Close Loop System Enak Grayson2012
Close Loop System Enak Grayson2012
Copyright 2012, SPE/IADC Managed Pressure Drilling and Underbalanced Operations Conference and Exhibition
This paper was prepared for presentation at the SPE/IADC Managed Pressure Drilling and Underbalanced Operations Conference and Exhibition held in Milan, Italy, 20–21 March 2012.
This paper was selected for presentation by an SPE/IADC program committee following review of information contained in an abstract submitted by the author(s). Contents of the paper have not been reviewed
by the Society of Petroleum Engineers or the International Association of Drilling Contractors and are subject to correction by the author(s). The material does not necessarily reflect any position of the Society of
Petroleum Engineers or the International Association of Drilling Contractors, its officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written consent of the
Society of Petroleum Engineers or the International Association of Drilling Contractors is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may not
be copied. The abstract must contain conspicuous acknowledgment of SPE/IADC copyright.
Abstract
The greatest risk to operational safety during the drilling and completion of a well is a kick. A gas influx, with its potential
for escalation into well control event, places the crew, the environment and the rig in imminent danger.
The second greatest risk is misdiagnosis of an event and the failure to quickly and correctly take action.
For kicks and other pressure related events, the question is often fundamental—“are we experiencing losses or is the well
ballooning during a connection”? The answer can be critical. An incorrect decision based on a misdiagnosed situation can
result in millions of dollars in non-productive time (NPT). In the extreme, incorrect diagnosis can lead to death and injury,
environmental damage and the loss of the rig.
These risks to well control and drilling efficiency are being mitigated using a handful of common oilfield technologies that
are the key elements of closed-loop circulating system—rotating control devices (RCDs), flow-metering technologies,
automated drilling choke systems and downhole isolation valves.
This is truly an instance of the whole being greater than the sum of the parts. That value is being further enhanced through the
integration of innovative analysis and management software. These closed loop systems have proven very successful in
mitigating risk and improving economics across a wide range of land and marine drilling applications and are allowing the
industry to safely tackle it’s most risk-laden and costly wells.
The elements are field proven—some with more than a 40-year history—readily available from numerous vendors and are
relatively economical. Individually they add incremental safety and efficiency benefits. However, when these elements are
paired or used in combination with each other to create a closed and pressurizable mud-returns system, the benefits escalate
at an exponential rate.
This paper examines the basics elements of a closed-loop circulating system and how this technology is enhancing the safety
and efficiency of drilling and completion operations without sacrificing other operational elements.
A Costly Problem
Wellbore instability and the resulting drilling hazards are a major source of risk to the safety, operations and economics when
drilling and completing wells. York et al analyzed non-productive time (NPT) in Gulf of Mexico deepwater operations
resulting from stuck pipe, well control and fluid loss. (York et. al, 2009) In non-subsalt wells the report found these hazards
accounted for 5.6% of total well time and 31% of total NPT. In subsalt wells the metric doubled to 12.6% of total well time
and 41% of NPT. (Figure 1) In a well of 20,000 ft MD, extrapolated losses in 2009 were equated to $2,500,000 and
$7,660,000 respectively. These metrics do not include the total well failures resulting from drilling hazards. A more recent
study shows that in the GOM, pressure related events such as kicks, lost circulation and stuck pipe make up 48% of incidents
when drilling conventionally. (Figure 2)
2 SPE/IADC 156893
Standard Mitigation
Reducing or eliminating drilling hazards has been a complex and frequently difficult objective. Achieving it first requires the
application of best practices in both well planning and management stages. These best practices are typically focused on
managing the drilling margin or window between the lowest equivalent circulating density (ECD) required to ensure safety,
wellbore integrity and drilling efficiency, and the highest ECD achievable without resulting in fluid loss or fracturing of the
formation.
But application of best practices is often not a sufficient response. Drilling hazards are commonly induced by actions taken
unnecessarily or inappropriately when wellbore dynamics within narrow drilling margins are incorrectly interpreted or simply
not recognized. Successful mitigation depends on recognizing, interpreting and integrating multiple dynamic factors while
drilling, including flow, equivalent circulating density (ECD), weight on bit, RPM, etc.
SPE/IADC 156893 3
A broad range of relevant drilling applications further complicates this process. Narrow drilling margins between pore
pressure and fracture gradient occur in many operational environments, from high pressure, high temperature (HPHT) wells,
to lack of sediment compaction in offshore wells, and reservoir depletion in mature fields. (Pritchard, et. al., 2003) Each of
these applications brings with it unique conditions that must be considered to optimally mitigate drilling hazards.
This presents a difficult quandary. To avoid a major event, drillers must often make immediate well control decisions based
on a very incomplete understanding of ongoing wellbore dynamics. But failure to respond correctly can exacerbate the
problem and in the worse case scenario, precipitate a major well control event.
Not only is the information about what’s occurring downhole limited, so is the means of response. Conventional well control
philosophy in an open loop system is comprised of primary well control, such as the fluid program and casing design, and
secondary control consisting of the BOP system and procedures.
Neither promotes a nuanced response to complex wellbore dynamics. The scope and effectiveness of available best practices
are thus constrained. In fact, this reactive response and control system is relatively imprecise, costly and risky.
The change from an open to closed system is a relatively simple step that contains and directs the returning annular flow to
create a pressurizable loop. While simple, it initiates a watershed change in well control capabilities.
The fundamental device used to create a closed loop system has been used on rigs for decades. Rotating control devices
(RCD) were innovated in air drilling operations where they directed cuttings and dust away from the rig floor via a blooey
line. The same safety advantage contributed to early adoption by fluid-circulating rig systems—in the event of a kick or
blowout, gas and fluid isn’t ejected under the rig floor.
Current RCD technology includes specialized devices for land and a full scope of marine applications. Onshore and from
fixed platforms, RCD are mounted atop the BOP. On floating systems, subsea Below the Tension Ring (BTR) RCD are
integrated with the riser system to close the circulating loop.
These RCD applications have a significant affect on well control results. In 2010, University of Texas at Austin researchers
statistically linked RCD use with reducing well control events. Jablonowski et al. found “consistent statistical evidence,
across a variety of regression models and variable specifications, that the use of RCDs decreases the incidence of blowouts.”
Barriers in Layers
The contrast between conventional well control and well control in a closed loop system is expressed in a pair of bow tie
diagrams. In Figure 3, causes of a hydrocarbon influx are identified—shallow gas, a kick, loss circulation and gas cut mud. In
conventional well control, the operator attempts to identify, and design for these conditions with casing, fluids, etc. Failure of
these plans can lead to a well control event such as an influx. To prevent the consequence of the influx—a blowout—
mitigation efforts are initiated. In a conventional circulating system that is open to the atmosphere, the options are limited to
mud remedies or closing the BOP.
4 SPE/IADC 156893
A closed-loop system adds new layers of options to both the prevention and mitigation sides of the diagram. (Figure 4) To
prevent an influx, CLD adds real-time data for early event detection and identification. Annular pressure control provides a
means of proactively managing pressure variations (e.g. transitioning between pumps-on and pumps-off) to prevent them
from developing into a well control event. Continually monitoring and capturing data also provides feedback for updating
pore pressure predictions on the fly, and for modeling future well designs.
Should an influx occur, a CLD system provides a greater degree of mitigation finesse ahead of closing BOP. The simple
addition of an RCD greatly enhances crew and rig safety by diverting any returns away from the rig floor. Sour gas or a
blowout, an RCD provides a fundamental improvement without any changes to conventional rig operations. Automated
control of an influx using MPD methods applies annular backpressure to mitigate the influx and enable controlled circulation
out of the wellbore. Both of these mitigation options enhance and supplement traditional control with methods that can be
applied early, effectively and with much less disruption and cost than traditional means.
In examining offshore safety, a DNV white paper (Pitblado, et. al.) supports and complements recommendations for a more
systematic approach to safety and the environment made by the U.S. Department of the Interior. (2010, Increased Safety
Measures) The authors note that while simple in concept, the importance of asking critical questions in the analysis of what
can go wrong is often underestimated. This analysis must be undertaken from a holistic perspective and from a detailed
perspective on technology, people and organization.
Two risk models are described: one for the safety case during the planning stage and one for the operations stage. The
planning model includes “quantified risk assessment (QRA) that uses detailed engineering studies and human performance
models to identify all risks and identify how they are prevented and, if an event occurs, mitigated.” This should include not
only a traditional topside focus on fire and explosion but environment and downhole related risk.
Operations risk management drives this information in the process and safety culture. This documentation typically includes
a qualitative barrier diagram or Bow Tie (described previously) and an operational version of the QRA.
Figure 5. Example of holistic, quantitative risk model for offshore installation (DNV)
Further DNV work in this area developed a Fault Tree Analysis addressing conventional well control. (Torstad, 2010) In a
quantitative risk evaluation, Fault Tree Analysis is employed to create a relational hierarchy of events. A fault tree or logic
diagram that shows events, and the likelihood or the probability of those events that must occur in order for other events to
occur describes the probability of a drilling event. (Figure 5)
Torstad observed that quantitative risk analysis for well control should consider a wide range of specific factors, such as the
type of technology that is used, how it is applied as a barrier, its reliability, redundancy types, and well and reservoir
characteristics. Human factors are also a key consideration and may include such variables as the type of activities being
conducted, and time of day and the environment that the activities are carried out.
The DNV fault tree is shown in Figure 6. In Figure 7, Weatherford has added MPD to the Loss of Primary Barrier
probabilities on the left side of the tree. In this probabilistic risk analysis, the conventional well control system was assigned a
probability of failure of 0.000164 or 1 in 61,000. A closed loop MPD system was 0.000000346 or 1 in 286,500. This equates
to a factor of difference of 469.
This major reduction in risk is particularly significant for deepwater drilling. In these operations, greater technical challenges
may increase the probability of an incident. Cohen (2011) examined the relative risk of deepwater drilling using data from
over 3,000 fixed platforms in the GoM and found that ultra deepwater production is more complex and riskier. For example,
the move from 500 to 5,000 ft water depth increases the annual probability of a reported incident from roughly 10 to 70
percent. The study notes that this finding reinforces the suspicion that drilling at increased depths results in greater technical
challenges and, therefore, may require novel approaches to industry operation and government regulation.
6 SPE/IADC 156893
Boolean algebra operations are used to describe the relationship of the event probabilities. For independent events an AND-
gate is calculated as:
Probability of Failure = P(A)*P(B)*..P(N) where P(X) are the individual event probabilities of failure
Probability of Failure = P(A)+P(B)+..P(N)-(P(A)*P(B)*..P(N)) where P(X) are the individual event probabilities of failure
The fault tree created by Torstad (Figure 1) describes the path to a blowout using a conventional system. This assessment of
the probability of losing well control (P=1.64E-4) is 0.000164 or 1 in 61,000. This is arrived at by determining the probability
of two other events—loss of the primary barrier (P=2.70E-1) and loss of the secondary barrier (p=6.06E-4). As described by
Gate 0, if primary (mud control) AND secondary barriers (BOP) fail, the result is a blowout.
For the primary barrier to fail, any of several events may occur—kick, swab OR loss circulation—each with its own
probability. Secondary barrier failure also passes through an OR gate: either the BOP control system fails OR the equipment
fails. For an equipment failure to occur, ram 1 AND ram 2 must fail.
Of course, human reliability also plays a significant role this analysis. Humans interact with equipment during operations,
accident response, system monitoring, and maintenance. (Sandia, 1983) These interactions can help mitigate an event (via
recovery and control actions), and initiate events through errors. For this Human Error Probability (HEP) assessment, the
HEP is based on a trained and skilled operator following procedural steps to diagnose and react to a situation or an event.
The values are based on studies in nuclear power plants under abnormal situations. In these studies the human element was
identified as an overriding contributor to system failures compared to other system components.
In this study of drilling operations, the HEP for a planned, controlled action such as a formation integrity test (FIT) or leak-
off test (LOT) is based on the operator having ample time for a diagnosis and reaction. In Figure 9 depicting failure
probability in a closed loop MPD system, the HEP for a 60 second response is 1.0E-3 for Event 7 (E7) and Event 9 (E9). For
an unplanned action (such as detection and reaction to a low volume, low rate kick that may fall under the parameters set for
an automated MPD system, and thus require a human response) a diagnosis and reaction time of 30 seconds has an HEP of
1.0E-2 for Event 10 (E10). In this example, the MPD control system includes electronic components such as sensors,
connectors, wiring. Probability of failure for E8 (Event 8)is assumed to be the same as a BOP control system probability of
failure per DNV data.
Software failure is not included in this analysis because its probability is low compared to human, hardware and control
system failure. While there is no accepted modeling of software reliability, lab and field testing does tend to prove reliability.
Reliability is also enhanced because, unlike hardware and instruments, it does not degrade with use.
In the closed system depicted in Figure 9, the probability of failure is described by the failure to correctly identify pore
pressure and fracture gradient. Failure to identify pore pressure in a FIT while drilling occurs when the operator fails to
follow procedures (P=1.00eE-3) OR the lower probability that the MPD control system fails (P=1.00E-4). The same
8 SPE/IADC 156893
probabilities occur for failure to identify fracture gradient during a LOT while drilling.
Figure 10 depicts the ability of the MPD system to diagnose and mitigate an influx based on the combination of HEP, MPD
control system and the hardware system to represent the overall MPD system reliability. Due to the similarity of the
equipment, control and hardware system failure probability is assumed to be the same as the DNV data on conventional well
control equipment control and hardware system.
Combining these probabilities provides a fault tree for comparison with a conventional system. (Figures 1 and 2) In Figure 2,
primary control is achieved with CLD/MPD methods while the secondary control is achieved with the BOP system.
The probability of a blowout is significantly reduced because it is based on the loss of both primary AND secondary barriers.
While the secondary barrier probability remains at 6.06E-4, loss of the primary barrier has a probability of only 5.75E-4
versus the conventional system where P=2.70E-1.
The lower chance of losing the primary barrier loss is based on the probability that a kick occurs (P= 5.42E-2) AND that the
MPD system fails to control the kick (P=1.06E-2). The kick probability is based on the probability of an influx OR a loss OR
a swabbed influx. There is a much higher probability of a swabbed influx (P=5.40E-2) initiated by pipe movement. There is a
lower chance of an influx or loss because two failures must occur together to initiate the event. An influx requires an
unanticipated pore pressure (P=1.89E-1) AND a failure by the MPD system to identify it (P=1.10E-3). Similarly, a loss
requires a loss of circulation and a failure of the MPD system to identify the fracture gradient.
This information travels equally well from the wellbore to the surface. A closed system thus provides not only control but
also a rich source of high-resolution data. Precise pressure and mass flow information is acquired in seconds while volume
variations measured in gallons can be detected almost immediately. These unique measurements of microfluxations in the
wellbore fluid column (obtainable while circulating, drilling, tripping, making connections and stripping) are precursors to
kick and loss events. This information, along with its speed and quality, enables a much more effective mitigation response
far in advance of a critical well event.
Real-time analysis of the data is done with a “Microflux” analysis and control system that applies proprietary algorithms to
the flow and pressure data. The system acquires data from multiple sources and characterizes it to provide real-time, high-
resolution information about wellbore dynamics. (Figure 12) On a fixed rig it has detected kicks at just 0.25 bbl of influx. On
a floating drilling unit, where vessel movement had introduced a 25 bpm peak-to-peak variation, a kick was detected at less
than 3 bbl influx.
Figure 12. Microflux screen capture shows the detection and control of an influx using the closed loop system
10 SPE/IADC 156893
Easily scaled from monitoring to early kick and loss detection and sophisticated wellbore control and management, CLD
provides a highly versatile platform for addressing some of the industry’s most perplexing drilling challenges.
Monitoring. The most basic configuration consists of an RCD to create a closed loop, pressurizable circulation system and
the control system to monitor the well. Pore pressure, equivalent circulating density (ECD) and swab/surge pressure can be
measured while drilling and making connections. Mud weight can be managed more effectively during tripping operations
and to detect pipe washouts and surface leaks.
Early Kick/Loss Detection. EKLD and management provide detection and automated management of minute pressure
fluctuations to prevent kicks and the development of kick/loss cycles.
Ballooning Interpretation. A key aspect of EKLD is the ability to differentiate between an impending kick and other
wellbore dynamics such as ballooning or shale gas. Wellbore ballooning, breathing or micro-fracturing readily demonstrates
the advantage of a closed loop system. Correct interpretation of ballooning is critical because the dynamic is a common factor
in the development of hazards. York et al notes in their analysis of instability and NPT that wellbore ballooning acerbated all
stuck pipe, well control, and fluid loss events.
Ballooning is experienced when mud that has been forced into the formation while pumping is returned to the wellbore when
pumps are turned off (as when making a connection). Within an open loop system it is very easy to misinterpret this flowback
as a kick. The situation may be further complicated by the wellbore release of gas in stringers or entrained in the drilled
shale—shale gas.
There are few options available to the driller when an apparent influx is indicated by return flow with pumps off. The risks
presented by a kick are so great and control options so limited that a well control response must be considered immediately.
The decision is complicated by the cost of a false diagnosis. Weighting up the mud system to mitigate a misdiagnosed kick
runs the risk of overbalancing the hole and initiating a loss. The event can dissolve into a cycle of kicks and losses consuming
days of lost time and millions of dollars, harming formation productivity, and potentially the loss of the well.
Riser Gas. Deepwater drillers face a similar situation with riser gas. Riser gas occurs when gas is released from cuttings or
the mud itself with reduced hydrostatic pressure as fluid circulated up from great depths. Released in the relatively low-
pressure environment of the riser, the gas presents an immediate risk to personnel, the environment and the rig. Because it
occurs in the riser, it is above the BOP and too close to the surface for an effective mud response. Misinterpreted as a kick, it
may nevertheless initiate a well control response. However, the insight and control afforded by a closed loop system provides
a unique means to identify, manage and circulate the gas out of the riser.
Managed Pressure Drilling. In a study by the official publication of the International Association of Drilling Contractors,
MPD was ranked second only to horizontal and directional drilling as being most influential to drilling/completion over the
next 20 years.
This control, either manual or automated, opens a toolbox of methodologies for proactively managing wellbore and riser
pressures ahead of conventional BOP and mud responses. Two commonly applied methods are constant bottom hole pressure
(CBHP) and pressurized mud cap drilling (PMCD).
CBHP is used to precisely manage extremely narrow drilling windows between pore pressure and fracture gradient. This can
be achieved with pumps on or off. While the term refers to bottom hole pressure, it is actually the narrowest aspect of the
window that must be managed and may not occur at the bottom of the hole but up-hole in a previously drilled section. This
“pivot point” is the critical balancing point for the wellbore where too much or too little pressure can result in an influx or
loss. The ability to define, monitor and manage dynamics within this critical portion of the open hole is key to differentiating
between ballooning and a kick, and avoiding the initiation of a kick/loss cycle.
PMCD provides the means to mitigate a total loss of fluids to the formation. This capability was matured in the Asia Pacific
region in vuggy carbonate formations that were previously impossible to drilling with a conventional open circulating
SPE/IADC 156893 11
system. The methodology places and maintains an annular mud cap that intentionally directs seawater pumped down the drill
pipe into the formation as a sacrificial fluid, along with cuttings. No returns are desired and PMCD only operates in a
wellbore experiencing total loss wellbore. The MPD system allows easy changeover between CBHP and PMCD, as
conventional drilling methods.
Case Histories
There are many field examples of how CLD is providing advantages that contrast with the difficulties experienced using
conventional open loop systems. Three recent applications are summarized below.
UK North Sea
In drilling a North Sea HTHP well in the Elgin/Franklin field area, MPD methods helped reach TD approximately 75 days
ahead of plans based on trouble with conventionally drilled offset wells. In the process, the MPD application successfully
handled five separate influxes over nine days to facilitate a fast resumption of drilling. A liner section was also eliminated. A
key aspect of the success was the ability to drilling through abnormally pressured formation layers by manipulating
backpressure to achieve dynamic mud weight management rather than the time and cost of conventional mud weight
changes. (Bouvet et. al.)
Some offset wells had been abandoned or side tracked. Others required contingency liners to reach TD. Challenges drilling
these offsets included:
• Inadequate mud management due to depleted and over-pressured zones
• Narrow drilling margins with influx and losses
• Differential sticking
• Nuisance gas
Safety and well control were enhanced using the closed loop system to quickly identify when drilling moved into high-
pressure, low-volume gas stringers. The system was then used to quickly and safely process the kick. Efficiency was
increased by not having to go through a conventional open loop mitigation process of circulating the kick out of the wellbore.
Indonesia
Closed loop drilling helped to drill a deepwater Indonesia exploratory well where pore pressures and fracture gradients were
not well understood. In addition to drilling the well successfully, the MPD system mapped the pressure profile while drilling
in the carbonate formation with pore pressure and dynamic leak off tests. (Nas, 2011)
Early in the drilling process the MPD system detected a 2 bbl and successfully mitigated the influx. The upper part of the
structure was drilled using CBHP methods and experienced no losses. Deeper in the hole losses began to occur and as they
become total, the MPD system was transitioned to PMCD methods and the well was drilled to TD.
The application aboard a drillship in 3,400 ft of water was the industry’s first use of a submerged RCD. The Weatherford
Model 7875 RCD was installed below the tension ring as an integral riser component.
The primary reason for using MPD was to avoid well breathing problems while maintaining an overbalanced wellbore. A key
objective was setting the 9 7/8-in production-casing shoe as close to the reservoir as possible, facilitating drilling of the 8 ½-
inch section to TD within a very narrow 0.4 ppg drilling window. The 8 ½-inch hole facilitated an optimal formation
evaluation program and drill stem test.
An estimated five days was saved compared to a conventional system by controlling gas influxes and precisely weighting up
the mud system. Time was saved by not having to circulate gas out of the hole due to ballooning incidents. Ballooning issues
when making connections were mitigated by eliminating the time required to circulate the gas out of the hole. The MPD
system accurately determined pore pressure without the need for wireline tools, even during a sudden rise from 17.5 to 18.6
ppg.
12 SPE/IADC 156893
Conclusions
Closed loops systems build new barriers to costly well control events through layers of prevention and mitigation. Prevention
is achieved with greater wellbore visibility that provides accurate, real-time measurements of wellbore pressure dynamics,
and enables real-time FIT and LOT to determine actual pore pressure and fracture gradient.
The simple addition of an RCD enhances safety by directing flow way from the rig floor. Automated control of annular
backpressure provides advanced mitigation by precisely managing small influxes and losses before they escalate.
Industry experience clearly shows closed loop systems and MPD methodologies have a significant capability to identify and
mitigate common wellbore dynamics before they become well control events. This reduced risk is also described by simple
probabilistic analysis showing that MPD may reduce the overall risk of a blowout by almost 500%.
Achieving this degree of risk reduction with a few simple changes to the circulating system enables drilling in even greater
extremes with a new degree of safety and efficiency.
Acknowledgments
The author thanks Weatherford management for their support and permission to present this paper.
References
“Increased Safety Measures for Energy Development on the Ouster Continental Shelf “ 2010 U.S. Department of the Interior, Bureau of
Ocean Energy Management, Regulation and Enforcement
Bouvet, A., et al., “Case Study: Effective Use of Automatically Monitored Managed Pressure Drilling to Achieve Significant Reductions in
Non Productive Time in the North Sea,”
Brantly, J.: “The History of Oil Well Drilling,” Gulf Publishing Company, 1971
Cohen, M., “Deepwater Drilling: Recommendations for a Safer Future,” Resources Magazine, 177, 2011, Resources for the Future.
http://www.rff.org/Publications/Resources/Pages/Deepwater-Drilling-Recommendations-for-a-Safer-Future-177.aspx
Jablonowski, C. and Podio, A., “The Impact of Rotating Control Devices on the Incidence of Blowouts: A Case Study for Onshore Texas,
USA,” SPE 133019
Malloy, K.: Drilling Engineering Association JIP 155 “A Probabilistic Approach to Risk Assessment of Managed Pressure Drilling
Offshore,” February 2004.
Nas, S., “A Legend Embraces Deepwater MPD Technology in Indonesia,” E&P Magazine, Hart Publishing, February 2011
NASA 2002, “Fault Tree Handbook with Aerospace Applications,” NASA office of Safety and Mission Assurance
Naesheim, S., et al. : “How MPD with Advanced Flow Detection System was Successfully Applied on an eHPHT Well in the
Norwegian North Sea,” paper OTC 21682 presented at, 2011OTC, Houston, Texas, May 2-5
Pitblado, R. , Bjerager, P., and Andreassen, E.: “Key Aspects of an Effective U.S. Offshore Safety Regime” DNV White paper, July 2010.
http://www.dnvusa.com/Binaries/1008-001%20Offshore%20Update_Key%20aspects_tcm153-430982.pdf
Pritchard, D., Tochikawa, T., Doi, E.: “Achieving the Technical Limit: An Engineering Targeted Approach,: paper AADE-03-NTCE-54
presented at the 2003 American Association of Drilling Engineers Conference, Houston, Texas, 1–3 April.)
Sandia National Laboratories, 1983,: NUREG/CR-1278 “Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plan
Applications,” Office of Nuclear Regulatory Research, U.S. Nuclear Regulatory Commission
Torstad, E.: 2010 DNV presentation, “Closed Loop Systems Reduce the Probability of Loss of Well Control,” Sept 30.
York, P., Pritchard, D., Dodson, J., Dodson T., Rosenburg, S., Gala, D. and Utama, B.: “Eliminating Non-Productive Time Associated with
Drilling Trouble Zones,” paper OTC 20220 presented at the 2009 Offshore Technology Conference, Houston, Texas, May 4-7
Pan, J.: “Software Reliability,” 18-849b Dependable Embedded Systems, Carnegie Mellon University, Spring 1999