Presentation quantitative risk assessment of BOP operations using BN
-
Upload
glaucio-bastos -
Category
Technology
-
view
349 -
download
2
Transcript of Presentation quantitative risk assessment of BOP operations using BN
Programa de Atualização Profissional
Quantitative Risk Assessment of BOP operations using Bayesian
Networks
methodology summary
by Gláucio Bastos, M.B.A, Ch.E.
Programa de Atualização Profissional
abstract
target: presentation of a methodology for application of Bayesian Networks (BN) in assessing the likelihood of failures during operations of subsea BOP closing, which can be generally applied to offshore operations in the oil & gas industry
Programa de Atualização Profissional
need
accidents in the offshore oil & gas industry lead to devastating consequences, as happened in 2010 when failures at BOP closing may have occurred before blowout or during operations prevented the isolation of the wells, causing explosions aboard the rig Deepwater Horizon
usually accidents in the offshore industry not only result from a single failure but from the confluence of a number of errors induced by various human, hardware, software, mechanical and hidraulic factors
human failures have proven origin in psychological, physical, sociological and organizational factors
Programa de Atualização Profissional
need
while the hardware failures happen in electronic equipment such as programmable logic controllers (PLC), distributed discrete output (DO) modules, ethernet switches and other electronic equipment used to control the operating systems
sources of failures in software are developed programs such as control logic implemented in PLCs and human machine interface (HMI) running on computers
mechanical and hydraulic systems are prime targets to be controlled by hardware and software systems
Programa de Atualização Profissional
methodology
is based on techniques of quantitative risk analysis (QRA) that have been used to reduce risk of failures during offshore operations, including Markovian chains implemented by BN, which allow the development of versatile models for performance analysis of both preventive (forward) and diagnostic (reverse)
at he beginning models, such as flowchart or fault tree type reliability algorithms, are converted directly into BN to risk assessment, such as in the case discussed here, the probability of failure of the subsea BOP closing function
Programa de Atualização Profissional
methodology a flowchart represents an algorithm or process and shows
the steps of various events or transactions (represented in the BN for its qualitative part of that are interconnected parent and children nodes) whose connection through arches define their order and causality (corresponding to the probability table conditional - CPT which is the quantitative part of the BN and is defined from historical data, expert judgment or a combination of both)
the 05 classes of risk factors examined - human, hardware, software, mechanical and hidraulic - are combined in a BN to assess their effects on the probability of failure during BOP operation
Programa de Atualização Profissional
methodology by the prediction function of BN, aiming to define the
system failure probability or reliability based on the statistical data, the probability distribution of a variable is calculated by marginalizing the joint probability distribution of failure (product of the CPTs of all variables) regarding that variable
by the diagnostic function of BN, to define the influence of a certain system variable in the occurrence of a failure, given the observation (evidence) of a variable (or set of variables) indicative of the occurrence of one or more failures in the system, is computed the posterior probability distribution of another variable, whose behavior is to be analyzed
Programa de Atualização Profissional
methodology
the last step of the methodology is the analysis of the model by performing predictive and diagnostic functions of BN, including sensitivity analysis of the system variables to determine the class of the most influential risk factors for failure in BOP closing and model validation from 03 axioms to prove the correctness and rationality of the proposed BN
Programa de Atualização Profissional
methodology
the tool used in the sensitivity analysis of risk factors is the influence strength - IS, based on entropy concept which measures the relevance of the information stored in the data, i.e. its potential to reduce uncertainty in the system (measured by entropy) existing before the release of that information
the influence is evaluated between 02 interconnected nodes of the chain by the value of IS measured on the arc connecting the 02 nodes 02 which represents the strength of information in both directions between these nodes
Programa de Atualização Profissional
issue description
the underwater BOP system consists of a control system and a column as in following figure
the control system includes electrical and fluid controls the surface components of the electrical control system
located in the rig make up the central control unit (CCU) which provides full functional capability for BOP operations
triple modular redundancy PLCs are used for transmitting control signals from the CCU to the 02 subsea electronic modules (SEM) located in the blue and yellow pods, completely independents of each other
Programa de Atualização Profissional
Programa de Atualização Profissional
issue description the 02 SEMs control with full redundancy all operations of
valves and all communication with the CCU when a pod or the corresponding SEM fail, the other one is
used to operate the BOP without interference from the inactive one
fluid control systems consisting of high and low hydraulic pressure systems are used to operate the BOP column hydraulic system, consisting of pumps, accumulators, pipes, hoses, etc.
on drilling the primary barrier is the drilling mud while the secondary is the BOP column, as it is designed to block the well hole or the drill column
Programa de Atualização Profissional
issue description
02 types of shields are used: annular and ram during drilling BOP can be equipped with 01 or 02 annular
shields and with 04 or more rams, including 01 blind shear and some pipe rams
BOP is often tested according viable operating practices during the test or occurring a kick or blowout, the operator
shall promptly block the well hole through the annular or ram BOP through similar operations for one or another type
the case study considered here is the “subsea ram BOP“ operation which flow chart is as follows
Programa de Atualização Profissional
Programa de Atualização Profissional
issue description during normal operation, the blue and yellow pods are
energized although only 01 pod is hydraulically operated when the operator notices a kick or blowout from the HMI
screen he can send the command “block the subsea ram BOP“
when PLCs receive the signal the system checks which pod is hydraulically activated
in this case the blue pod is initially selected, so the yellow pod is inactive and modules DO in blue SEM energizes the blue solenoid direct drive valve (DDV) while the low hydraulic pressure in blue pod drives the blue sub plate mounted valve (SPM)
Programa de Atualização Profissional
issue description after 10 sec. the system checks whether the SPM valve is
activated via a pressure fitting if so the system checks whether the ram BOP is completely
blocked by hydraulic high pressure after 20 sec. if ram BOP is closed, the operator sends the command “block
subsea ram BOP" and then the blue DDV valve is de-energized and the blue SPM is disabled
after 10 sec. disabling of blue SPM is checked if any checking fails, the control logic informs the operator to
hydraulically select the yellow pod the command “block subsea ram BOP" is run again but on
yellow pod when all checkings are successful, the operation is complete
Programa de Atualização Profissional
issue description
the flowchart of the command “block subsea ram BOP“ is translated directly into a BN as shown in the following figure
the flowchart represents the transactions processing while the BN represents the relationship between events through their occurrence probability
in the flowchart the events of each column - left and right - represent connectors of 02 parallel or redundant control pods where one copy each other and therefore can not be translated directly into a BN
Programa de Atualização Profissional
Programa de Atualização Profissional
issue description
the failure of an event in each column causes the failure of control pod with no provision for direct activation of another pod in this case, so the BN information is sent to the node "yellow | blue pod failure" and then representing the activation of another pod by the operator, the node “pod connector” receives this information
as seen earlier this BN nodes are affected by 05 classes of factors, each consisting of some risk factors or independent faults affecting the operation performance, as shown in the following figure
Programa de Atualização Profissional
issue description
Programa de Atualização Profissional
results
according to the BN figure on slide 18 which depicts the a priori and posterior probabilities in the 3rd month of the facility operation, the success probability of the closing subsea ram BOP operation is around 81% regarding the redundancy imperfect coverage of hardware and software factor as 95% and the probability of the result intrinsic error being propagated from the uncertainties on data from expert judgments and historical projections
Programa de Atualização Profissional
results regarding risk factors sensitivity analysis, from the average IS
of each class its decreasing sequence in terms of degree and significance for operation failure occurrence is as follows:
hidraulic ≈ mechanical >> human > software > hardware these results confirm that failures in the subsea BOP
operations are mainly caused by hydraulic and mechanical factors
the human factors contribution is low because the submarine BOP column is not often operated since it is only used for testing and during kicks and blowouts occurrence, and its operation it is relatively easy for experienced operators
Programa de Atualização Profissional
results
however when a major incident occurs involving a large number of people, events and equipment then human factors become relevant
software and hardware factors have a smaller share in failure occurrence thanks to the triple redundant control logic of PLC and DO subsystems
Programa de Atualização Profissional
results
the figure above shows the result of variations on factors’ a priori probability, confirming the higher sensitivity of the system to failures from the first 02 factors classes while showing light sensitivity to variations of the human factor and insensitive to changes of software and hardware factors
Programa de Atualização Profissional
results
adjacent figure shows the analysisrepeating by BN over up to 06 months operating time confirming increasedoperation time leads to successfuloperation probability decrease
at the beginning the success probability is 96.1% instead of 100% for human and software factors out of these can cause errors at any time while hydraulic, mechanical and hardware start in perfect condition
maintenance were not considered although in practice maintenance of hardware, software and equipment decreases the failure probability
Programa de Atualização Profissional
resultado adjacent figure shows the time influence on IS at 01, 03 and 05operation months over time the effects of hydraulicmechanical and hardware factors increase out of they are used all thetime in the contrary the effects of human and software factors
decrease out of their a priori probabilities have uniform distribution
concluding, hydraulic and mechanical factors should receive greater attention for improvement of the BOP performance, including application of increased reliability redundancy techniques
Programa de Atualização Profissional
results
human risk factors should receive more attention in offshore operations analysis as a whole, e.g. on drilling since it is proven that human factors are generically the main contributors to operational failures
Programa de Atualização Profissional
model checking consists in proving that the model is a reasonable
representation of the real system the model should satisfy the 03 axioms:
a slight increase / decrease in a priori probability of each parent node should lead to a relative increase / decrease in posterior probabilities of child nodes;
the magnitude of variations influence in a parent node probability should be consistent with that one of the child node; and
the total magnitude of variations influence in the combination of 'x' attributes probabilities should be always larger than that of a full set of 'x – y’ (y x∈ ) atributes
Programa de Atualização Profissional
model checking
the exercise of increasing parent node probabilities of each factor class and checking the influences result satisfies the 03 axioms, partially validating the model out of, e.g.:
when the "Company_Polices" risk probability is 100%, the success probability falls from 81% to 78%
also when the "Company_Standards“ risk probability is 100%, the success probability drops to 73%
finally when the "Organizational_Factor“ last parent node together with the former 02, i.e. "Procedures“ node also has risk probability of 100%, the success probability drops to 69%