Risks and concerns of single-casing riser systems versus dual-casing risers

In 1970 one company's chief drilling engineer sent a memo with the theme that engineers should weigh the costs and benefits of operations decisions as long as the consequences were only "expensive." However, "critical risks" should be totally avoided. Each drilling engineer was encouraged to make his own cost/benefit analysis. For example, one might run a bit until cones are locked and about to fall off. The benefit was that a few bits and associated rig time to change bits could be saved on each well if fewer bits were pulled "green." One consequence might be an expensive fishing job to get bit cones out of the hole. Critical risk might be, for example, repairing or replacing a wellhead or BOPs with only mud in the hole to prevent a blowout. It was known intuitively that it was prudent to set a downhole plug to back-up mud as a well control barrier if BOPs had to be removed. The consequence of a blowout was too onerous to rely on mud alone to control the well.

In the past, decisions were based on the "gut feel" of a few experienced personnel. Today risk analysis tools and processes formalize thoughtful analyses that capture input from both experienced personnel and specialists from many disciplines.

But normal cost/benefit analyses are insufficient when comparing cost savings estimates for using a more risky single-casing riser system with the low probability, high consequence cost of a blowout.

Deepwater production platforms

Deepwater well designs have evolved from land and shallow water designs. Large outer casing supports the weight of inner casing strings. Bottom founded platforms do not support well systems; rather, they provide lateral support to help prevent buckling of the long, slender casings between seafloor and surface. Deepwater floating platforms must support the weight of all casing risers that reach the surface.

Floating production platforms are used when water is too deep to build bottom-founded platforms. These floating platforms are permanently moored and can withstanding severe storms. They do not need to "run" from hurricanes like floating mobile offshore drilling units (MODUs). These stable structures permit wellbores to be extended to the surface where well construction operations can be conducted efficiently.

Deepwater developments can use either dry tree well systems, where the wellbore is extended to the platform with heavy casing risers, or wet tree systems, where the wellbores are terminated at the ocean floor. Dry tree systems use surface BOPs for well construction operations and then install a dry tree with multiple control valves for production. Wet tree systems use large subsea BOPs and a marine riser to the floating structure for well construction, and then install a subsea tree at the ocean floor to contain the flow of oil/gas during the productive life of the well. Subsea wells usually are connected to the surface platform via production flowlines. Flowlines require less platform support than dry tree systems that extend wellbores to the surface.

Many factors must be considered when deciding whether a dry tree or wet tree development is most economical. Reservoir size and shape, depth below mud line, number of wells, type and frequency of workover operations expected during the productive life of the field, and other factors must be evaluated. Compromising safety with single- rather than dual-casing risers should not be a consideration in selecting a dry tree well system.

Since deepwater floating platforms must support vertical loads from dry tree wells, the heaviest outer casing, e.g., 36-in., 30-in., 26-in., 20-in. ID, are not extended to the platform. Typically, two smaller casing strings extend to the surface and are supported by the floating platforms. Two concentric casing strings (risers) provide two independent well control barriers.

Dry tree systems have advantages. A less expensive platform rig can be used and well construction operations take less time compared to subsea operations with a MODU. However, a larger, more expensive platform is required to support the rig and casing risers. Dual-casing riser systems impose greater loads on the platform than single-casing riser systems and therefore can increase platform cost.

Understandably, project managers prefer single-casing risers to improve project economics. A quantifiable capex increase with dual casing risers typically is compared to a more nebulous increase in blowout risk exposure. For any one field development, the odds of a catastrophic blowout resulting from use of a single-casing riser failure may be small. However, the enormous consequence associated with another Macondo type blowout makes increased risk of single-casing risers unacceptable.

This plots riser loss versus mud weight required to balance formation pressure. Several early deepwater dry tree systems are plotted, showing the water depth and required mud weight, and riser loss that would occur if the riser were disconnected. The solid stars indicate dual-casing riser systems; open stars indicate single-casing systems.

Component reliability challenges

Deepwater operations achieve comparable safety and performance levels as shallow water operations but require greater time, expense, and diligent effort. There is generally less margin for error in deepwater well designs and operations. As water depth increases, riser reliability decreases because there are more casing connections and higher stresses. For example, risers are exposed to dynamic environmental loads that can cause fatigue damage, and seawater promotes corrosion. Additional barriers (outer riser strings) would be required to achieve the same reliability and safety as shallow water systems with the same number and quantity of barriers.

Floating platforms sometimes use subsea BOPs or a subsea isolation device (SID) during drilling operations. If the drilling riser leaks, the BOPs or SID are closed to prevent loss of control. Subsea equipment is more complicated and more prone to failures than surface BOPs because they must be installed, tested, and operated remotely. When testing surface BOPs, because the total volume of test fluid is small the loss of a few drops of test fluid is seen easily and can be detected by a decrease in test pressure. A much larger volume of fluid is required to test subsea BOPs. Temperatures near seafloor are typically 37°F to 40°F (3°C to 4.5°C). Temperature changes of the test fluid cause pressure changes that can confuse test results. In addition, control systems for subsea BOPs are more complicated and vulnerable than surface BOP controls.

Why multiple barriers

Why are multiple barriers required in well systems when other equipments such as pipelines and production separators are single-walled? The difference is because if a pipeline or pressure vessel ruptures, the source of potential pollution can be isolated with control valves to limit the release to the environment.

It is ironic that our industry uses dual-walled oil tankers to transport crude and uses dual-walled gasoline storage tanks in service stations, but sometimes use single-walled risers. As the Macondo well incident demonstrated, loss of well control that results in unrestrained flow to the environment from a prolific reservoir has a much greater consequence than other spills.

Many people falsely assume that when a system is designed and tested to function under a prescribed load that it is risk free unless the load is exceeded. Most failures occur well below the design load limits. Well system components (tubulars, valves, fluid densities) are designed to safely control maximum pressures of formation fluids. But most well system leaks occur not because design loads have been exceeded, but because multiple low-probability events occur.

Connections sometimes have small flaws or damages; inspection fails to find small defects; testing is inadequate to detect minor leaks. Then, transient effects of temperature, pressure, and load cause small leaks that escalate into large leaks.

Theoretically, if a single barrier provides a probability of only one chance in a thousand of failure, then two barriers will provide one in a thousand times a thousand chance of failure, i.e., only one chance in a million. In practice, we find common causes reduce this theoretical value to less than a million. Experience shows that two properly designed and tested independent well control barriers usually are adequate. However, it is virtually impossible to engineer a single-barrier system to the reliability equivalent of a normal dual-barrier system.

A joint industry project funded by 12 oil companies and the MMS showed that blowout probability with single-casing risers is typically an order of magnitude higher than with dual-casing risers. Even the worst case consequences considered by the JIP were many times less than the Macondo blowout costs.

Many factors can detrimentally affect the integrity of a barrier. These include such things as out-of-specification materials, corrosion, improper installation procedures, and poor management processes. A leak in any one of the hundreds of connected components is a barrier failure. Escalation control or mitigation factors such as testing, monitoring, and active corrosion control can reduce the effects. These activities do not add barriers to the system; they only improve the reliability of the physical well control barriers.

Riser loss phenomena

Riser loss is reduction in hydrostatic pressure when the mud in a riser is replaced with seawater. Riser margin is how much higher the mud hydrostatic pressure is than the formation pressure. Riser margin may be 500 to 700 psi (3.4 to 4.8 MPa) during drilling, but usually is less for completions and workover operations. Riser loss is small in shallow water and/or if the calculated mud density is near that of seawater. If the riser leaks, the level of heavier mud in the riser drops until the mud column pressure equals seawater pressure. A blowout starts if the riser loss exceeds the riser margin. Closing surface BOPs provides no protection against a leak below the BOPs.

A single-casing riser system with surface BOPs was selected for the first floating platform, the Hutton TLP, because riser loss was only about 170 psi (1.2 MPa). It was reasoned that in the event of a riser leak, the riser margin would be sufficient to maintain well control. This design provided two independent well control barriers – the mud column and the single-casing riser. A very small riser loss is an absolute requirement for single-casing riser system to provide two independent well control barriers.

Evolution of deepwater well systems

Early floating production platforms were installed in relatively shallow water and relatively low formation pressures. Mud hydrostatic pressure and a single-casing riser were independent well control barriers because riser loss was minor. In deeper water, most TLPs and spars use dual-casing risers where formation pressures are abnormal. However, there always have been economic incentives to justify less expensive single casing risers rather than more expensive dual-casing versions.

Some spars have been installed with single-casing risers with the provisions to pull the vessel aside to perform workover operations with a MODU using a subsea BOP. During production operations, the tubing, packer, and tree provide the primary well control barrier (with a SCSSV for additional backup) and the single-casing riser system provides a second barrier. The argument is that single-barrier is risky only during initial completions and during transition from production mode to MODU operations. History shows, however, that it is during well intervention operations that most well control incidents occur.

Over the years, single-casing drilling risers have become common, especially for drilling surface and intermediate sections of the hole where prolific hydrocarbon bearing zones are thought to be absent. A riser failure can cause a blowout, but it is reasoned that the consequence will be minimal. But how can anyone be certain how extreme a blowout would be? In some cases operators have deemed it acceptable to drill into the primary producing zones with a single-casing riser, arguing that the exposure time to this high risk is short.

As more aggressive, riskier, well designs evolve, each project argues that the risks are only slightly higher than before. Although Macondo was not caused by a single barrier failure, it emphasized the need to reduce probability of failure to compensate for the higher consequences of a blowout.

Single-casing riser failures

It is sometimes argued that single-casing risers have a good track record. However, risers have parted and inadvertently been disconnected when remote operated vehicles mistakenly disconnected the wrong risers. Tensioning system failures have occurred, resulting in damaged risers. These failure and near misses show that a blowout with a single-casing riser is a real possibility.