Journal of Loss Prevention in the Process Industries 68 (2020) 104326

Contents lists available at ScienceDirect

Journal of Loss Prevention in the Process Industries

journal homepage: http://www.elsevier.com/locate/jlp

Application of dynamic risk analysis in offshore drilling processes

Bijay B *, Priscilla George, V.R. Renjith, Anish Job Kurian
Safety and Fire Engineering Division, School of Engineering, Cochin University of Science and Technology, Kerala, India

A R T I C L E I N F O A B S T R A C T

Keywords: Process safety is the common global language used to communicate the strategies of hazard identification, risk
Bow-tie analysis assessment and safety management. Process safety is identified as an integral part of process development and
Dynamic risk assessment focuses on preventing and mitigating major process accidents such as fires, explosions, and toxic releases in
Bayesian network
process industries. Accident probability estimation is the most vital step to all quantitative risk assessment
Kick
Drilling
methods. Drilling process for oil is a hazardous operation and hence safety is one of the major concerns and is
often measured in terms of risk. Dynamic risk assessment method is meant to reassess risk in terms of updating
initial failure probabilities of events and safety barriers, as new information are made available during a specific
operation. In this study, a Bayesian network model is developed to represent a well kick scenario. The concept of
dynamic environment is incorporated by feeding the real-time failure probability values (observed at different
time intervals) of safety barriers to the Bayesian network in order to obtain the corresponding time-dependent
variations in kick consequences. This study reveals the importance of real-time monitoring of safety barrier
performances and quantitatively shows the effect of deterioration of barrier performance on kick consequence
probabilities. The Macondo blowout incident is used to demonstrate how early warnings in barrier probability
variations could have been observed and adequately managed to prevent escalation to severe consequences.

1. Introduction significantly. Deepwater oil production, as a percentage of all oil pro­

duced in the Gulf of Mexico, increased from 4 percent in 1990 to more
Prominent risk assessment techniques for envisaged accident sce­ than 80 percent in 2014. Deepwater drilling operations are considered
narios in the offshore drilling includes quantitative risk assessment to be more complicated than shallow-water and land-based drilling,
(QRA), probabilistic safety analysis (PSA), and maximum credible ac­ thereby increasing associated safety and environmental risks. One of the
cident analysis. Although these methods consist of different steps and most devastating accident with severe consequences in the offshore oil
follow specific procedures, accident scenario identification in terms of and gas industry is a blowout, such as the Macondo blowout accident
both mechanism and likelihood is a common and central step to all of (Rathnayaka et al., 2013). Accident history records reveals that the
them. majority of past offshore kick/blowouts occurred during the drilling
Efficient risk analysis techniques prevents accidents and helps in phase. A blowout is an unrestrained flow of gas and oil (hydrocarbons)
identifying appropriate mitigation measures. It is of great relevance and to the environment (Khakzad et al., 2013a). Many blowout accidents
applicability in offshore drilling operations due to challenges in safety have occurred in offshore drilling operations around the globe. The most
measures arising from the harsh environment and remoteness. While recent and most devastating environmental disaster in U.S history is the
conventional risk assessment methods play an important role in identi­ Macondo blowout of April 20, 2010. This accident was caused by a series
fying major risks and sustaining safety in petroleum industries, they of technical factors (Rathnayaka et al., 2013).
have the disadvantage of being static and using generic failure data. The Nowadays, drilling industries are opting to drill deeper wells
static structure of conventional risk assessment methods fails to catch up offshore, which in turn involves more uncertainty owing to the higher
with the variations which occur during the operational time of a drilling conditions of pressure and temperatures involved. Drilling Industries
process. Also, use of generic data prevents the analysis from being case- should take necessary steps to ensure safe operations, while Bureau of
specific and introduces uncertainty into the results. Safety and Environmental Enforcement (BSEE) must fulfil its mandate
Over the past 25 years, deep water drilling has increased for enforcing offshore safety and environmental regulations on the Outer

* Corresponding author.
E-mail address: [email protected] (B. B).

https://doi.org/10.1016/j.jlp.2020.104326
Received 16 June 2020; Received in revised form 15 September 2020; Accepted 14 October 2020
Available online 17 October 2020
0950-4230/© 2020 Elsevier Ltd. All rights reserved.
B. B et al. Journal of Loss Prevention in the Process Industries 68 (2020) 104326

continental shelf (OCS). Recent advancements in technology enables of the case study and illustrates the development of risk assessment
efficient monitoring of equipment and sensors to capture data which models used in the study. Sections 5 and 6 gives the results and dis­
may be used for trend analysis and anomaly detection on the offshore cussion and the conclusions drawn from the study.
drilling units (Booth, 2009). Moreover, surface measurements and
downhole tool readings may be used to dynamically monitor drilling 2. Literature review
processes.
Safety management of offshore drilling operations demands contin­ There are numerous studies based on Bayesian Networks and Dy­
uous monitoring of the safety performance and safety indicators of the namic Bayesian Networks following the Deepwater Horizon accident.
system. They are also affected by several time-dependent effects such as Most of them pertain to the estimation of kick occurrence probabilities,
season changes, ageing of equipment/components, sequential de­ reliability analysis of blow out preventers (BOP), finding main contrib­
pendencies, operator experiences and operation time, inspection and utors to failure of BOP and comparison of drilling techniques.
testing time interval etc. Safety indicators provide information Khakzad et al. (2013b) demonstrates the use of bow-tie analysis and
regarding the level of safety in a system, to decision makers so that the Bayesian networks for conducting risk assessment of offshore drilling
decision makers can activate safety systems wherever the level of safety operations and brings out the advantages of Bayesian networks. The
in the system is below the acceptable range (Skogdalen and Vinnem, concept of Object-Oriented Bayesian Networks (OOBNs) consisting of
2011). Most of the approaches adopted in risk analysis of offshore both instance nodes (sub-networks) and usual nodes are introduced.
drilling operations are analytical methods (Khakzad et al., 2013a), This paper highlights the disadvantage of bow-tie model in capturing the
(Kujath et al., 2010), (Skogdalen and Vinnem, 2011), (Xue et al., 2013). conditional dependencies between various nodes and maps the devel­
However, analytical techniques do not take into consideration the oped bow-tie into an Object-Oriented Bayesian network to overcome
probabilistic dependencies (structure) among well specific data. This this. OOBNs have the additional advantage of simplified representation
calls for the need of dynamic risk assessments. Dynamic risk assessment of complex networks by use of instance nodes.
methods are capable of taking new information into account and tailors Subsea blowout preventers are used to ensure safe operation of
itself to the dynamic environment, which is dominant in process system drilling processes. Hence it is very important to assess the reliability of
risk and safety analyses. It may be employed at the design phase of a blowout preventers and perform periodic maintenances. Liu and Liu
process system and also during the system’s entire life time as a decision (2019) discusses the development of a Bayesian network model to
support and risk management tool. Dynamic risk assessment methods analyse the reliability of subsea blowout preventers.
takes advantage of case specific data and updating mechanisms to revise Cai et al. (2013) develops individual Bayesian networks for five
the failure probabilities obtained from the initial generic data in the factors affecting the operations of offshore oil and gas industry such as
design phase of the system (Berdouzi et al., 2018). human, hardware, software, mechanical and hydraulic factors. Bayesian
Among many available techniques, bow-tie model (BT) is very pop­ Networks are developed from flow diagrams of subsea BOP operations.
ular because it represents the complete accident scenario comprising of The basic events leading to the above five factors affecting the operation
both causes and consequences. However, it suffers from having a static of BOP are identified and the probability values are assigned by expert
structure limiting its application in real-time risk monitoring and elicitation.
probability updating which are key features in dynamic risk analysis Bhandari et al. (2015) makes a risk comparison for two drilling
(Khakzad et al., 2012). Bayesian approaches are emerging as the most techniques, namely, Managed Pressure Drilling Operations (MPD) and
widely used form of dynamic risk assessments, which employs new data Underbalanced Drilling (UBD). The blowout sequence for these two
in the form of likelihood functions to update prior failure rates. Bayesian technologies are modelled using Bayesian Networks to compute the
Network (BN) is a probabilistic technique for demonstrating a set of blowout occurrence probability. It was observed that UBD technology
random variables and corresponding conditional dependencies using a resulted in higher blowout occurrence probability than MPD technol­
directed acyclic graph based on probability theory and graph theory. In ogy. Abimbola et al. (2014) have used a Bow-Tie model to represent
Bayesian Networks, each node represents variables carrying information different drilling techniques and makes a comparison across the
element (e.g., root events, safety barriers and consequences). The different techniques. Abimbola et al. (2014) focuses on developing
directed edge between nodes illustrates conditional dependencies i.e., predictive models for failure probabilities of barriers using physical
the degree of association between the connected nodes. Based on the reliability models.
type and strength of the relationship between the nodes, conditional Tamim et al. (2019) discusses the development of decision support
probability tables are assigned to the nodes. Most conditional proba­ algorithms based on real-time indicators to study the development and
bility tables (CPTs) corresponds to conventional AND/OR gate logic progression of kick scenarios.
(Bobbio et al., 2001) (Lampis and Andrews, 2009). Due to its flexible Dynamic models with time-dependent output are extensively used in
structure and probabilistic reasoning, Bayesian network is an effective engineering for decision making and risk assessment. Dynamic risk as­
technique for modelling and performing the safety analysis of complex sessments enables the employees to identify a potentially dangerous
systems (Khakzad et al., 2012). environment or situation and take appropriate steps to either leave the
The present study aims to perform a dynamic risk assessment of environment or remove the risk before it escalates into an accident (Villa
offshore drilling processes. The hazards and underlying accident sce­ et al., 2016) (Boudali and Dugan, 2005). The first complete Dynamic
narios associated with offshore drilling blowouts are identified and a Risk Assessment methodology for process facilities, termed as Dynamic
Bow-tie model is developed to represent well kick and its mitigation Failure Assessment, was developed by Meel and Seider (2008). This
barriers. This model is then converted to a Bayesian network model and approach aims at estimating the dynamic probabilities of accident se­
real-time monitored rig-specific data is used to update failure proba­ quences, including near misses and incident data (named as Accident
bilities of safety barriers. The objective of this study is to highlight the Sequence Precursors – ASP) as well as real-time data from processes (Li
importance of real-time monitoring of safety barrier performances and et al., 2019). This method was applied to several case studies, such as
to quantitatively show the effect of deterioration of barrier performance CSTR reactor safety systems, Ethyl Benzene process, and alarm systems
on kick consequence probabilities. The time-dependent probability for process equipment (Pariyani et al., 2012). Dynamic Risk Assessment
variations of barriers are fed to the Bayesian network to obtain corre­ (DRA) was further developed by (Kalantarnia et al., 2009), where ac­
sponding time-dependent variations in kick consequences. cident precursors were used to update the risk profile.
The paper is organized as follows. Section 2 gives a brief literature During different phases of offshore drilling, the risk of accidents may
review of dynamic risk assessment. Section 3 describes the methodology vary with time, and such dynamicity should be recorded in risk assess­
involved and the materials used in the study. Section 4 provides details ment. Zhang et al. (2018) presents a method for the application of

2
B. B et al. Journal of Loss Prevention in the Process Industries 68 (2020) 104326

dynamic Bayesian networks (DBNs) in accident scenario analyses and 3.1.3. Accident process modelling
dynamic quantitative risk assessment. The vulnerable root causes are Bayesian network is a relatively new technique in the field of process
identified by sensitivity analysis for accident prevention and mitigation safety and risk analysis. Application of Bayesian network in risk analysis
measures. is very advantageous as it can combine the expert judgment and quan­
Wu et al. (2016) uses a dynamic Bayesian network based approach to titative knowledge to estimate risk. Also, Bayesian networks can capture
take into consideration the effect of equipment degradation and the changes of variables with time through reasoning process. This dy­
real-time changes in parameters on risk evolution and proceeds to namic risk methodology has the ability to provide updated probability
determine root causes for lost circulation. with time, to incorporate inspection and testing time interval, which
Zhang et al. (2018) makes use of DBNs to investigate the safety as­ shows its effect on the critical event probability. The prior failure
pects of managed pressure drilling (MPD) techniques. The effect of un­ probability of safety barriers and the occurrence probability of conse­
certain risk factors and degradation are also taken into consideration to quences can be obtained by Bayesian forward analysis (Khakzad et al.,
estimate the dynamic risk. Sensitivity analysis is performed to identify 2013b).
critical root causes of kick scenario. Wu et al. (2019) performs dynamic In this study, initially a fault-tree model is developed to represent the
risk analysis of hydrogen sulphide leakage during MPD technique. basic events leading to kick scenario. An event-tree model with initiating
The probabilistic relationships (structure) among the primary oper­ event as kick occurrence and the associated identified safety barriers is
ational (drilling) parameters are modelled using the Bayesian Tree also developed to represent all possible consequence paths. A Bow-Tie
Augmented Naïve Bayes (TAN) algorithm in (Adedigba et al., 2018). The model representing the complete cause-consequence model of kick
developed model predicts the time-dependent probability of kicks, and scenario is then developed by combining the fault-tree and event-tree,
is continuously updated based on the current state of key drilling pa­ which is then converted in a Bayesian network model. The basic event
rameters. The blowout risks are modelled as a function of time by using failure probabilities are taken from OREDA database (OREDA, 2002).
the real-time probability of kick. The dynamic risk profile generated The prior probability provides a snapshot of likelihood of failure.
from the model is useful in operational decision making to prevent ac­ However, it fails to provide better understanding of how a system de­
cidents and enhance the safety of drilling operations. teriorates with time. Similarly, the prior risk provides understanding of
Shalev and Tiran (2007) introduced condition-based fault tree in risk at a given time; however, it is not able to change with time or the
which failure rates of components are periodically updated using in­ situation. Therefore, it is not preferable to derive safety critical decisions
formation obtained through predictive maintenance. Consequently, the based on prior risk.
failure probability of the top event is updated by recalculating the fault The real-time failure probability values (observed at different time
tree (FT) for new failure rates. Čepin and Mavko (2002) developed an intervals) of identified safety barriers are fed to the Bayesian network in
extension of the well-established fault tree to represent time re­ order to obtain the corresponding time-dependent variations in kick
quirements in safety systems and Bucci et al. (2008) presented a meth­ consequences.
odology to extend fault trees and event trees in a dynamic perspective.
Chang et al. (2019) is a fatigue failure risk analysis based on DBN, 3.2. Safety barriers for offshore drilling and its functions
where previously accumulated fatigue of wellhead is used to probabi­
listically predict the dynamic fatigue failure of the wellhead during its 3.2.1. Well contorl barrier (WCB)
service life. The main purpose of the WCB is to prevent reservoir fluid entering
The objective of this study is to highlight the importance of real-time the wellbore. The WCB is divided into three main sub barriers: primary
monitoring of safety barrier performances and to quantitatively show WCB, secondary WCB, and operational barrier, the primary WCB con­
the effect of deterioration of barrier performance on kick consequence sists of two elements: (1) the drilling fluid column (usually mud), to
probabilities. The study also brings out the importance of paying prevent hydrocarbon entering prior to the cement job, and (2) primary
attention to early warnings to prevent severe consequences. cement job to seal off the annular space around the casing to achieve
zonal isolation. The density of the drilling mud, if properly designed and
3. Materials and methods operated, is set to provide overbalance compared with the reservoir pore
pressure; thus, the hydrostatic pressure represented by the mud column
This section discusses the materials and methodologies involved in prevents the well from flowing. The secondary WCB consists of me­
this study. chanical equipment, such as the shoe track, seal assembly, and casing.
They serve as passive barriers and function continuously without any
3.1. Steps in dynamic risk assessment external action. Operational barriers are in place to prevent influx owing
to operational errors. Cement evaluation tools, such as the cement bond
3.1.1. System definition log, volume and pressure indicators, casing programs, and procedures
The first step in dynamic risk assessment method is defining the are examples of operational barriers. The influx enters the wellbore once
system boundaries. Understanding the systems, subsystems, system in­ the WCB has failed to control the fluid pressure in the formation or has
terfaces and their interactions is critical in identifying the hazards, ac­ failed to achieve zonal isolation. A kick (unwanted influx of fluid or gas
cident processes and safety barriers. This study is limited to offshore into the wellbore) will occur as a result of failure of the WCB. To control
drilling process. the kick, it must first be detected and then stopped from progressing by
activating barriers (Rathnayaka et al., 2013).
3.1.2. Hazard identification and analysis
Once the system and its boundaries are defined the next step is 3.2.2. Influx mitigation barrier (IMB)
hazard identification and its analysis. This step identifies the most likely The main purpose of the IMB is to prevent reservoir fluid entering the
scenarios, types of failures and end-states associated with an incident. surface and to conduct pressure integrity tests, seal assembly pressure
After determining the scenario, the initiating abnormal event and all test, positive pressure test, and negative pressure test to verify the
safety systems serving as protective layers to reduce or eliminate the integrity of the well (Rathnayaka et al., 2013) (Kujath et al., 2010). This
effect of that event are identified. The identified safety barriers for is to ensure that nothing could leak in or out during the intervening time.
offshore drilling processes are Well Control Barrier (WCB), Influx Miti­ After installing the casing, a seal assembly test is conducted to check the
gation Barrier (IMB), Ignition Prevention Barrier (IPB), Escalation Pre­ integrity of the interface between the casing and the well head. The
vention Barrier (EPB), Emergency Mitigation Barrier (EMB) And positive pressure test checks the integrity of the well by testing whether
Management & Organizational Barrier (M&OB) (Kujath et al., 2010). the casing and well head seal assembly can contain the high pressure

3
B. B et al. Journal of Loss Prevention in the Process Industries 68 (2020) 104326

that surrounds them. It does not check the integrity of the cement of the to face any level of an emergency situation. The crew must include
shoe track. The negative pressure test checks the integrity of the cement trained medical persons for immediate medical treatments. However,
at the bottom of the well. Two sub-barriers are assigned to detect and there are many challenges in preparing the crew to deal with real-life
respond to the kick accordingly. The down-hole and surface conditions emergency situations and unanticipated events. In addition to tech­
are examined using various indicators. These indicators include pit gain, nical failures, management and organizational failures always
flow-out versus flow-in, drill pipe pressure, and gas content in the mud. contribute to oil and gas accidents. Particularly for the Macondo well
Kick detection instruments are placed in many locations within the rig to blowout, many of the technical failures can be traced back to manage­
generate an early warning about the kick, to create automatic action to ment and organizational errors (Rathnayaka et al., 2013). Therefore,
control it, and to enhance awareness of the operators. Once a kick is sufficient barriers should be applied to avoid management and organi­
identified, the rig crew should respond to it quickly and according to zational failures. The management and organizational barrier represent
procedures. Annular preventer rams of the BOP act as a primary barrier show deficiencies of factors, such as standard practices, procedures,
in case any kick event occurs. programs, expert knowledge, better risk management programs, and
communication lead to this barrier failure.
3.2.3. Ignition prevention barrier (IPB)
The main purpose of the ignition prevention barrier (IPB) is to pre­ 4. Case study
vent unintentional breakthrough of fire in rig surface (Rathnayaka et al.,
2013) (Kujath et al., 2010). An uncontrolled hydrocarbon release may In this study, a Bayesian network model is developed to represent the
ignite in the presence of an ignition source. Therefore, a set of barriers well kick scenario. The prior failure probabilities for basic events and
needs to be in place to keep hydrocarbon concentrations below the lower barriers are incorporated from OREDA database (OREDA, 2002). The
explosive limit and to avoid ignition sources contacting the combustible time-dependent variations in barrier probabilities were incorporated
mixture. If gaseous hydrocarbon moves past the BOP through annulus, it from (Rathnayaka et al., 2013) in order to study the corresponding
is diverted to either overboard lines or the MGS. The decision depends variations in kick consequences.
on the size of the influx in the riser. The MGS is obviously suitable for
small quantities of mixture of a mud and hydrocarbon. It separates mud 4.1. Fault tree model
from gas and allows the crew to collect and reuse the mud rather than
discharge it overboard into the sea. In the case of a large hydrocarbon The Fault Tree Analysis (FTA) is a technique to explore the potential
influx in the riser, the flow must be sent through overboard diverter or actual causes of system or product failure. FTA is a top-bottom
lines. A properly designed heating, ventilation, and air conditioning analysis method where it starts with a cause till the consequence in a
system is another important barrier. This prevents gas entering areas structured manner. And by usage of gates, it is easier to calculate the
such as the engine and compressor rooms where potential ignition most and least likely paths of failure. The fault tree diagram, with well
sources exist. Fire and gas systems are installed to take automated ac­ kick as the top event, is drawn from the HAZOP study created from the
tions upon detection of combustible gas. During the design stage, the available rig information. Usually, a kick propagates to a blowout due to
space or area of the rig is divided and classified based on the probability either failure of secondary barriers or as a result of non-detection of the
and possibility of containing an explosive gas–air mixture. Specially kick, which prevents the activation of kick preventing barriers. The
designed electrical equipment is installed and tested on a regular basis to Fault-tree in Fig. 1 consists of 24 basic events which shows the signifi­
ensure it does not initiate an explosion. Furthermore, passive barriers cance of drilling pressure and well integrity check during process. The
are installed to prevent ignition by spark, friction, impact, and hot failure probabilities of the basic events are listed in Table 1.
surfaces. During a drilling operation, the drilling mud is used as the well’s
primary safety barrier to ensure that the wellbore’s bottom hole pressure
3.2.4. Escalation prevention barrier (EPB) (BHP) is higher than the pore pressure (PP) and at the same time less
The function of the escalation prevention barrier (EPB) is to mitigate than fracture pressure (FP). This relationship among these vital drilling
or prevent the escalation of the blowout incident to a catastrophic or parameters must be maintained to prevent the formation fluids from
disastrous event. The key barrier is the BOP system; the fire/explosion flowing into the wellbore and to ensure that the formation is not frac­
mitigation barrier is also installed to mitigate spreading of fire and ex­ tured (Khakzad et al., 2013a). The bottom hole pressure should be
plosion. The BOP is designed to prevent hydrocarbon influx through the maintained between fracture pressure and pore pressure. The pressure
annulus or through the drill pipe. It was also designed to shut the well in difference between BHP and PP are varied based on the method of
case of an uncontrollable blowout. The blind shear ram (BSR) is drilling. If differential pressure is positive, it doesn’t lead to kick con­
designed to cut the drill pipe and shut the well in an emergency well dition. If the differential pressure is negative, it leads to kick.
control situation. Activation of the BSR is obtained in five ways in the
Deepwater Horizon BOP: direct activation of the ram by pressing a 4.2. Event tree model
button on a control panel on the rig, activation of the EDS by rig
personnel, direct subsea activation of the ram by a remotely operated Event Tree Analysis (ETA) is a forward, bottom-up, logical modelling
vehicle (ROV) (hot stab intervention), activation by the automatic mode technique for both success and failure that explores responses through a
function (AMF) or ‘‘deadman’’ system owing to emergency conditions or single initiating event and lays a path for assessing probabilities of the
initiation by ROV, and activation by the ‘‘autoshear function’’ if the rig outcomes and overall system analysis. This analysis technique is used to
moves off location without initiating the proper disconnect sequence. analyse the effects of functioning or failed systems given that an event
However, even if properly activated, the BSR may fail to seal the well has occurred. This technique may be applied to a system early in the
because of design and mechanical limitations, such as overlapping of design process to identify potential issues that may arise, rather than
tool joints (Rathnayaka et al., 2013) (Kujath et al., 2010). correcting the issues after they occur. The event tree diagram for the
well kick consisting of the safety barriers is shown in Fig. 2. The failure
3.2.5. Emergency mitigation and management and organizational barrier probabilities of safety barriers are listed in Table 2.
(EMB & M&OB)
The crew members face various challenges during their efforts to 4.3. Bow-tie model
evacuate the rig, especially in a catastrophic situation. Therefore,
adequate emergency drills and training must be implemented. It is The Bow-Tie method is a risk evaluation method that can be used to
important that a rig have a comprehensive emergency preparedness plan analyse and demonstrate causal relationships in high risk scenarios. A

4
B. B et al. Journal of Loss Prevention in the Process Industries 68 (2020) 104326

Fig. 1. Fault tree diagram for well kick.

tree together as shown in Fig. 3.

Table 1
Failure probability data of Basic Events (OREDA, 2002).
Basic Description of Basic Events Probability of 4.4. Bayesian Network
Events Failure

BE01 Exposure to high pressure layer of formation 2.00 × 10− 2 The Bayesian Network representing the kick scenario was developed
BE02 Hydrocarbon pressure 2.00 × 10− 1
using GeNIe 2.3 Academic software (shown in Fig. 4) from the devel­
2
BE03 Pump failure 4.00 × 10− oped Bow-Tie model. The prior failure probabilities for basic events and
4
BE04 Power failure 2.70 × 10−
4
barriers are entered from Tables 1 and 2 The prior occurrence proba­
BE05 Plug annulus 1.00 × 10−
BE06 Annular loss 1.00 × 10− 2 bilities for Kick and consequences are obtained by forward propagation
BE07 Fluid damage due to formation failure 1.00 × 10− 2 in Bayesian network (Shown in Fig. 5). The occurrence probabilities for
BE08 Effect of temperature on drilling fluid 3.00 × 10− 3
consequences are listed in Table 3.
2
BE09 Effect of oil/gas/water entering drilling fluid (cut 5.00 × 10−
mud)
BE10 Error in density measurement equipment 2.00 × 10− 4 5. Results and discussions
2
BE11 Operator error in mixing drilling fluid density 4.00 × 10−
BE12 Poor design 2.00 × 10− 3
The highlight of this study is in monitoring the variations in the
2
BE13 Geographical and geological condition 1.25 × 10− probability of barriers in order to predict the changes in occurrence
3
BE14 Improper drainage of tubes 1.00 × 10−
BE15 Error in inspecting drill tube 1.00 × 10− 3 probabilities of consequences-this shows the effect of deterioration of
BE16 Error in inspecting cementing 1.00 × 10− 3 barrier performance in leading to kicks. The monitored probability value
BE18 Error in cement mixing 3.00 × 10− 2
of each barriers is updated and subsequent change in consequence
2
BE19 Contaminating cement mud with drilling mud or 1.00 × 10− probability is noted in this study. The study brings out the importance of
other corrosive fluids
4 paying attention to early warnings to prevent severe consequences.
BE20 Error choosing type of cement class 5.00 × 10−
BE21 Error in measuring cement weight correctly 5.00 × 10− 3 In the present work, the performance of three main safety barriers-
BE21 Cement shrinkage 5.00 × 10− 3 WCB, IMB, and M&OB are primarily discussed. This does not imply that
BE22 Inadequate drilling mud to replace cement from 5.00 × 10− 3
other barriers are less important. The barrier performance is time
tube variant and important in evaluation of the safety integrity of the well.
3
BE23 Cement spillage through drilling formation 1.00 × 10−
BE24 Error in calculating amount of cement needed for 5.00 × 10− 3 We already know from many associated investigation reports that the
the pipe blowout resulted from technical factors such as annulus cement barrier
failure, shoe track and seal assembly failure, mud gas separator failure,
blowout preventer failure, and management and organizational failures.
Bow-Tie model gives a visual summary of all possible accident scenarios WCB barrier involves primary cementing barrier, seal assembly and shoe
that could exist around a certain hazard and the barriers set up to control track. WCB failure results in kick, which is to be detected and mitigated
those scenarios. The resulting Bow-Tie diagram for the critical event of by IMB barrier by means of associated pressure tests and integrity tests.
well kick is obtained by combining their respective fault tree and event Monitoring the performances of these two barriers is expected to reveal

5
B. B et al. Journal of Loss Prevention in the Process Industries 68 (2020) 104326

Fig. 2. Event tree diagram.

and organization decisions were successful at that particular time.

Table 2
Moreover, it may also integrate some other linked decisions and man­
Failure probability data of Barriers (OREDA, 2002).
agement and organizational errors that were made previously, such as 1)
BARRIERS FAILURE PROBABILITY inadequate communication and excessive compartmentalization of in­
Well control barriers (WCB) 0.0713 formation, 2) the inability to use internal experts effectively, and 3)
Influx mitigation barrier (IMB) 0.0643 conflicts and confusion between managers regarding who are account­
Ignition prevention barrier (IPB) 0.1377
able for critical decisions.
Escalation prevention barrier (EPB) 0.1110
Emergency management barrier (EMB) 0.1088
The time-dependent variations in failure probabilities of WCB, IMB,
Management & Organizational barrier (M&OB) 0.1207 and M&OB, incorporated from (Rathnayaka et al., 2013), are shown in
Tables 4–6 respectively.
The resulting real-time variations in occurrence probabilities of
early warnings for the accident under consideration for this particular consequences due to probability variations in barriers are listed in
study. M&OB is also incorporated in this study as management and Table 7.
organizational factors affect all stages of an accident evolution. It is due SAFE, KICK, BLOWOUT, FIRE & EXPLOSION AND, CATASTROPHIC
to this prior knowledge from investigation reports, that the monitoring FAILURE are the five different states of the consequence node. The
has been limited to these three barriers. In an actual drilling process, updated values for these five states at different time instants are ob­
real-time monitoring of all concerned barriers are required. tained by feeding the real-time monitored values of barriers into the
The failure probability of WCB (mainly comprised of primary Bayesian network. For example, at time 00:05, the failure probabilities
cementing barrier, mud circulation, operational barrier and mechanical of barriers WCB, IMB and M&OB are 0.0375, 0.0100 and 0.0650
barrier) drastically changes overtime and get seriously compromised. respectively. These are fed to the developed Bayesian network and the
Once the crew identifies that WCB has failed, preventive measures (such consequence node probabilities are estimated as SAFE = 0.9875,
as remedial cementing or preparation for annular BOP activation) may KICK = 0.0122, BLOWOUT = 0.0001, FIRE & EXPLO­
be applied to prevent further escalation. It is not possible for the crew to SION = 7.090 × 10− 06 and CATASTROPHIC FAILURE = 8.852 × 10− 07.
get the well back online if WCB fails critically. The performance of the By changing the barrier values with real-time values at each time
IMB, which consists of pressure integrity testing (negative pressure, instant, the corresponding updated consequence values are estimated.
positive pressure and seal assembly test), cement logging and evaluation The same procedure is repeated for different time slots.
tools, and annular preventer, is also critical to establish the well integ­ From Table 7 it is evident that at the starting time of drilling oper­
rity. Any kind of misprint in negative pressure test can make it as an ation, at time 0:05Hrs, the probability of safe condition was about 98%
escalation factor for well blowout. and the occurrence probability of kick was as low as 1.2%. As time
It is important to study the performance of M&OB barrier as it plays a progressed, at 16:45Hrs, the probability for safe condition started fluc­
critical role in well integrity and decision making. The failure proba­ tuating and eventually decreased to 86% at 21:45Hrs. Similarly, it can
bility profile of M&OB in Table 5 depicts quantitative performance pa­ be noted that by 21:45Hrs, the probability for blowout and fire and
rameters, such as efficiency, accuracy, adequacy, timeliness, and explosion increased to a significant value. The probability for cata­
appropriateness of management and organizational decisions. A failure strophic failure due to well kick was raised from 8.852 × 10− 07 to
probability variation at any time indicates to what extent management

6
B. B et al. Journal of Loss Prevention in the Process Industries 68 (2020) 104326

Fig. 3. Bow-Tie diagram for well kick.

Fig. 4. Bayesian Network diagram using GeNIe.

4.040 × 10− 04 in the course of time. This shows that the time dependent variations and deterioration of
The increase in consequence failure value for fire & explosion and barrier performance results in corresponding time dependent variations
catastrophic failure at 21:45 is due to the barrier performance being in occurrence probabilities of well kick and its consequences. Hence this
compromised as observed in Tables 4–6. The failure probabilities of study reveals the importance of real-time monitoring of safety barrier
barriers are observed to start fluctuating largely from 16:45 onwards. performances. Taking suitable and timely actions by observing
The first explosion in Macondo well occurred at around time 21:49. This abnormal variations in failure probabilities of barriers can prevent
was followed by a second explosion at about 10 s later. This is expected adverse consequences.
by the increase in probability values of fire & explosion and catastrophic
failure at 21:45. This could have been prevented if early warnings at
16:45 were observed and adequately managed.

7
B. B et al. Journal of Loss Prevention in the Process Industries 68 (2020) 104326

Fig. 5. Occurrence probabilities of consequences.

Table 3 Table 5
Probability of consequences using GeNIe. Probability variation of IMB (Rathnayaka et al., 2013).
CONSEQUENCE PRIOR OCCURRENCE PROBABLITY INFLUX MITIGATION BARRIER VARIATION WITH TIME PROBABILTY
(Hrs) VARIATION
SAFE 0.97641
KICK 0.02206 00:05 0.0100
BLOWOUT 0.00130 01:45 0.0100
FIRE & EXPLOSION 0.00018 03:45 0.0100
05
CATASTROPHIC FAILURE 2.31781 × 10− 05:05 0.0100
06:45 0.0100
08:25 0.0270
10:05 0.0270
Table 4 11:45 0.0270
Probability variation of WCB (Rathnayaka et al., 2013). 13:25 0.0200
15:05 0.0200
WELL CONTROL BARRIER VARIATION WITH TIME PROBABILTY
16:45 0.0520
(Hrs) VARIATION
18:25 0.2000
00:05 0.0375 20:05 0.2200
01:45 0.0125 21:45 0.4500
03:45 0.0125
05:05 0.0125
06:45 0.0120
08:25 0.0250 Table 6
10:05 0.0250 Probability variation of M&OB (Rathnayaka et al., 2013).
11:45 0.0200
MANAGEMENT & ORGANIZATIONAL BARRIER PROBABILTY
13:25 0.0220
VARIATION WITH TIME (Hrs) VARIATION
15:05 0.0230
16:45 0.0370 00.05 0.0650
18:25 0.0875 01.45 0.0250
20:05 0.1000 03:45 0.0250
21:45 0.2000 05:05 0.0220
06:45 0.0230
08:25 0.0440
6. Conclusions 10:05 0.0440
11:45 0.0400
13:25 0.0400
Accident probability estimation is the most vital step to all quanti­ 15:05 0.0590
tative risk assessment methods. The dynamic capability of Bayesian 16:45 0.0850
networks is illustrated in this study by developing a BN model using 18:25 0.0890
GENIE software to represent the kick scenario. The concept of dynamic 20:05 0.0870
21:45 0.0910
environment is incorporated by feeding the real-time failure probability
values (observed at different time intervals) of identified safety barriers
to the Bayesian network for Macondo blowout incident. The failure
probability values of three safety barriers (well control barrier, influx

8
B. B et al. Journal of Loss Prevention in the Process Industries 68 (2020) 104326

Table 7
Real-Time monitored consequence probability values.
Time (Hrs) SAFE KICK BLOWOUT FIRE&EXPLOSION CATASTROPHIC FAILURE
− 04 − 06 07
0:05 0.9875 0.0122 1.000 × 10 7.090 × 10 8.852 × 10−
05 06 07
1:45 0.9958 0.0040 3.868 × 10− 2.363 × 10− 2.950 × 10−
05 06 07
3:25 0.9958 0.0040 3.868 × 10− 2.363 × 10− 2.950 × 10−
05 06 07
5:05 0.9958 0.0040 3.868 × 10− 2.363 × 10− 2.832 × 10−
05 06 06
6:45 0.9960 0.0039 3.713 × 10− 2.268 × 10− 1.593 × 10−
04 05 06
8:25 0.9917 0.0080 2.000 × 10− 1.276 × 10− 1.593 × 10−
04 05 06
10:05 0.9917 0.0080 2.000 × 10− 1.276 × 10− 1.274 × 10−
04 05 06
11:45 0.9933 0.0064 1.000 × 10− 1.021 × 10− 1.038 × 10−
04 06 06
13:25 0.9927 0.0071 1.000 × 10− 8.319 × 10− 1.085 × 10−
04 06 06
15:05 0.9923 0.0074 1.000 × 10− 8.697 × 10− 4.542 × 10−
04 05 06
16:45 0.9877 0.0116 5.000 × 10− 3.677 × 10− 4.131 × 10−
03 04 05
18:25 0.9338 0.0604 4.900 × 10− 7.000 × 10− 8.847 × 10−
03 04 04
20:05 0.9272 0.0654 6.200 × 10− 8.000 × 10− 1.100 × 10−
02 03 04
21:45 0.8678 0.1058 2.280 × 10− 3.200 × 10− 4.040 × 10−

mitigation barrier and management & organizational barrier) are Chang, Y., Wu, X., Zhang, C., Chen, G., Liu, X., Li, J., Cai, B., Xu, L., 2019. Dynamic
Bayesian networks based approach for risk analysis of subsea wellhead fatigue
monitored real-time and their time-dependent probability variations are
failure during service life. Reliab. Eng. Syst. Saf. https://doi.org/10.1016/j.
fed to the Bayesian network to obtain corresponding time-dependent ress.2019.03.040.
variations in kick consequences. The failure probabilities of barriers Kalantarnia, M., Khan, F., Hawboldt, K., 2009. Dynamic risk assessment using failure
are observed to start fluctuating largely from 16:45 onwards, which is assessment and Bayesian theory. J. Loss Prev. Process. Ind. https://doi.org/10.1016/
j.jlp.2009.04.006.
long before actual explosion occurred. The severe consequences could Khakzad, N., Khan, F., Amyotte, P., 2012. Dynamic risk analysis using bow-tie approach.
have been avoided if the early warnings at 16:45 were observed and Reliab. Eng. Syst. Saf. https://doi.org/10.1016/j.ress.2012.04.003.
adequately managed. This study reveals the importance of real-time Khakzad, N., Khan, F., Amyotte, P., 2013a. Quantitative risk analysis of offshore drilling
operations: a Bayesian approach. Saf. Sci. https://doi.org/10.1016/j.
monitoring of safety barrier performances and shows the effect of ssci.2013.01.022.
deterioration of barrier performance on kick consequence probabilities. Khakzad, N., Khan, F., Amyotte, P., 2013b. Dynamic safety analysis of process systems by
The study shows that taking suitable and timely actions by observing mapping bow-tie into Bayesian network. Process Saf. Environ. Protect. https://doi.
org/10.1016/j.psep.2012.01.005.
abnormal variations in failure probabilities of barriers can prevent Kujath, M.F., Amyotte, P.R., Khan, F.I., 2010. A conceptual offshore oil and gas process
adverse consequences. accident model. J. Loss Prev. Process. Ind. https://doi.org/10.1016/j.
jlp.2009.12.003.
Lampis, M., Andrews, J.D., 2009. Bayesian beliefnetworks for systemfault diagnostics.
Authorship contributions Qual. Reliab. Eng. Int. https://doi.org/10.1002/qre.978.
Li, X., Chen, G., Khan, F., Xu, C., 2019. Dynamic risk assessment of subsea pipelines leak
Bijay B.: Methodology, Software, Investigation. Priscilla George: using precursor data. Ocean. Eng. https://doi.org/10.1016/j.oceaneng.2019.02.009.
Liu, Z., Liu, Y., 2019. A Bayesian network based method for reliability analysis of subsea
Software, Writing. V.R. Renjith: Conceptualization, Supervision. Anish
blowout preventer control system. J. Loss Prev. Process. Ind. https://doi.org/
Job Kurian: Supervision 10.1016/j.jlp.2019.03.004.
Meel, A., Seider, W.D., 2008. Real-time risk analysis of safety systems. Comput. Chem.
Declaration of competing interest Eng. https://doi.org/10.1016/j.compchemeng.2007.03.006.
OREDA, 2002. Offshore Reliability Data Handbook. DNV, Trondheim, Norway.
Pariyani, A., Seider, W.D., Oktem, U.G., Soroush, M., 2012. Dynamic risk analysis using
The authors declare that they have no known competing financial alarm databases to improve process safety and product quality: Part I-Data
interests or personal relationships that could have appeared to influence compaction. AIChE J. https://doi.org/10.1002/aic.12643.
Rathnayaka, S., Khan, F., Amayotte, P., 2013. Accident modeling and risk assessment
the work reported in this paper. framework for safety critical decision-making: application to deepwater drilling
operation. Proc. Inst. Mech. Eng. Part O J. Risk Reliab. https://doi.org/10.1177/
References 1748006X12472158.
Shalev, D.M., Tiran, J., 2007. Condition-based fault tree analysis (CBFTA): a new method
for improved fault tree analysis (FTA), reliability and safety calculations. Reliab.
Abimbola, M., Khan, F., Khakzad, N., 2014. Dynamic safety risk analysis of offshore
Eng. Syst. Saf. https://doi.org/10.1016/j.ress.2006.05.015.
drilling. J. Loss Prev. Process. Ind. https://doi.org/10.1016/j.jlp.2014.05.002.
Skogdalen, J.E., Vinnem, J.E., 2011. Quantitative risk analysis offshoreHuman and
Adedigba, S., Oloruntobi, O., Khan, F., Butt, S., 2018. Data-driven dynamic risk analysis
organizational factors. Reliab. Eng. Syst. Saf. https://doi.org/10.1016/j.
of offshore drilling operations. J. Petrol. Sci. Eng. https://doi.org/10.1016/j.
ress.2010.12.013.
petrol.2018.02.049.
Tamim, N., Laboureur, D.M., Hasan, A.R., Mannan, M.S., 2019. Developing leading
Berdouzi, F., Villemur, C., Olivier-Maget, N., Gabas, N., 2018. Dynamic simulation for
indicators-based decision support algorithms and probabilistic models using
risk analysis: application to an exothermic reaction. Process Saf. Environ. Protect.
Bayesian network to predict kicks while drilling. Process Saf. Environ. Protect.
https://doi.org/10.1016/j.psep.2017.09.019.
https://doi.org/10.1016/j.psep.2018.10.021.
Bhandari, J., Abbassi, R., Garaniya, V., Khan, F., 2015. Risk analysis of deepwater
Villa, V., Paltrinieri, N., Khan, F., Cozzani, V., 2016. Towards dynamic risk analysis: a
drilling operations using Bayesian network. J. Loss Prev. Process. Ind. https://doi.
review of the risk assessment approach and its limitations in the chemical process
org/10.1016/j.jlp.2015.08.004.
industry. Saf. Sci. https://doi.org/10.1016/j.ssci.2016.06.002.
Bobbio, A., Portinale, L., Minichino, M., Ciancamerla, E., 2001. Improving the analysis of
Wu, S., Zhang, L., Zheng, W., Liu, Y., Lunteigen, M.A., 2016. A DBN-based risk
dependable systems by mapping fault trees into bayesian networks. Reliab. Eng.
assessment model for prediction and diagnosis of offshore drilling incidents. J. Nat.
Syst. Saf. https://doi.org/10.1016/S0951-8320(00)00077-6.
Gas Sci. Eng. https://doi.org/10.1016/j.jngse.2016.06.054.
Boudali, H., Dugan, J.B., 2005. A discrete-time Bayesian network reliability modeling
Wu, S., Zhang, L., Fan, J., Zhou, Y., 2019. Dynamic risk analysis of hydrogen sulfide
and analysis framework. Reliab. Eng. Syst. Saf. https://doi.org/10.1016/j.
leakage for offshore natural gas wells in MPD phases. Process Saf. Environ. Protect.
ress.2004.06.004.
https://doi.org/10.1016/j.psep.2018.12.013.
Bucci, P., Kirschenbaum, J., Mangan, L.A., Aldemir, T., Smith, C., Wood, T., 2008.
Xue, L., Fan, J., Rausand, M., Zhang, L., 2013. A safety barrier-based accident model for
Construction of event-tree/fault-tree models from a Markov approach to dynamic
offshore drilling blowouts. J. Loss Prev. Process. Ind. https://doi.org/10.1016/j.
system reliability. Reliab. Eng. Syst. Saf. https://doi.org/10.1016/j.
jlp.2012.10.008.
ress.2008.01.008.
Zhang, L., Wu, S., Zheng, W., Fan, J., 2018. A dynamic and quantitative risk assessment
Cai, B., Liu, Y., Liu, Z., Tian, X., Zhang, Y., Ji, R., 2013. Application of bayesian networks
method with uncertainties for offshore managed pressure drilling phases. Saf. Sci.
in quantitative risk assessment of subsea blowout preventer operations. Risk Anal.
https://doi.org/10.1016/j.ssci.2017.12.033.
https://doi.org/10.1111/j.1539-6924.2012.01918.x.
Čepin, M., Mavko, B., 2002. A dynamic fault tree. Reliab. Eng. Syst. Saf. https://doi.org/
10.1016/S0951-8320(01)00121-1.