1、An Evaluation of the Risks and Benefits of Penetrations in Subsea Wellheads below the BOP Stack TECHNICAL REPORT 17TR3 NOVEMBER 2004 An Evaluation of the Risks and Benefits of Penetrations in Subsea Wellheads below the BOP Stack Upstream Segment TECHNICAL REPORT 17TR3 NOVEMBER 2004 SPECIAL NOTES API
2、 publications necessarily address problems of a general nature. With respect to particular circumstances, local, state, and federal laws and regulations should be reviewed. API is not undertaking to meet the duties of employers, manufacturers, or suppliers to warn and properly train and equip their
3、employees, and others exposed, concerning health and safety risks and precautions, nor undertaking their obligations under local, state, or federal laws. Information concerning safety and health risks and proper precautions with respect to particular materials and conditions should be obtained from
4、the employer, the manufacturer or supplier of that material, or the material safety data sheet. Nothing contained in any API publication is to be construed as granting any right, by implication or otherwise, for the manufacture, sale, or use of any method, apparatus, or product covered by letters pa
5、tent. Neither should anything contained in the publication be construed as insuring anyone against liability for infringement of letters patent. Generally, API standards are reviewed and revised, reaffirmed, or withdrawn at least every five years. Sometimes a one-time extension of up to two years wi
6、ll be added to this review cycle. This publication will no longer be in effect five years after its publication date as an operative API standard or, where an extension has been granted, upon republication. Status of the publication can be ascertained from the API Standards department telephone (202
7、) 682-8000. A catalog of API publications, programs and services is published annually and updated biannually by API, and available through Global Engineering Documents, 15 Inverness Way East, M/S C303B, Englewood, CO 80112-5776. This document was produced under API standardization procedures that e
8、nsure appropriate notification and participation in the developmental process and is designated as an API standard. Questions concerning the interpretation of the content of this standard or comments and questions concerning the procedures under which this standard was developed should be directed i
9、n writing to the Director of the Standards department, American Petroleum Institute, 1220 L Street, N.W., Washington, D.C. 20005. Requests for permission to reproduce or translate all or any part of the material published herein should be addressed to the Director, Business Services. API standards a
10、re published to facilitate the broad availability of proven, sound engineering and operating practices. These standards are not intended to obviate the need for applying sound engineering judgment regarding when and where these standards should be utilized. The formulation and publication of API sta
11、ndards is not intended in any way to inhibit anyone from using any other practices. Any manufacturer marking equipment or materials in conformance with the marking requirements of an API standard is solely responsible for complying with all the applicable requirements of that standard. API does not
12、represent, warrant, or guarantee that such products do in fact conform to the applicable API standard. All rights reserved. No part of this work may be reproduced, stored in a retrieval system, or transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, without prior
13、written permission from the publisher. Contact the Publisher, API Publishing Services, 1220 L Street, N.W., Washington, D.C. 20005. Copyright 2004 American Petroleum Institute FOREWORD API publications may be used by anyone desiring to do so. Every effort has been made by the Institute to assure the
14、 accuracy and reliability of the data contained in them; however, the Institute makes no representation, warranty, or guarantee in connection with this publication and hereby expressly disclaims any liability or responsibility for loss or damage resulting from its use or for the violation of any fed
15、eral, state, or municipal regulation with which this publication may conflict. Suggested revisions are invited and should be submitted to API, Standards department, 1220 L Street, NW, Washington, DC 20005, standardsapi.org. Executive Summary (revised from original Report) The purpose of this study w
16、as to provide an evaluation of the risks and benefits of allowing penetrations in subsea wellheads below the blowout preventer (BOP) stack. Current Minerals Management Service Regulations require that all annuli be monitored for casing pressure. However, industry standards (ISO 13628-4 especially in
17、 the drilling and cementing phases. If the penetration is plugged, an invalid pressure reading will occur and possibly lead to an erroneous conclusion regarding annular pressure characteristics. If the penetration becomes plugged, the benefits listed above are compromised and the penetration will ju
18、st provide another leak path in the system. For the comparative risk analysis, fault trees were built with the top event of the fault tree being “The Inability of the Wellhead System to Maintain a Pressure Barrier over the Life of the Well.” In the fault tree analysis, various potential leak sources
19、 and failure modes were identified and individual risk values assigned. The comparative risk from the fault tree analysis gives the following results: Relative Risk Analysis Summary Event Configuration No Penetrations B-annulus Penetration B they cover only the most credible faults as assessed by th
20、e analyst. It is also important to note that a fault tree is not in itself a quantitative model. It is a qualitative model that can be evaluated quantitatively and often is. The fact that a fault tree is a particularly convenient model to quantify does not change the qualitative nature of the model
21、itself. Finally, a fault tree analysis addresses the likelihood of the failure to occur, but does not address the severity of the occurrence. API Technical Report 17TR3 4 API 17D Committee 10-Feb-2004 Stress Engineering Services, Inc. 5 PN 111986 4.3 Failure Modes and Effects Analysis (FMEA) A Failu
22、re Modes and Effects Analysis (FMEA) is defined as a procedure by which each potential failure mode in a system is analyzed to determine the results or effects thereof on the system and to classify each potential failure mode according to its severity. Failure mode(s) is defined as the manner by whi
23、ch a failure is observed. It generally describes the way the failure occurs and its impact on equipment operation. It is sometimes defined as the problem, the concern, the opportunity to improve, or the failure. It is the physical description of the manner in which a failure occurs. Examples of fail
24、ure modes are cracked, leaked, broken, warped, corroded, and binding. The effect(s) of failure is defined as the outcome of the failure on the system, design, process, or service. In essence, the effect(s) of failure attempts to answer the questions: What happens when a failure occurs? What is (are)
25、 the consequence(s) of that failure? The effects of a failure must be addressed from both a local and a global viewpoint. The local viewpoint is that in which the failure is isolated and does not affect anything else in the system. The global viewpoint is that in which the failure can and does affec
26、t other functions and/or components. Therefore, a failure with a global effect is more serious than one with a localized effect. The cause(s) of failure is defined as the physical or chemical processes, design defect(s), quality defect(s), part misapplication, or other processes that are the basic r
27、easons for failure or those that initiate the physical process by which deterioration proceeds to failure. It is the root cause of the noted failure mode. When looking for the cause of the failure, one must look for the root cause, not the symptom of the failure. The cause of a failure may also be d
28、ue to human error. There may be several causes for one failure mode and all causes should be listed on the FMEA report. The detection method is the means or method by which a failure can be discovered during normal system operation or by some diagnostic action. The purpose of the FMEA is to identify
29、 and prevent known and potential problems from reaching the customer. The FMEA process helps to define and rank the problems so that they can be addressed with respect to their overall importance. A risk priority number (RPN) is used to articulate the priority of a problem. The risk priority number
30、(RPN) is defined as the product of the severity of the failure, the frequency of occurrence, and the reliability of the detection method. The highest RPN value is assigned to the problem that should be addressed first to prevent future failures. If the FMEA is to follow the guidelines of a qualitati
31、ve analysis, the RPN should follow theoretical (expected) behavior of the component. If the guideline is quantitative, it must be specific. It must follow actual data, statistical process control data, historical data, and/or similar or surrogate data for the evaluation. API Technical Report 17TR3 5
32、 API 17D Committee 10-Feb-2004 Stress Engineering Services, Inc. 6 PN 111986 The severity of failure is a rating that indicates the seriousness of the effect of the potential system failure mode. The rating is based upon a scale of 1 to 10 with 10 being the most severe. Occurrence is the rating valu
33、e corresponding to the estimated number of failures that could occur for a given cause over the design life of the system. The rating is based upon a scale of 1 to 10 with 10 being the most frequent. The detection is a rating corresponding to the likelihood that the proposed system controls will det
34、ect a specific root cause of a failure mode. The rating is based upon a scale of 1 to 10 with 10 being the highest likelihood of detecting the cause of failure. Examples of the FMEA work is shown in Appendix H. 4.4 Methodology Used Following is the process used in performing the analysis for this st
35、udy: 1. An FMEA analysis listing each potential failure mode, causes of failure, effects of the failure, and current design controls to detect the failure was developed. An index value (from 1 to 10) was assigned for each of the following: frequency of occurrence, severity of effects, and likelihood
36、 of detection. These indices were multiplied together resulting in a risk priority number (RPN) used to rank the design characteristics that were most important to address first. See Reference 6 for method. 2. Once the preliminary results from the FMEA analysis were obtained, it was determined that
37、a better method for meeting the objectives of this study would be to switch to the (FTA) method. The FTA method is more appropriate for developing a comparative risk analysis between two designs (wellhead without penetrations and a wellhead with penetrations). See Reference 8 for method. 3. The FMEA
38、 data along with a literature search and brainstorming sessions with well systems experts was used to define the failure modes (causes) for each of the major system components wellhead penetrations, casing/pipe connections, casing hanger packoff, and casing cement. These failure modes are defined in
39、 Tables 3 through 7. 4. An Experts Forum comprised of members from the API Spec 17D/ISO 13628-4 Task Group was convened to refine (add to or delete from) the list of failure modes and to rank the likelihood of occurrence of each failure mode on a scale of 1 to 10 (10 being almost likely occurrence).
40、 5. The fault tree logic diagram was constructed for three cases no penetrations; “B” annulus penetration only (one penetration); and “B” annulus plus “C” annulus penetrations (two penetrations). 6. A Weibull analysis (see Figure 5) was performed on the MMS data for OCS wells with casing pressure as
41、 a function of well age (see Reference 9). From this Weibull analysis, API Technical Report 17TR3 6 API 17D Committee 10-Feb-2004 Stress Engineering Services, Inc. 7 PN 111986 the cumulative distribution function (CDF) curve shown in Figure 6 was created. This curve was used to determine the probabi
42、lity that the event will have occurred as a function of time. 7. The probability values from the CDF curve were used for each of the index values in the failure occurrence index table found in Table 2. 8. Based upon each of the frequency index values defined in the Experts Forum, the failure occurre
43、nce values from Table 2 were assigned to each of the lower level failure modes on the fault tree diagram using Boolean logic (see Reference 8). By definition, the “Or-Gate” probability of occurrence is: PO= P1+ P2 (P1x P2). For an “And-Gate” the probability of occurrence is: PA= P1x P2. 9. The proba
44、bility of failure for each of the fault tree cases (no penetrations, one penetration, and two penetrations) was then normalized relative to the No Penetrations case to give a relative risk value, i.e., the likelihood of failure for a wellhead with one penetration is 2.5 times that of a wellhead with
45、 no penetrations. 10. The benefits of allowing penetrations in the subsea wellhead were developed from brainstorming sessions with the project steering committee and the Experts Forum. They did not come from using specific risk analysis methodologies. 5 Casing Pressure Risk Analysis 5.1 Development
46、Background The initial objective of this project was to develop a qualitative risk assessment to compare a subsea wellhead design with penetrations (thus allowing for monitoring of pressure in the “B” and “C” annuli) to the existing subsea wellhead design without penetrations. The planned method to
47、accomplish this was to use the FMEA or the Failure Modes, Effects and Criticality Analysis (FMECA). An FMEA is usually recommended as the first step of any risk analysis effort. After meeting with the project Steering Committee in February 2003, this effort was started. The initial effort involved a
48、 literature search on sustained casing pressure. This search yielded some very valuable information on the subject that was used in the analysis and is referenced below. The literature provided useful information regarding the root causes of casing pressure in existing offshore systems. However, the
49、 literature did not address the issue of adding penetrations in the subsea wellhead housing for the purpose of monitoring additional annuli for casing pressure. Based upon the literature research, an FMEA was initiated to identify the causes of failure, frequency of occurrence, and the severity of each mode of failure. This was initially developed for the existing subsea wellhead system design without penetrations. Following this, several brainstorming sessions were held to begin development of the risks associated with adding penetrations in the wellhead housing. API Technical R
