Research on the Risk of Drilling Phases Based on the Development Model of Shallow-Water Subsea Trees

<jats:p>China is actively advancing offshore oil and gas exploration and development, focusing on addressing the technical challenges associated with resource extraction in shallow waters. The shallow-water subsea tree development model has gradually been applied in such environments, alleviating some construction difficulties. However, it still poses well control risks that require systematic analysis and quantitative evaluation. Given that the blowout preventer (BOP) is located on the platform and the shallow-water subsea tree is only used during certain drilling stages, this study divided the drilling process into two phases: the first three sections and the fourth section. Based on the “man–machine–material–environment” analytical framework and an improved system-theoretic process analysis (STPA), a control model for the construction phases was developed. Fault tree analysis (FTA) was then employed to identify comprehensively the potential risks from the platform to the wellbore in both phases. Subsequently, the decision-making trial and evaluation laboratory (DEMATEL) method were used to assess quantitatively the well control risks. Using the average weight as the evaluation criterion, high-risk factors exceeding the average weight in each phase were identified. The results indicate that in the shallow-water subsea tree development model, well control risks in the first three drilling sections primarily stem from human errors and equipment failures, while risks in the fourth section are mainly caused by damage to the subsea tree itself. The identified risk factors provide a theoretical basis for enhancing well control safety management in the shallow-water subsea tree development model.</jats:p>

section_content: With the increasing depth of offshore oil and gas exploration and the growing complexity of marine environmental conditions, subsea production systems are gradually becoming one of the main modes of offshore oil and gas resource development [1] [2] [3]. The Bohai Bay area, as a Chinese inland sea, hosts the Bohai Oilfield, which is the second largest oilfield in China, predominantly producing oil and gas from Bohai Bay [4, 5]. However, the development of shallow-water areas has become significantly more challenging. The Bohai Sea area is busy with shipping and has a thriving fishing industry, making coordination for oil and gas field development difficult [6]. 

Currently, there are dozens of oil fields in Bohai Bay whose development is restricted by navigation, involving hundreds of wells [7]. This results in millions of tons of crude oil production being unreleased annually, with untapped crude oil reserves amounting to hundreds of millions of tons. This presents a severe challenge for increasing reserves and production in the Bohai Oilfield. To address this, the operator has innovatively proposed shifting the development of restricted area oil and gas fields from jacket platforms to subsea production systems, specifically the shallow-water subsea tree development model (see Figure 1 ). production in the Bohai Oilfield. To address this, the operator has innovatively proposed shifting the development of restricted area oil and gas fields from jacket platforms to subsea production systems, specifically the shallow-water subsea tree development model (see Figure 1 ). Subsea tree is an indispensable core component of subsea production systems, responsible for connecting oil and gas from deep reservoirs to external transport pipelines, controlling production rates, and enabling real-time monitoring and adjustment of production conditions [8]. In shallow-water environments, subsea trees are installed on the seabed, particularly during the fourth stage of drilling, where they are positioned above the subsea wellhead. The tree connects to the drilling platform above via risers and the BOP on the platform deck, while also linking to the subsea wellhead below, creating a unique and complex wellbore environment [9]. Unlike deepwater and conventional drilling operations, in this scenario, there is only one blowout preventer, which is located on the offshore platform, while the subsea tree is situated on the seabed in shallow water, with a flow path maintained between the two. Although this development model offers certain operational advantages, it also presents specific well control risks. These risks are particularly pronounced when dealing with the complex wellbore conditions in shallowwater environments, requiring more rigorous monitoring and risk management strategies. There are numerous risks in the drilling and completion stages under the shallowwater subsea tree development mode. Since this technology has just begun to be applied in China, related reliability studies are not yet mature, especially as a complete reliability analysis system for shallow-water oilfields has not been established [1, 10, 11]. Currently, some scholars evaluate the risk of well control incidents based on quantitative risk analysis methods, including fault tree analysis, event tree analysis, analytic hierarchy process, fuzzy mathematics, bow-tie model, and Markov process [12] [13] [14] [15] [16] [17]. However, conventional risk analysis methods are limited to specific fields or types of risks and are influenced by individual subjective judgment, making it difficult to consider comprehensively the complexity and diversity of the system and quantitatively analyze numerous risks. 

This paper, based on the improved system-theoretic process analysis (STPA) and fault tree analysis (FTA), identifies and lists typical well control risk factors in the drilling stage of the shallow-water subsea tree development model through a systematic analysis framework. Combined with the DEMATEL method, the interrelationships and impacts of various factors within the system are explored in depth, high-weight risk factors are calculated, and detailed mitigation measures are formulated. This method overcomes the limitations of traditional methods, improves the accuracy and completeness of risk analysis, and enhances the objectivity and scientific nature of the analysis.
section_name: Introduction

section_content: Traditional methods are based on the concept of potential event chains in simple or complex linear causal relationships, whereas the method has improved upon this basis to more comprehensively identify and analyze risk factors [18]. Given this advantage, this Subsea tree is an indispensable core component of subsea production systems, responsible for connecting oil and gas from deep reservoirs to external transport pipelines, controlling production rates, and enabling real-time monitoring and adjustment of production conditions [8]. In shallow-water environments, subsea trees are installed on the seabed, particularly during the fourth stage of drilling, where they are positioned above the subsea wellhead. The tree connects to the drilling platform above via risers and the BOP on the platform deck, while also linking to the subsea wellhead below, creating a unique and complex wellbore environment [9]. Unlike deepwater and conventional drilling operations, in this scenario, there is only one blowout preventer, which is located on the offshore platform, while the subsea tree is situated on the seabed in shallow water, with a flow path maintained between the two. Although this development model offers certain operational advantages, it also presents specific well control risks. These risks are particularly pronounced when dealing with the complex wellbore conditions in shallow-water environments, requiring more rigorous monitoring and risk management strategies. There are numerous risks in the drilling and completion stages under the shallow-water subsea tree development mode. Since this technology has just begun to be applied in China, related reliability studies are not yet mature, especially as a complete reliability analysis system for shallow-water oilfields has not been established [1, 10, 11]. Currently, some scholars evaluate the risk of well control incidents based on quantitative risk analysis methods, including fault tree analysis, event tree analysis, analytic hierarchy process, fuzzy mathematics, bow-tie model, and Markov process [12] [13] [14] [15] [16] [17]. However, conventional risk analysis methods are limited to specific fields or types of risks and are influenced by individual subjective judgment, making it difficult to consider comprehensively the complexity and diversity of the system and quantitatively analyze numerous risks. 

This paper, based on the improved system-theoretic process analysis (STPA) and fault tree analysis (FTA), identifies and lists typical well control risk factors in the drilling stage of the shallow-water subsea tree development model through a systematic analysis framework. Combined with the DEMATEL method, the interrelationships and impacts of various factors within the system are explored in depth, high-weight risk factors are calculated, and detailed mitigation measures are formulated. This method overcomes the limitations of traditional methods, improves the accuracy and completeness of risk analysis, and enhances the objectivity and scientific nature of the analysis.
section_name: Improved STPA-FTA-DEMATEL Method

section_content: Traditional methods are based on the concept of potential event chains in simple or complex linear causal relationships, whereas the method has improved upon this basis to more comprehensively identify and analyze risk factors [18]. Given this advantage, this paper combines the characteristics of human, machine, material, and environment, and uses FTA to construct all the risks faced in the four drilling stages. 

The DEMATEL analysis method is mainly used to solve complex and difficult problems. This method reduces the composition of system elements, simplifies the relationships between system elements, and introduces quantitative analysis to study the control body of the system [19]. However, due to the presence of risk factors in the drilling stage of the shallow-water subsea tree development model, this method has been improved. The intermediate layer of the fault tree constructed based on STPA is used as the analysis factor of DEMATEL to calculate high-weight typical factors, extract high-risk factors, perform refined analysis, and construct a high-risk weight control body. 

The steps of the improved STPA-FTA-DEMATEL analysis method are as follows. 

1. 

Identify the main boundaries of the system: Construct a control body model according to the analysis principles of human, machine, material, and environment 2. 

Establish a fault tree: Using the control body as a unit, construct a fault tree with the occurrence of on-site well control accidents as the top event 3. 

Quantitative evaluation based on DEMATEL: Quantitatively evaluate the risk factors of the intermediate layer, while the refined bottom layer helps accurately identify the details of risk factors, facilitating expert scoring, as follows. 

(1) Scoring by experts to clarify the logical relationships of risk factors within the system and the relationship matrix (with impacts classified into 5 levels: no impact 0; minor impact 1; moderate impact 2; significant impact 3; and major impact 4). The direct impact matrix M is then calculated using a formula:

In the formula, a ij represents the direct influence matrix. 

Find the maximum value in each row of the matrix and normalize the direct impact matrix to N: N = (

(2) Obtain the comprehensive impact matrix T by standardizing the direct impact matrix:

In the formula: I denotes an n-order identity matrix, where n is determined by the number of risk factors involved in the calculation. 

(3)

Use the comprehensive impact matrix to calculate various indicator values, including the impact degree D, the affected degree C, the centrality D + C, the causality D -C, and the weight value. 

Impact Degree D:

Affected Degree C:

Centrality D + C, denoted as M i :

Causality D -C, denoted as R i :

Then normalize the importance of the above factors to obtain the weight values. 

(4) Using Equation ( 8 ) we can calculate the average weight of all risk factors. Factors with weights higher than the average are considered high-risk factors. 

Focus on these high-risk factors, investigate their typical characteristics and high-risk weights, and establish a control system for high-risk weights:

(5) Based on the above analysis, constrain the high-risk weight factors.
section_name: Improved STPA-FTA-DEMATEL Method

section_content: In the shallow-water subsea tree development model, complex geological conditions and climatic changes pose challenges to well control operations. To ensure the safety of well control operations, it is crucial to identify accurately various risks during the drilling stages. Especially during the drilling process, the uncertainty of formation pressure, the complexity of the downhole environment, and the diverse operating conditions of drilling equipment make risk management complex [20, 21] As shown in Figures 2 and 3, respectively, they illustrate the wellbore structures for the first three drilling operations and the fourth drilling operation. The wellbore structure of the first three drilling operations includes a surface blowout preventer, high-pressure riser, wellhead, and downhole structure, while the fourth drilling operation additionally includes a subsea tree between the high-pressure riser and the subsea wellhead. Through the STPA and FTA methods, the key risk factors at different stages of drilling can be ac identified.
section_name: Identification of Well Control Risks in Drilling Stages Based on the STPA-FTA Method

section_content: In the first three drilling operations, due to the absence of a subsea tree, the wellbore structure of the shallow-water subsea tree development model primarily included a blowout preventer, a high-pressure riser, and a subsea wellhead. During the first three drilling stages, the system s boundaries included on-site personnel (surface operators and subsea operators), on-site equipment (drilling fluid circulation system, pressure risers, combination drill tools, cementing equipment, equipment connection devices, and safety protection devices), on-site materials (drilling fluid, cement slurry, and life-saving supplies), and
section_name: Risk Identification in the First Three Drilling Operations

section_content: In the first three drilling operations, due to the absence of a subsea tree, the wellbore structure of the shallow-water subsea tree development model primarily included a blowout preventer, a high-pressure riser, and a subsea wellhead. During the first three drilling stages, the system's boundaries included on-site personnel (surface operators and subsea operators), on-site equipment (drilling fluid circulation system, pressure risers, combination drill tools, cementing equipment, equipment connection devices, and safety protection devices), on-site materials (drilling fluid, cement slurry, and life-saving supplies), and the natural environment on-site. Based on the aforementioned analysis, as illustrated in Figure 4, a corresponding control body model was constructed to identify and manage the risks during the first three drilling processes. 

At the drilling site, risks brought by humans, machinery, materials, and the environment can lead to major accidents such as blowouts, wellbore ruptures, and derrick fires, potentially causing platform explosions, severe casualties, and significant property damage. 

Employees at the drilling site face serious risks, including improper operation of drilling and monitoring auxiliary equipment, failure to detect timely on-site incidents, and failure to promptly take appropriate measures after detecting incidents. These risks pose significant threats to the operation of drilling activities, potentially causing production interruptions and posing major threats to the safety of on-site personnel. Based on the above analysis, as shown in Figure 5, the well control risks present during the operational processes of on-site employees are detailed. 

During the drilling process, various key equipment is used, including casing, drill string, wear sleeves, blowout preventers, and high-pressure risers. These pieces of equipment may experience functional failures, wear, or breakage due to inherent characteristics, operational errors, or environmental conditions. Particularly in shallow-water development scenarios, the sealing performance and wear resistance of high-pressure risers and blowout preventers are crucial, as they directly impact operational safety. Through an analysis of the actual field situation (as shown in Figure 6 ), the related risks of field equipment systems can be classified into six major categories. 

the natural environment on-site. Based on the aforementioned analysis, as illustrated Figure 4, a corresponding control body model was constructed to identify and mana the risks during the first three drilling processes. At the drilling site, risks brought by humans, machinery, materials, and the enviro ment can lead to major accidents such as blowouts, wellbore ruptures, and derrick fir potentially causing platform explosions, severe casualties, and significant property da age. 

Employees at the drilling site face serious risks, including improper operation drilling and monitoring auxiliary equipment, failure to detect timely on-site incidents, a failure to promptly take appropriate measures after detecting incidents. These risks po significant threats to the operation of drilling activities, potentially causing producti interruptions and posing major threats to the safety of on-site personnel. Based on t above analysis, as shown in Figure 5, the well control risks present during the operation processes of on-site employees are detailed. During the drilling process, various key equipment is used, including casing, d string, wear sleeves, blowout preventers, and high-pressure risers. These pieces of equ At the drilling site, risks brought by humans, machinery, materials, and the environment can lead to major accidents such as blowouts, wellbore ruptures, and derrick fires, potentially causing platform explosions, severe casualties, and significant property damage. 

Employees at the drilling site face serious risks, including improper operation of drilling and monitoring auxiliary equipment, failure to detect timely on-site incidents, and failure to promptly take appropriate measures after detecting incidents. These risks pose significant threats to the operation of drilling activities, potentially causing production interruptions and posing major threats to the safety of on-site personnel. Based on the above analysis, as shown in Figure 5, the well control risks present during the operational processes of on-site employees are detailed. During the drilling process, various key equipment is used, including casing, drill string, wear sleeves, blowout preventers, and high-pressure risers. These pieces of equipment may experience functional failures, wear, or breakage due to inherent characteristics, operational errors, or environmental conditions. Particularly in shallow-water development scenarios, the sealing performance and wear resistance of high-pressure risers and blowout preventers are crucial, as they directly impact operational safety. Through an analysis of the actual field situation (as shown in Figure 6 ), the related risks of field equipment systems can be classified into six major categories. At the drilling site under the development model of shallow-water subsea trees, the main items include drilling fluid, cement slurry, and life-saving supplies (as shown in Figure 7 ). Drilling fluid, as an important medium in the drilling process, directly affects the wellbore pressure through its chemical composition and usage. Second, the quality At the drilling site under the development model of shallow-water subsea trees, the main items include drilling fluid, cement slurry, and life-saving supplies (as shown in Figure 7 ). Drilling fluid, as an important medium in the drilling process, directly affects the wellbore pressure through its chemical composition and usage. Second, the quality and sealing effect of the cement slurry directly affect the integrity of the wellbore and the safe operation of the downhole equipment. In addition, the adequacy and availability of emergency rescue supplies are directly related to the safety and survival of personnel in emergency situations. At the drilling site under the development model of shallow-water subsea trees, the main items include drilling fluid, cement slurry, and life-saving supplies (as shown in Figure 7 ). Drilling fluid, as an important medium in the drilling process, directly affects the wellbore pressure through its chemical composition and usage. Second, the quality and sealing effect of the cement slurry directly affect the integrity of the wellbore and the safe operation of the downhole equipment. In addition, the adequacy and availability of emergency rescue supplies are directly related to the safety and survival of personnel in emergency situations. Stratigraphic conditions, gas composition in the formation, and other natural factors significantly affect the formation of natural gas hydrates, the release of dissolved gas, drilling platform stability, groundwater intrusion, and wellbore stability. These environmental factors include tides, water flow, salt layers, small gas caps, and weak edge-bottom water phenomena, as well as the impact of harsh environments on the normal operation of equipment and staff. Specific risks are shown in Figure 8. Stratigraphic conditions, gas composition in the formation, and other natural factors significantly affect the formation of natural gas hydrates, the release of dissolved gas, drilling platform stability, groundwater intrusion, and wellbore stability. These environmental factors include tides, water flow, salt layers, small gas caps, and weak edge-bottom water phenomena, as well as the impact of harsh environments on the normal operation of equipment and staff. Specific risks are shown in Figure 8.
section_name: Risk Identification in the First Three Drilling Operations

section_content: During the fourth drilling phase, based on the risks encountered in the previous three phases, the emphasis was mainly on the significant impact of the deployment and installation of the subsea tree on the drilling process. This phase involved the assessment of factors related to the operation of the subsea tree, including personnel, equipment, materials, and environmental aspects. The complexity of this process mainly arises from dynamic changes in equipment stability, personnel operational skills, environmental factors, and material quality, all of which affect the safety and efficiency of drilling operations. Instability or loss of control of these factors may lead to equipment deviation, damage, or performance degradation, thereby increasing the likelihood and severity of well control
section_name: Risk Identification in the Fourth Drilling Operation

section_content: During the fourth drilling phase, based on the risks encountered in the previous three phases, the emphasis was mainly on the significant impact of the deployment and installation of the subsea tree on the drilling process. This phase involved the assessment of factors related to the operation of the subsea tree, including personnel, equipment, materials, and environmental aspects. The complexity of this process mainly arises from dynamic changes in equipment stability, personnel operational skills, environmental factors, and material quality, all of which affect the safety and efficiency of drilling operations. Instability or loss of control of these factors may lead to equipment deviation, damage, or performance degradation, thereby increasing the likelihood and severity of well control risks. To accurately identify potential risks during this process, a control model for the fourth drilling phase was developed, as shown in Figure 9. 

During the fourth drilling phase, based on the risks encountered in the previous thr phases, the emphasis was mainly on the significant impact of the deployment and inst lation of the subsea tree on the drilling process. This phase involved the assessment factors related to the operation of the subsea tree, including personnel, equipment, ma rials, and environmental aspects. The complexity of this process mainly arises from d namic changes in equipment stability, personnel operational skills, environmental facto and material quality, all of which affect the safety and efficiency of drilling operatio Instability or loss of control of these factors may lead to equipment deviation, damage, performance degradation, thereby increasing the likelihood and severity of well cont risks. To accurately identify potential risks during this process, a control model for t fourth drilling phase was developed, as shown in Figure 9. During the installation of the subsea tree, improper operation of the lifting equipme by surface personnel may lead to equipment instability or loss of control. Such errors m cause cable instability or entanglement, resulting in the subsea tree becoming unstable suddenly breaking during descent. Similarly, if subsea operators fail to properly secu the subsea tree assembly or do not follow the prescribed pressure testing procedures During the installation of the subsea tree, improper operation of the lifting equipment by surface personnel may lead to equipment instability or loss of control. Such errors may cause cable instability or entanglement, resulting in the subsea tree becoming unstable or suddenly breaking during descent. Similarly, if subsea operators fail to properly secure the subsea tree assembly or do not follow the prescribed pressure testing procedures, it could lead to serious well control risks during subsequent drilling operations. These operational errors could result in the failure of the subsea tree system, posing a potential threat to well control safety. As shown in Figure 10, the personnel risks during the fourth drilling operation are analyzed. 

Under the special conditions of the shallow-water subsea tree development model, the equipment risks during the fourth drilling process mainly involve a comprehensive analysis of the drill pipe, pressure riser, and tree. For example, collisions between the drill pipe equipment and the subsea tree, loosening at the connection points leading to leaks, and damage to the protective devices and the body of the subsea tree can all exacerbate well control risks in this environment. Therefore, the risk factors listed in Figure 11 need be given special attention under these conditions. 

In the shallow-water subsea tree development model, external factors can increase operational risks on facilities and equipment. These external forces may include falling objects in the marine environment, ship anchoring, and fishing net entanglement, all of which can interfere with or damage the normal operation of the subsea tree. During the first three drilling processes, the risks posed by various items were analyzed, but at this stage, particular attention needs to be paid to the potential well control risks posed by falling heavy objects, foreign vessels, and maintenance materials. Falling heavy objects may cause damage to or abnormal operation of the subsea tree, inadvertent operation of foreign vessels may lead to collisions or entanglement, and the incorrect use of maintenance materials may also pose hazards, as shown in Figure 12. 

During the fourth drilling operation, based on the analysis of the previous three operations, this phase particularly focuses on environmental risks. These risks primarily stem from the impact of adverse weather, geological, and biological conditions on the subsea production tree and its safety protection devices (as shown in Figure 13 ). 

Sci. Eng. 2024, 12, x FOR PEER REVIEW 9 could lead to serious well control risks during subsequent drilling operations. Thes erational errors could result in the failure of the subsea tree system, posing a pot threat to well control safety. As shown in Figure 10, the personnel risks during the f drilling operation are analyzed. Under the special conditions of the shallow-water subsea tree development m the equipment risks during the fourth drilling process mainly involve a comprehe analysis of the drill pipe, pressure riser, and tree. For example, collisions between th pipe equipment and the subsea tree, loosening at the connection points leading to and damage to the protective devices and the body of the subsea tree can all exace well control risks in this environment. Therefore, the risk factors listed in Figure 11 be given special attention under these conditions. could lead to serious well control risks during subsequent drilling operations. These operational errors could result in the failure of the subsea tree system, posing a potential threat to well control safety. As shown in Figure 10, the personnel risks during the fourth drilling operation are analyzed. Under the special conditions of the shallow-water subsea tree development model, the equipment risks during the fourth drilling process mainly involve a comprehensive analysis of the drill pipe, pressure riser, and tree. For example, collisions between the drill pipe equipment and the subsea tree, loosening at the connection points leading to leaks, and damage to the protective devices and the body of the subsea tree can all exacerbate well control risks in this environment. Therefore, the risk factors listed in Figure 11 need be given special attention under these conditions. In the shallow-water subsea tree development model, external factors can increase operational risks on facilities and equipment. These external forces may include falling objects in the marine environment, ship anchoring, and fishing net entanglement, all of which can interfere with or damage the normal operation of the subsea tree. During the first three drilling processes, the risks posed by various items were analyzed, but at this stage, particular attention needs to be paid to the potential well control risks posed by falling heavy objects, foreign vessels, and maintenance materials. Falling heavy objec may cause damage to or abnormal operation of the subsea tree, inadvertent operation foreign vessels may lead to collisions or entanglement, and the incorrect use of maint nance materials may also pose hazards, as shown in Figure 12. During the fourth drilling operation, based on the analysis of the previous three o erations, this phase particularly focuses on environmental risks. These risks primari stem from the impact of adverse weather, geological, and biological conditions on the su sea production tree and its safety protection devices (as shown in Figure 13 ). nance materials may also pose hazards, as shown in Figure 12. During the fourth drilling operation, based on the analysis of the previous three o erations, this phase particularly focuses on environmental risks. These risks primar stem from the impact of adverse weather, geological, and biological conditions on the su sea production tree and its safety protection devices (as shown in Figure 13 ). Taking the intermediate layer risks in the fault tree as the object of quantitative analysis, as shown in Table 1, and using the bottom layer risks as discriminating factors, can better connect the internal causal relationships among various risks, facilitating experts in scoring. Employees failed to promptly detect well control incidents during drilling operations X 3

Employees did not immediately identify drilling equipment malfunctions X 4 Upon accident occurrence, on-site employees did not immediately shut down operating equipment and initiate emergency repairs X 5

Failure of drilling fluid circulation system equipment X 6

Wear and cracking of assembled drilling tools X 7

Wear and cracking of safety protection sealing devices X 8

Poor cementing quality (casing) X 9

Wear and cracking of pressure-bearing risers X 10

Loosening and detachment of equipment connections X 11 Poor quality of drilling mud system X 12 Poor quality of cement slurry system for cementing X 13 Lack of life-saving and rescue supplies X 14 Natural factors such as formation conditions and gas composition causing the formation of natural gas hydrates X 15 Natural factors like formation conditions and gas composition leading to dissolved gas degassing X 16 Natural phenomena such as tides and currents affecting the stability of the drilling platform X 17 Groundwater intrusion in shallow-water zones causing "salt layer" issues in the wellbore X 18 Small gas caps and weak edge/bottom water causing wellbore instability X 19 Harsh environmental conditions damaging equipment such as derricks and wellbores X 20

Harsh environmental conditions impacting employees' normal work operations Specific results regarding the degree of influence, degree of being influenced, centrality, and rationality of each factor are obtained from the comprehensive influence matrix, as shown in Table 2 (The relationship matrix of risk factors for the first three drilling operations, the direct in-fluence matrix, and the comprehensive influence evidence can be found in the Appendix Tables A1-A3 ). Both the centrality and causality of personnel risk are at relatively high levels, indicating that personnel risk holds a significant position in overall risk management and significantly influences other factors, thus being considered a primary causal factor. In contrast, the centrality of on-site equipment risk is high, but the causality is low, indicating its significant position in overall risk, primarily influenced by other factors, thus classified as a resultant factor. Additionally, the centrality of on-site environmental risk is relatively low, but the causality is high, indicating its relatively low importance in overall risk, yet significant influence on other factors, thus identified as a primary causal factor. Drilling fluid plays a crucial role throughout the drilling process, hence closely related to equipment risk and classified as a resultant factor. However, due to their lower importance in the comprehensive influence matrix, cementing systems and biological rescue materials are classified as secondary causal factors. Similarly, the intermediate layer risks in the fault tree can be used as objects of quantitative analysis, as shown in Table 3. Collision occurred between the drill pipe equipment and the shallow-water subsea tree equipment. Y 4

Loosening at the connection between the equipment and the production tree led to leaks. Y 5 Damage to protective device for shallow-water subsea trees Y 6 Damage to shallow-water subsea trees body Y 7

Heavy objects falling from water damage shallow-water subsea trees Y 8

Foreign ships damaging shallow-water subsea trees Y 9 Lack of maintenance materials. Y 10 Severe marine climate conditions damage shallow-water subsea trees Y 11 Severe geological conditions damage shallow-water subsea trees Y 12 Adverse marine biological conditions damage shallow-water subsea trees

Based on the aforementioned method, the intermediate layer was selected as the object for DEMATEL analysis, and the comprehensive influence matrix was calculated. Through the analysis, specific results regarding the degree of influence, degree of being influenced, centrality, and rationality of each factor were obtained, as detailed in Table 4 (The relationship matrix of risk factors for the fourth drilling operation, the direct influence matrix, and the comprehensive influence evidence can be found in the Appendix Tables A4-A6 ). During the first three drilling operations, since the subsea production tree had not yet been installed, the blowout preventer directly controlled the wellbore pressure (as shown in Figure 14 ). Through quantitative calculations, we found that the high-risk weights primarily stemmed from human operational errors, equipment failures, and the drilling fluid system among on-site items. These risks encompass various scenarios, including potential human operational errors or failure to execute timely the corresponding actions, wear and tear of drilling tools, failure of equipment connection seals, and poor quality of the drilling fluid system. These factors could lead to serious operational incidents or equipment failures, thereby affecting the safety of the drilling process.
section_name: Risk Identification in the Fourth Drilling Operation

section_content: 0. 726 0. 000 0. 726 0. 726 Y12 0. 553 0. 000 0. 553 0. 553
section_name: Y11

section_content: During the first three drilling operations, since the subsea productio yet been installed, the blowout preventer directly controlled the wellbor shown in Figure 14 ). Through quantitative calculations, we found that weights primarily stemmed from human operational errors, equipment fa drilling fluid system among on-site items. These risks encompass various cluding potential human operational errors or failure to execute timely the actions, wear and tear of drilling tools, failure of equipment connection s quality of the drilling fluid system. These factors could lead to serious op dents or equipment failures, thereby affecting the safety of the drilling pro
section_name: Extracting High-Risk Weights from the First Three Drilling Stages

section_content: The risk analysis for the fourth drilling operation is based on the exp the first three operations and considers the importance of the production tr the drilling process and its environmental impact (as shown in Figure 15 water environments, the production tree operates under special conditions, sideration of various possible marine environmental scenarios during in
section_name: Extracting High-Risk Weights from the Fourth Drilling Stages

section_content: The risk analysis for the fourth drilling operation is based on the experiences from the first three operations and considers the importance of the production tree throughout the drilling process and its environmental impact (as shown in Figure 15 ). In shallowwater environments, the production tree operates under special conditions, requiring consideration of various possible marine environmental scenarios during installation and operation, such as falling objects, ship anchoring, and fishing net entanglement. Through quantitative calculations and analysis, it was found that during the fourth drilling operation, high-risk weights are mainly concentrated on potential collisions between the production tree and other equipment, connection failures, and structural damage to the tree itself (as shown in Figure 6 ). Since underwater operations in shallow-water environments are susceptible to various external factors, the stability and integrity of the subsea production tree are particularly important. Abnormal adverse events could result in severe safety accidents or equipment damage. 

duction tree and other equipment, connection failures, and structural dam itself (as shown in Figure 6 ). Since underwater operations in shallow-water are susceptible to various external factors, the stability and integrity of the s tion tree are particularly important. Abnormal adverse events could result i accidents or equipment damage.
section_name: Extracting High-Risk Weights from the Fourth Drilling Stages

section_content: This study utilized STPA to map out comprehensively the people, ma als, and environment involved in the first three drilling operations and the operation of the shallow-water oil development model, thoroughly extractin risk factors. Subsequently, FTA was employed to explore the interrelatio these risk factors from the perspectives of personnel, equipment, items, an ment. We designated the second-layer factors from the FTA as calculation t plied the DEMATEL method to identify high-weight typical factors. Based sis, the specific conclusions are outlined below. 

The risks in the first three drilling stages primarily include improper erations, equipment failures, and inadequate emergency responses. Ad wear and loosening of connections in blowout preventers, risers, and drill nents, as well as instances of perforation are also critical risks. The curren shortcomings in drilling fluids, cementing materials, and lifesaving suppli exhibit poor physical and chemical properties. Furthermore, environmenta as the formation of shallow gas and hydrates along with strong winds and ing the drilling platform, pose significant threats to operational safety. Thro cation of the DEMATEL method for quantitative analysis, we identified hig in the first three drilling stages, encompassing a total of 11 risk factors, incl nel operations, equipment status, and drilling fluid system quality. 

In the fourth drilling stage, the shallow-water subsea tree operates working conditions in an underwater environment, necessitating considera possible marine scenarios, such as falling objects, ship anchoring, and fish glement. The focus of the fourth drilling stage is to analyze the risks assoc special working conditions that the subsea tree and its auxiliary eq
section_name: Conclusions

section_content: This study utilized STPA to map out comprehensively the people, machines, materials, and environment involved in the first three drilling operations and the fourth drilling operation of the shallow-water oil development model, thoroughly extracting the relevant risk factors. Subsequently, FTA was employed to explore the interrelationships among these risk factors from the perspectives of personnel, equipment, items, and the environment. We designated the second-layer factors from the FTA as calculation targets and applied the DEMATEL method to identify high-weight typical factors. Based on this analysis, the specific conclusions are outlined below. 

The risks in the first three drilling stages primarily include improper personnel operations, equipment failures, and inadequate emergency responses. Additionally, the wear and loosening of connections in blowout preventers, risers, and drill string components, as well as instances of perforation are also critical risks. The current project faces shortcomings in drilling fluids, cementing materials, and lifesaving supplies, which also exhibit poor physical and chemical properties. Furthermore, environmental factors, such as the formation of shallow gas and hydrates along with strong winds and waves damaging the drilling platform, pose significant threats to operational safety. Through the application of the DEMATEL method for quantitative analysis, we identified high-risk weights in the first three drilling stages, encompassing a total of 11 risk factors, including personnel operations, equipment status, and drilling fluid system quality. 

In the fourth drilling stage, the shallow-water subsea tree operates under special working conditions in an underwater environment, necessitating consideration of various possible marine scenarios, such as falling objects, ship anchoring, and fishing net entanglement. The focus of the fourth drilling stage is to analyze the risks associated with the special working conditions that the subsea tree and its auxiliary equipment may encounter. High-risk weights primarily stem from damage between the subsea tree and its auxiliary equipment, including collisions between drilling equipment and the subsea tree, punctures caused by loose connections, damage to the protective devices of the subsea tree, and structural damage to the subsea tree itself. 

(2) The fourth drilling phases:
section_name: Conclusions

section_content: Research on the Risk of Drilling Phases Based on the Development Model of Shallow-Water Subsea Trees.

section_content: Funding: This research was funded by the National key research and development program (No. 2022YFC2806504 ); National Natural Science Foundation of China (No. 52274026 ); CNOOC Research Project (No. KJGG-2022-17-04, KJGJ-2023-0002 ). Institutional Review Board Statement: Not applicable. Informed Consent Statement: Not applicable.

section_content: Data Availability Statement: Data are contained within the article.

section_name: Conflicts of Interest:

section_content: Author Contributions: Data curation, Y. M. ; Funding acquisition, Z. Y. ; Investigation, H. W. and C. X. ; Methodology, Z. Y. ; Validation, M. R., X. Y. and D. T. ; Writing-original draft, Z. Y. ; Writing-review and editing, C. X. and J. Q. All authors have read and agreed to the published version of the manuscript.

section_content: Authors Zhiming Yin, Meipeng Ren, Yingwen Ma, Xiangqian Yang, Deqiang Tian, and Haiwei Wang are employed by CNOOC Research Institute Co., Ltd. The authors declare that this study received funding from CNOOC Research Institute Co., Ltd. The funder was not involved in the study design; the collection, analysis, and interpretation of the data; the writing of this article; or the decision to submit it for publication. 

Appendix A (1) The first three drilling phases:
section_name: Conflicts of Interest: