SPEIIADC 25693

Casing System Risk Analysis Using Structural Reliability

A.J. Adams: Enertech Engineering & Research Co.; S.H.L. Parfitt, ** BP Exploration;
T.B. Reeves,t BP Exploration Inc.; and J.L. Thorogood,t BP Exploration
'SPE Member formerly with Atkins Oil & Gas Engineering Ltd.
"IADC Member
tSPE and IADC Members

Copyright 1993, SPE/IADC Drilling Conference.

This paper was prepered for presentation at the 1993 SPElIADC Drilling Conference held in Amsterdam 23-25 February 1993.
This paper was selected for presentation by an SPElIADC Program Commillee following review of information contained in an abstract submitted by the author(s). Contents of the paper,
as presented, have not been reviewed by the International Association of Drilling Contractors or the Society of Petroleum Engineers and are subject to correction by the author(s). The
material, as presented, does not necessarily reflect any posillon of the SPE or IADC, their officers, or members. Papers presented at SPElIADC meetings are SUbject to publication
review by Editorial Committees of the SPE and IADC. Permission to copy is restricted to an abstract of not more than 300 words. Illustrations may not be copied. The abstract should
contain conspicuous acknowledgment of where and by whom the peper is presented. Write Librarian, SPE, P.O. Box 833836, Richardson, TX 75083-3836, U.S.A. Telex, 163245 SPEUT.

ABSTRACT

each string, stress check type and load case were evaluated
and divided into:

This paper describes a method for quantitative risk analysis

(QRA) of casing/tubing systems, using a structural reliability
approach. The technique was used to calculate risk-ealibrated
design factors 'for exploration and development wells, taking
into account the nature and consequences of failure for each
string, stress check type and load case. The methodology and
results are a significant advance on previous work.

SUMMARY
In 1991, BP Exploration commissioned a major design study
to assist in the updating of their casing design manual. Its
objectives were twofold:
- to develop a general method for quantitative risk analysis
(QRA) of the casing/tubing system;
- to use the method to calculate risk-ealibrated design factors
for exploration and development wells, taking into account the
nature and consequences of failure for each string, stress check
type (eg, burst, tension, etc.) and load case.

- blowout events (target reliability = 1()4);

- repair events (target reliability = 10'2)
and the QRA method was then used to work backwards from
the target reliability to the necessary design factor (DF) for
each case.
It was found that the maximum DFs for the exploration well
were broadly in line with current industry practice, except for
the tension DF which was rather lower (see Table 1). The
minimum exploration well DFs were substantially lower than
current values. The DFs for the development well were lower
than those for the exploration well. It is therefore likely that
substantial cost savings can be made by adopting riskcalibrated DFs for casing and tubing design.
The QRA method is also useful for calibration of design
methods, determination of least-risk operating practice, costbenefit analysis, and QA/QC planning.

RISK ANALYSIS - AN OVERVIEW

The first task was the more difficult of the two. In order to
achieve the required functionality, it proved necessary to
develop three complementary techniques - a FORM/SORM
(First/Second Order Reliability Method) computer program
and two simpler spreadsheet methods. The three methods
were cross-validated against each other, with uniformly
excellent results.

Why risk analysis?

The oil industry has, to date, designed casing using
deterministic methods alone. As this approach has been
largely successful, why complicate matters now?
The answer lies in two areas, namely:

In the second part of the study, the consequences of failure for

- the limitations of the deterministic method;
- the additional (and valuable) knowledge that QRA gives us.

References and figures at end of paper

169

CASING SYSTEM RISK ANALYSIS USING STRUCTURAL RELIABILITY

Deterministic design (that is, 'ordinary' design methods such

as permissible stress or limit state) should ensure a 'safe'
design as long as the design factors and load cases have been
correctly chosen. What it doesn't tell us is how safe the
design is. For instance, if the burst design factor is reduced
from 1.2 to 1.1, the design will be less 'safe' - but by how
much?
QRA gives us an answer to the 'how much' question. It
allows us to calculate the probability of failure for any given
structure and load case: or conversely, to obtain the design
factors required to keep the failure probability below some
given level.
This is an important development, for the following reason.
Until now, there has been no means of calculating what the
design factors (DFs) should be. As a result, the DFs used by
the industry have largely evolved on a historical basis. The
factors adopted have usually been taken to apply equally to all
well types, casing grades and load cases. This approach,
while widely used, has a number of shortcomings, as follows.
Poor economics The present DFs are based on historical
experience - but this is always of the 'worst' wells (eg,
wildcats), for which the failure probability is highest. DFs
which are correct for the worst cases may be overconservative for less severe cases such as development wells,
resulting in wasteful oversizing.
Inflexibility In general, one DF is used for all strings and all
load types: eg, 1.2 is used for production casing burst after
tubing leak as well as for pressure test of the outer casings.
However, the consequences of the first scenario (possible
release of hydrocarbons to the environment) are much more
severe than those of the second (casing repair); so surely the
first condition should have a higher DF than the second.
Uneven risk At present, the same DF is normally used for all
steel types and grades. This is open to criticism, as the
margin of safety depends in part on the difference between
ultimate tensile strength (UTS) and yield; and this is much
lower for high strength steels (eg, V150) than for lower grades
(eg, J55, LSO). Furthermore, our historical experience is
almost solely for API steels - and hence the DFs based upon
it may not be applicable to newer steel types such.as CRAs l
In summary: the present system of design factors is limited
because

- it is implicitly based on historical information, which is both

limited in extent and variable in quality;
- the DFs so obtained are biased towards the few worst cases,
and so will not give economic design for the majority of wells
and load types which are not worst case.
In 1989, Payne and Swanson2 suggested that many of these
limitations could be overcome by the use of QRA; and they

170

SPE/IADC 25693

gave single-variable resistance examples to show how the

method could be applied. This paper is an extension and
generalisation of their important early work. It:
- extends the analysis method from single to multiple input
variables;
- considers both the load and resistance responses;
- enables calculation of risk-calibrated design factors.
Furthermore, it addresses the vital issue of the consequences
of failure, and how this should be included in the design
philosophy.
The new method proves to be a powerful one. As well as
fully addressing the issues listed earlier, it also allows
examination of other areas previously closed to us, such as:
Target reliability What are the DFs required to achieve a
given reliability, such as Ht4'? How much greater are they,
say, than those for 10-2?
Cost-benefit What is the most cost-efficient set of DFs - that
is, where is the right balance between cost and safety?
Design methodology If a limited-kick criterion is adopted,
what influx volume should be used? What is the effect of
early kick detection? Do the design factors allow for casing
wear, or should it be included explicitly as a reduced wall
thickness in the data?
QA/QC planning Should I accept or reject a batch of casing
that is slightly undersized/undergraded? What is the most
cost-efficient QA/QC strategy for well tubulars?

It therefore very much appears as if QRA is justified by the

benefits it offers in terms of better design. Furthermore, as

the QRA process is used to calibrate our existing deterministic
methods, it does not require any additional analysis at user
level. The user therefore achieves the twin benefits of simple
analysis methods and better, more economic design.

Summary of method
In 'ordinary' deterministic design, we use the nominal values:
for instance, the nominal wall thickness of a 7" #26.0 casing
is 0.362". However, tubulars are never rolled exactly to size.
The real thickness might be 0.37", in which case the section
would be stronger than its nominal rating; or, say, 0.35",
Which would make the section weaker than the nominal rating.
If we measured the thickness of a large number of 7" #26.0
casings, we could plot a graph like Figure 1. It is called a
probability distribution function (or PDF), and gives the
probability of occurrence with thickness. It is quite different
from the tidy world we assume in deterministic design: the
mean value is slightly lower than the nominal value, and it is
quite possible to get thicknesses that are substantially higher or

SPE/IADC 25693

ADRIAN ADAMS, STEVE PARFITT, BRENT REEVES, JOHN THOROGOOD

lower than nominal.

Rather than having one unique value for design, we therefore
have a range of possible values, each with a different
probability of occurrence. This is called random behaviour,
and the variable concerned (in our case, thickness) is often
called a random variable.
Examination shows that all the variables for tubular design
show the same random behaviour. This means that functions
of these variables - such as casing strength - must also be
random. As casing strength will therefore vary in a similar
way to that shown in Figure 1, it is impossible to say that a
given design is 'safe' or 'unsafe' - we can only say how safe
or unsafe it is.
Which brings us back to risk analysis. A quantitative risk
analysis (as distinct from qualitative methods such as FMEA
(Failure Mode and Effect Analysis) and FTA (Fault Tree
Analysis)) requires the use of structural reliability techniques.
This method can be understood quite simply at a conceptual
level by taking a simple API casing design equation such as
(1)

for burst strength. This has an output (burst strength) and

three inputs (yield stress, wall thickness and outside diameter).
Structural reliability methods calculate the probability
distribution function (or PDF) of the output, given the PDFs
of the various inputs and the input-output relationship (in our
case, equation (1)). The output PDF is then used to calculate
the probability of failure for any given load level.

Poisson's ratio, linear expansivity);

- annulus fluid properties (density, expansivity,
compressibility);
- formation properties (fracture pressure).
The means of gathering this data, and the values used in the
study, are described below.

DATA
Resistance variables
The probability data used for the resistance variables is
summarised in Table 2. The diameter, thickness, yield stress
and UTS data was based on information supplied by the
manufacturers. Five mills participated in the survey, so
The
creating a total dataset of some 2000 casings.
probabilistic properties were consistently found to be:
- approximately Gaussian;
- broadly uniform with diameter and grade.
All the variables were therefore modelled as Gaussian, and the
dataset was treated as homogeneous to produce values
representative of all casing sizes and grades, as shown. Note
that the dataset contained API steels only, and that the values
given should therefore not be used for CRA or stainless
grades.
The probability data for Young's modulus and Poisson's ratio
was based on the test results reported in Galambos and
Ravindra3

Load variables
We now need a couple of definitions. Resistance variables are
those input variables which determine the casing strength - eg,
yield stress and wall thickness. Load variables (eg, reservoir
pressure and mud density) govern the applied load.
The example above has used random resistance variables, and
assumed that the load is deterministic (that is, it has a fixed
value which cannot change). In general, of course, both the
load and resistance input variables will be random, and thus
both the load and resistance output PDFs must be calculated.
Figure 2 gives an overview of the analysis process.

The load variables are quantities such as gas kick influx

volume, pore pressure, and temperature gradient. The likely
values of these quantities are predicted at design stage, and
these predictions are then used to select the tubular sizes and
grades. If the actual loads are higher than predicted, the well
system will suffer higher stresses than the design stresses; and
the converse if the actual loads are lower than predicted.

The full list of input variables. (or basic variables) is as

follows:

The load probability data is therefore concerned with the

difference between the predicted (design) and actual values.
If the load prediction is very good, its variability (or
'randomness') will be small, and thus the probability of failure
will likewise be small. If the load prediction is poor, the load
variability will be higher, and the failure probability will be
relatively greater, all other things being equal.

- drilling loads (kick volume, pore pressure);

- operating loads (reservoir pressure and temperature,
production fluid density);
- wellbore geometry (DLS);
- casing geometry (diameter, wall thickness, wear);
- casing material (yield stress, UTS, Young's modulus,

This is where we start to see the influence of well type. For

development wells, the load data is usually predicted on the
basis of information from earlier wells in the group, and
should therefore be known quite accurately. For exploration
wells, however, load prediction is usually based on offset data
from other nearby wells; and the load data will therefore be

Data for a reliability analysis

171

CASING SYSTEM RISK ANALYSIS USING STRUCTURAL REliABILITY

rather less accurate than for the development case. For rank
wildcat wells, even offset data may not be available, in which
case the loads will be estimated from the anticipated lithology;
and the quality of the load data is therefore likely to be
substantially worse than for both development and exploration
wells.
This line of reasoning strongly suggests that the necessary
design factors will be a function of the confidence of load
estimation, and therefore of well type: and we will return to
this theme in a later section.
The study results showed that the most important load
variables were pore pressure and kick volume, because they
dominate the applied pressures. The probability data for both
these v8rlables was based on field results, as described below.
For pore pressure, a large number of values of actual
pressure/predicted pressure were recorded from several BP
fields. The dataset included all three well types discussed
above. The probabilistic properties calculated from this data
(and assuming a Gaussian distribution) are summarised below.
Well type

Development
Exploration (1)
~

COY of pore
pressure
0.01-0.05
0.05-0.15

1) With offset data

2) COY = standard deviation/mean

The field data suggested quite a wide possible variation of

COY within each well type. The table above therefore gives
the likely COY ranges rather than any single value(s). Note
that wildcat wells are not included in the exploration figures.
The kick volume probability data was again derived from field
information. The dataset was gathered from several operating
centres, and comprised 28 kicks for exploration wells and 17
kicks for development wells. Reduction of the data showed
that kick volume was Weibull distributed, and the field
datapoints were curve-fitted to produce design PDFs for the
exploration and development cases.
Note that the kick data was obtained from a variety of
different rigs, crews, and kick detection systems. While the
data was treated as homogeneous in this study, it is very likely
that the detection threshold and time to shut-in will vary with
all of the above; and work is in progress to better quantify
these effects.
Probability data for the other load variables was prepared
using confidence level data provided by BP, and assuming the
variable distributions to be normal.

172

SPEIIADC 25693

ANALYSIS METHOD
Strategy
The analysis strategy can be summarised as follows:
- for each string, define all possible failure events by load case
and stress check type (eg, burst, tension, etc.);
- determine the consequences of each failure event;
- in the light of the above, select an appropriate target
reliability for each consequence.
This provides a means of associating an acceptable probability
of failure with a given string, load case, and stress check type.
The design factor required to achieve the target reliability is
then calculated using the QRA techniques outlined in the
earlier part of this paper.

Basis of use
Ideally, any new design method should be calibrated against
historical experience. For QRA, however, this is very
difficult to achieve, because historical failure data is both
sparse and (understandably) difficult to obtain. Moreover,
most major failures (eg, blowouts) are initiated by human
error rather than by primary failure of the structural system.
How should this difficulty be overcome? Given that design
factor (OF) and risk of failure are interrelated, it seems very
unlikely that there will ever be enough historical data to
provide a reliable calibration for both at once. The approach
used in this study was therefore to take the existing design
factors, see what failure rate they predicted, and compare it
with the actual failure rate. Depending on the success of this
exercise, the QRA method would then be used for one of:
i) relative calculation with respect to a known baseline;
ii) absolute calculation in its own right.
The study results showed that, for the DFs in current use by
the industry, the predicted blowout rate due to structural
failure alone was about 10"", ie, 1 in 10000 wells. As the
historical ratio of failures due to human error/failures due to
structural causes is about 10: 1 (see, eg, Madsen et al4), this
implied an overall blowout rate of around 1 in 1000 wells,
which seemed about right or perhaps a little on the low side.
This was a very encouraging result - as the method was getting
the historical structure-only failure rate about right, it could
therefore be possible to use it in an absolute or predictive
sense (ie, ii) above). For the moment, however, it was
decided to adopt a relative approach (option i, using the
current DFs as the known baseline.
This allowed all the objectives of the study to be met, as QRA
could be used to investigate the effect on risk level of different
design options (size, grade, etc.), well configurations, service

SPEIIADC 25693

ADRIAN ADAMS, STEVE PARFfIT, BRENT REEVES, JOHN THOROGOOD

loads, and so on, and thus to optimise the casing/tubing design

to achieve a lower well cost for the $ame relative safety.
The true utility of the method is presently somewhere between
i) and ii) above. It will almost certainly become possible to
move up to the absolute level as more and better input data
becomes available.

Implementation
'Risk analysis' is often spoken of as if it comprised one type
of analysis only. In fact, closer examination shows that
structural reliability analyses divide into two main groups,
namely:
- working forwards (given DFs - > outcome risk);
- working backwards (acceptable risk -> necessary DFs).

Failure events
Each failure event has a consequence. In general, only
failures during drilling, production and workover will
potentially lead to a blowout; failures during the remainder of
the well operations (cementing, pressure test, etc) will in
general lead to a casing/tubing repair. The severity of each
event consequence depends on:

The published work in risk analysis has, oddly, concentrated

on the first problem almost to the exclusion of the second.
Both analysis types were needed for the study, and it proved
necessary to develop three complementary techniques in order
to achieve the capability for this. They were:
- FORM/SORM (First/Second Order Reliability Method);
- convolution integrals;
- Gaussian linearisation.

- whether a repair is necessary;

- whether a repair is possible;
- whether hydrocarbons are released to the environment;
- the location of hydrocarbon release.

The FORMISORM technique was implemented as a computer

program, by integrating a global FE program for casing/tubing
analysis6- 7 within a proprietary package for FORM/SORM
calculation8 The other two methods were implemented as
MathCAD spreadsheets.

The consequence levels chosen were as follows:

- surface blowout;
- shallow subsurface blowout;
- deep subsurface blowout;
- major repair;
- repair;
- no repair necessary.

Limited space precludes any detailed discussion of these

techniques. The authors hope to do justice to the subject in a
future publication.

Validation
The consequence of each failure event (by string and stress
check type) was determined and allocated to one of the above
consequence levels. The next step was to select the acceptable
probability of failure (or target reliability) for each level. This
was achieved by a mixed process of:
- calibration against historical data (see 'basis of use' above);
- sensitivity checking;
- reference to established industry standards
and the results are given below. The figures were chosen
purely for the purposes of the study, and do not necessarily
represent BP design policy.
Consequence

Blowout
Repair

Target
reliability
10-4
10-2

(Note that the 10"" figure above is the usual industry standard
for the ultimate failure event - see, eg, the DnV and NKB
codess). This associated a target reliability with each string,
load case, and stress check type. The next step was to apply
the QRA method; and this is discussed in the section below.

173

The validation work had two objectives, namely:

- to check that the calculation methods had been implemented
correctly (ie, to ensure mathematical correctness);
- to investigate the method's physical credibility by comparing
program predictions against relevant test results.
Mathematical correctness One of the advantages of having
three analysis techniques was that they could be cross-validated
against each other. Seventeen test problems were developed,
and the probability of failure (Pr) was calculated for five mean
load levels for each problem - a total of 85 individual
validation cases. The agreement on P r was in general good to
the fourth significant figure; Table 3 shows typical results.
Comparison with test data If the method was to be judged
physically reasonable, it had to be capable of correctly
predicting the scatter of, for instance, burst and collapse test
results. Table 4 shows the comparison against available test
data. The agreement on the scatter of collapse strength is
excellent, if perhaps a little fortuitous: burst strength compares
rather less well, but this was attributed to the number of test
samples, which was too small for accurate evaluation of the
dataset dispersion.

CASING SYSTEM RISK ANALYSIS USING STRUCTURAL RELIABILITY

Table 5 shows typical results for the burst and collapse cases.
The load cases considered were:

RESULTS AND DISCUSSION

Before moving on to look at the results, we first need to
briefly review how they were calculated. Very broadly, the
QRA method was used to:
- calculate the probability distribution function (or PDF) of the
combined loads from the individual load probabilities;
- calculate the POF of casing strength (ie, the resistance) from
the individual resistance probabilities (Table 2);
- calculate the probability of failure from the two output PDFs
(see Figure 2).
We are only allowed to use this approach if the load and
resistance POFs are independent. This is true as long as the
load and resistance outputs are functions of different sets of
input variables - that is, no one variable can appear on both
sides. This is not strictly satisfied in our case, as inputs like
diameter and thickness affect both load and resistance.
However, the early study results showed that the effect of
casing geometry on the load response was negligible, and
therefore that the load and resistance PDFs could be taken as
independent with no practical loss of accuracy.
This was an important simplification, because it meant that the
load and resistance responses could be calculated separately,
so giving a far better overview of the physical issues. This
section is therefore divided into three parts:
- load;
- resistance;
- design factors.

Load
The loads exerted on the casing in the various load cases (eg,
plug bump, gas kick, tubing leak) are almost always load
combinations. For instance, the total tension load during
production is made up of several load components, as follows:
P toIaI =

self-weight + buoyancy + bending

+ ballooning + thermal

SPE/IADC 25693

(2)

These load components (or illdividual loads) are in tum

functions of one or more of the input variables; for example,
the equivalent bending load is a function of dogleg severity.
The combined load POFs were therefore calculated in two
stages: the load input variable probabilities were used to obtain
the individual load PDFs, which were in tum employed to
calculate the combined load PDFs. The various stress check
types needed different load measures; those used in this study
were:
- tension, compression: axial stress;
- burst, collapse: differential pressure;
- triaxial: VME (Von Mises equivalent) stress.

174

- installation: running, cementing, plug bump.

- drilling: pressure test, maximum drilling mud weight, well
control (no hydrocarbons), well control (gas kick), lost
circulation to atmospheric, lost circulation to FW/SW.
- production: tubing leak, OST, production collapse, shut-in
pressure, tubing collapse, water injection.
The results are reported as coefficient of variation or COV.
This is a dimensionless measure of dispersion (that is,
variability or 'randomness'), given by:
COy = standard deviation
mean

(3)

The larger the COV, the greater the variability and the higher
the risk of failure. Note that the combined load COY will
vary with load case, as each one has a different mix of load
inputs. For simplicity, the table just gives the COY range for
the installation, drilling and production conditions, rather than
listing separate variabilities for each load case.
The most striking thing about the results is that the load
variability for exploration wells (COV = 0.10 - 0.22) is far
higher than that for development wells (0.02 - 0.04). This is
because of the greater uncertainty of load estimation for
exploration wells, as discussed in the section headed 'load
variables' earlier in this paper. Note that Table 5 does not
include wildcats (ie, wells without any offset data).
The tension, compression and VME load variabilities showed
a similar trend, with the exploration COVs consistently higher
than those for development. They were also affected by the
well trajectory, because of the additional axial load due to
dogleg bending. This was often the governing load effect, as
dogleg severity (DLS) was found to have a much higher
uncertainty than the other load types. It therefore tended to
dominate the total axial load in the curved sections particularly in the outer casings, which are relatively stiffer
and so generate a higher bending stress per unit OLS. Dogleg
sections thus tend to have a rather higher load variability than
straight hole; and within any given dogleg section, the outer
casings will have a higher load variability than the tubing.
Resistance
The resistances were the ultimate failure loads for each stress
check type. These were defined as:
- burst: UTS at inner wall;
- collapse: mean collapse pressure (ie, 50 % exceedence) as
per API Bulletin 5C39 ;
- tension: UTS on pipe body;
- VME: UTS on triaxial combined stress.

ADRIAN ADAMS, STEVE PARFITT, BRENT REEVES, JOHN THOROGOOO

SPE/IADC 25693

Figures 3 and 4 show typical resistance results for casing

burst. They are graphs of required design factor (OF) versus
load COV, and are used as follows:
- determine the load variability (COV J, as described above;
- select the appropriate value of COVL on the x-axis;
- choose the curve for the desired casing grade and/or target
reliability;
- read off the required design factor on the y-axis.
Several points are worthy of note. First, the necessary OF
increases with load variability. This is exactly what we would
expect - if the load data is uncertain (eg, exploration wells),
we will need a relatively higher OF than if the loads were
known very accurately (eg, development wells).
The required OF also varies with grade. The reason for this
lies in the difference between the allowable (design) load and
the failure load. The permissible design load limits the wall
stress to some fixed proportion of yield: but the failure load,
on the other hand, is a function of the ultimate stress (UTS).
The 'safety margin' is therefore partly made up of the
difference between the UTS and the yield stress, or
alternatively their ratio; and this varies with casing grade, as
illustrated below.
Grade

UTS
(ksi)

Yield
(ksi)

UTS
yield

J55
PlIO
V150

75
125
160

55
110
150

1.14

1.36

Lastly, the required DF increases with target reliability (Figure

4). This is again as we would expect, as we know intuitively
that big design factors will give us more safety than small
ones. The table below gives the required burst DF with target
reliability, for grade P110 casing and a load COV of 0.2.
Design
factor

10-1
10-2
10-3
10-4

0.88
1.02
1.13
1.23

though the design factor is not.

Design factors
The design factors (DFs) were obtained by producing graphs
similar to Figures 3 and 4 for the full range of stress check
types and target reliabilities, and reading off the required
design factors for each string, stress check type and load case.
In most cases, this was done using Gaussian linearisation; nonGaussian cases were calculated using convolution integrals.
This gave 191 separate OFs for exploration wells, and 200 for
development wells. This impressive array was promptly
simplified for design purposes, to strike an appropriate balance
between economy and ease of use; Table 1 gives a summary
of the results. Before going on to comment on the factors, it
may first be helpful to review the basis of their calculation.
The DFs have been calculated so as to limit the notional
probability of failure to:
- 10"" for failures resulting in a blowout;
- 10-2 for failures resulting in a repair.
Grade V150 material was taken in order to give the worst
possible UTS/yield ratio, although it is unlikely that it would
be used in practice. Gas kick loads were calculated using the
driller's method for kick circulation. Collapse strength was
evaluated as in API Bulletin 5C39, and the worst case O/t was
taken. Casing wear was not included; that is, the OFs given
are for new pipe.

1.07

The higher grades have their yield stress closer to the UTS,
and so have a smaller margin of safety against ultimate failure..
They therefore need relatively higher DFs to achieve the same
safety level.

Target
reliability

This brings us on to an enormously important issue - namely,

the relationship between the design method and the design
factors. If our design assumptions are very conservative, we
intuitively expect that the necessary OF to achieve a given
reliability will be lower than if the design assumptions were
unconservative. For example, if we designed a certain casing
for a 100 barrel kick, we would expect to use a lower OF than
if we designed for a 50 barrel kick, all other ttmIgs being
equal. Figure 5 illustrates this key point.
The design assumptions and the DFs are therefore not separate
but inextricably linked, as both combine to determine the
structural safety. This means that to calculate risk-ealibrated
DFs, we must first know the proposed design method. A
given set of OFs can therefore only be used together with the
design assumptions upon which it is premised.
These assumptions vary quite widely across the industry.
Areas where design practice differs include:

Note that one of the design factors is below 1.0. This is

because the permissible design load was based on the
minimum section (ie, 87.5 % of nominal wall thickness), so
adding a further factor of 1/0.875 to those already present.
The actual safety margin is therefore greater than I.d, even
175

Wear This may either be 'in the design factors', or modelled

explicitly as a loss of wall thickness.
Minimum vs. nominal section While it is normal to use
minimum section for burst, practice varies as to which is used

CASING SYSTEM RISK ANALYSIS USING STRUCTURAL RELIABILITY

for the tension, collapse and triaxial checks.

Gas kick Design may be based on either casing full of gas or
limited kick; if the latter, the design kick volume may be
anything from 25 to 150 barrels.
Dogleg severity (DLS) The typical maximum DLS varies
from 5 to 10 deg/l00', depending on casing size.

SPE/IADC 25693

and load case. The issue can also be viewed from the opposite
standpoint - cost savings could equally be achieved by
improving the quality of geological forecasting and wellbore
simulation, so reducing the load uncertainty, and thus allowing
lower DFs for the same safety level.

CONCLUSIONS
Methodology

Temperature effects Some designers derate yield stress with

temperature, others do not.
If the industry is ever to have one common set of design
factors, it must therefore first have a common basis for casing
and tubing design. Until such a time, each casing design
manual should strictly have its own individual set of design
factors. Those shown in Table 1 are for the BP design
manual, and therefore may well not be applicable to design
practice elsewhere.

That said, we now tum to the factors themselves. The figures

given are for the dogleg section (the straight hole values are
lower for tension and VME), and give the range of DF for all
strings and load cases. The maximum DFs for the exploration
well are broadly in line with current practice. The exception
is the tension factor, which at 1.3 is rather lower; but it has
long been suspected that the current values (generally 1.5 1.6) were too high2 Note that all the DFs are for the pipe
body only, and do not apply to the connectors.
For the tension, burst and VME checks, the maximum DFs
are the same for both well types. This is for two reasons, as
follows.
i) For tension, the DF is dominated by dogleg bending, which
was assumed to be equally uncertain in both cases.

1) A general method has been developed for quantitative risk

analysis (QRA) of casing/tubing systems. It is capable of
working both forwards (given structure and design factors
(DFs) -> probability of failure) and backwards (acceptable
probability of failure -> required DFs).
2) The method has been successfully validated against hand
and spreadsheet calculations and, insofar as is possible, against
test results and the historical failure rate.
3) It has many valuable uses, including:
- calculation of risk-based design factors;
- calibration of design methods;
- determination of least-risk operating practice;
- cost-benefit analysis;
- QA/QC planning.
Physical behaviour

1) High grade steels (eg, V150, Q125) need higher design

factors than low grades (eg, J55, L80).
2) Dogleg hole needs higher tension and VME factors than
straight hole.
3) Blowout cases require higher DFs than repair cases.

ti) For burst and VME, the reason lies in the different design

assumptions used for each well type. The maximum DFs in

both cases were caused by gas kick; and while the gas kick
PDF for exploration wells was much more severe, the
exploration design kick was also more severe - in fact, twice
as large as the development well design kick. The two effects
therefore compensated, and this happened to result in similar
DFs for both well types.
The minimum DFs are generally 20-30 % lower than the
maximum DFs. This is not because they give any less safety
than the maximum values - it is simply that the load cases to
which they apply are less demanding, because they have less
uncertainty or 'randomness'. This confirms our earlier
suspicions that the current DFs, which have evolved on a
historical basis, were likely to be for the worst case wells
and/or load cases.
It should therefore be possible to achieve considerable cost
savings by adopting specific design factors for each well type

Results

1) The calculated maximum DFs for exploration wells (ie,

those for the worst load cases) are broadly in line with
current industry practice, except for the tension DF which is
rather lower (see Table 1).
2) In general, the development well DFs are lower than those
for exploration wells.
3) It is reasonable to expect that substantial cost savings can be
made by adopting risk-calibrated DFs for casing and tubing
design.
4) Risk-calibrated DFs only apply to the design method upon
which they are premised.

ACKNOWLEDGEMENTS

176

SPE/IADC 25693

ADRIAN ADAMS, STEVE PARFITT, BRENT REEVES, JOHN THOROGOOD

1st Int. Health, Safety and Env. Conf., Nov 1991, 673-680.
2. Payne, M.L. and Swanson, J.D., "Application of
Probabilistic Reliability Methods to Tubular Design", SPE
19556, Proc. 64th Annual SPE Conf., Oct 1989, 373-388.
3. Galambos, T. V. and Ravindra, M.K., "Properties of Steel
for Use in LRFD", Proc. J. Struct. Divn. ASCE, Vol. 104,
ST9, Sep 1978, 1459-1468.
4. Madsen, H.O. et aI, "Methods of Structural Safety",
Prentice-Hall Inc., Englewood Cliffs, NJ (1986).
5. NKB, "Recommendations for Loading and Safety
Regulations for Structural Design", Report no. 36 (1978).
6. MacEachran, A. and Adams, A.J., "Impact on Casing
Design of Thermal Expansion of Fluids in Confined Annuli" ,
SPE/IADC 21911, Proc. 1991 Drill. Conf., Mar 1991, 131141.
7. Adams, A.J., "How to Design for Annulus Fluid Heat-up" ,
SPE 22871, Proc. 66th Annual SPE Conf., Oct 1991, 529540.
8. RCP Consulting Gmbh, STRUREL program manual,
Munich, Germany (1990).
9. American Petroleum Institute, "Bulletin on Formulas and
Calculations for Casing, Tubing, Drill Pipe and Line Pipe
Properties", API Bulletin 5C3, 5th edn, 1989.

The study was performed at Atkins Oil and Gas Engineering

(AOGE) under BP contract DRL 60215. The authors would
like to express their thanks to the following:
- BP Exploration, for foresight in anticipating the importance
of QRA in casing and tubing design, for supporting its
development, and for permission to publish this paper;
- Enertech Engineering and Research, for supporting the
preparation of this paper;
- Nigel Barltrop (AOGE), for many helpful discussions and
also for specialist advice on material failure;
- Jacek Gierlinski (WS Atkins Safety and Technology), for
specialist advice on FORMISORM;
- Trevor Hodgson and Martin Pittilo (both AOGE), for
programming the QRA method;
- Greg Fairlie (formerly AOGE, now with Century Dynamics
UK), for assistance in validating the computer program;
- Randy Wagner (Enertech), for paper review.

REFERENCES
1. Banon, H. et aI, "Reliability Considerations in Design of
Steel and CRA Production Tubing Strings", SPE 23483, Proc.

Development
Exploration

Tension

Burst

Collapse

VME

1.0-1.3
1.0-1.3

0.9-1.2
1.1-1.2

1.0
1.0-1.2

0.9-1.25
1.0-1.25

Table 1 - Swnmary of design factors

-A...

Pi - Po
1.8
1.9
2.0
2.1
2.2

Probability of failure
FORM Gaussian Conv!!!
linear!! integral
0.6096
0.5362
0.4697
0.4108
0.3594

0.6096
0.5362
0.4697
0.4108
0.3594

Installation
Drilling
Production

0.03-0.04
0.02-0.04
0.02-0.04

0.15-0.21
0.10-0.22
0.10-0.21

Table 5 - Burst/coUapse: combined load COVs

t,

COY

1.005
1.00
1.09
1.09
1.00
1.00

0.0013
0.018
0.022
0.015
0.035
0.025

Table 2 - Resistance input variables:

probability data

Failure
type

Method of
casing
manufacture

Burst
Burst
Collapse

ERW
Seamless
Seamless

Table 3 - Program validation: comparison

between analysis methods

Exploration

Outside diameter
Wall thickness
Yield stress
Ultimate stress
Young's modulus
Poisson's ratio

Mean
nominal

COY = standard deviation/mean

0.6096
0.5362
0.4697
0.4108
0.3594

Development

COY of casing
strength
Predicted Test
data
0.016
0.028
0.045

0.026
0.018
0.047

Number
of
samples
8
8
12

Table 4 - Program validation: comparison against test data

177

SPk:.25b93

l~.

t~.

Diameler

Mud density

Load

Resistance

Reservoir pressure

Waillhickness

Yield stress

Produdion fluid density

l~.

load,
resistance

Kick volume

UTS

PDFs of output variables

(load, resistance)

etc.
PDFs of input
variables (load)

COY!

etc.
PDFs of input
variables (resistance)

Figure 2 - Overview of structural reliability method

= 0.020

p(l)

2.0

..

Probability of
failure = 10-2

E
0
.:!

Q125

=
~

'(iJ

.g

.~
~

0.5
0.32

0.33

0.34

0.35

0.36

0.37

0.38

0.4

COY of differential pressure

I (in)

f= 0.358"

Figure 3 - Burst resistance:

Figure 1 - Typical probability

distribution for wall thickness

..

0.2

0.39

effect of grade

Constant

2.0

Grade L80

10-4

.:!
~

High

DESIGN
FACTORS

Unconservative

DESIGN
METHOD

Low

.~

"0

'S

Conservative

OS
0

0.2

0.4

COY of differential pressure

Figure 4 - Burst resistance: effect

of target reliability

Figure 5 - Achieving structural safety

178

safety
level