Hi Matteo,
You were not being Greta-ish. No apologies required and again, many thanks for the clarifications.
My Chi-squared was very simple. I viewed a "well life" or a "well day" as a cycle. Granted, the scope of a "well day" will vary over time with completion ops, production, workover, etc., but generally (crudely) speaking, our population of subsea wells have pretty similar lives and a large population provides smoothing. On average, I expect my wells' lives to be very similar to other deepwater subsea wells' lives.
If my field's "well-lives" are analogous to the general population's well-lives, then the past well-lives with zero failure (no need for SCSSV) can be seen as "test cycles" for my wells. The key difference in our math is that I'm not seeking a million operating-years between failure, but instead was demonstrating that MTBF is greater than my field's 625 projected well-years, with 99% confidence. That may be a lower threshold than is preferred, but the required 3000 well-years are also a lot less than the 80000+ available in the "test cycle" history afforded by industry.
Again, I was playing Devils Advocate. I know the wheels fall off my math if all our wells run without SCSSVs ... an increasing population of SCSSV-less wells will rapidly reduce the calculated confidence.
A related point is that the workovers that result from SCSSV failure (which won't happen if they're not run) DO cause harm. Its far less harm than a spill, but at a far higher frequency. I've never seen an assessment that confirms:
SCSSV-induced workover (higher frequency) * workover HSE harm (lower impact) < loss of containment prevented by SCSSV (very low frequency) * spill harm (very high impact).
We focus on the latter half, but there is a risk that the preventative measures are more harmful overall than the consequence we're trying to avoid.
Interestingly, the paper that Basker shared in another post touches on this argument, but I think we're all a little wary of the methodology.
Anyway, we've both beaten this horse pretty hard. As always, thank you for your insights and I assure you, they are valued.
Cheers,
R
------------------------------
Ron Nelson
Subsea Completion Consultant
ron@deep-blue.ca------------------------------
Original Message:
Sent: 08-21-2024 06:27 AM
From: Matteo Loizzo
Subject: Do we need SSVs in deepwater subsea wells?
Hi Ron,
Apologies, I may have sounded a bit Greta-ish: a condescending list of absolute truths followed by a "how dare you" conclusion. That was in the interest of brevity, but there is nothing more annoying than "the proof is left to the reader". So let me profusely explain my position instead.
- "One [event] per million operating years" is a common yardstick to classify a major accident risk as tolerable. It depends on the regulator and the scenario, but by and large that's the first number people grab. Yes, societal risk may reduce the probability threshold further (it's much worse to kill 10 people in one go than 10 times one person), but let's stick to it. "[H]ow is this even possible to demonstrate?". Well, yes, that's exactly the point: when you do quantitative risk assessment for chemical plant leaks - or semi-quantitative e.g., following API 581 - you are required to estimate probabilities for accident scenarios, and you do it using frequency. Our event is "release from a subsea wellhead, with rate of at least 10,000 tons per year": do we have enough data to hazard a probability?
- I agree that you would use the chi-square distribution to estimate the confidence level of MTBF, but I'm not sure I follow your calculations. Let's restart slowly: let's suppose that the failure rate is constant, without aging, hence an exponential distribution of reliability. I can live with that: subsea completions are not beaten to death and, whereas they will leak in time (saw that), it will hopefully be past their short operating life. Let's assume there have been no containment failures (I doubt it, but we'll discuss that later), so we're looking for the lower confidence limit with "type I" censoring (i.e., wellheads are taken out of service before failing). Following any textbook, for instance NIST, we obtain a lower confidence interval for MTBF of 2 x 5000 x 20 / chi^2(0.995,2), where you want to use CHISQ.INV in Excel to compute the statistics. The result is just short of 19,000 years. If we wanted a lower bound of 1,000,000 years between failures we would need 265,000 wells, 53 times what we've completed so far.
- Mind that this is under the assumption that no well has a DHSV (a lot of them have), that the probability of catastrophic failure has stayed the same (it's not: trawlers fish deeper and sabotage has become more likely), and that we've had no accident so far. Suppose that we've had a handful of unreported losses of containment, then the left confidence bound is 7,100 years and the right one 540,000 years (yes, you can almost be sure that the 1,000,000 level cannot be attained with current technology).
- CO2 emissions are hardly relevant: you talk about 2,000 tons from burned fuel. Steel emits about 1.5 tons per ton, but I doubt we'll use more than a ton of it. Even for "mild" releases like Aliso Canyon (100,000 tons) or the Nord Stream pipelines (220,000 tons), using a Global Warming Potential of 30 we get >3,000,000 tons CO2 equivalent.
- I think the concept of "HSE-only cost-benefit analysis" may be misleading. By definition, you're allowed to seek ALARP only when the risk is not unacceptable i.e., red. Let me translate this: suppose you go to the regulator and say that your maintenance tech gets dizzy and so cannot climb on the tank and test/calibrate the PSV. You're saving a life, at the cost of increasing the chance of a major accident. What will the regulator answer? a) your commitment to life is exemplary, here's a "get out of jail free" card; or b) I will just stop your plant until you find a fitter maintenance tech? Whenever you have a major risk scenario, you cannot ALARP it away: you must reduce the risk to below the unacceptable level AND THEN you can negotiate additional barriers based on cost-benefit analysis. If your necessary control measures increase the overall risk, then by definition you're not allowed to operate. If you want to bring a subsea well on stream then you have to get more reliable DHSV, less risky maintenance operations and - why not - reduce emissions since you're at it. To quote a friend (to be read with Schwarzenegger's accent) "you vill do it, and you vill like it".
- How about the legitimate question: we've done it like this for ages, why can't we just move on? Two things have happened: the move to safety cases, and Macondo. A safety case is built on the premise that regulators will not tell you what to do: they set a goal (e.g., unacceptable risk level for major accidents) and we, as an industry, say what we will do to achieve this goal. All industry standards I know, starting with NORSOK D-010, say that DHSV shall be installed, no exemption carved with subsea wells. If we, as an industry, decide not to install DHSV and a blowout happens, we will be fully accountable and the regulators will stare at us with beady, incredulous, unsupportive eyes. As for Macondo, it shot pollution right into the major accident definition: before the catastrophe, nobody thought that subsea wells could cause major accidents (no bystanders will be killed, anyway). $63 billion later, we know they do. If anybody volunteers in belching 1,000,000 tons of methane into the atmosphere and then claim nothing happened, be my guest. I have a feeling it will be a major accident too.
Now it's my turn to thank for your patience - and the perseverance of anybody who got this far.
Best regards,
------------------------------
Matteo Loizzo
Well integrity consultant
matteo.loizzo@mac.com
Berlin, Germany
------------------------------
Original Message:
Sent: 08-20-2024 06:12 PM
From: Ron Nelson
Subject: Do we need SSVs in deepwater subsea wells?
Greetings Matteo,
Thank you for the feed-back. I'm not an integrity engineer, so please forgive me if some of these questions have obvious answers. Also forgive me for playing the Devil's Advocate a bit here ...
Is it true that typically, we want to reduce major incidents to less than one per million operating years? While that's certainly aspirational, how is this even possible to demonstrate? Not rhetorical ... honestly curious.
Deepwater really took off in the late '90s and there were some years where over 500 subsea wells were completed (according a recent web search). If 5000 wells is high, I'll wager that there are 4000 wells out there with 20-year histories, and far more if I include TLP and similar wells that should technically be at higher risk than subsea.
4000 wells x 20 years is 80,000 deepwater well years without need for an SCSSV. Using a simple Chi-squared distribution, assuming my field has 25 wells and a 25-year life expectancy (625 well years), all I need is 3000 problem-free well-years from industry to be 99% confident that MTBF (ie, an event needing an SCSSV, assuming our procedures and processes are the same) won't happen in my field life.
I know its not that simple, as confidence will drop if we increase the population of wells without SCSSVs. But 80,000 well years that didn't require an SCSSV is a big number. And hopefully we're getting smarter ... I haven't heard of a dropped BOP in a while (touch wood).
This would be an easier decision, IMO, if workovers had only cost implications. They don't. Every workover comes with emissions: 20+ days to do a deepwater tubing swap x 20 tons/day of diesel for a DP drillship x about 6400 lb CO2 per ton of burned diesel = 1300 tons of CO2 per workover, just in rig fuel. Add the fleet of boats and helos supporting the rig. Add all the shipping from across the world, new steel and all the other consumables, and it grows. I know this is debatable, but our social license is impacted by emissions. While "normal", these emissions have very real, negative effects. Then there is HSE risk: I've worked with operators who've dropped tubing strings when pulling SCSSVs in deepwater wells. People get injured. We want to avoid workovers, and not just to save money.
And these SCSSVs do fail. I worked for one operator who had a string of failures in the GoM, out of what was maybe (high side) a 30-valve population. My current client just had one fail in an operated well, and another in a partner well.
I agree that we need to minimize the risk of disaster, but I've yet to see a proper cost-benefit analysis that justifies the SCSSV's use, showing that the probability-adjusted SCSSV harm doesn't exceed that of the spill its notionally preventing.
I'm happy to exclude the dollar cost (that's not the driver, IMO) ... I'm not convinced that they actually pass an HSE-only cost-benefit analysis.
That said, as Basker's post makes clear, we don't have the data with which to do this, as nobody has current, industry-wide data with which to calculate deep-set SCSSV reliability. This is embarrassing. Its also a problem, as it allows anyone with an agenda to use theory in place of data, which can be problematic if there is bias.
Enough said. Thanks again for your mindful comments and patience :)
R
------------------------------
Ron Nelson
Subsea Completion Consultant
ron@deep-blue.ca
Original Message:
Sent: 08-15-2024 12:21 AM
From: Matteo Loizzo
Subject: Do we need SSVs in deepwater subsea wells?
Hi Ron,
A couple of points and then a tentative conclusion:
- Being able to "flow hydrocarbon" (or CO2) is a bit maximalist as a requirement. I would rather argue for a major accident scenario: the possibility of killing 5 or more people (unlikely for a subsea well, unless during intervention), cause an environmental disaster (Macondo? Check), or sink the reputation of a company. Imagine witnessing a dry gas blowout, like the Nord Stream pipelines or Aliso Canyon, but without the reassurance of a relatively small inventory - after all, subsea wells are prolific producers. Would the operator be able to survive?
- Once you establish a credible major accident scenario, then you cannot hide behind reassuring but faulty statistics: you have to install a DHSV as an additional barrier. Let me be a bit more specific about the statistical fallacy: I doubt there have been more than 5,000 subsea wells, each with a life of 20 years. That gives us 100,000 years of experience. Typically, you want to reduce a major accident probability to below one in a million years of operation. To be confident about "won't happen to me" you may need 5,000,000 well-year of experience, which is clearly way more than what we have in our pockets.
- Mind that the number of threats, and thus the probability of a major accident, just keeps increasing: trawling becomes deeper and more common, as shallow fish stocks have been depleted. And the possibility of deniable accidents (cargo anchors in the Baltic come to mind) or outright sabotage cannot be ruled out.
- So my position is: major accident scenario? Then install a DHSV. I would be very happy to negotiate the 6 month minimum frequency provided a proper third-party RCM analysis is performed, but not the presence of such a barrier.
Fundamentalist yours,
------------------------------
Matteo Loizzo
Well integrity consultant
matteo.loizzo@mac.com
Berlin, Germany