Subsurface Safety Valves: Safety Asset or Safety Liability? J .M. Busch, SPE, ARCO Alaska Inc. B.J. Policky, SPE, Sohio Alaska Petroleum CO. D.CG. Llewelyn, SPE, BP Alaska Exploration Inc.

Summary This paper summarizes the methods used to compare the risk of a blowout for a well completion with a subsurface safety valve (SSSV) to a completion without an SSSV. These methods, which could be applied to any field, in-clude a combination of SSSV reliability and conventional risk analyses.

The Kuparuk River Unit Working-Interest Owners recently formed a group to examine the risks associated with installing and maintaining SSSV's in the Kuparuk field. Considering Kuparuk field operating conditions, the group was charged with determining whether SSSV's are a safety asset or whether the numerous operating and maintenance procedures make them a safety liability.

The results indicate that, for the Kuparuk River Unit, an SSSV becomes a safety liability when the mean time between SSSV failures is less than 1 year. Because cur-rent SSSV mean time to failure (MTTF) at Kuparuk is approximately 1,000 days, they are considered a safety asset.

Introduction The use of SSSV's in onshore North Slope development wells was adopted as a statutory requirement to prevent oil spills caused by casing collapse in a permafrost envi-ronment. The primary reason for installing an SSSV in a well completion is to reduce the risk of a blowout, an uncontrolled flow of well fluid to the environment. How-ever, a number of wireline and workover operations specifically conducted to service SSSV's in an individual well are likely. These operations, in turn, represent ad-ditional risk of a blowout.

A typical risk analysis was used to compare risk with and without SSSV's. The steps of the analysis are as follows.

1. Define the equipment system, in this case the two alternative well completions to be studied.

2. Developthe possible failure modes that could affect the reliability of the system.

3. Build a fault tree to describe these failure relations. 4. Develop component failure rates for each branch of

the fault tree, including the development of the relation-ship of SSSY availability to the other components of the fault tree.

5. Calculate the total failure probability as a function of SSSV MTTF.

Not all the component failure rates were derived easily because of the nature of the data required. Thus some of

Copyright 1985 Society of Petroleum Engineers

OCTOBER 1985

the failure rates are based on engineering judgment. This does not affect greatly the comparison of two very similar well completions, because the relative failure rate is more important than the absolute failure rate. When a compo-nent failure rate appeared to have significant influence on the results, a range of values was used in the calculation.

System Definition The standard production well completion for the Kuparuk field (Fig. 1) has a tubing-retrievable subsurface safety valve (TRSSSV) installed at approximately 2,000 ft [610 m] measured depth below the surface. In the rare event of a TRSSSV failure, the first repair method is by wireline manipulation. If this is unsuccessful, the TRSSSV is locked in the open position, and a wireline-retrievable sub-surface safety valve (WRSSSV) is used

3" TREE

SSSV CONTROL LINE

16" CASING

-TRSSSV

10-3/4" CASING

--3-112" TUBING W/GASLIFT MANDRELS

I I I I

PACKER

KUPARUK SANDS

7" CASING

Fig. 1-Schematic of a typical Kuparuk field completion.

assumed constant for the stated operating conditions. The reciprocal of the failure rate A. -I is defined as the MTTF, where MTTF is time multiplied by population, divided by number of failures.

The two basic ways in which components interact in a risk analysis are series and parallel.

In a series combination, every component must fail in service. This is defined as an AND logic gate. Mathe-matically, the reliability of the combined event is simply the product of the reliability of each component:

n

RAND(t)= II Ri(t). . ..................... (2) i=1

1814

TABLE 1-SSSV AVAILABILITY INPUT PARAMETERS

Parameter SSSV critical failure rate, % of total SSSV noncritical failure rate, % of total Mean time to inspect, hours Mean time to repair (lockout not included), hours Mean time to lock out TRSSSV, hours Mean unsafe waiting time, days Mean safe waiting time, hours Miscellaneous wireline operations, trips/well/year Probability of failure to reopen after closing, % Inspection interval, months

if MTTF greater than 500 days if MTTF less than 500 days

75 25

1.7 6.5

19.6 24 12 21

0.25

6 3

In a parallel combination, anyone component may fail. This is defined as an OR logic gate. Mathematically, the reliability of the combined operation is as follows.

n

R OR(t)=l- II [l-Ri(t)] . ................. (3) i=1

Constructing the fault tree for this study involved relating the identified risks to each other. Two very similar fault trees were developed, one for a well with an SSSV (Fig. 2) and one for a well without an SSSV (Fig. 3). For the fault tree describing a completion with the SSSV, there are two added components-the wireline and the work-over work associated with SSSV service operations-because there is a blowout risk associated with the number of operations needed to service SSSV's, which in turn is a function of SSSV life.

SSSV Availability An important parameter for calculating blowout risk for a well with an SSSV is the availability of the SSSV. Availability is defined as the mean proportion of time an SSSV is capable of functioning as a barrier to a blowout. SSSV availability is a function of SSSV failure rate, in-spection and replacement procedures used in the field, and the frequency of other well service operations. The calculation method presented by Engen and Rausand 2,3 and Engen et at. 4 was used in this study. A brief sum-mary of their availability technique and the assumptions used in this study are presented below.

For the purpose of determining SSSV availability, valve failures were classified as either critical or noncritical. A critical failure, such as leaking when closed, failure to close on command, and failure to hold in a seating nip-ple, renders the valve useless in preventing a blowout. In a noncritical failure, such as failure to reopen after clos-ing and premature closure, the valve continues to act as a blowout barrier.

These failures usually are found during routine inspec-tions that occur at 3- to 6-month intervals in the Kuparuk field. SSSV availability (A s,av) is mathematically defined as follows:

As,av= ~ As,av,iXPi, .................... (4) i=1

where As,av,i equals the mean proportion of time the valve system is a blowout barrier for the ith SSSV performance.

JOURNAL OF PETROLEUM TECHNOLOGY

Fig. 2-Fault-tree diagram for completion with SSSV.

Fig. 3-Fault-tree diagram for completion without SSSV.

OCTOBER 1985 1815

TABLE 2-WELL BLOWOUT SURVEY RESULTS FOR NONCOMMUNIST WORLD,1979-82

Drilling Blowouts 216 Production Blowouts 55

Total 271

Production Blowouts Description Workover Leak between tubing hangar and master

valve Tubing leak followed by casing failure Packer leak followed by casing failure Wireline work COiled tubing operations Equipment failure during stimulating

or killing Human negligence Vehicle damaged wellhead Nonrelated fire caused tree leak Gas from nearby well damaged wellhead Stuck backpressure valve Sabotage

Total

'With operationat SSSV instatted.

Pi is the probability of the ith SSSV performance. Three valve performances were assumed for this study: (1) no failure is found by the time of inspection, (2) a critical failure is found to have occurred by the time of inspec-tion, and (3) a noncritical failure occurs by the time of inspection.

The probability of more than one failure occurring be-tween routine inspections is small and, therefore, was ne-glected.

The parameters used to calculate SSSV availability for a typical Kuparuk well are summarized in Table 1. These include the relative number of critical and noncritical failures. The operating time required to inspect or to per-form a repair also must be identified as either safe or un-safe waiting time. The time between a critical SSSV failure and securing the well for repair is unsafe waiting time. Safe waiting time is the time after a noncritical SSSV failure or that time during a repair operation when the well is secured. Other data needed to calculate SSSV availability include the amount of routine wireline work, the expected workover interval, and the SSSV inspection interval. It was assumed that these parameters apply ap-propriately to either a WRSSSV or a TRSSSV; that the SSSV failure rate is independent of valve type was assumed also.

Fig. 4 is a plot of SSSV availability vs. SSSV MTTF assuming various inspection intervals. This plot indicates that, at current Kuparuk SSSV failure rates (MTTF = 1,000 days), more frequent inspections provide only a small additional increase in safety when compared to a 6-month inspection interval.

Blowout Statistics Several data sources were used to determine failure rates associated with each event in the fault-tree diagram. These included blowout specialists, trade journals, Kuparuk field history, published technical reports, and insurance com-panies.

1816

All Wells 14

Z 0 f= u 0:: u-

>-t-::::i iIi -l

~ > (f) (f) (f)

11 11

2 4 2

2 2 1 3 1 1 1

55

0.9

0.8

0.7

0.6

Relevant to Kuparuk

Total 12

6 9 2 3

2 2 2

41

Number Blowouts Prevented'

5

6 3 o 1 1

2 2

23

1 MONTHi

0.5 I' , , , 'Tl 100 1000 10000

SSSV MEAN TIME TO FAILURE - DAYS

Fig. 4-SSSV availability vs. MTTF for various inspection in-tervals.

Discussions were held with the two m~jor blowout specialists who operate worldwide. This information was used to compile a list of 271 blowouts that have required the use of blowout specialists in the noncommunist world in the past 3 V:z years. Fifty-five of these blowouts occurred during the production phase of operations (Table 2); four-teen of these occurred during workover operations. Blowouts caused by the use of non-API equipment, sabotage, and accidents unique to offshore structures were not included in this study. The edited list of blowouts was then subdivided into two categories: blowouts relevant to Kuparuk and blowouts that would have been prevented with an operative SSSV (Table 2).

JOURNAL OF PETROLEUM TECHNOLOGY

TABLE 3-BLOWOUT FREQUENCIES USED TO CALCULATE SYSTEM BLOWOUT RISK

Workovers, minimum maximum

Wireline operations, minimum maximum

Derrick collapse

2.0 x 10 - 4/operation 4.0 x 10 - 4/operation

2.0 x 10 - 8/wireline-hour 1.0 x 10 - 7/wireline-hour

Airplane crash (> 5 miles from airport) 1.0 x 10 - 5/rig-year

3.0 x 10 - 9/well-year 6.6 x 10 -6/well-year 1.0 x 10 -6/well-year

( < 5 miles from airport) Vehicle collision Tubing failures (top 2,000 ft) Wellhead failures Tubing/casing failure

2.0 x 10 - 3/well-year 1.2 x 10 -5/well-year 3.4 x 10 - 6/well-year

A blowout resulting from an aircraft crash was possi-ble at Kuparuk because of the proximity of well pads to a busy airstrip that handles large jet aircraft. A blowout attributed to aircraft crash has not been documented; therefore, the failure rate was determined from studies performed at Sandia Natl. Laboratories. 5 Similarly, rig collapse was treated separately because of the relatively close spacing (60 to 120 ft [18.3 to 36.6 mD of wellheads on the pads in the Kuparuk field. The derrick collapse failure rate (one rig collapse per 4,000 rig years) was based on historical data from rig insurance companies.

Workover risk was based on Gulf of Mexico statistics that indicate that the blowout frequency was four per 10,000 workovers during 1970-79. 6 Wireline-related blowout frequency was based on the number of wireline-related blowouts and an estimate of the hours of wireline work performed in the noncommunist world during the same time interval.

Published information was used to estimate the number of producing wells capable of free flow to the surface in the noncommunist world at the beginning of 1981 (halfway through the blowout survey period). 7-11 Wells capable of flow were defined as gas wells, flowing oil wells without artificial lift, and 25 % of oil wells on gas lift. The estimated total was 275,000 wells.

The data obtained from these sources were used to estimate a blowout frequency for each type of failure mode in the fault-tree diagrams. The basic blowout-frequency data are summarized in Table 3. Then these frequencies were used in the fault-tree calculations to determine the probability of a blowout. For example, three wireline-related blowouts occurred during the 3.5-year survey period. With 40 hours of wi reline work per well-year and 275,000 wells, a wireline blowout frequency of one blowout per 1.3 X 107 wireline hours is indicated.

Sensitivity Calculation During the study, it was found that the frequency and blowout rate assumptions for workovers and wireline work to service failed SSSV's had a major effect on the results. Therefore, sensitivities were run on these param-eters. Sensitivities on wireline blowout rates covered the range of one blowout per 1 X 10 7 wireline hours through one blowout per 5 X 10 7 wireline hours.

Workover blowout rate sensitivities covered the range of two blowouts per 10,000 operations through four blowouts per 10,000 operations. A limited amount of data concerning the expected number of workovers required to repair SSSV's was available. Sensitivity analysis

OCTOBER 1985

HIGH

:x:: (f) a::: I-:::> o 3: o .....J m w >

~ .....J W a:::

LOW 100 1000 10000

SSSV MEAN TIME TO FAILURE - DAYS

Fig. 5-Typical plot of relative blowout risk vs. SSSV MTTF.

showed this to be a critical factor. As a result, a relation-ship between SSSV failure rate and SSSV repair workovers was developed for the Kuparuk field based on the following assumptions.

1. Workovers would be required only in the event of unsuccessful SSSV repair by wireline, by stuck WRSSSV, or by control-line failure.

2. High SSSV failure rates (MTTF < 500 days) would imply that the SSSV itself was failing often (relative to control-line failure). These types offailures usually would be repaired by wireline operations. For this SSSV failure rate, workover frequency of 2 to 5 % per SSSV failure was assumed.

3. Low SSSV failure rates (MTTF > 2,000 days) im-plies that a larger percentage of failures are caused by control line failure. In this case a workover frequency of 10% per SSSV failure was assumed.

Calculation Results The calculation results were plotted to show blowout risk vs. the MTTF of the SSSV. In Fig. 5, the well comple-tion with an SSSV shows a decrease in blowout risk as SSSV life improves. Also plotted is a line showing blowout risk without an SSSV, which is independent of SSSV life. The crossover point, which occurs at MTTF = 300 days (Fig. 5), represents the point at which the SSSV is neither a safety asset nor liability. Sensitivi-ty results give a range of crossover points from an MTTF of 100 to 420 days. Data from the first 12 months of Kuparuk field operations show an SSSV MTTF of 980 days, indicating that under assumed conditions the SSSV is a safety asset.

Conclusions 1. Blowout risk is reduced by including SSSV's under

all conditions studied if the SSSV MTTF is more than 420 days.

2. SSSV inspection frequency of 3 instead of 6 months does not improve SSSV availability significantly at cur-

1817

rent levels of SSSV performance. 3. The results are most sensitive to the frequency of

SSSV repairs completed by workover and the associated workover blowout risk.

The study also reinforced the importance of increasing SSSV life to reduce blowout risk. This objective can be achieved best by continued industry efforts to develop a more reliable SSSV and to improve field operating pro-cedures.

Acknowledgments We wish to thank ARC a Alaska Inc., Sohio Alaska Pe-troleum Co., and BP Alaska Exploration Inc. for permis-sion to publish this paper. Also, we thank the Red Adair Co. and Boots & Coots Inc. for providing blowout data.

References 1. Woodyard, A.H.: "Risk Analysis of Well Completion Systems,"

J. Pet. Tech. (April 1982) 713-20. 2. Engen, R. and Rausand, M.: "Reliability of Downhole Safety

Valves Used in the North Sea," paper OTC 4355 presented at the 1982 SPE Offshore Technology Conference, Houston, May 3-6.

3. Engen, G. and Rausand, M.: "DHSV Arrangement II, Failure Statistics, Ekofisk 1977-1980," SINTEF Report STF18 A81003 (Jan. 1981).

1818

4. Engen, G., Rausand, M., and Tjus, L.: "Analysis of Safety Barriers in Well Systems," SINTEF Report STF18 A81075 (Dec. 1981).

5. Bilinger, B.E.: "Assessments of the Probabilities of Aircraft Impact with the Sandia Pulsed Reactor and Building 836, Sandia Natl. Lab-oratories, Albuquerque," Sandia Laboratories Report SAND 76-0366 (Nov. 1976).

6. "Blowout Risks Still Growing Concern," Offshore (Feb. 1982) 127. 7. "Producing Gas Wells Maintain Steady Rise," World Oil (Feb.

15, 1982) 204. 8. "Oil Wells on Stream Reach Record Level," World Oil (Feb. 15,

1982) 203. 9. "International Well Survey," Pet. Eng. (Juiy 1982)30-32.

10. International Petroleum Encyclopedia, PennWell Publishing Co., Tulsa (1982) 336-52.

11. Moore, S.D.: "Well Servicing Tops the $4-Billion Mark," Pet. Eng. (July 1983) 32.

SI Metric Conversion Factors ft x 3.048*

in. X 2.54* mile x 1.609 344*

Conversion factor is exact.

E-Ol E+OO E+OO

m

cm km

JPT Original manuscript received in the Society of Petroleum Engineers office Oct. 5, 1983. Paper accepted for publication Feb. 5, 1984. Revised manuscript received Oct. 31, 1984. Paper (SPE 12193) first presented at the 1983 SPE Annual Technical Conference and Exhibition held in San Francisco Oct. 5-8.

JOURNAL OF PETROLEUM TECHNOLOGY