariables (e.g. pore pressures). Also, the system of safetyfactors would rapidly bccomc sub-optimal, as drilling tech-nology advances (e.g. a ncw kick detection system) or moredata bccomcs available.Partial Factors. This approach involves assigning safetyfactors to each variable before input into the design equa-tions. This atlords the designer more control over the de-sign process. In this way, over-conservatisms can be moreeasily screened out, while uncertainties (e.g. pore pressures)can be accounted for adequately.

The procedure involves an escalation of complexity, as agreater number of safety factors arc required, but the designprocess remains broadly the same. The same ditXculty ex-ists as with single S.F, design, whereby the one-off QRA as-sessment means that once this stage is over, the designer isagain designing blind to risk.Full QRA methodologies. The next stage of developmentis to consider a full QRA implementation for every WCIIde-sign, or at least to have the capability of doing SC, Thebenefits of this are t~vofold: it is a tool by which the de-signer can quickly and objectively evaluate casing designson a risk basis, It is also useful in that it allows the regularrc-validation of the two approaches outlined above, main-taining accuracy in the light of fresh information orchanges in conditions. The following section provides avery brief description, and presents some of the pros andcons of each technique.

7/28/2019 00035038.pdf

4/9

4 APPLYING QUANTITATIVE RISK ASSESSMENT TECHNIQUES TO CASING DESIGN SPE 35038

Gaussian Linearisation. This proccdurc takes the mathe-matical formulation for the various input PDFs, and con-verts each to an expanded series of terms, which can thenbe Imearly combined 10produce the desired formulation of.tf Resistance -[mad . . (2)

where M rcprcscnts thc safety margin between the twoquantities. The failure rate can then be produced from aprobabilistic form of this equation.

The process is relatively simple, although it requires ancw formulation for every design case. and introduces somedegree of error when the series are truncated.Convolution Integrafs. Although more mathematically

elegant, this method is highly abstract, and requires re-formulation for each case. Mathematical expressions foreach of the PDFs arc combined, and then the relative sizeof the failure area is determined, usually through numericaior explicit integration. A failure rate can then bedctermlncd.FORMAWRM Methodology. Standing for First and Sec-

ond Order Reliability method, this tcchniquc converts thePDF into a standard form, performing a transformation oneach one. The normalised PDFs are then placed into Equa-tion 2 and a failure probability can he dctcrmincd from thesize of M. This value of M equates to (}, a measure of sys-tcm reliability, the inverse of failure ralc.

This method is highly abstract, but is advantageous inthat it is accurate, quick, rcpcatablc, and requires very littlerearranging for each different case.Simulation. This tcchniquc uscs a computer to randomly

select a value for each input variable, using the PDF. In thisway, a single value for each input variable is obtained, andcan be input into the standard equations. [f this process iscarried out rcpcatcdly, then a picture of systcm response forall combinations of inputs (or at least a rcprcscntativc sam-ple) is built up, and the proportion of faihrrcs can bc di-rectly read from the results.

This process is conceptually very simple, requiring verylittle additional formulation and effort. However, due to thevery large number of calculation repetitions required (oftenof the order of several million) a power!id computer is re-quired to perform the task in an acceptable Iimc. Also, thistime-consuming proccdurc must bc repeated for everyassessment.

Implementation IssuesIn order to make the most of a Quantitative Risk Assess-ment implementation, a company should bc willing to domore than simply re-jig their design factors, A change indesign procedures presents a number of potentially valuableopportunities to improve the whole design process, but alsoa number of challenges that must be met,Acceptance of the possibility of failure. In any cnginccr-lng design the possibility of failure exists, It can be maskedby safety factors, but the underlying possibility of a per-fectly good design failing can be minimised, but nevereliminated. The basic philosophy of a reliability-based ap-proach requires the acceptance of the possibility of a failure.Once this has been achieved, it can bc a positive rather thana negative action. It disciplines the company into bettercontingency planning and mitigation strategies, and a com-prehensive assessment of what sort of failures they reallycan and cannot afford, This can often pose diftlcultics forcnginccrs, management and governmental bodiesData Capture, Storage and Maintenance. If a decision ismade to implement a full QRA methodology, then the qual-ity of data is extremely important. It is certainly a truism tosay that one only gets out what one puts into a QuantitativeRisk Assessment, and appropriate systems must bc put inplace in order to ensure that the QRA has the best qualityand the Iargcst quantity of data possible. This may involve acloser relationship with steel suppliers. It may also meanncw data rcquircmcnts from scrvicc companies for differentdata during and after drilling (c.g, a record of surface tcm-pcraturcs, ECDS and logging information),Changes in Design Philosophy. As previously stated, anyconsideration of a change in design practice should initiatea process of challenging and reviewing current practice, inorder to improve the cftlcacy of the design, For example,questions like given current equipment capability and op-erating procedure, is casing burst through complctc evacua-tion in the wellbore still a realistic - and thcrcforc andominant - load case? should be asked. However, a moveto a new way of casing design must respect the Icssonslearned during years of deterministic design, This ncccssi-tatcs not straying too far from conventional wisdom, and aseries of incrcmcntal, technically justiticd changes. In prac-tice, this means a great deal of field testing and practicalevaluation of a QRA methodology. No changes to designpractice will be carried out without Icgislativc approval.Computerisation. For a full QRA implementation, this isalmost a pre-requisite, as the time and effort to perform re-peated hand calculations are, in most cases, prohibitivelyIargc, This means that at Icast some degree of computerisa-tion must bc undertaken. Several choices arc, once more,presented.

64

7/28/2019 00035038.pdf

5/9

SPE 35038 KEILTY, RABIA 5

Stand-afone impfernentation. This IT solution is perhapsbest suited to a full QRA method. It would also be the sim-plest to create. However, such a package would not be ableto make fill usc of data available during standard designusing a suite of programs.Integration. Another possibility wouldbc to nest the de-vclopmcnl as a part of a commonly available suite of well

design programs. This would enable some commonality ofdata to be exploited (e.g. the basic engine from a slandardcasing design module) and allow greater flexibility, byquickly determining the effect of a QRA-modified casingdesign upon other well parameters (e.g. cementingprogrammc)Acceptance of Method. Duc to their complex nature, andthe likelihood of a computerised method, the probabilisticelements of the calculation will be all but invisible to thedesigner using QRA on a day-to-day basis. It is thereforeimportant that the limitations of QRA are not ignored, andQRA results arc factored into or compared with a morestandard, easily understood design approach, This will en-sure continued good design, whilst making QRA more ac-ceptable to the dcslgncrExample of ImplementationThe full QRA methodology has been applied rctrospcctivclyto a casing design, largely for bench-marking purposes, andas a means of eliminating any problems with the procedure.The well was drilled in an area where the company had aconsiderable knowledge of the local geology and pressureregime. The basic API design equations were used4, andsome nominal variables were input, due to a lack of data.This would mean that the probabilities of failure obtainedwould be higher than were the equations accurate, and acorrect PDF assigned to each variable. A SORM-like ap-proach was adopted, and the safety factors were convertedinto reliabilities for each casing.

The results presented in Table 1 refer 10the 7 inch casing.with a yield strength of 80,000 psi. The casing was set at adepth of 8,200 feet, against a predicted pore pressure of4100 psi, using a mudwcight of 11 ppg. The table lists theconventional safety factors (obtained through the usc ofstandard design proccduresg ) followed by the reliability in-dices and a conversion into failure rates. The results showthat, despite a set of safety factors that would not bc consid-ered abnormally high, the actual failure rates for this par-ticular casing are exceptionally low. In fact, it wasncccssa~ to mcludc the P index in order to demonstratehow far, in relative terms, each case is away from failure, asthe probabilities arc minute in two of the cases shown.

It can also be seen, by comparing the burst and collapsecases, that there is no direct relationship between safety fac-tor and failure rates. Although the burst has a slightlysmaller S F. than that of the collapse case, the probability offailure is actually lower. This result is counter-intuitive, and 65

the explanation lies in the fact that the QRA mathematics ishighly non-linear, making it impossible to infer safety lcv-CISfrom the relative magnitude of current S.F. S. Instead, itis necessary to engineer a flat response (i.e. uniform failurerates) into a Safety Factor-based design procedure through aQRA approach before a designer can be confident of safety\vith optimisation.ApplicationsQRA has an application potential in a variety of areas:Development Wells. The potential for optimisationthrough improved design and usc of appropriate safety fac-tors for this kind of drilling is clear. A few successful QRAapplications in this area should cover implementation costs.Critical/Wildcat wells. Obviously, the uncertainty associ-ated with these wells is large, and the application of QRAin this case will almost certainly be for safety assurancepurposes it will allow the application of a more powerfuldesign toolo underwrite overall well safety through a bet-ter knowledge of the areas of increased risk. However, inthis area, as in all others, the QRA tcchniquc must bc mar-ried with the cxpcricncc and judgemcnt of the operators anddesigners. In an imperfect world, where data is not presentin the abundance or with the assurance that we would likeit, there is still a strong role for experience and sound cngi-nccring judgement, However, QRA will still give a good,although conscrvativc, indication of the risks of failure,given the nominal input data, whereas S.Fs do not.Fitness For Purpose Assessment. If, for one reason or an-other, it is decided that a certain casing weight and grademust k run, and this does not meet standard SF. rcquirc-mcnts, it is possible to carry out a more refined assessmenton the problem, using QRA to determine if the design istruly acceptable or notProject StatusThe company has taken the work far enough to demonstratethe potential of a fully operational QRA methodology, andis ready to take the next step into practical implementation.The project is set to go ahead into 1996.Parallel QRA-based Designs. As a way of further demon-stration, and a test of robustness of methodology, severalfull QRA-based casing designs arc planned, to run concur-rently with the standard design process, This technique willallow senior management and engineers to judge first handthe benefits and challenges created by QRA, as well ashighlighting a number of changes that will no doubt bc re-quired m the methodology along the way. The developmentfunction will work closely with the front-line drilling func-tion, in order to transfer this technology, and also to ensurethat the correct quantity and ICVCISof technology arctransferred.

7/28/2019 00035038.pdf

6/9

6 APPLYING QUANTITATIVE RISK ASSESSMENT TECHNIQUES TO CASING DESIGN SPE 35038

The Future.These benefits - along with the technology and skills re-quired to realise them - arc not yet in place, and this will bethe challenge for British Gas, and the rest of the industtyover the next few years, There are, however, several areasthat require particular attention, possibly through a JointIndustry Forum of some kind,Full Computerisation. In order to make a QRA tool ac-

cessible and simple to operate, routes toward a full comput-criscd QRA design tool should be identified and explored.Improved design equations, To gain the fill benefit of a

QRA approach, there is a need for equations that predictthe actual casing behaviour accurately. Some of the APIequations governing casing behaviour contain conserva-tism specifically factored in to take account of the statisti-cal variation in materials4g. This is obviously a good thing,when designing using safety factors, but the question is:are these the most suitable equations for a QRA designbase? It is necessary to draw out implicit conservatismwithin equations for tubular resistance, and challenge thcl rvalidity, for the following reasons:

Some material properties and manufacturing processeshave altered since the creation of the equations, For exam-ple, tolerances on diameter, thickness, and control overproperties such as yield strength have improved drasticallyin recent years,

In order to determine actual casing response for QRApurposes, a set of equations stripped of implicit conserva-tism arc required. Equations must refer to the limit statesof the casing, without any statistical adjustments (e.g. thefactor of 0.875 present in the API formula for casing burst).

It has also been shown that the probabilistic responseacross the data space for the current casing design equa-tions is not flat, and that the equations provide differinglevels of redundancy for different input values (see Figure5.), The ideal situation is, if a single equation approach isto be used, that redundancy (and therefore safety margins)arc uniform irrespective of casing dimensions etc.Data gathering and collation. The numbr of wellsdrilled by the industry as a whole is fairly large, but work

needs to be carried out on accessing this information andusing it to reduce uncertainty in QRA. Sparsity of data insuch areas as HPHT wells is an issue that must also be ad-dressed through industry co-operation and collaboration,Methodoio~ improvements. The methods outlined for

QRA have yet to be fully developed and tested for each ofBritish Gas design load cases.

System approach, Each casing joint cannot necessarily beconsidered in isolation, and they are connected in terms ofprobabilistic response, as well as physically, The ap-proaches discussed here focus on a consideration of casingjoints as components rather than a system. This is an im-portant distinction, and this area requires furtherinvestigation.Casing coupfingx Thus far, it is the pipe bodies that have

been investigated, but the issue of casing couplings andtheir etTecton system reliability, should also be addressedConclusionsA casing design method incorporating at least some useofQRA is a move that will be demanded increasingly by bothregulatory bodies seeking more responsibility and account-ability from operators, and the companies themselves, seek-ing a better understanding of the factors governing theircasing designs.

British Gas is committed to further exploration and devel-opment of such a methodology, in order to prepare for suchregulatory pressures, and to improve its casing design.

The authors have demonstrated several benefits from aQRA implementation, and foresee a number of others:

A better understanding of real load and resistancebehaviour in casing design,Some cost savings whilst maintaining or improvingthe focus on safety.Safer HPHT drilling and completion operations,Improved post-analysis and fitness-for-purposeassessment capabilities.

It is worth stating that casing design is by no means theonly area that impacts upon well economics and safety, andshould not always be considered in isolation from operatingprocedures, wellhead equipment and through-life consid-erations. QRA is not a panacea for well safety,

Like all design aids, QRA is merely a tool, and cannot initself be blamed for failure or bad design, It must be usedwith caution, and as a partner - not a substitute for - soundengineering judgement. The potential benefits from usingsuch a tool - estimated to be as high as 30% of casing costssmust be considered worth the outlay and effort

The potential - in the limit - of Quantitative Risk Assess-ment is obvious. However, upon reflection, several dangersalso become apparent, and one must recall the words ofMark Twain, quoted at the beginning of this paper. Anysteps the industry takes toward this method must be care-fully measured, and only taken after safety has beenassured.

66

7/28/2019 00035038.pdf

7/9

SPE35038 KEILTY, RABIA 7

References1.

2.

3.

4

56.

-1

8.

9

Construction Industry Research and LrrformationAssociation. Rafionalisatjon of Safey and Serviceability[~actor .~in .Ytmctural (I&es, CiRiA, 6Storey!~ Gate,/.ondon, SWIP.?.4U (July 1977)I.ewis, D]]. , Brand, P.R. and Wlutney, W S : load andResistance Factor Designyor oil ~ounfty Tubular Goads,paper OTC 7936, presented at the CMTshoreTechnologyConference, I iouston, ( I995).IIaugcn, ll.B and Wirschong, PIJ. PR{~BAl~ll,/,STIC;LXSIG,V: ,4 realistic look at risk and reliabili~ inenglneerlng, Reprinted from:,bfAC1/INI;DSIGN,April17throughto June 12, 1975, Periton mc, Cleveland, 0hlo44114APIBulletin 5C1 Bulletin on tormulas and Calculationsfor ~astng Tubing, Drrll Pipe and tine Pipe Properties,S111publication, (July 1989)API Spec 5A .YpeclficationJor {Tasing, Tubing and DrillPipe, S111Publ]catiors, (May 1987).Reeves, T B, Parfitt, S I [ 1. and Adams, A.J Casing.S,vstem Risk ;lnalv.~is llsltrg Structural Reliabi/ i~, SP]25693, Procecdmgs of the SPWIADC Drilling Conference,Amsterdam, (1chraary 1993)The IIon [.ord Odlcn: The Public lnqui~ info /he PiperAlpha Disasler, HMSO, I,ondon, (Nov 1990)Veritas Scwm Systems: SEUM PROBAN - Generalpurpose probahills[ic analysls program - [ JSMSMA NIJMI,, SESAM, P 0 Dox 300, Vcritasveien 1N-13221lovik, Norway, (17 Jan. 1992).Rabia, I{ : Fundamentals of (asmg Ile~ign, Graham &Trotman, Sterling I{ouse, 66 Wilton Rd, I.ondon SW 1V11)}{(1987)

67

7/28/2019 00035038.pdf

8/9

BURST

Safety Factor Fp Value

F7.36

Failure oProbability

COLLAPSE AXIAL

T4.86 31.38

6x1 O-7 o

Load Resistance

Tablel. Comparison beMeen QRAandconventional S.F.'sfor7' casing

II

S.F. ;

Figurel. Standard deterministic design

Resistance/~Ii \

Load / I

Load > Resistafice(Failure) Figure 2. Probabilistic design

Many Tests NormalDistribution

Figure 3, Example of how a probability distribution is formed68

7/28/2019 00035038.pdf

9/9

SPE 35038 KEILIY, RABIA 9

Input PDFs*A ,!1 /,,,,

/ /Yield Strength -

Kick Size

4,,/DESIGN ----

EQUATIONS 11),/,,-- Pore Pressure *

Increasing D/t -

Probabilityof FailureResistance/\

Load t ;

iII\\

Figure 4. The QRA design process

Ideal Riskresponse

--- Typicalresponse

Figure 5. Example of risk levels from casing design equations

69