Risk Assessment and Reduction for an Innovative Subsurface Well Completion System

: In recent years, many oil and gas ﬁelds have been discovered in ultra-deep sea (UDS). Some of these ﬁelds are evaluated to have no commercial value if existing oil ﬁeld development approaches are used, especially while the oil prices remain low. A new alternative ﬁeld development solution, termed as Subsurface Well Completion (SWC) system, is proposed with the aim to produce oil and gas in a cost-effective manner in UDS. This system primarily consists of four parts: a tethered of SSP, rigid risers and SWC equipment provides ﬂexibility to the installation schedule.


Background
In recent years, hundreds of UDS oil and gas fields have been discovered. Some of these fields are evaluated to have no commercial value using existing conventional oil field development approaches [1] (dry tree units or subsea developments, or a combination of both [2]), especially while oil prices remain low.
In this context, the STLP system concept [3,4], as illustrated in Figure 1, is proposed and can be regarded as a subsurface development, which is a totally new oil field development approach. The STLP facility aims at producing oil and gas in a cost-effective manner in UDS and primarily consists of four parts: a tethered subsurface Sea-star platform (SSP), rigid risers, SWC equipment and flexible jumpers. The top of SSP is positioned some distances below Mean Water Level (M.W.L) to minimize the effects of direct loads from waves and strong surface currents.
With respect to the new SWC technology, shallow-water rated X-mas trees are installed on top of the subsurface wellheads while shallow-water rated flexible jumpers are used to connect these X-mas trees to the Floating Production Unit (FPU). The following key advantages of the STLP facility in UDS [5,6] are envisaged: (1) In place riser fatigue is low due to the location of SSP away from the wave zone.
(2) Compared with the conventional dry tree production vessels, light weighted FPU can be considered in service as the SWC equipment, rigid risers and SSP are all decoupled from the FPU motions. (3) Direct access to local subsea wells is provided, and thus demanding flow assurance requirements can be met. (4) Field layout is optimized and allows large offshore developments and unforeseen future field expansion, as a large number of subsurface wells can be supported. (5) Shallow-water rated SWC technology offers improved technical and commercial performance in UDS. (6) Pre-installation of SSP, rigid risers and SWC equipment provides flexibility to the installation schedule.

Background
In recent years, hundreds of UDS oil and gas fields have been discovered. Some of these fields are evaluated to have no commercial value using existing conventional oil field development approaches [1] (dry tree units or subsea developments, or a combination of both [2]), especially while oil prices remain low.
In this context, the STLP system concept [3,4], as illustrated in Figure 1, is proposed and can be regarded as a subsurface development, which is a totally new oil field development approach. The STLP facility aims at producing oil and gas in a cost-effective manner in UDS and primarily consists of four parts: a tethered subsurface Sea-star platform (SSP), rigid risers, SWC equipment and flexible jumpers. The top of SSP is positioned some distances below Mean Water Level (M.W.L) to minimize the effects of direct loads from waves and strong surface currents.
With respect to the new SWC technology, shallow-water rated X-mas trees are installed on top of the subsurface wellheads while shallow-water rated flexible jumpers are used to connect these X-mas trees to the Floating Production Unit (FPU). The following key advantages of the STLP facility in UDS [5,6] are envisaged: (1) In place riser fatigue is low due to the location of SSP away from the wave zone.
(2) Compared with the conventional dry tree production vessels, light weighted FPU can be considered in service as the SWC equipment, rigid risers and SSP are all decoupled from the FPU motions. (3) Direct access to local subsea wells is provided, and thus demanding flow assurance requirements can be met. (4) Field layout is optimized and allows large offshore developments and unforeseen future field expansion, as a large number of subsurface wells can be supported. (5) Shallow-water rated SWC technology offers improved technical and commercial performance in UDS. (6) Pre-installation of SSP, rigid risers and SWC equipment provides flexibility to the installation schedule.

Motivation and Objective
Aiming to drill deep sea exploration and appraisal wells, China Oilfield Services Ltd. (COSL), as the major offshore oilfield service company in China, selected two ways stepping into deep sea [7]. One way is to build a totally new deep-water semi-submersible and the other way is to modify existing semi-submersibles to the deep-water drilling rigs. As it would take a long time to construct a totally new deep-water semi-submersible, COSL finally decided to utilize proper facilities for improving existing semi-submersibles' drilling capacity at various water depths. Be aware of the attractive technical features of subsurface wells in deep water, COSL has, since June 2004, carried out a series of laboratory tests and sea trials to prove the technical feasibility of the subsurface well for deep-water drilling activities based on the Artificial Seabed Deep-water Drilling system (ASDD system) [7][8][9][10]. Large trial subsurface well operations had been performed in the South China Sea (SCS) in the period of 2008 to 2009 with successful results. Nevertheless, ASDD technology is still not field proven and its safety is questioned [1]. In 2011, Dalian University of Technology (DUT) initiated related research activities to further develop the subsurface well technology in UDS. Then, a new STLP system concept was proposed and developed. The STLP facility utilizes the new SWC technology and meets large offshore developments successfully as a large number of subsurface wells can be supported. It is noted that central to the evaluation of both the ASDD and STLP facility is the question of risk in relation to the subsurface well application. In the light of this, a study of the subsurface well safety in drilling, completion, production, workover, and abandonment activities was carried out by DUT in collaboration with the Norwegian University of Science and Technology (NTNU).
An uncontrolled release of hydrocarbons to sea, which may have catastrophical consequences involving personnel risk, environmental damage and economic loss, is a main contributor to the total risk and of great concern to the offshore petroleum industry. The main objective of this paper is to propose and apply a QRA framework [11] for such uncontrolled releases to sea in the production phase with regard to the SWC system of the STLP facility. The paper hence deals with the identification of the area or the equipment that needs further improvements. Moreover, the corresponding risk reduction measures are focused in order to improve the safety of the present SWC system.

Structure of the Paper
The content of this paper is structured as follows: Section 2 describes the main characteristics of the studied SWC system in the STLP facility. In Section 3, appropriate RAC incorporating the environmental risk acceptance criteria (ERAC) and commercial risk acceptance criteria (CRAC) are established. Section 4 identifies typical scenarios representing uncontrolled releases to sea for the specific SWC system. In Section 5, the overall risk model is developed. The probabilities and consequences associated with each of the risk sub-models are investigated. Section 6 evaluates the calculated risks against the established RAC. In addition, recommended risk reduction measures are proposed. Section 7 carries out the uncertainty assessment while the critical topic for further research is also suggested. Conclusions are summarized in the final section.

SWC System Characteristics
The main characteristics of a SWC system are described in this section. In particular, the SWC process and the specific subsurface well configuration in the production phase are introduced. The aim is to define and establish boundary conditions for the QRA of the SWC system. The design basis is presented for the further study and discussions in this paper.

Subsurface Well Types and Life Cycle
There can be different types of subsurface wells that are used for offshore field developments: exploration well, appraisal and delineating well, production well, injection well. After drilling, subsurface wells may be completed for production and/or injection. Production wells transport well fluids from the reservoir to the process facilities, while injection wells are normally used to inject water or gas to the reservoir to maintain pressure. Figure 2 illustrates the entire life cycle of a subsurface well in different stages [12]. As has been noted, this paper is concerned with the production phase of an oil field. fluids from the reservoir to the process facilities, while injection wells are normally used to inject water or gas to the reservoir to maintain pressure. Figure 2 illustrates the entire life cycle of a subsurface well in different stages [12]. As has been noted, this paper is concerned with the production phase of an oil field.

SWC Process and Configuration
SWC takes place in order to prepare the subsurface well for production when the subsurface wellhead makes connection with the subsea wellhead via the rigid riser. Typical steps are as follows: (1) A production tubing is run in hole, tubing hanger landed on the subsurface wellhead and production packer is set. (2) A vertical X-mas tree is installed on top of the subsurface wellhead.
(3) A control umbilical coming from FPU is used to control the X-mas tree and downhole function. (4) A flexible jumper is connected to the X-mas tree for production, as shown in Figure 1. Figure 3 shows a specific subsurface production well of the STLP facility. The detailed working principle and technical feasibility of the STLP facility have been presented in the granted patents and different academic papers [2][3][4][5]. The scope of the study is limited to the system from the downhole to the flexible jumper, while the control system and other topside equipment are not included, as shown in Figure 4.

SWC Process and Configuration
SWC takes place in order to prepare the subsurface well for production when the subsurface wellhead makes connection with the subsea wellhead via the rigid riser. Typical steps are as follows: (1) A production tubing is run in hole, tubing hanger landed on the subsurface wellhead and production packer is set. (2) A vertical X-mas tree is installed on top of the subsurface wellhead.
(3) A control umbilical coming from FPU is used to control the X-mas tree and downhole function. (4) A flexible jumper is connected to the X-mas tree for production, as shown in Figure 1. Figure 3 shows a specific subsurface production well of the STLP facility. The detailed working principle and technical feasibility of the STLP facility have been presented in the granted patents and different academic papers [2][3][4][5]. The scope of the study is limited to the system from the downhole to the flexible jumper, while the control system and other topside equipment are not included, as shown in Figure 4. fluids from the reservoir to the process facilities, while injection wells are normally used to inject water or gas to the reservoir to maintain pressure. Figure 2 illustrates the entire life cycle of a subsurface well in different stages [12]. As has been noted, this paper is concerned with the production phase of an oil field.

SWC Process and Configuration
SWC takes place in order to prepare the subsurface well for production when the subsurface wellhead makes connection with the subsea wellhead via the rigid riser. Typical steps are as follows: (1) A production tubing is run in hole, tubing hanger landed on the subsurface wellhead and production packer is set. (2) A vertical X-mas tree is installed on top of the subsurface wellhead.
(3) A control umbilical coming from FPU is used to control the X-mas tree and downhole function. (4) A flexible jumper is connected to the X-mas tree for production, as shown in Figure 1. Figure 3 shows a specific subsurface production well of the STLP facility. The detailed working principle and technical feasibility of the STLP facility have been presented in the granted patents and different academic papers [2][3][4][5]. The scope of the study is limited to the system from the downhole to the flexible jumper, while the control system and other topside equipment are not included, as shown in Figure 4.

Design Basis
The primary design basis and main characteristics of the STLP facility are tabulated, as shown in Table 1.

Design Basis
The primary design basis and main characteristics of the STLP facility are tabulated, as shown in Table 1.

Risk Acceptance Criteria
In view of the special characteristics of the SWC system in the production phase, subsurface well is at a significant distance from FPU. Thus, any failure of the SWC facilities will not have a significant and direct risk for the personnel on the FPU. Nonetheless, such failures can cause environmental damage and economic loss. Based on a thorough review of alternative RAC [13][14][15], specific ERAC and CRAC are established, as shown in Tables 2 and 3. Both ERAC and CRAC values are focused on the maximum acceptable annual probability and corresponding release quantity of oil to sea.
Normally, the costs of a technical system failure can be divided into three main parts: (1) material damage and production delay; (2) global cleanup cost; (3) compensation of damages. In this study, as the expected value of material damage and production delay are, as for the expected amount spilled, entirely artificial values [16], the failure costs are focused on the last two cost components-global cleanup cost and the compensation of damages. Generic values for the compensation of damages are also hard to estimate. However, it can be assumed that the compensation costs are related to the environmental & socioeconomic costs [15]. It is acknowledged that the relationship between cleanup costs and environmental & socioeconomic costs will be strongly dependent on the accident type, location, etc. However, for the purpose of this general study, environmental and socioeconomic costs are assumed to be 150% of the global cleanup cost [14]. As the weighted global average worldwide cleanup cost per ton oil spilled is 15,900 USD [14], it can be noted from Table 3 that the CRAC has also used the corresponding released amount of oil to sea to define the equivalent consequence class. Nonetheless, risk reduction measures should be further investigated according to the ALARP principle even though the RAC is fulfilled. Here, the ALARP area is defined as the risk from 20 to 100% of the acceptance criterion, which means that risk reduction measures should be considered if the estimated risk level exceeds 20% of the acceptance criterion.

Hazard Identification
The hazards considered in this paper refer to consequences in terms of uncontrolled releases to sea. The scenarios that may lead to such hazardous events are identified as follows: (1) Subsea wellhead leaks (2) Rigid riser leaks (3) Subsurface wellhead leaks (4) Release from X-mas tree (5) Flexible jumper leaks Table 4 gives the main causes of incidents causing the above hazardous events. It can be seen from Table 4 that the main causes of incidents are related to corrosion threats, structural threats, third party threats, material defects, control system threats and natural hazard threats. Table 4. Main causes to the specific SWC system which resulted in uncontrolled releases to sea.

Rigid Riser
Subsurface Wellhead

Corrosion threats
Internal

Risk Models
The overall risk model with respect to uncontrolled releases to sea is developed and illustrated in Figure 5. In the following, probabilities and consequences associated with each of the risk sub-models are investigated. The probabilities are determined based on the existing data dossiers and the consequences are calculated by means of the analytical method.  Table 4 gives the main causes of incidents causing the above hazardous events. It can be seen from Table 4 that the main causes of incidents are related to corrosion threats, structural threats, third party threats, material defects, control system threats and natural hazard threats. Table 4. Main causes to the specific SWC system which resulted in uncontrolled releases to sea.

Rigid Riser
Subsurface Wellhead

Corrosion threats
Internal

Risk Models
The overall risk model with respect to uncontrolled releases to sea is developed and illustrated in Figure 5. In the following, probabilities and consequences associated with each of the risk sub-models are investigated. The probabilities are determined based on the existing data dossiers and the consequences are calculated by means of the analytical method.

Well Barrier Concept
NORSOK D-010 [17] defines the well barrier as "envelope of one or several well barrier elements preventing fluids from flowing unintentionally from the formation into the wellbore, into another formation or the external environment". Well barriers are used to prevent leaks and reduce

Well Barrier Concept
NORSOK D-010 [17] defines the well barrier as "envelope of one or several well barrier elements preventing fluids from flowing unintentionally from the formation into the wellbore, into another formation or the external environment". Well barriers are used to prevent leaks and reduce the risk associated with well activities. A well barrier has one or more well barrier elements (WBEs). NORSOK D-010 defines WBE as "a physical element which itself does not prevent flow but in combination with other WBEs forms a well barrier".
The two barrier principle, which is followed in most oil producing countries, is also available for the studied SWC system. This means that there will be at least two well barriers in the SWC system and the two independent barriers are referred to as the primary and the secondary barriers respectively.

Well Barrier Diagram
The barrier diagram has been constructed for modeling the situation of preventing uncontrolled releases to sea during temporary shut-in of the specific SWC system. The barrier diagram is also constructed for calculating the leak probability of each of the risk sub-models.
A set of assumptions are made for the well barrier diagram's construction: (1) The SWC system is shut-in.
(2) The PMV, PWV, and SCSSV have been given a close command.
(3) CV in the full closed position can shut-off flow.
(4) Uncontrolled releases to the sea through the casings and cement are not taken into account as these probabilities are relatively very low [18]. (5) Failures of the control system and other topside equipment are not taken into consideration. (6) Only the failure mode "external leakage" for the subsea/subsurface wellhead, rigid riser, X-mas tree and flexible jumper is considered while other failure modes are not assumed to result in environmental and commercial impacts.
The well barrier diagram for the specific SWC system is illustrated in Figure 6. It is worth noting that the X-mas tree is not considered as a single barrier while its main safety valves are regarded as independent barriers. Further, it can be seen from Figure 6 that all the paths from the reservoir to the surroundings are possible flow leakage paths (FLPs). Then, the minimal cut sets of the SWC system can be identified from the well barrier diagram by following different FLPs, as given in Table 5. The minimal cut sets will be used as the basis for quantitative reliability analysis. It can be seen that the minimal cut set with the lowest failure tolerance is the leak from the reservoir to the surroundings via A-annulus merely.

Probability Calculation Model
From the minimal cut sets presented in Table 5, approximate formulas are used to calculate the leak probabilities. It should be noted that the formulas given in this section are based on the assumption that all the basic events are statistically independent.
Let the top event denote the uncontrolled releases to sea for the specific SWC system. The probability that the top event occurs at time t is denoted 0 ( ) Q t , which can be approximated by: where ( ) (1) Non-repairable unit. Non-repairable component failures are not detected and repaired. An approximate formula can be given as: where i λ is the failure rate.
(2) Repairable unit. Unit i is repaired when a failure occurs. The unit is assumed to be "as good as Figure 6. Well barrier diagram for the specific SWC system.

Probability Calculation Model
From the minimal cut sets presented in Table 5, approximate formulas are used to calculate the leak probabilities. It should be noted that the formulas given in this section are based on the assumption that all the basic events are statistically independent.
Let the top event denote the uncontrolled releases to sea for the specific SWC system. The probability that the top event occurs at time t is denoted Q 0 (t), which can be approximated by: where Q j (t) denotes the probability that minimal cut set j fails at time t, q i (t) is the basic event i occurs at time t.
With regard to the Equation (1), it is assumed that the products of all the Q j (t)s are so small that they can be disregarded.
The probabilities of all the basic events depend on the type of the basic event, and three basic event types are distinguished as follows: (1) Non-repairable unit. Non-repairable component failures are not detected and repaired.
An approximate formula can be given as: where λ i is the failure rate. (2) Repairable unit. Unit i is repaired when a failure occurs. The unit is assumed to be "as good as new" after a repair. Basic event probability: where MTTR i is the mean time to repair. (3) Periodic testing. Unit i is tested periodically with test interval τ. After a test/repair, the unit is assumed to be "as good as new". In this case, the probability of the basic event is:

Probability Calculation Results
The following list presents the data dossiers, which form a basis for the input to the failure probability calculations.

3) Pipeline and Riser Loss of Containment (PARLOC) 2001 [21]
Based on the identified minimal cut sets in combination with the approximate formulas, the results of annual leak probability for each of the risk sub-models are obtained, as presented in Table 6. The periodic testing unit is given a test interval of 6 months.

Consequence Assessment
As has been noted in the Section 5, the total oil spill amount will be assessed in order to measure the environmental and commercial impacts.

Oil Spill Calculation Model
The equation for the total oil spill amount m tot takes the form as follows: where . m is the mass release rate, T is the effective duration of the release event. The oil spill characteristics are discussed below.
(1) Mass release rate. The mass release rate in the liquid phase is calculated by the Bernoulli equation [15].
where C is the contraction coefficient varying range 0.6-1.0, A h is the size of damage area, ρ oil is the density of oil, (P 1 − P 2 ) is the differential pressure between internal pressure and external pressure.
Note that the size of damage area will be classified according to the equivalent hole diameter based on details of the incident record [21]. However, there is a scarcity of information for developing estimates of hole size distributions of the subsea production facilities. In order to facilitate hole size characterization, it is assumed that the hole size distributions for offshore pipelines are used to infer hole size distributions for subsea production facilities in this study. Furthermore, the hole size distributions for the flexible riser and subsea steel riser are used to infer hole size distributions for flexible jumper and rigid riser respectively [22]. Table 7 shows the recommended hole size distributions for the specific SWC system.
(2) Release duration time. The release duration time is assumed to be a function of the active repair time. However, the active repair time will vary to a large extent because of the difficult accessibility, available emergency response equipment, etc. A correction factor in relation to the accessibility (water depth) is applied for the purpose of adjusting the effective duration time. Thus, the effective duration time of the release event is calculated as follows: where t r is the active repair time, t c f is the time correction factor (TCF). Table 8 shows the recommended TCFs, which is determined by the expert judgment [15]. Here, TCF setting in deep sea is the benchmark.

Oil Spill Calculation Results
The release rate for a large hole size in the production phase is set to 1000 m 3 /day [23], and the contraction coefficient is set to 0.8. With respect to the statistical data and expert judgments, the hole diameter is set to 20 mm for the small hole size, 50 mm for the medium hole size, 80 mm for the large hole size. On this basis. The release rate for the large hole size (80 mm), the medium hole size (50 mm) and the small hole size (20 mm) is 35.00 tons/h, 13.68 tons/h and 2.19 tons/h, respectively. The active repair time based on the data dossier is shown in Table 9. Table 10 presents the specific oil spill amount calculation results.

Risk Evaluation and Risk Reduction Measures
The risk relating to the environmental and commercial impacts resulting from various accidental scenarios are shown in Figures 7 and 8. It can be seen that the overall risk level is dominated by the subsea wellhead leak scenario. Further, compared with the established RAC, it can be found that the environmental risk level for the subsea wellhead's leak lies within the ALARP region while the other environmental and commercial risks are all below the ALARP limits. Thus, risk reduction measures should be considered for the subsea wellhead area. It can also be noted that there are no serious and major commercial losses for all the identified accidental release scenarios, which is of great importance and attractiveness for oil producers. In addition, both the environmental and commercial risk levels for the X-mas tree and flexible jumper are so low that the relaxed design requirements may be accepted with respect to the SWC technology.
As the risk is often expressed in terms of a combination of the consequences of an event and the associated likelihood of occurrence, risk reduction measures thus can be grouped into two main categories: probability reducing measures and consequence mitigation measures. It should be noted that the Petroleum Safety Authority (PSA) guidelines [13] state that probability reducing measures should be prioritized before consequence reducing measures.
Recommended risk reduction measures are proposed and considered in the following areas: (1) Design of the additional safety valve with respect to riser/subsea wellhead connection.
(2) Design of the inner casing between rigid riser and production tubing.
(3) Design of the sealed tubing hanger between production tubing and casing.
(4) Configuration of special leakage alarm system including leakage detection and alarm generation for the subsea wellhead connection. (5) Adequate preparedness measures for the uncontrolled subsea wellhead leaks.

Risk Evaluation and Risk Reduction Measures
The risk relating to the environmental and commercial impacts resulting from various accidental scenarios are shown in Figures 7 and 8. It can be seen that the overall risk level is dominated by the subsea wellhead leak scenario. Further, compared with the established RAC, it can be found that the environmental risk level for the subsea wellhead's leak lies within the ALARP region while the other environmental and commercial risks are all below the ALARP limits. Thus, risk reduction measures should be considered for the subsea wellhead area. It can also be noted that there are no serious and major commercial losses for all the identified accidental release scenarios, which is of great importance and attractiveness for oil producers. In addition, both the environmental and commercial risk levels for the X-mas tree and flexible jumper are so low that the relaxed design requirements may be accepted with respect to the SWC technology.
As the risk is often expressed in terms of a combination of the consequences of an event and the associated likelihood of occurrence, risk reduction measures thus can be grouped into two main categories: probability reducing measures and consequence mitigation measures. It should be noted that the Petroleum Safety Authority (PSA) guidelines [13] state that probability reducing measures should be prioritized before consequence reducing measures.
Recommended risk reduction measures are proposed and considered in the following areas: (1) Design of the additional safety valve with respect to riser/subsea wellhead connection.
(2) Design of the inner casing between rigid riser and production tubing.
(3) Design of the sealed tubing hanger between production tubing and casing.
(4) Configuration of special leakage alarm system including leakage detection and alarm generation for the subsea wellhead connection. (5) Adequate preparedness measures for the uncontrolled subsea wellhead leaks.

Uncertainty Assessment and Sensitivity Study
Even though the QRA in this study is believed to be based on the best available information and consideration, there are still a number of uncertainties affecting the results of this study. Table 11 lists the assumptions and their possible effects as well as uncertainty sources in this study. It can be found that some assumptions made are conservative or optimistic while the others are unknown. In many cases, a conservative approach including conservative model approximations and conservative values of input parameters to QRA is applied. Thus, the QRA results presented in this paper can be regarded as somewhat conservative.
Sensitivity studies are carried out in order to illustrate some of important uncertainties in Table 11, in relation to critical assumptions for QRA. Here, only the risk levels for subsea wellhead leaks, rigid riser leaks and subsurface wellhead leaks are shown as other risk levels are far below the RAC.  Figures 9 and 10 illustrate the effects of limit variations for ALARP on the environmental risk and commercial risk respectively. It can be found that limit variations for ALARP ranging from 15 to 25% of the acceptable limit have little influence on the risk levels of the identified hazardous events.

Uncertainty Assessment and Sensitivity Study
Even though the QRA in this study is believed to be based on the best available information and consideration, there are still a number of uncertainties affecting the results of this study. Table 11 lists the assumptions and their possible effects as well as uncertainty sources in this study. It can be found that some assumptions made are conservative or optimistic while the others are unknown. In many cases, a conservative approach including conservative model approximations and conservative values of input parameters to QRA is applied. Thus, the QRA results presented in this paper can be regarded as somewhat conservative.
Sensitivity studies are carried out in order to illustrate some of important uncertainties in Table 11, in relation to critical assumptions for QRA. Here, only the risk levels for subsea wellhead leaks, rigid riser leaks and subsurface wellhead leaks are shown as other risk levels are far below the RAC. Figures 9 and 10 illustrate the effects of limit variations for ALARP on the environmental risk and commercial risk respectively. It can be found that limit variations for ALARP ranging from 15 to 25% of the acceptable limit have little influence on the risk levels of the identified hazardous events. This is because that the environmental risk level for the subsea wellhead leaks is above 25% of the acceptable limit while the other risk levels are all below the 15% of the acceptable limit. Nonetheless, the operator should be deliberative when a strict limit for ALARP will be required and determined. Figures 11 and 12 illustrate the effects of release rate variations for the subsea wellhead leaks on the environmental risk and commercial risk respectively. Figures 13 and 14 illustrate the effects of TCF variations for the subsea wellhead leaks on the environmental risk and commercial risk respectively. It can be observed from Figures 11-14 that the risk level changes horizontally with regard to consequence class variations while the corresponding annual probability keeps constant.
It can be found from Figures 12 and 14 that the release rate variations between −50% and 50% and TCF variations from 1.0 to 10.0 have little influence on the commercial risk evaluation and thus have no influence on the final decision-making. However, if the assumptions for the release rate and TCF are too optimistic, total different conclusions from the environmental risk evaluation may be drawn. It can be found from Figure 11 that when the release rate for a large hole size is set to 25% or 50% lower than the pre-defined release rate, the environmental risk level for the subsea wellhead leaks is negligible. Likewise, it can be found from Figure 13 that when the TCF for UDS is assumed 1.0 or 2.5, the environmental risk level for the subsea wellhead leaks is negligible. It means that if the over optimistic release rate and TCF are set, the environmental risk level for the subsea wellhead leaks may not lie within the ALARP region anymore. Thus, no further risk reduction measures are required and a completely opposite conclusion may be reached.
Here, it is emphasized that the QRA should be considered as an on-going process. The QRA results can be continuously updated when the latest data and relevant information become available.
As some of the uncertainties may have significant influence on the QRA results of some accidental scenarios, it is suggested that further studies should be carried out in relation to the quantitative risk model of release characteristics including the release rate, hole size, TCF, etc. This is because that the environmental risk level for the subsea wellhead leaks is above 25% of the acceptable limit while the other risk levels are all below the 15% of the acceptable limit. Nonetheless, the operator should be deliberative when a strict limit for ALARP will be required and determined. Figures 11 and 12 illustrate the effects of release rate variations for the subsea wellhead leaks on the environmental risk and commercial risk respectively. Figures 13 and 14 illustrate the effects of TCF variations for the subsea wellhead leaks on the environmental risk and commercial risk respectively. It can be observed from Figures 11-14 that the risk level changes horizontally with regard to consequence class variations while the corresponding annual probability keeps constant.
It can be found from Figures 12 and 14 that the release rate variations between −50% and 50% and TCF variations from 1.0 to 10.0 have little influence on the commercial risk evaluation and thus have no influence on the final decision-making. However, if the assumptions for the release rate and TCF are too optimistic, total different conclusions from the environmental risk evaluation may be drawn. It can be found from Figure 11 that when the release rate for a large hole size is set to 25% or 50% lower than the pre-defined release rate, the environmental risk level for the subsea wellhead leaks is negligible. Likewise, it can be found from Figure 13 that when the TCF for UDS is assumed 1.0 or 2.5, the environmental risk level for the subsea wellhead leaks is negligible. It means that if the over optimistic release rate and TCF are set, the environmental risk level for the subsea wellhead leaks may not lie within the ALARP region anymore. Thus, no further risk reduction measures are required and a completely opposite conclusion may be reached.
Here, it is emphasized that the QRA should be considered as an on-going process. The QRA results can be continuously updated when the latest data and relevant information become available.
As some of the uncertainties may have significant influence on the QRA results of some accidental scenarios, it is suggested that further studies should be carried out in relation to the quantitative risk model of release characteristics including the release rate, hole size, TCF, etc.

Conclusions
The following conclusions can be drawn in this paper: (1) Any failure of the new SWC system is not a direct and significant source of risk for the personnel on the surface installations with regard to its offset feature. (2) The overall risk level is dominated by the failure event of the subsea wellhead leaks. Compared with the established RAC, only the environmental risk level for the subsea wellhead's leak lies within the ALARP area, and thus risk reduction measures should be considered for the subsea wellhead area. The rest risk levels are all below the corresponding ALARP limit and thus negligible. (3) The new SWC technology has a distinct advantage for the leakage duration time in UDS, and hence can mitigate the environmental and commercial impacts as much as possible. (4) There are no serious and major commercial losses for all the identified accidental release scenarios, which is of great importance and attractiveness to oil producers. (5) Corresponding design alternatives are proposed and can be considered to apply to improving the design deficiencies of the current SWC system. (6) With respect to the SWC technology, relaxed design requirements for the X-mas tree and flexible jumper may be accepted.

Conclusions
The following conclusions can be drawn in this paper: (1) Any failure of the new SWC system is not a direct and significant source of risk for the personnel on the surface installations with regard to its offset feature. (2) The overall risk level is dominated by the failure event of the subsea wellhead leaks. Compared with the established RAC, only the environmental risk level for the subsea wellhead's leak lies within the ALARP area, and thus risk reduction measures should be considered for the subsea wellhead area. The rest risk levels are all below the corresponding ALARP limit and thus negligible. (3) The new SWC technology has a distinct advantage for the leakage duration time in UDS, and hence can mitigate the environmental and commercial impacts as much as possible. (4) There are no serious and major commercial losses for all the identified accidental release scenarios, which is of great importance and attractiveness to oil producers. (5) Corresponding design alternatives are proposed and can be considered to apply to improving the design deficiencies of the current SWC system. (6) With respect to the SWC technology, relaxed design requirements for the X-mas tree and flexible jumper may be accepted.

Conclusions
The following conclusions can be drawn in this paper: (1) Any failure of the new SWC system is not a direct and significant source of risk for the personnel on the surface installations with regard to its offset feature. (2) The overall risk level is dominated by the failure event of the subsea wellhead leaks. Compared with the established RAC, only the environmental risk level for the subsea wellhead's leak lies within the ALARP area, and thus risk reduction measures should be considered for the subsea wellhead area. The rest risk levels are all below the corresponding ALARP limit and thus negligible. (3) The new SWC technology has a distinct advantage for the leakage duration time in UDS, and hence can mitigate the environmental and commercial impacts as much as possible. (4) There are no serious and major commercial losses for all the identified accidental release scenarios, which is of great importance and attractiveness to oil producers. (5) Corresponding design alternatives are proposed and can be considered to apply to improving the design deficiencies of the current SWC system. (6) With respect to the SWC technology, relaxed design requirements for the X-mas tree and flexible jumper may be accepted.
All in all, in spite of the inevitable uncertainties, it is believed that the QRA results in this study are meaningful and of value for improving the engineering design of the future SWC system as well as pushing its industrialization progress.
Author Contributions: X.Z., T.M., Z.G. and Y.H. conceived and designed the research work. X.Z. performed the analytical calculations and analyzed the data. All the authors reviewed the results, drew conclusions, and wrote the paper. The total oil spill amount . m

Abbreviations
The mass release rate P 1 /P 2 Internal/External pressure q i (t) The basic event i occurs at time t Q 0 (t) The probability that the top event occurs at time t Q j (t) The probability that minimal cut set j fails at time t