Safety and Risk Analysis of Deepwater Drilling using Managed Pressure Drilling Technology

Safety and Risk Analysis of Deepwater Drilling using Managed Pressure Drilling Technology Jyoti Bhandari 1, Faisal Khan* 1, and Vikram Garaniya 1 1.Offshore Safety and Risk Management Group, Australian Maritime College, University of Tasmania, Launceston, TAS 7250, Australia Abstract:Deepwater reservoir fields have high pressure, high temperature and are remotely located. High reservoir pressure and temperature provide a narrow window between pore pressure and fracture pressure to operate. This may cause potential issues that include but not limited to; loss of circulations of drilling fluids, controlling hole deviations, sticking and torquing pipe, twist off, bridging, kick and dangerous blowouts. Hence, it is important to better understand and manage the drilling operations. Managed Pressure Drilling (MPD) is regarded as a potential solution for drilling in narrow windows between fractures and pore pressure. It allows the safe drilling of the nearby lower pressure boundary by reducing mud density. Managed Pressure Drilling operations create a closed loop fluid system, which allows precise control of bottomhole pressure, timely detection and mitigation of kick and mud losses. However, MPD has a potential threat of blowout in case of underbalance condition and release of hydrocarbon. Therefore, it is crucial to assess and monitor risks associated to MPD technology for deepwater reservoirs. The present work proposes detailed ology to conduct risk assessment of managed pressure drilling. The study investigates different risk factors associated with MPD and recommends use of the probabilistic approach to monitor the risk. Keywords:Managed Pressure Drilling, Risk analysis,,, Safety barrier. 1. Introduction The recent accident at the BP Deepwater Horizon was arguably the largest accidental marineoil spill in world history[1]. Safety during drilling operations is the most important aspect to be considered. The transient, intersecting, continuous and complex characters of drilling operations determine the variety of risk and the risk is extremely difficult to control [2]. s are the most undesired and feared incident during drilling operations [3]. is another major problem in drilling operations. When a kick is not controlled properly, it will escalate to blowout which can have catastrophic consequences. Deep-water reservoir fields are often at high pressure, high temperature and are remotely located. High reservoir pressure and temperature provide a narrow window between pore * Corresponding author: Faisal Khan, research field : Offshore Safety and Risk Management, E-mail: fikhan@mun.ca. pressure and fracture pressure to operate. This may cause potential issues which include, but are not limited to, loss of circulations of drilling fluids, controlling hole deviations, sticking and torqueing pipe, twist off, bridging and even kick and blowout. cannot be stopped completely from occurring but preventative measures can be used to reduce the probability of occurrence and severity of consequences [3]. The detection of inflow from the formation is one of the primary safety aspects of drilling operations. Even with closed wellbore, and with the use of Managed Pressure Drilling (MPD) technology, kick detection and the subsequent well-control procedure must remain in place [4]. The MPD technology is used as a better solution for kick but the causes of kick are not removed. Controlling the annular pressure profile is one of the 31

main advantages of MPD technology. MPDis also used to control bottom hole pressure, hence it can be regarded as primary well-control because the pressure in the well is controlled to avoid an influx of formation fluids into the wellbore [4]. In MPD technology, a Rotating Control Device (RCD)is employed to close the wellbore which makes the drilling operations safer. Figure 1: Schematic of managed pressure drilling flow process. Figure 1 shows the schematic of the MPD flow process drawn using computer software ANDREW MAX [5]. As shown in Figure 1, anrcd is installed on the top of the annular preventer to close the wellbore around the drill pipe. The outlet of the RCD is split between the main return flowline and the MPD choke manifold. Backpressure can be applied to the well anytime by use of MPD manifold [4]. In MPD technology, the secondary safety barriers i.e. the blowout preventer (BOP) and the rig choke manifold remain ready for operations in case they need to be operated. Risk analysis is an important tool used to develop strategies to prevent accident and devise mitigation measures [3]. The present work is aimed to conduct risk assessment of MPD technology using the probabilistic approach. As listed below, six different blowout scenarios have been analysed in this article: i) Increased the flow through annulus ii) Mud pit volume change iii) Pump failure iv) Rotating control device (RCD) failure v) Pump efficiency loss and vi) Decrease in bottomhole pressure. 2. Managed Pressure Drilling Technology Well Control is defined as the uncontrolled influx of the formation fluid into the wellbore. usually occurs when the pressure of drilling fluid in the wellbore has less pressure than that of the formation fluid; whether as a result of the loss of mud circulation or increase in formation pressure. [3]. Uncontrolled kick could lead to catastrophic blowout. Hence, early kick detection is mandatory in drilling operations to prevent blowouts [6]. The kick detection is the exposure of gas influx into the borehole of any oil and gas well. This could be found in the drilling operations of high pore pressure reservoirs [7]. Normally, hydrostatic pressure of the drilling fluid column is greater than the pressure of formation fluids, which prevents the flow of formation fluids into the wellbore [8].When the hydrostatic pressure drops below the formation fluid pressure, formation fluid enters the well and forms a kick that is very likely to be detected [7].When the perceptible increase in mud-pit volume occurs, the gas influx will be detected and the event is known as kick detection. Thus it is of a great importance to detect the kick in its early phase so that it can be reduced in a controlled manner before escalating to blowout [3]. Detecting the kick early and limiting its volume by shutting in the well are critical to secondary well control, and could mean the difference between a manageable situation and one that leads to loss of control [4]. Although the level in the well is not visible, the increase in pit volume is themost reliable indicator of a kick. Other warning signs and possible kick indicators can be observed at the surface. Not all warning signs necessarily identify a potential kick situation. Some of the key warning sign for the kick detection are i) increase in flow rate, ii) increase or decrease in penetration rate, iii) flowing well with pump off and iv) decrease in bottom hole pressure etc[7]. MPD technology uses the calibration of the flow into the well from the pump strokes and then measures the flow out of 32

the well with Coriolis meter as a potential kick detection. occurs as a result of failure of the secondary safety barrier [3]. could occur if the kick is not detected properly. In fact a kick can escalate into blowout either due to mechanical failure of the secondary safety barrier or failure to detect the kick on time [3]. Equipment failure, failure caused by human error, annular losses, poor cement, casing failure, swabbing, low density of mud weight, tubing plug failure, well test failure or unexpected high well pressure could also cause the blowout [2]. Inadequate mud weight (Coriolis) Well shut down Decrease in annulus pressure Apply backpressure via choke Microflex control Increase in the flow through annulus High pressure reservior Microflex detection Unexpected increase in pump rate Increase pump rate Volumetric kill High influx reservior Increase pump rate and backpressure 3. Scenarios To investigate the blowout probabilities in MPD technology six different blowout scenarios (Figures 2 to 7)are studied in this section. Scenario 1- Increased in Flow throughannulus MPD offers a wellbore pressure profile close to the formation pore pressure. Any reduction in a bottomhole pressure component may cause the wellbore pressure to shift below the formation pore pressure, which can cause kick situation [9]. Increase in the flow rate through annulus is an indication of the kick occurring in the managed pressure drilling phase. Factors that cause the flow increase through the annulus could be due to inadequate mud weight, decrease in annulus pressure due to high influx reservoir, the use of a faulty flow meter, or human error. Figure 2: Flowchart for MPD scenario 1 (increase in flow through annulus). Scenario 2- Mud Pit Volume Changes The gain in mud pit volume is a critical situation in Managed Pressure Drilling in terms of kick.if there is unexplained increase in the volume of surface mud in the pit, it could signify an impending kick [10].This is because as the formation fluid feeds into the wellbore, it causes more drilling fluid to flow through the annulus which could eventually increase in bottomhole pressure leading to kick.the basic factors that can cause increase in mud pit volume could be density reduction, drop in mud weight and mud volume reduction. The mud volume variation can be detected on the density meter or with the Coriolis meter. In some cases failure of mud logging could lead to mud volume changes. Likewise, the mud density meter or Coriolis meter could be faulty in some case to indicate the change in mud pit volume. Well shut-in, shutting the mud pump, shut-in the annular preventer and increasing the backpressure are the applicable initial responsesfor mud pit volume changes.the flowchart in Figure 3 shows the factors that can cause the increase in flow through annulus, its detection, initial response to the event, control s and the mitigation plan. Well shut-down, applying the backpressure through choke and increasing 33

pump rate are also the applicable initial responses for the present scenario. Density reduction Density meter Well shut down Apply backpressure via choke Microflex control Mud pit volume change Drop in mud weight Mud logging Figure 3: Flowchart for MPD blowout scenario 2 (mud pit volume change). Scenario 3 - Pump Failure Increase pump rate Volumetric kill Flow volume reduction Tank level indicator Increase pump rate and backpressure As shown in Figure 4, in MPD the failure of pump may result in the kick event. does not cause any well problems for the conventional drilling, but it could lead to a kick for managed pressure drilling. In this scenario the well is circulated at the original rate until the assumed pump failure occurs. Afterwards, equivalent circulating density (ECD) in the annulus will be lost resulting in the formation of influx. ECD is the effective density that combines mud density and annular pressure drop [6]. The applicable response for the pump failure will be shutting in the well or a new pump could be started without shutting the well as shown in Figure 4. Scenario 4 - Drop in Bottomhole pressure Drilling in narrow margins between pore pressure and fracture requires close control of the bottomhole pressure (BHP). One of the aspects of the Managed Pressure Drilling is to keep bottomhole pressure constant, and drop in the bottomhole pressure is very likely for kick to occur. Drop in bottomhole pressure Pump failure Power failure (Coriolis) Pump mechanical failure Increased flow through choke Reducing pump rate High fracture well (Coriolis) High formation pressure Well logging Pump shut down Start new pump Well shut down Apply backpressure via choke Increase pump rate Increase pump rate and backpressure Volumetric kill Microflex control Volumetric kill Figure 4: Flowchart for MPD blowout scenario 3(pump failure). A power or a mechanical failure may result in a pump failure. When pump fails circulation stops and the annular frictional pressure is lost [6]. The pump failure Figure 5: Flowchart for MPD blowout scenario 6 (decrease in BHP). There are several potential causes of BHP reduction duringmpd. This reduction can fit into three categories such as, human carelessness, equipment failure or 34

formation failure. The carelessness of the drilling crews may cause bottomhole pressure (BHP) reduction is shown in Figure 5. Human error can lead to filling the annulus during tripping, reducing pump rate during circulation, increasing the choke opening or reduction of the surface pressure [6]. Factors such as annular loss can cause a decrease in mud height and gas cut can cause a decrease in mud density resulting in a decrease in BHP [3]. Scenario 5 - Pump Efficiency Loss Pump efficiency loss is a common pump problem in the drilling operations. Continuous operation for an extended period causes a loss in pump efficiency which can change the flow rate pumped into the drill-string. Ultimately, this process reduces the Annular Frictional Pressure (AFP) in the wellbore [6]. As shown in Figure 6 the applicable initial response for this scenario can be shut-in, applying backpressure, increasing the pump rate and starting the new pump in case of kick detection. Pump efficiency loss Rotating Control Device (RCD) is an excellent supplement safety device adjunct to BOP stack above the annular preventer. In MPD technology RCD is a highly effective reactionary tool, which can be used to safely mitigate hydrocarbons escaping from the wellbore to the rig floor. The reactive usage of RCD is one of the strengths of MPD which enables the control of the flow safely [7]. The RCD is a rubber-sealing element which is prone to wearing out after continuous use for an extended period of time. If the RCD is not monitored continuously it can fail in some extent causing wellhead to be lost and the annulus to be exposed to atmospheric pressure [6]. The RCD failure could result in kick if it is fails to replace over a time period, in case the wellhead pressure is lost and in the event of loss of surface pressure, as shown in Figure 7. The applicable initial response of this event can be complete pumping off and shut-in of the well. The BOP can be closed as a secondary safety barrier to control the kick to escalate to blowout [6]. RCD failure Flow rate increased through drillstring Continous operation for extended period Decreasing pump rate RCD wears out Well head pressure lost loss of surface pressure Multiphase flow simulator pressure gauge Volume and flow metering MPD choke manifold Return flow monitoring Well shut down Apply backpressure via choke Increase pump rate Increase pump rate and backpressure Pump off Shut-in Microflex control Volumetric kill Close well by closing BOP Figure 6: Flowchart for MPD blowout Scenario 5(pump efficiency loss). Scenario 6 - Rotating Control Device Failure Figure 7: Flowchart for MPD blowout scenario 4 (rotating control device failure). 4. Well safety barrier for the proposed blowout scenarios 35

Well safety is very essential for drilling operations. Every well must have safety barriers to resist and control the certain amount of kick influx. In the above explained blowout scenarios, kick detection is the first and important safety barrier as previously described. In addition, initial responses are applied if the kick is successfully detected. All possible well safety barriers used for above explained blowout scenarios are explained in these sections with their significance. 4.1 Initial responses to s The initial response to a kick is crucial in stopping formation fluid influx as soon as possible. Traditionally, when a kick is detected through increased flow, pit gain or by other means, the rig pumps will be shut off. If the kick is confirmed, the well will be shut-in by the blowout preventer [7]. In conventional drilling shut-in is the only generally accepted initial response that can be applied in the well control situation. Sometimes, after the well is shut-in, the combined pressure of the kick and the hydrostatic column will exceed the reservoir pressure, stopping the influx [7]. Despite shut-in, MPD allows the annulus and diverts the return flow to the choke manifold [6]. The surface backpressure can be applied and the Annular Frictional Pressure (AFP) can be managed as alternative initial response for MPD technology. As shown intable 1, for all studied scenarios, shut-in can be used for initial response in case of kick events. The application of backpressure through choke, increasing pump rate are applicable initial response for the increase in flow rate through annulus. Shut-in the annular preventer and to increase backpressure are the applicable initial responses for mud pit volume changes. The applicable response for the pump failure is shutting in the well or a new pump could be started without shutting the well.the applicable initial response for RCD failure can be complete pump off and shut-in the well. In addition, the applicable initial response for this scenario can be shut-in, applying backpressure, increasing the pump rate and starting the new pump in case of kick detection. Well shut-in can be applied for drop in bottomhole pressure along with closing BOP as a secondary safety barrier to control the kick to escalate to blowout. alternative initial response application for the closed circulation systems. Since the annulus is sealed with a RCD the drilling fluid can be pressurized, which isolates Table 1:Applicable initial responses for kick in MPD technology Scenarios SI Pump shut down Increase in surface backpressure Increase Pump rate Increase flow rate Start new pump Increase in flow rate Yes Yes Yes Yes - - through annulus Mud pit volume Yes Yes Yes Yes - - changes Pump failure Yes Yes - - - Yes Pump efficiency loss Yes Yes Yes Yes Yes Yes Drop in bottom hole Yes Yes Yes Yes - - pressure RCD failure Yes Yes - -- - 4.1.1 Shut-In 36

Shut-in (SI) procedure closes the well, enables pressure build up and stops formation fluid influx. Shut-in can be accomplished by using either an annular BOP or a ram BOP. During constant bottomhole pressure of MPD technology, a well can be shut in either by closing BOPs or by fully closing the choke on the MPD choke manifold when the BOP s are open if an RCD is in use [6]. 4.1.2 MPD Pump Shut Down MPD pump shut down is a for turning off the pumps and increasing choke pressure to provide relatively constant bottomhole pressure [6]. This is based on the pump shutdown schedule for routine operations in constant bottomhole pressure (CBHP). It can be used to check for flow when signals for a kick are not clear[11]. Frictional pressure losses in the annulus are calculated for several pump rates before reducing the pump rate. The difference in the frictional pressure between the current and next slower rate is added as backpressure using the choke. Afterwards the pump rate is reduced to next level until the pump is turned off [6]. 4.2 Circulation Procedures 4.2.1 s s is one of several well controls s to kill the well. The main idea of driller s is to kill the well with constant bottomhole pressure [12]. With the driller s, the fluid from the reservoir is circulated out of the well before the mud weight is increased to overbalance the formation pressure. This means that the volume of mud in the well has to be displaced twice before the well is properly killed [12]. The driller has no need to follow the drill pipe schedule, since the pump pressure is always held constant as the mud weight is changed. 4.1.3 Increasing Surface Backpressure Increasing the casing pressure is afast initial response that can be applied to stop formation flow in an MPD technology. The surface casing pressure is applied by reducing the choke opening until the flow in and flow out are equalized[11]. 4.1.4 Increasing Pump Rate Increasing pump rate is the initial response for a kick event in MPD technology. Increasing pump rate is the first stage of dynamic kill in which increasing surface backpressure is not required[12]. 37

4.2.2 Kill Operations If the applied initial response does not prevent the kick condition the well may need to be killed. For example, when a kick is shut-in and the hole does not hold, an underground cross-flow between reservoirs can occur. In order to restore the control of well, the well may have to be killed [7].Either sandwich kill or dynamic kill can be applied as kill operation. Sandwich kill is to bullhead kill fluid from above and below the loss zone [7]. In dynamic kill, the relief well is drilled to intersect the flowing well as close as possible to the zone of influx. In order to kill dynamically, salt water can be pumped at high rates up the annulus of the flowing well, creating sufficient frictional pressure to stop influx. 5. Bow-Tie Model Bow-tie model is developed combining fault and event trees for all previously described scenarios. The combination of basic event probabilities and safety barrier probabilities are used to obtain the blowout probability using bow-tie. Figure 8shows the bow-tie model for the well-control scenario 1 with the consequences. Figure 8 is the base case for blowout in which entire factor is contributing towards the blowout. When the kick is not detected, the probability of blowout is estimated to be 0.00112. The probability of blowout when kick is detected, but mitigation is not successful, is estimated to be 0.00002.Similar bow-tie models for all other scenario are also developed. Figure 8: Bow-tie model for well control scenario. 5. Result and Discussion Figure 9 shows the blowout probability for the different proposed scenarios. Mud pit volume change has the highest probability of blowout.this is because as the formation fluid feeds into the wellbore, it causes more drilling fluid to flow through the annulus, which could eventually increase in the bottomhole pressure leading to kick.the basic factors that can cause an increase in mud pit volume could be density reduction, drop in mud weight and mud volume reduction. The blowout probability depends on the kick volume that entered the wellbore. The volume gained at the surface provides an indication of this volume. For all proposed scenarios kick is handled using MPD technology. Closing the BOP (shut-in), and use of the rig s choke manifold to circulate the kick out of the hole arepossible initial responses for all previously described scenarios. 38

The International Conferencee on Marine Safety and Environment, 12-13 November 2013, Johor Bahru, Malaysia probability 0.00400 0.00300 0.00200 0.00100 0.00000 1 2 3 4 5 6 Scenarios Figure 9 probability and proposed MPD scenarios Figure 10 shows the different incidents that could occur in offshore drilling operations using MPD technology. It is clear that almost all scenarios have higher probability to maintain safe operations in the event of kick. To maintainn safe operations in the event of the kick, kick detection is very crucial. Low volume of the kick can be circulated using RCD. To be able to circulate kick using RCD can be said to have safe operations maintained in the events of kick. The successful kick initial response and circulation s are to be applied to maintain near miss events. The near miss events are unplanned events that do not result in injury or damage but have the potential to do so. Near miss events can be the events when kick is detected. 0.025 Accident Probability 0.020 0.015 0.010 Mishap 0.005 0.000 1 3 5 Scenarios Figure 10 Event occurring probability profile for different scenarios. The occurrence probability of the mishap event is significantly lower than that of safe operations. Mishap is an avoidable incident, if due diligence is exercised and forecasted effectively. Mishap could be the event when secondary safety barrier fails to control kickk and then other circulations s are needed such as applying backpressuree or increasing surface casing pressure. Well killed is whena kick is shut in and the hole does not hold, and an underground cross-flow between reservoirs can occur. In order to restore control of well, the well may have to be killed. The probability of this incident is very low in comparing to near miss events or mishaps.this event is the most critical event which could lead to blowout if it is not killed properly. A blowout which is an extremely risky event in drilling operations could occur only if the kick is not detected and or failure of the secondary safety barrierr and mitigation. For the proposed scenarios the probability of the blowout is very low. Comparing all scenarios the highest probability of the blowout is estimate to be for scenario 2. 6. Conclusions Risk analysis of MPD operations are carried out using bow-tie approach and sensitivity analysis. Six safety barriers are identified, the failure of which lead to blowout, and these are modelled to represent accident sequences process. The human failure contributes about 20%-30% to the blowout event. Reservoir conditions like high pressuree zone and high influx zone contribute about 33% to the blowout event. From the sensitivity analysis of the safety barrier, kick detection has higher importance to prevent blowout. If kick is not detected, shut-in is the initial response that has higher probability to work perfectly. If kick responsee is not successful, kill operations is very important to mitigate blowout. detection, well shut-down, applying driller s s and kill operations are very important initial responses and mitigation procedure to prevent and control kickk from growing into a disastrous blowout in MPD 39

technology. From the risk analysis conducted in this article it is crucial to understand that blowout cannot be stopped completely. However, it is recommended that the development of the comprehensive monitoring and reporting mechanism, along with proper training of crews and durable risk management could definitely minimise catastrophic blowout. References [1] Vandenbussche, V., A. Bergsli, H. Brandt, O.W. Brude, and T. Nissen-lie. Well-Specific Risk Assessment. in International Conference on Health, Safety and Environment in Oil and Gas Exploration and Production. 2012. [2] Januarilham, Y., T. Aven, T.B. Fylking, and L. Bengtsson, Faculty of Science and Technology. 2012. [3] Khakzad, N., F. Khan, and P. Amyotte, Quantitative Risk Analysis of Offshore Drilling Operations: A Bayesian Approach. Safety Science, 2013. 57: p. 108-117. [4] Schubert, J., Well Control Mpd Managed Pressure Drilling, 2012: p. 84-97. [5] Max, E., Flow Chart 2013. [6] Guner, H., Simulation Study of Emerging Well Control s for Influxes Caused by Bottomhole Pressure Fluctuations During Managed Pressure Drilling. 2009, BS, Middle East Technical University. [7] Birkeland, T., Automated Well Control Using Mpd Approach. 2009. [8] Zhou, J., G. Nygaard, J. Godhavn, O. Breyholtz, and E.H. Vefring. Adaptive Observer for Detection and Switched Control for Bottomhole Pressure Regulation and Attenuation During Managed Pressure Drilling. in American Control Conference (ACC), 2010. 2010: IEEE. [9] Rohani, M.R., Managed-Pressure Drilling; Technique and Options for Improving Operational Safety and Efficiency. Petroleum & Coal, 2012. 54(1): p. 24-33. [10] Fossli, B., S. Sangesland, O. Rasmussen, and P. Skalle. Managed-Pressure Drilling; Techniques and Options for Improving Efficiency, Operability, and Well Safety in Subsea Ttrd. in Offshore Technology Conference. 2006. [11] J.E. Chirinos, J.R. Smith, and D.A. Bourgoyne. Experimental Wells Confirm Alternative Well Control Procedures to Be Effective in Range of Well Conditions. 2012; Available from: http://www.drillingcontractor.org/study-simulates-kick-res ponses-during-mpd-14548. [12] Hauge, E., Automatic Detection and Handling in Managed Pressure Drilling Systems. 2013, Norwegian University of Science and Technology. 40