Journal of Petroleum Science and Engineering 51 (2006) 111 – 126

www.elsevier.com/locate/petrol

Characterization of operational safety in offshore oil wells

Kazuo Miura a, Celso K. Morooka b,*, Jose Ricardo P. Mendes b, Ivan R. Guilherme c
a
Petrobras, E and P-SSE/UN-BC/ST/EP, Macae, RJ, Brazil
b
State University of Campinas, UNICAMP/FEM/DEP, C.P. 6052, 13083-970, Campinas, SP, Brazil
c
Paulista State University, DEMAC/IGCE, Rio Claro, SP, Brazil
Accepted 4 November 2005

Abstract

The main concern of activities developed in oil and gas well construction is safety. But safety during the well construction
process is not a trivial subject. Today risk evaluation approaches are based in static analyses of existent systems. In other words,
those approaches do not allow a dynamic analysis that evaluates the risk for each alteration of the context. This paper proposes the
use of Quantitative and Dynamic Risk Assessment (QDRA) to assess the degree of safety of each planned job. The QDRA can be
understood as a bsafe job analysisQ approach, developed with the purpose of quantifying the safety degree in entire well
construction and maintenance activities. The QDRA is intended to be used in the planning stages of well construction and
maintenance, where the effects of hazard on job sequence are important unknowns. This paper also presents definitions of bbarrierQ
and bbarriers integrated setQ (BIS), and a modeling technique showing their relationships.
D 2006 Elsevier B.V. All rights reserved.

Keywords: Drilling; Completion; Workover; Plug and abandonment; Offshore well; Well safety; Safety barriers

1. Introduction In the first phase, the well is drilled through surface

Oil field development plans invariably translate into
huge investments on well construction. High risks are
inherent to any well construction because of the uncer-
tainties and unknowns in geological modeling and in
rock and fluid properties. Although risks cannot be
eliminated, they certainly can be reduced by using an
appropriate safety approach during the design and plan-
ning phases. Besides, when the system itself changes
over time, as it does in well construction and mainte-
nance processes, a dynamic safety analysis approach is
suggested. For example, as the drilling phases are
performed, the well (system) comes deeper and deeper.
* Corresponding author. Tel.: +55 19 3788 3339; fax: +55 19 3289
4916.
E-mail address: morooka@dep.fem.unicamp.br (C.K. Morooka).
0920-4105/$ - see front matter D 2006 Elsevier B.V. All rights reserved.
doi:10.1016/j.petrol.2005.11.018
layers not competent to withstand the higher fluid
pressure of deeper layers, and could become unstable
if surface casings are not run and cemented at the
proper depth.
Usage of the term brisk analysisQ varies widely in the
Oil and Gas industry. In most cases it denotes a prof-
itability analysis characterizing each project in terms of
its probability of reaching commercial production and
hence revenue (Yu et al., 1990; Suslick and Furtado,
2001; Accioly and Chiyoshi, 2004; Divi, 2004; Ross,
2004; Schiozer et al., 2004; Suslick and Schiozer, 2004;
Walls, 2004; Zabalza-Mezghani et al., 2004). Alterna-
tively, it can mean any of the following: a feasibility
analysis dealing with uncertainty in technical matters
(Ursin, 2000; Moos et al., 2003; van der Poel and
Jansen, 2004; Yeten et al., 2004a,b); a reliability anal-
ysis dealing with equipment and system availability
112 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126
issues (Tanaka, 1989; Sachon and Paté-Cornell, 2004);
or a hazard and operability study dealing with opera-
bility of system like processing plant by humans (Schu-
bert et al., 2002; Holand et al., 2004). We have no
notice of any study with a bsafe job analysisQ approach
(NORSOK D-010, 1998) as proposed in this paper.
This paper proposes the use of Quantitative and
Dynamic Risk Assessment (QDRA) to measure the
safety degree of each planned job for the entire well
construction and its maintenance activities. It also
extends the concept of bsafety barrierQ and proposes
the new concept of bbarriers integrated setQ (BIS), and
its associated modeling technique that shows the rela-
tionships among barriers. Given a set of active barriers,
the model can predict how many BISes are activated
(Miura, 2004).
A case study illustrates how this approach allows
computing the safety degree of an entire workover
plan. Any intervention plan such as drilling, formation
evaluation, completion, workover, suspension, or plug
and abandonment plan can be used. Using an example
of job planning from an offshore well maintenance,
quantity of available BIS at each planned operation is
computed.
Finally, computational prototypes based on the graph
modeling technique, and the BIS computation algorithm
supporting the BIS approach, are shown. The prototypes
allow the well planner to model the barriers and BIS;
compute the safety degree for the entire well intervention
without additional effort; analyze the operational risks at
any time during the well interventions; and know the
risks associated to each intervention.
2. Quantitative and Dynamic Risk Assessment
(QDRA)
Quantitative and Dynamic Risk Assessment (QDRA)
is an approach developed with the purpose of quantify-
ing safety degrees in entire well construction and main-
tenance activities. The objective of the QDRA is to check
whether the entire work environment is safe throughout
the well construction and maintenance interventions.
The QDRA approach is intended to be used in the
planning stages of well construction and maintenance
activities, where the effects of hazards on job sequence
are important unknowns. The main feature of this ap-
proach is to be fast and expedite. It is based on the
concepts of barrier, BIS, and mutual independence as
defined in Section 3.
The BIS quantification algorithm uses the sequence
of planned operations as a guide for computing. It
assesses the risk between two sequenced operations,
i.e. it computes the status of well BISes at the threshold
between the end of an operation and the beginning of
the subsequent operation.
The initial conditions, i.e., the statuses of all barriers
at the beginning of the intervention, should be given by
the planner. From these first statuses, one can derive BIS
statuses of sequential operations by a computation based
on the impact of planned operations on the barriers. The
impact of each operation on each barrier should be
mapped at this stage. It is assumed that the safety degree
is directly related to the available amounts of BIS. The
approach is called dynamic because it evaluates the well
safety degree for entire plan, at the beginning of each
planned operation, following each change in wellbore.
This approach is fully suitable in practice, because
the operations can be monitored in the field, and the
operation inner risks can be quantified and mitigated on
the basis of both the intervention plans and the daily
bulletins.
Summarizing, the proposed QDRA approach
requires following steps:
1. defining and modeling existing barriers and BISes;
2. defining the acceptance criteria based on BIS;
3. building operation ontology and mapping the
operations;
4. mapping the impacts of operations on barriers;
5. specifying the algorithm for BIS quantification;
6. applying the algorithm in field example as a case
study.
Each one of these steps is fully addressed in the
following sections.
3. Safety barrier and barriers integrated set (BIS)
In well engineering, the philosophy of safety bar-
riers is used to mitigate operational risks. Several
examples are seen in the industry (Takashina, 1989;
Rike et al., 1993; CSEPH, 1998; ANP Technical
Resolution 025, 2002; Petrobras N-1860, 1998;
Holand, 1996; NORSOK D-010, 1998, ISO/DIS
13628-1, 2003; ISO 13628-4, 2003). But with current
barrier definitions, we cannot assess quantitative pre-
dictions of the safety degree—they will only allow a
qualitative assessment.
The common point to these definitions is the barrier
objective: all of them are concerned with creating a
barrier against a blowout—the unintentional fluid flow
from well reservoir to the environment. Current barrier
definitions do not deal with the issue of mutual inde-
pendence, and therefore do not allow barrier quantifi-
 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126
cation. In the next section a barrier concept that over-
comes this restriction is defined.
3.1. Safety barrier
We define safety barriers as bphysical separations
composed of one or more elements, capable of pre-
venting or isolating an undesirable event along a
specific path between the system under study and
the environmentQ.
Applying this barrier concept to a well, it would be
defined as ba physical separation capable of preventing
unintentional fluid flow from a permeable interval (for-
mation or pay zone) to the surface through one specific
pathQ. Fig. 1 shows two examples of well barriers. One
is a bcement plugQ in the bopen holeQ path, and the other
is the surface-controlled subsurface safety valve
(bSCSSVQ) in the binside tubingQ path.
Fig. 1 also shows all the possible paths between the
well bpay zoneQ (permeable interval-formation) and the
benvironmentQ around the well. These paths are the
totality of possible fluid flow paths from the bpay
zoneQ, mapped for the entire well construction and main-
tenance activities. bIncompetent layerQ and bPermeable
layer into the surfaceQ are related to rock layers traversed
by the well. While bIncompetent layerQ usually is a
surface layer that has no rock competence to support
deeper well pressure, bPermeable layer into the surfaceQ
are shallow permeable layers crossing the well, consti-
tuting an alternative path through which fluid can flow.
bOpen holeQ is the status of the well just drilled at a
certain depth; in this condition, the well can develop an
instability problem, and a path could be created between
the reservoir and the environment. bCasing  well
annulusQ is the path through the annulus between the
outermost casing and the drilled well, usually sealed with
cement to avoid any fluid flow. bCasing  casing
annulusQ is the path through the annulus between two
Fig. 1. Totality of possible fluid flow paths between well pay zone and
environment around the well with two examples of well safety
barriers.
113
concentric casings, usually filled with cement with a
height of at least 60 m. The bInside casingQ, also called
cased hole, is the safest path during the entire drilling.
Both bString casing annulusQ and bInside tubingQ are
paths that occur when a string is run inside the well.
Then, by mapping all possible paths, as we do here, and
identifying barriers for each path, we can avoid omis-
sions and guarantee the safety of the entire system.
Another issue to address is the concept of mutual
independence of barriers. Without this concept there is
no way of identifying the barrier contour, and therefore
barriers can neither be distinguished from one another
nor be quantified.
The formal definition of barrier independence can be
stated in any of the following ways: btwo barriers are
mutually independent if there is no intersection in their
componentsQ, or, btwo barriers are mutually indepen-
dent if the elements that compose one barrier do not
belong to another oneQ, or else:
Given n barriers with their element sets E 1,E 2,. . .,E n
then the barriers are said to be mutually independent if
E 1\E 2\. . .\E n = /.
For instance, each well scenario for well construc-
tion and maintenance deals simultaneously with at most
three paths named bStringQ, bWellboreQ and bAnnulusQ.
bStringQ is the bInside tubingQ path; bWellboreQ could be
the bInside wellQ or bString  casing annulusQ paths; and
bAnnulusQ could be all other paths taken together.
If only these parallel paths existed, and no shortcuts
between them, the two definitions about barrier and
independence would be enough to compute the safety
degree of the entire system (or well). But there are
shortcuts among the paths and following topic
addresses it.
3.2. The problem of shortcuts
bShortcutsQ or deviations are defined as path junc-
tions that allow communication between independent
paths, such as between string and well, or between well
and its annulus.
The proposed barrier definition does not prevent the
undesirable top event to happen through shortcuts
among mapped paths, as shown in Fig. 2.
In Fig. 2, even though there is a barrier bCement
PlugQ as shown in Fig. 1, there might be a shortcut from
the bopen holeQ path to the bpermeable layer into the
surfaceQ path, through bformation fractureQ that might
occur during the plug back execution due to excessive
pressure.
Another example shows the shortcut from the
binside tubingQ path, which despite having the barrier
114 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126
Fig. 2. Shortcuts between the paths.
bSCSSVQ might find the bannular string  casingQ path
through btubing leakingQ below the barrier.
To overcome this shortcut problem, the definition of
Safety Barriers Integrated Set (BIS) is proposed in the
following topic.
3.3. Safety barriers integrated set (BIS)
The safety barriers integrated set (BIS) can be
defined as a bset of one or more barriers with the
aim of preventing the undesirable top event, consid-
ering all the possible paths between the system under
study and the environmentQ.
A well BIS can be defined as a bset of one or more
barriers with the aim of preventing unintentional fluid
flow from a permeable interval (formation or pay zone)
to surface, considering all the possible pathsQ, as seen in
Fig. 3.
Notice in Fig. 3 that in a BIS, barriers must not
only exist in all possible paths, but also be integrated,
i.e., barriers must also prevent bshortcutsQ between
paths.
An example of a BIS during the workover inter-
ventions might be the production packer (for well-
bore path) with standing valve and fluid weight
compatible with static pressure (for string path) and
production casing tested above the packer (for annu-
lus path).
Another example of a BIS, in abandoned well, might
be the cement plug in the casing (for wellbore path) and
cemented annulus (for annulus path).
With both BIS and barrier definitions, we have the
means to identify a set composed of barriers for all the
possible paths, integrated amongst them, yet we cannot
distinguish one set from another without the notion of
BIS independence.
The same concept of barrier independence can be
extended to BIS independence: btwo BISes are mutu-
ally independent, if the intersection between their com-
ponents (i.e., barriers) is a null setQ. In math mode, it
can be stated as follows:
Given n BISes with their related barrier sets B 1, B 2,
. . ., B n then the BISes are said to be mutually indepen-
dent if B 1\B 2\. . .\B n = /.
Now, with these three definitions (barrier, BIS, and
BIS independence), the number of independent BISes
available for each scenario can be quantified. But
there remains at least one issue to clarify. The barriers
and BISes are composed of elements with some kind
of dependency relationship amongst them, because
they are not simply sets, but systems. In order to
model these relationships, a graphical representation
technique named bGraph SetQ is introduced in the
following topic.
3.4. Modeling barriers and BISes using bGraph SetQ
Both the barrier and the BIS can be modeled
through a graphical representation technique named
bGraph SetQ, based on the combination and adaptation
of the knowledge graph (Miura, 1992; Morooka et al.,
1993) and the fault tree analysis (FTA) techniques. The
main difference between graph set and FTA lies on the
top event. While in FTA the top event is defined as the
undesirable critical event, in graph set the top event is
defined as the availability, readiness or reliability of the
entire set.
The graph set model decomposes the BIS into a set
of barriers somewhat related amongst them, and each
barrier into a set of components also somewhat related
amongst them.
The Graph Set is a directional graph composed of
three layers representing the reasoning process, where:
n Each node at the input layer represents one input data
item, from which the information is propagated through
the graph. The input nodes are represented by I i .
Fig. 3. Safety Barriers Integrated Set (BIS).
 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126
n The single node at the output layer represents the
possible graph output. The output node is repre-
sented by O.
n The associative nodes (bANDQ gate and bORQ gate)
at the intermediary layer represent the aggregation
operators acting on the input data related to these
nodes. The bANDQ gate can be expressed by mini-
mum, multiplication or any T-norm (Pedrycz and
Gomide, 1998). The bORQ gate can be expressed
by maximum, addition or any S-norm (Pedrycz and
Gomide, 1998). These associative nodes are repre-
sented by A i .
n The relationships between the input layer nodes and
the intermediary layer nodes, and between these and
the output layer node, are represented by arcs
(arrowed lines) linking them.
Therefore, the Graph Set ( G) is defined by G :
I i  A j  OY[0,1] where the status of input elements
{I i } can assume values in the interval [0,1], which are
aggregated by logic operators {A j }, generating a value
in the interval [0,1] associated to the status of output
element {O}.
The barrier status is checked by using the concept of
availability. The availability of equipment is the prob-
ability of having it with correct operation. It is defined
as the complement of the failure index, or (1  k),
where k is the failure index.
Once the graph set is modeled, an availability value
can be assigned for each element of this set: (1  k) for
active elements, and zero (0) for disabled elements. One
can also navigate through this graph and compute the
availability value for the entire set. If the result is a value
greater than zero, the graph set is active (or available); a
value of zero means that the graph set is not activated.
Fig. 4. Subsea BOP scheme.
115
Below the use of the graph set technique is demon-
strated in an application example.
3.5. Application example: modeling blowout preventer
stack as barrier
A well-known barrier in well engineering is the
blowout preventer stack (BOP), a set of rams, flow-
lines, and valves installed on the wellhead in order
to control the well in the event of an influx from
the formation. The schematic drawing of a subsea
BOP, representing its main components, is shown in
Fig. 4.
Fig. 4 represents a subsea BOP with three pipe
rams (upper, middle, and lower), one blind and
shear ram, and one annular BOP. Usually the middle
and lower rams can close around the same work
string, and the upper ram can close around strings of
different diameters. The annular BOP can close a
variety of string diameters, and even a situation with-
out string, and therefore it is redundant with the blind
ram, upper pipe ram, middle pipe ram, and lower pipe
ram. There is a single wellhead connection for the
entire BOP.
Fig. 5 shows the result of modeling this subsea BOP
with the graph set technique.
The column at the left side of Fig. 5 shows the 16
BOP components; at the right side the single node
represents the entire BOP. The relationships among
BOP components are modeled by using three bANDQ
gates and five bORQ gates.
This mutual redundancy of rams (middle and lower
pipe rams) and the redundancy of annular BOP with
regard to all other rams are sometimes misinterpreted as
indications of two or more independent barriers. How-
116 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126

Fig. 5. Subsea BOP model, based on the Graph Set technique.

ever, the BOP will always be one single barrier, regard- k6 failure index of BOP MIDDLE PIPE RAM;
less of the number of rams, because all rams depend on k7 failure index of BOP LOWER PIPE RAM;
a single wellhead connection and housing. Increasing k8 failure index of BOP HOUSING;
the number of rams increases BOP availability, but does k9 failure index of BOP SPACER;
not increase the number of barriers. k 10 failure index of BOP WELLHEAD
Let us suppose that failure indexes of all BOP CONNECTOR;
components are given as follows: k 11 failure index of CHOKE VALVE;
k 12 failure index of CHOKE LINE;
k1 ¼ k2 ¼ 2% k 13 failure index of CHOKE MANIFOLD;
k 14 failure index of KILL VALVE;
k3 ¼ k5 ¼ k6 ¼ k7 ¼ 5% k 15 failure index of KILL LINE;
k 16 failure index of STANDPIPE MANIFOLD.
k4 ¼ 10%
And let us use the following computations for log-
k8 ¼ k9 ¼ k10 ¼ k11 ¼ k12 ¼ k13 ¼ k14 ¼ k15 ¼ k16 ical gates, using failure index (k):
¼ 1%
n bANDQ gate with input {a,b}: (1  k a ) * (1k b );
where: n bORQ gate with input {a,b}: (1  k a * k b ).

k1 failure index of BOP CONTROL LINES Then, according to graph set, the computations are:
POD—BLUE;
k2 failure index of BOP CONTROL LINES ð1  kBOP Þ ¼ ð1  k1 4k2 Þ4ð1  k3 Þ
POD–YELLOW; 4ð1  k4 4k5 4ð1  ð1  k6 4k7 ÞÞ
k3 failure index of BOP BLIND and SHEAR 4ð1  k8 Þ4ð1  k9 Þ4ð1  k10 Þ
RAM;
4ð1  k11 4ð1  ð1  k12 Þ4ð1  k13 ÞÞ
k4 failure index of ANNULAR BOP;
k5 failure index of BOP UPPER PIPE RAM; 4ð1  k14 4ð1  ð1  k15 Þ4ð1  k16 ÞÞ:
 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126
Replacing the failure indexes (k i ) by their values, we
have:
n (1k BOP)=(10.02*0.02)*(10.05)*(10.10*0.05*
(1(10.05*0.05))*(10.01)*(10.01)*(10.01)*
(10.01*(1(10.01)*(10.01))*(10.01*(1(1
0.01)*(10.01));
n (1k BOP)=(0.9996)*(0.95)*(0.999875)*(0.99)*
(0.99)*(0.99)*(0.999801)*(0.999801);
n (1k BOP)=0.9302.
Thus, the BOP stack has 93% of availability or 7%
of failure index.
As shown in a previous example, if the failure in-
dexes of all components are given, this bGraph SetQ
modeling technique can compute the graph set avail-
ability (or reliability) function, with values varying from
0 to 1.
Computations using availability function that varies
in the interval [0,1] are valid to assess the barrier
availabilities over their entire lifetime. But when an
assessment of the BIS availability during the short
time of an intervention is desired, the following sim-
plification is proposed.
3.6. BIS availability function simplification
Usually the availability function is applied to the
whole lifetime of a system. Because the QDRA ap-
proach is only applied during interventions, which are
just a fraction of the lifetime, such as 1 month over
20 years, it would be meaningless to consider the
failure index of such small intervals. Therefore, in
order to simplify the BIS availability computations,
we propose to ignore all failure indexes. In other
words, we propose that the barrier and BIS availabil-
ities be discretized and reduced to one of two possible
values: 1 when they are active and 0 when they are
disabled.
Thus, the BIS availability computations might be
simplified, with integers as results. This simplification
is based on the fact that all these computations are
proposed in order to check the BIS availability changes
which might occur during an intervention.
Once a BIS graph is modeled, if the availability
function is assigned the value 1 for each active barrier
and 0 for disabled barrier, BIS availability can be
checked by navigating the model through logical com-
putations. The result should be an integer.
Modeling the barrier and BIS into set graphs is a
convergent consolidating process, and these models can
be refined over the time. Therefore, the BIS graphs
117
should be periodically inspected, and the barrier and
its dependency obsolescence checked.
In the next section the issue of mapping all known
barriers and BISes is addressed.
3.7. Mapping of existent BIS
The barriers and BISes were mapped and then col-
lected in a structured database. The relationships be-
tween BIS, barrier, and surrounding entities are
represented in the bentities and relationships diagramQ
(ERD) shown in Fig. 6.
In Fig. 6, according to the notation of Entities and
Relationships Diagram (ERD), boxes represent the en-
tities, and arcs represent the relationships between two
linked entities. All relationships modeled in the dia-
gram are of the one-to-many type, i.e., for each in-
stance (or element) on the doneT side of the relationship,
it is possible to find several instances on the dmanyT
side of the relationship. The circle end of the arc
represents the doneT side of the relationship and the
crowfoot end of the arc represents the dmanyT side of
the relationship. Therefore, the BISes are mapped for
each scenario (drilling, formation evaluation, comple-
tion, production, workover, suspension, plug and aban-
donment), while the barriers are mapped for each path
(string, wellbore and annulus). The BISes are com-
posed of barriers and a barrier in turn has its compo-
nents. The impact of each operation on each barrier
status is mapped in the table boperation  barrierQ that
maps the barrier status change after an operation is
accomplished. For example, after a perforation, the
perforated production casing is no longer an active
barrier, and assumes a disabled status.
We scrutinized all the scenarios related on well
construction and maintenance, such as drilling, forma-
tion evaluation, completion, production, workover, sus-
pension, and plug and abandonment (P&A), and we are
Fig. 6. Relationships between barriers and BISes, modeled as entities
and relationships diagram (ERD).
118 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126
able to identify 16 BISes. Furthermore, examining all
the known paths (Fig. 1), we found 55 barriers and their
components.
The BIS for drilling is presented in the Fig. 7.
In Fig. 7, the five independent BISes were modeled
for the drilling scenario. The first two BISes, the natural
BIS and the shallow hazards BIS, are used mainly in
the well spud in activities. The Fluid BIS is used
throughout the drilling scenario, and also during the
formation evaluation scenario. The BOP BIS is used
from the drilling through evaluation, completion, work-
over, suspension, and plug and abandonment scenarios.
The fifth BIS, controlled pressure drilling equipment, is
a set of equipment used for special drilling operations
called pressure controlled drilling.
4. BIS-based safety acceptance criteria
The proposed safety acceptance criteria are applied to
the offshore petroleum well life cycle context. In other
words, the system boundary being reinforced is the set of
possible paths between the pay zone (hydrocarbon res-
ervoir, formation) and the sea (the surrounding environ-
ment). The undesirable critical event is the blowout (non-
controlled eruption) of hydrocarbons to the environment.
These criteria must be applied to the whole design of
any intervention, whether it is drilling, formation eval-
uation, completion, workover, suspension, or P&A.
The well engineering community since long time
recommends the use of two BISes for all interventions
(NORSOK D-010, 1998; PETROBRAS N-1860, 1998).
Fig. 7. Examples of barriers integrated set (BIS) for drilling scenario.
But in P&A interventions, the Brazilian Regulatory
Agency (ANP) demands three independent BISes, ba-
sically composed of cement plugs, in both the wellbore
and its annuli.
Therefore, the proposed safety acceptance criteria
for the offshore well life cycle are:
n In plug and abandonment interventions, at least three
independent and tested BISes should be available to
prevent unintentional well flow.
n During any other well interventions but P&A, such
as drilling, formation evaluation, completion, work-
over, and suspension interventions, at least two in-
dependent and tested BISes should be available to
prevent unintentional well flow.
n Each BIS status should be known during the entire
intervention, and checked at least before carrying out
each planned operation.
n In the event of a BIS failure, immediate action
should be taken in order to re-establish the function-
ality of two independent BISes. No activities should
be carried out, excepting those to re-establish the
minimum condition of two independent BISes.
With these safety acceptance criteria based on the
previously introduced definitions and modeling tech-
nique, the QDRA approach can be run, provided the
operations and their impacts on barriers are known.
Operations and their impact on each barrier (shown in
Fig. 6) have not yet been defined. This is addressed in
the following section.
 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126 119

5. Mapping the impact of operations on the barriers Table 2

The accomplishment of some operations activates or
disables the status of some barriers, whereas for several
other operations the status remains unmodified. This
mapping looks for the impact of each operation on each
barrier, i.e., it maps the change of the well barrier status
caused by the impact of each operation.
The mapping process can be described as follows:
1. Generate a list crossing all operations against all
barriers (Operations vs. Barriers).
2. Find the impact of the operation on the barrier for
each item mapped in step 1. The impact can be one
of the three options:
n Operation activates the barrier;
n Operation disables the barrier; or
n Operation has no impact on the barrier.
3. Eliminate all items with no impact in order to sim-
plify the list.
Note that an operation can impact more than one
barrier, and one barrier can be impacted by several
operations. The Operations vs. Barriers list generated
by this process is composed of 289 items, of which
224 items are about operations that activate a barrier
and 65 items are about operations that disable a barrier.
An important point is that only 45 of the 55 barriers
An example of offshore well workover plan
Sequence Operation
1 Moving rig
2 Setting back pressure valve
3 Nippling down X-tree and adapter spool
4 Nippling up and installing BOP
5 Pulling out back pressure valve
6 Pulling out of hole ESP and tubing
7 Running in hole electric submersible pump (ESP)
w/ tubing
8 Setting back pressure valve
9 Pulling out and nippling down BOP
10 Nippling up X-tree and adapter spool
11 Pulling out back pressure valve
12 Switching on electric submersible pump (ESP)
13 Retrieving standing valve w/ slickline from
tubing string
suffer some impact from operations. Some examples of
this list are shown in Table 1.
Using this list and updating it periodically should
provide the convergence to the correct relationships
between operations and barriers.
Thus, with the definitions and modeling technique
introduced in Section 3, the safety acceptance criteria
established in Section 4, the operations as mapped in
Section 5, and the impact of operations on barriers as
mapped in this section, we are now ready to address the
BIS quantifying algorithm.

6. The BIS quantifying algorithm

Table 1
Some examples of operation impact on barriers The BIS Quantifying Algorithm comprises the fol-
Operation Barrier State lowing steps:
BOP installing Wellbore-diverter Activated
BOP installing Wellbore-wellhead Activated 1. Establish the intervention plan with a sequence using
Cement squeezing Annular-casing Activated standardized operations.
overlap cemented
2. Define the intervention initial condition, i.e., map the
Cement squeezing Annular-cemented Activated
Cutting cement plug Wellbore-bottom Disabled status of all well barriers at the beginning of the
cement plug intervention.
Cutting cement plug Wellbore-cement Disabled
plugging of liner
Cutting cement plug Wellbore-surface Disabled Table 3
cement plug Activated barriers at beginning of workover in an offshore depleted
Killing the well Wellbore-workover fluid Activated well with X-tree and ESP installed
Perforating thru tubing Wellbore-casing Disabled
Barrier code Barrier name Status
Perforating w/ TCP String-drill pipe Activated
Perforating w/ TCP Wellbore-casing Disabled CMT_ANNULUS Annulus-cemented annulus Activated
Perforating w/ TCP Wellbore-operating packer Activated CMT_OVLAP_CSG Annulus-cemented Activated
Perforating w/ wireline Wellbore-casing Disabled overlapped casings annulus
Static level control Annular-natural barrier Activated CSG_HANGER Annulus-casing hanger Activated
with sonolog NATURAL_BARRIER Annulus-natural barrier Activated
Static level control Wellbore-workover fluid Activated TBG_HGR Wellbore-tubing hanger Activated
with sonolog WELLHEAD Wellbore-wellhead Activated
... ... ... X-TREE Wellbore-X-tree Activated
120 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126

3. Check barrier status changes after the accomplish-
ment of each operation included in the sequence
(step 1), using the operations vs. barriers list as
mapped in Section 5.
4. Compute the amount of active independent BISes
for each sequenced operation, using the BIS graphs
as mapped in Section 3.
5. Check whether all sequenced operations exceed the
safety threshold required by the acceptance criteria
as stated in Section 4.
a. Correct the operation sequence where it fails the
safety acceptance criteria, i.e., to change the oper-
ation sequence in such a way that safety acceptance
criteria are satisfied. This can be done by inserting,

Table 4
Disabled barriers at beginning of workover in an offshore depleted well with X-tree and ESP installed
Barrier code Barrier name Status
BH_PLUG String-bottomhole plug Disabled
BH_STV String-standing valve Disabled
BH_VALVE String-bottomhole valve Disabled
BHA_BPV String-floating valve on bha Disabled
BOP Wellbore-blowout preventer-bop Disabled
BRIDGE_PLUG_PERM Wellbore-permanent bridge plug Disabled
BRIDGE_PLUG_RECU Wellbore-retrievable bridge plug Disabled
CABLE_BOP String-cable bop Disabled
CABLE_LUBRICATOR String-lubricator Disabled
CASING Wellbore-casing Disabled
CMT_PLUG_BOTT Wellbore-bottomhole cement plug Disabled
CMT_PLUG_LINER Wellbore-liner top cement plug Disabled
CMT_PLUG_OH Wellbore-open hole isolation cement plug Disabled
CMT_PLUG_SURF Wellbore-surface cement plug Disabled
COILED_TBG String-coiled tubing Disabled
COMPLETION_FLUID Wellbore-completion fluid Disabled
CT_BOP String-coiled tubing bop Disabled
DRILL_STRING String-drill string Disabled
DRILLING_FLUID Wellbore-drilling fluid Disabled
EMERG_SHUTDOWN Wellbore-emergency shutdown Disabled
FI_VALVE String-formation isolation valve Disabled
Fluid_loss_ctrl Wellbore-fluid loss control Disabled
GAS_CIRCUIT Wellbore-gas circuit Disabled
GP_PACKER Wellbore-gravel pack packer Disabled
IBOP String-inside bop Disabled
LRP Wellbore-lower marine riser package Disabled
MARINE_RISER Wellbore-driiling marine riser Disabled
MUDLOGGING Wellbore-mud logging Disabled
OP_PACKER Wellbore-operation packer Disabled
PROD_PACKER Wellbore-production packer Disabled
S_HAZARD_BARRIER Wellbore-barrier against shallow hazards Disabled
SAFETY_HEAD Wellbore-safety head Disabled
SCSSVALVE String-surface controlled subsurface safety valve Disabled
SLIDING_SLEEVE String-sliding sleeve Disabled
SNUB_STRIPPER Wellbore-stripper Disabled
SOLID_REMOVER Wellbore-solid remover Disabled
SQZ Wellbore-cement squeezing Disabled
STRING String-production string Disabled
SUBSURFACE_TREE String-subsea test tree Disabled
SUMP_PACKER Wellbore-sump packer Disabled
SURFACE_DIVERTER Wellbore-diverter Disabled
SURFACE_TREE String-surface tree Disabled
TAIL String-production tail Disabled
TBG_HGR_PLUG String-surface plug Disabled
TBG_HGR_RT String-tubing hanger running tool Disabled
TOPDRIVE String-top drive Disabled
WO_BOP String-workover bop Disabled
XSJ String-expandable separation joint Disabled
 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126 121

BH_STV BHA_BPV BOP CMT_ANNULUS CMT_OVLAP_CSG CSG_HANGER NATURAL_BARRIER STRING TBG_HGR WELLHEAD X-TREE
before the critical operation which is failing the
safety acceptance criteria, one or more operations

1
1
0
0
0
0
0

0
0
1
1
1

1
that activate the necessary barriers.

With this BIS quantifying algorithm, the QDRA

approach is now complete. In the following section,

1
1
1
1
1
1
1

1
1
1
1
1

1
as a case study, the algorithm is applied to an offshore
well workover plan.

1
1
1
1
1
0
1

1
1
1
1
1

1
7. Case study: applying the QDRA approach to an
offshore well workover plan

1
1
1
1
1
0
1

1
1
1
1
1

1
In this case study, the BIS Quantifying Algorithm is
applied step by step to demonstrate the use of the
QDRA approach and its expected results.
The six steps of the algorithm are shown in the
topics below.

1
1
1
1
1
1
1

1
1
1
1
1

1
7.1. Establishing an offshore well workover plan

The operation sequence of the offshore well work-

over plan is shown in Table 2. This plan is used to do
1

1
1
1
1
1
0
1

1
1
1
1
1

1
workover intervention in an offshore depleted well with
X-tree and ESP installed.
Note that even though a workover plan is being
taken here as an example, the QDRA approach can
be used in any type of intervention, such as drilling,
1

1
1
1
1
1
1
1

1
1
1
1
1

1
formation evaluation, completion, suspension, or P&A.

7.2. Defining the initial condition of the chosen

intervention
Changes in barrier status after accomplishment of each sequenced operation

1
1
1
1
1
1
1

1
1
1
1
1

1
In this example, the initial condition for workover of
an offshore depleted well with x-tree and ESP installed
0

0
0
0
1
1
1
1

1
0
0
0
0

is shown in both the Table 3 (activated barriers), and 0

Table 4 (disabled barriers), i.e. the tables show the

status of all barriers at the beginning of the workover.
0

0
1
1
1
0
0
0

1
1
1
0
0

Tables 3 and 4 are generated by the list of whole

known barriers mapped for offshore well interventions.
This list is composed by 55 known barriers for three
0

0
0
0
0
0
0
1

1
1
1
1
1

known paths: annulus, wellbore, and string.

Nippling down X-tree and adapter spool

Nippling up X-tree and adapter spool

Running in hole electric submersible

Pulling out and nippling down BOP

Pulling out of hole ESP and tubing

Switching on electric submersible

7.3. Checking barrier status changes after the accom-

Nippling up and installing BOP
Pulling out back pressure valve

Pulling out back pressure valve

SEQ Initial condition and sequenced

Initial Condition: X-Tree and

ESP Installed. Depleted Well

plishment of each sequenced operation

Retrieving standing valve w/
Setting back pressure valve

Setting back pressure valve

slickline from tubing string

pump (ESP) w/ tubing

In this step, the impact of each sequenced operation

on the barrier status is checked, and results are shown in
pump (ESP)

Table 5. It is assumed that failure indexes are zero for

Moving rig
operations

all activated barriers (see Section 3.5), i.e., if a barrier is

in an activated status, the value is assumed to be 1.
Table 5

Table 5 shows the barrier status after accomplishment

10

12

13
11

of each sequenced operation based on impact of these

0

1
2
3
4
5
6
7

8
9
122 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126

operations, beginning with initial condition as stated in Table 7

first row (row N8 0). The barrier codes are in the columns List of known BISes
(see Tables 3 and 4 for their names). Each row is a BIS code BIS name
sequenced operation, starting with the initial condition DRL_NATURAL Drilling-natural barrier assembly
as defined in step 7.2. The cells with values 0 or 1 map DRL_SHALLOW_HZD Drilling-shallow hazard barrier
assembly
the barrier statuses according to the sequenced operation.
DRL_FLUID Drilling-fluid barrier assembly
The b1Q value means that the barrier is on active status, DRL_BOP_ASSY Drilling-bop barrier assembly
and b0Q value means that the barrier is on disabled status. PCD_OP_EQPT PCD-operation equipment
To simplify the table, only the activated barriers are DST_PRIMARY Formation evaluation-primary
displayed in this example. barrier assembly
CMP_FLUID Completion-fluid barrier assembly
CMP_LOWER Completion-lower barrier assembly
7.4. Computing the amount of active independent BISes CMP_UPPER Completion-upper barrier assembly
for each sequenced operation CMP_X-TREE_ASSY Completion-X-tree barrier assembly
WO_SNUBBING Workover snubbing-well control
These computations are based on BISes modeled as WO_CABLE_CT Workover slickline/wireline/
tractor/coiled tubing-well control
set graphs (Fig. 7) and using the Table 5 as input. The
X_ZONE_ISOLATION Abandonment-reservoir isolation
Table 6 shows the impacted BISes by the sequenced X_LINER_PLUG Abandonment-liner top plugging
operations used as example. X_BOTTOM_PLUG Abandonment-bottom plugging
The Table 6 shows the computed BIS statuses after X_SURFACE_PLUG Abandonment-surface plugging
accomplishment of each sequenced operation based on
set graphs which barrier statuses are inputs. The BIS
codes are in the columns (see Table 7 for their names), status. To simplify the table, only the activated BISes
and each row is a sequenced operation, starting with the are displayed in this example.
initial condition as defined at step 7.2. The cells with b0Q Table 7 shows all known BISes mapped for off-
or b1Q values map the BIS statuses according to the shore well. Applicable scenarios are drilling, pressure
sequenced operation. The b1Q value means that the controlled drilling (PCD), formation evaluation, com-
BIS is on active status and the b0Q value means that pletion, workover, suspension and plug and abandon-
the BIS is on disabled status. The last column (Amount ment. The first term of BIS names represents the
of BISes) shows the amount of BISes on activated scenario where they are applied, but this does not

Table 6
Changes in BISes statuses after accomplishment of each sequenced operation
SEQ Initial condition and sequenced DRL_NATURAL DRL_BOP_ASSY CMP_UPPER CMP_X-TREE_ASSY Amount
operations of BISes
0 Initial condition: X-Tree and ESP 1 0 1 1 3
Installed. Depleted Well
1 Moving rig 1 0 1 1 3
2 Setting back pressure valve 1 0 1 1 3
3 Nippling down X-tree and 1 0 1 0 2
adapter spool
4 Nippling up and installing BOP 1 1 1 0 3
5 Pulling out back pressure valve 1 1 1 0 3
6 Pulling out of hole ESP and tubing 1 1 0 0 2
7 Running in hole electric submersible 1 1 1 0 3
pump (ESP) w/ tubing
8 Setting back pressure valve 1 1 1 0 3
9 Pulling out and nippling down BOP 1 0 1 0 2
10 Nippling up X-tree and adapter 1 0 1 1 3
spool
11 Pulling out back pressure valve 1 0 1 1 3
12 Switching on electric submersible 1 0 1 1 3
pump (ESP)
13 Retrieving standing valve w/ 1 0 1 1 3
slickline from tubing string
K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126 123

Fig. 8. Main screen of graph editor.

Fig. 9. Input screen of barriers verifier.

124 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126

imply that these BISes are only applicable to that adequate safety degree. The next section presents
scenario. For example, the DRILLING-BOP BARRI- some software prototypes developed to support the
ER ASSEMBLY BIS is applicable to all scenarios. QDRA approach are presented.

7.5. Checking the sequenced operations against the 8. Prototype tools developed to support the QDRA
safety acceptance criteria approach

In this step one checks whether the amount of
BISes computed in step 7.4 (last row of Table 6)
exceeds the threshold established by the safety accep-
tance criteria.
As said in Section 4, a workover intervention should
have at least two BISes at each sequenced operation.
Therefore, there is no sequence to correct, and all
sequenced operations exceed the safety acceptance cri-
teria; it can be said that this workover plan has an
In Section 7 the use of the BIS quantifying algorithm
was demonstrated. According to the QDRA approach,
the workover plan has an adequate safety degree for each
sequenced operation. The procedure can be eased by
introducing some automation. Two prototypes were de-
veloped in this work, one for modeling the barriers and
BISes according to the bset graphQ technique, and anoth-
er for computing BIS quantity, according to BIS quanti-
fying algorithm. These prototypes are detailed below.

Fig. 10. Main screen of barriers verifier.

 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126
8.1. Prototype tool for modeling barrier and BIS
graphs
The first prototype developed to support the ap-
proach is a graph modeling tool named bGraph
EditorQ. Its main screen is shown in Fig. 8.
In Fig. 8, the Graph Editor interface is presented. It
allows graphically editing or modeling the set graph
for barriers and BISes. The red circles represent input
nodes, the blue circles represent the aggregation nodes
that can be translated as logic bORQ gate (with b+Q
icon) or bANDQ gate (with bd Q icon), and the green
circle represents the output node which is the result or
the conclusion of the set graph. The tool also allows
testing the navigation through the set graph,
performing the computations to check whether the
output node is activated or not, according to the values
assigned to each input node. When saved, the set
graph is stored in a database which is used by another
prototype for BIS quantifying computation.
8.2. Prototype tool to compute BIS quantity
Another computational prototype was developed in
order to compute the amount of independent BIS.
Named bBarriers VerifierQ, it allows the storage of the
list of operation impact on the barriers (Table 1), and
the editing and storage of the initial condition list
(Tables 3 and 4).
The bBarriers VerifierQ user interface screens are
shown in Figs. 9 and 10. In Fig. 9, the user can
either choose one of the typical initial conditions, or
create a new initial condition for the given interven-
tion. In the example, an initial condition named
bWet X-Tree and ESP installed. Depleted WellQ is
selected.
In the main screen of Barriers Verifier, shown in
Fig. 10, at the left frame the user may check, and
change if necessary, the barrier statuses in the begin-
ning of a given intervention (initial condition). At the
line box below the frames, the root and name of
intervention plan are specified as DRIVE:\ROOT\NA-
ME.txt, a file containing the sequenced operations of a
given intervention in text format. Clicking on the
execute icon (green triangle), the tool computes the
amount of BISes for each sequenced operation and the
frame bResultQ is filled out with the computations
result. It shows the operations in the same sequence
as in the original file and the amount of BISes at the
end of each line. The prototype saves the computation
results creating automatically a file with the original
name and the extension [*.sim.txt].
125
9. Conclusions
This work proposes the Quantified and Dynamic
Risk Assessment (QDRA), an approach based on the
concept of barrier integrated sets (BIS). The BIS mod-
eling uses the set graph technique, and allows quanti-
fication of the safety level according to the integrated
barriers existing between the system under consider-
ation and the environment.
With this approach, the bsafe job analysisQ can be
done at a planning stage of a given intervention, guar-
anteeing a quantified safety degree at each sequenced
operation (dynamic behavior).
Two computational prototypes support the QDRA
approach, facilitating the process by automating all
computations. They allow users to get the amount of
BISes for each sequenced operation, given the inter-
vention plan and initial conditions of all barriers.
The additional effort required by the QDRA ap-
proach consists of preparing the list of sequenced
operations for the intervention plan using standardized
names for the operations, and defining all barrier sta-
tuses at the beginning of a given intervention.
References
Accioly, R.M.S., Chiyoshi, F.Y., 2004. Modeling dependence with
copulas: a useful tool for field development decision process. J.
Pet. Sci. Eng. 44 (1–2), 83 – 91 (October 31).
ANP Technical Resolution 025, 2002. Brazilian National Petroleum
Agency, Technical Resolution #25/2002: Procedures for Oil and
Gas Abandonment. Rio de Janeiro, ANP, 06/mar/2002 (in
Portuguese).
CSEPH,, 1998. Fermeture des Puits Petroliers Recommandations.
CSEPH, France. Jan/1998.
Divi, Rao S., 2004. Probabilistic methods in petroleum resource
assessment, with some examples using data from the Arabian
region. J. Pet. Sci. Eng. 42 (2–4), 95 – 106 (April).
Holand, P., 1996. Offshore Blowouts, Causes and Trends, Trondheim,
Norway, Doctoral dissertation, Department of Production and
Quality Engineering, Norwegian Institute of Technology.
Holand, P., Jenssen, H.P., Molnes, E., Rye, H., Ramstad, S., Johansen,
Ø., Skognes, K., Lise, J., Resby, M., Hokstad, J.N., Berntsen, V.,
Larssen, C.-M., Vislie, G., Emilsen, M.H., 2004. Risk Analysis of
Subsea Wells Completed With or Without a Surface Controlled
Subsurface Safety Valve (SCSSV). ExproSoft AS, Trondheim,
Norway. 167 pp.
ISO 13628-1, 2003. Draft International Standard ISO/DIS 13628-1
Petroleum and Natural Gas Industries–Design and Operation of
Subsea Production Systems: Part 1. General Requirements and
Recommendations, ISO/DIS 13628-1. 218 pp.
ISO 13628-4, 2003. International Standard ISO 13628-4 Petroleum
and Natural Gas Industries – Design and Operation of Subsea
Production Systems: Part 4. Subsea Wellhead and Tree Equip-
ment, ISO/DIS 13628-4.
Miura, K., 1992. Offshore Well Completion Operational Knowledge
Acquisition and Structuring. Master dissertation, Petroleum Engi-
126 K. Miura et al. / Journal of Petroleum Science and Engineering 51 (2006) 111–126
neering Department, State University of Campinas, Brazil (in
Portuguese).
Miura, K., 2004. A Study on Safety of Construction and Repair in
Offshore Oil and Gas Wells.Doctorate thesis, Petroleum Engi-
neering Department, State University of Campinas, Brazil (in
Portuguese).
Moos, D., Peska, P., Finkbeiner, T., Zoback, M., 2003. Comprehen-
sive wellbore stability analysis utilizing Quantitative Risk Assess-
ment. J. Pet. Sci. Eng. 38 (3–4), 97 – 109 (June).
Morooka, C.K., Rocha, A.F., Miura, K., Alegre, L., 1993. Offshore
Well Completion Operational Knowledge Acquisition and Struc-
turing, OMAE-93-404, vol. I. Glasgow, OMAE 1993 Interna-
tional Conference on Offshore Mechanics and Artic Engineering,
pp. 371–398. 30 pp.
NORSOK Standard, bD-010: Drilling and Well OperationsQ, D010,
Rev. 2, Oslo, Norway, Norwegian Technology Standards Institu-
tion, Dec/1998. 55 pp.
Pedrycz, W., Gomide, F., 1998. An Introduction To Fuzzy Sets:
Analysis and Design. MIT Press, Cambridge, MA, p. 33.
Petrobras N-1860, 1998. Petrobras CONTEC, Commission of Tech-
nical Norms- Petrobras., N-1860, Rio de Janeiro, Petrobras, Dec/
1998 (in Portuguese).
Rike, J.L., Whitman, D.L., Rike, E.R., Hardin, L.R., 1993. Why
Workover and Drilling Well Control Needs Differ, Vol. 214,
Issue 11, World Oil, Nov., p. 39. 5 pp.
Ross, J.G., 2004. Risk and uncertainty in portfolio characterisation. J.
Pet. Sci. Eng. 44 (1–2), 41 – 53 (October 31).
Sachon, M., Paté-Cornell, E., 2004. Managing technology develop-
ment for safety-critical systems. IEEE Trans. Eng. Manage. 51.
Schiozer, D.J., Ligero, E.L., Suslick, S.B., Costa, A.P.A., Santos,
J.A.M., 2004. Use of representative models in the integration of
risk analysis and production strategy definition. J. Pet. Sci. Eng.
44 (1–2), 131 – 141 (October 31).
Schubert, J.J., Juvkam-Wold, H.C., Weddle III, C.E., Alexander,
C.H., 2002. HAZOP of Well Control Procedures Provides Assur-
ance of the Safety of the SubSea MudLift Drilling System, SPE
74482, Dallas, Texas, USA, IADC/SPE Drilling Conference.
Suslick, S.B., Furtado, R., 2001. Quantifying the value of technolog-
ical, environmental and financial gain in decision models for
offshore oil exploration. J. Pet. Sci. Eng. 32 (2–4), 115 – 125
(December 29).
Suslick, S.B., Schiozer, D.J., 2004. Risk analysis applied to petroleum
exploration and production: an overview. J. Pet. Sci. Eng. 44 (1–
2), 1 – 9 (October 31).
Takashina, N.T., 1989. The Reliability Barriers Concept in Petroleum
Wells. No. 32 (1/2), Rio de Janeiro, Technical Resolution, Petro-
bras, Jun/1989, pp. 59–66 (in Portuguese).
Tanaka, T., 1989. Evaluation of a dynamic reliability problem based
on order of component failure. IEEE Trans. Reliab. 38.
Ursin, J.R., 2000. Fault block modelling—a material balance model
for early production forecasting from strongly compartmentalised
gas reservoirs. J. Pet. Sci. Eng. 27 (3–4), 179 – 195 (September).
van der Poel, R., Jansen, J.D., 2004. Probabilistic analysis of the value
of a smart well for sequential production of a stacked reservoir. J.
Pet. Sci. Eng. 44 (1–2), 155 – 172 (October 31).
Walls, Michael R., 2004. Combining decision analysis and portfolio
management to improve project selection in the exploration and
production firm. J. Pet. Sci. Eng. 44 (1–2), 55 – 65 (October 31).
Yeten, B., Brouwer, D.R., Durlofsky, L.J., Aziz, K., 2004. Decision
analysis under uncertainty for smart well deployment. J. Pet. Sci.
Eng. 44 (1–2), 175 – 191 (October 31).
Yeten, B., Brouwer, D.R., Durlofsky, L.J., Aziz, K., 2004. Decision
analysis under uncertainty for smart well deployment. J. Pet. Sci.
Eng. 43 (3–4), 183 – 199 (August).
Yu, J.P., Zhuang, Z., Kumar, K.H., Watts, R.J., 1990. A simulation
approach in economic assessment and risk analysis of the CO2
miscible flooding process. J. Pet. Sci. Eng. 4 (4), 359 – 374
(September).
Zabalza-Mezghani, I., Manceau, E., Feraille, M., Jourdan, A., 2004.
Uncertainty management: From geological scenarios to produc-
tion scheme optimization. J. Pet. Sci. Eng. 44 (1–2), 11 – 25
(October 31).