SPE-173569-MS

Barrier Verification: A Pillar of Industry Well Control

A.I. Ahluwalia, M.D. Novia, and M. Fernandes, Baker Hughes

Copyright 2015, Society of Petroleum Engineers

This paper was prepared for presentation at the SPE E&P Health, Safety, Security, and Environmental Conference-Americas held in Denver, Colorado, USA, 16 18
March 2015.
This paper was selected for presentation by an SPE program committee following review of information contained in an abstract submitted by the author(s). Contents
of the paper have not been reviewed by the Society of Petroleum Engineers and are subject to correction by the author(s). The material does not necessarily reflect
any position of the Society of Petroleum Engineers, its officers, or members. Electronic reproduction, distribution, or storage of any part of this paper without the written
consent of the Society of Petroleum Engineers is prohibited. Permission to reproduce in print is restricted to an abstract of not more than 300 words; illustrations may
not be copied. The abstract must contain conspicuous acknowledgment of SPE copyright.

Abstract
The oil and gas industry is well aware of the criticality of well control barriers; they are often what stand
between us and catastrophe. Emphasis on barriers has become more prominent within the Oil and Gas
industry, which has utilized several methods to keep the hydrocarbons where they belong. However, most
provide little insight into methods of barrier verification, and the assurance of such methods.
Building on the results of previous studies that emphasize the criticality of barriers in relation to well
control by J.G. Go Boncan and G.E. King & D.E. King in publications titled BowTie and Job Hazard
Analysis: A Case Study to Communicate the Barrier Philosophy as it Relates to Process Safety in Well
Operations and Environmental Risk Arising From Well-Construction FailureDifferences Between
Barrier and Well Failure, and Estimates of Failure Frequency Across Common Well Types, Locations,
and Well Age respectively, this paper addresses the need for barrier verification assurance, which is seen
as the next logical step in achieving the ultimate goal of well control. Well control barriers are critical,
but how is the industry verifying them? And if so, how are they assured? More importantly, is there a way
to measure barrier assurance?
This paper explains an evaluation of several barrier verification methods, their strengths and limitations, taking into account various geographical, technological and resource considerations. The output of
the evaluation is a Barrier Assurance Metric (BAM) which can be used to determine if there is an adequate
level of barrier assurance at the well site.

A Call To Action
We know that the oil and gas industry has become more complex increasing the hazards and risks we are
faced with, thus requiring the industry to continuously improve the way it manages/controls these hazards
and risks. It is increasingly clear that it is not sufficient to manage risks in only one area such as
equipment/ systems, people or procedures but rather we must manage/control risks in all these areas. The
industry has seen some disastrous process safety incidents such as Chernobyl Nuclear Plant Disaster, Piper
Alpha Disaster, Texas City Refinery Explosion, Bhopal Gas Tragedy and most recently the Deepwater
Horizon Oil Spill. The industry has made huge advances in technology, engineered remarkable solutions
and has come a long way in the field of safety and safety culture. So why do we continue to have
catastrophic events?

SPE-173569-MS

It is possible for an organization (s) to see a reduction in the number of incidents for many years, and
then have a major incident with little or no change in operations. As conditions change, equipment ages,
process and crews change, new risks are introduced. We not only need multiple barriers but we also need
effective barriers to prevent incidents. So what are barriers and why are they important? Barriers are
defined differently across the industry but generally speaking barriers, or controls, are ways to eliminate
/ minimize risks that lead to catastrophic events. Preventive barriers are required to potentially stop a
hazardous event from happening. Mitigative barriers help to reduce or lessen the effects of a hazardous
event that has an impact on people, assets, or the environment. Preventative and Mitigative barriers can
also be further broken up into non-physical and physical barriers. Non-physical barriers are typically
processes and procedures; Physical barriers are typically engineered components and systems.
A key question is - if we set up barriers one time, is that sufficient to prevent a catastrophic incident?
The answer is an obvious one; it is not. Remember, in most operations there are many parties involved
such as operators, service companies and drilling contractors. We know that barriers are dynamic, barriers
may be breached, disengaged or undergo degradation in the course of operations so barriers need to be
verified.How can this be achieved?
It is well known that any effective risk management starts at the planning phase and same applies to
barrier management and hence verification as well. Within Baker Hughes, it starts with use of a bowtie
assessment for the service being provided. During the planning phase we identify barriers that would
prevent threats and mitigate consequences for a top event such as a loss of well control. The next step is
to understand what barriers are required for that specific service. From a service company perspective,
most of these barriers tend to be process barriers; which may or may not be in our control. In order to
manage risk effectively, barriers which may not be in our control should also be verified. A key factor to
consider in barrier verification is that personnel accountable to maintain barriers must be competent in the
service being provided, and understand the barriers, threats to barriers, mitigation steps, and consequences
as related to well control assurance .

SPE-173569-MS

In order to manage these risks we have to ensure required barriers are verified at wellsite and also have
some level of assurance to its effectiveness irrespective of the nature of barrier i.e. non-physical or
physical. This is necessary to manage the risk holistically and help minimize risk to a level which is as
low as reasonably possible. There could be multiple ways to facilitate this process of barrier verification
at the well site: electronic means, virtual/ real time surveillance or some form of paper trail. But the issue
is that most of these means are dependent on geographic and IT infrastructure available at the location.
Also, another important contributing factor to this is the willingness of the parties involved in operation.
So how do we measure effectiveness of barriers and the quality of verification of these barriers? This
is the most crucial step as it directly influences the risk of operation, and therefore safety of people,
environment and future of industry and society at large.
We commenced our study by comparing the different types of barrier verification means such as
virtual, electronic or paperbased verification methods, but soon realized that it was not an effective means
for assuring barrier verification. Someone could answer yes to all verification questions, but that does
not necessarily mean 100% assurance of well control or mean something would not go wrong (e.g. LOWC
/ LOPC). What we achieved by providing these means was just a checklist to perform and document the
barrier verifications. But the most important question was still left unanswered: How do we achieve
barrier assurance at wellsite? Is it possible to get barrier assurance at wellsite?
How do we measure the quality of barrier verification and hence measure well control assurance? What
is that one metric, that one measure, we could use to gauge this?

Measuring Barrier Assurance

Measuring barrier assurance relies heavily on the quality of the components mentioned above such as:
hazard and threat identification, barrier identification, and verification tools that are applicable to the
operational environment. Without them, it would be nearly impossible to generate useful metric for
assurance. This section examines the process for the quantification and application of barrier assurance
metrics, and intends to accomplish three primary objectives:
1. Determine the minimum acceptable level of barrier assurance for a given operation,
2. Calculate a Barrier Assurance Metric (BAM) to determine if there is an adequate level of barrier
assurance,
3. Determine the gap that exists between measured assurance and the ideal level of assurance.
The process in achieving these three objectives is discussed below and is followed by a mock test-case
to demonstrate the processs inputs and outputs.

Assumptions
In the context of barrier assurance at the well site there are a few assumptions that must hold true for this
process to be effective. First, front line employees must have a general level of awareness and competency
around the intent and key components of process safety at the well site. For example, they should be
familiar with the term barrier, and understand how barrier failures could potentially result in a well
control event. Second, front line employees must be familiar with the tools that their organization has
implemented for barrier management such as BowTie assessments, barrier verification checklists, etc.
Third, they should be competent in performing barrier verification at the well site, and the operational
tasks which they have been assigned.

Methods of Verification
The key to this approach for barrier assurance is to not look at if barriers are verified, but how they
are verified. As mentioned previsouly, selecting yes down a list of barriers on a checklist does not

SPE-173569-MS

provide a robust sense of assurance; rather, one should go a step further and answer the question of: How
do you know...? For example, a BOP is a critical barrier for many well site operations. Simply observing
that a BOP is in placeby itself does not give much assurance as to whether or not one can expect it to
perform as intended if a well control event occurs. However, a common way to obtain this type of
assurance is through routine testing. If one can verify that the BOP has passed all the required tests at the
prescribed time it is not unreasonable to say that the level of assurance in the BOP is higher.
The point of the example above is that there are different methods to verify barriers, and that different
methods provide different levels of assurance. Table 1 below categorizes four general methods of
verification in the order of the anticipated assurance that they can provide.
Table 1Methods of Verification
Method of Verification
Witnessed First-Hand or Personally Performed Verification (e.g. Personally Performed a Test, Measurement, or Calculation to Verify a Barrier)
Personally Checked Verification Data (e.g. Test Report, Calibration Certificate, Well Plan, Communication Records, etc)
Received Verbal Confirmation Through Questioning / Conversation
Visual Observation

The first method in the table above provides the highest level of assurance because it deals with having
first-hand knowledge of the performance of a barrier. The second method provides assurance through data
generated without personally witnessing how the data was obtained. The third method provides assurance
through verbal communication without data or tangible evidence as support. The fourth and last method
is visual observation without any supporting information as to whether or not it can be relied upon to
function correctly if needed.
Organizing the four methods of verification in this way allows for them to be weighted in terms of the
level of anticipated assurance. Specific weights can vary based on the operation or facility; for purposes
of simplicity, the four methods will be weighted as 4, 3, 2, and 1 in this paper with the number 4 being
assigned to the method that provides the most assurance as shown in Table 2.
Table 2Methods of Verification with Assigned Weights
Method of Verification
Witnessed First-Hand or Personally Performed Verification (e.g. Personally Performed a Test, Measurement, or Calculation to
Verify a Barrier)
Personally Checked Verification Data (e.g. Test Report, Calibration Certificate, Well Plan, Communication Records, etc)
Received Verbal Confirmation Through Questioning / Conversation
Visual Observation

Weight
4
3
2
1

Calculating Barrier Assurance Metrics

It is possible to measure barrier assurance prior to beginning operations if all physical and non-physical
barriers are known and understood. The necessary data can be collected through a variety of methods, such
as a barrier checklist, as discussed earlier. Ultimately, the objective of measuring assurance in this paper
is achieved by summing together the weight, or score, of each barriers method of verification.
This simplistic method of measuring assurance provides value to the end user when the actual measure
of assurance is compared to a baseline value of assurance, or a minimum acceptable level of assurance.
Comparing the actual score to the baseline provides a clear-cut answer to the question of: Is the level of
assurance in my barriers high enough to execute the job?

SPE-173569-MS

The aforementioned baseline acts as the lower limit, or threshold, that is used to determine whether or
not enough barrier assurance exists for a given operation. Calculating the baseline requires the minimum
acceptable method of verification for each barrier to be determined, or pre-set, prior to the verification
process at the front-line. This allows for aspects such as the level of risk and practicality of the verification
method to be adequately considered during the planning phase. For example, for a service company, it
may not always be possible or practical to test certain physical well control barriers that are not owned,
installed, or operated by the company. Therefore, based on Table 2, the minimum assurance score for
barriers such as these should be less than 4. On the other hand, even though the example barrier may
not be owned, installed, or operated by the company, it may be important enough to be verified with more
than a visual observation; therefore, the minimum assurance score should be greater than 1.
The actual, or measured, barrier assurance is calculated in a similar way. Current best practices in the
industry suggest that each barrier should be verified one by one prior to operations. The additional step
proposed in this paper is to include a method of verification, or simply a number from Table 2 that
indicates a method of verification, next to each barrier during the verification process. The sum of these
scores yields a measure of barrier assurance, or a Barrier Assurance Metric (BAM), that can be compared
directly to the baseline. If the BAM is greater-than or equal to the baseline level of assurance, the level
of barrier assurance can be assumed to be adequate. However, the assumption that this alone is enough
to prevent a process safety incident should never be made.
The relevance, or scope, of the BAM correlates directly to the scope of the checklist used for
verification, which correlates to the scope of the initial risk assessment, e.g. BowTie, and depends heavily
on the assessment being comprehensive. For example, an assessment of process safety risks at an industry
level can lead to industry level barrier checklists which can lead to a BAM applicable at an industry level.
The same correlation applies to assessments completed at an organization level and at a local, or
job-specific, level.
In addition to the baseline value, or lower limit, an upper limit can be introduced which indicates the
best anticipated level of assurance. This upper limit can be used to approximate the highest level of
assurance that can be practically achieved for a given company for a given operation. Comparing this
upper limit to the BAM can provide a measure of the gap that exists between the actual assurance that
exists at the front-line and the potential assurance that can realistically be achieved.
It is important to clearly identify in advance which barriers must be in place prior to operations, and
which ones are optional barriers. Optional barriers should have a baseline score of 0; in turn, it is
acceptable that optional barriers that are not in place during the verification process receive a score of 0.
On the other hand, mandatory barriers that are not in place, or receive a score lower than the minimum
allowable score, should trigger a response such as Stop Work and/or initiation of a MoC process.

Mock Case
In order to demonstrate this process, a mock case is presented below to help illustrate the concepts,
calculations, inputs, and outputs discussed above. Table 3 contains the relevant data for this mock case.

SPE-173569-MS

Table 3Mock Case Data

Columns A and B include the number and the description of the barrier which can be taken from a
BowTie assessment or a barrier checklist. Column C is the maximum theoretical assurance score that can
be achieved. Physical barriers can theoretically achieve a score of 4 if they are verified with the highest
weighted method listed in Table 2; however, some non-physical, or process, barriers can theoretically only
achieve a maximum score of 3 if they can not be verified through a test, measurement, or calculation.
Column D is the best anticipated score which, as mentioned above, is used to determine the most realistic
or practical upper limit of assurance taking into consideration the various constraints and scope of work
for a given company and/or operation. Column E is used to indicate whether or not a particular barrier is
mandatory for the operation. Column F is the minimum passing score which, also mentioned above, is
used to calculate the baseline or lower limit of assurance. Lastly, Column G is the measured assurance,
which is measured at the well site and correlates directly to the method of verification that was used to
verify each barrier for the specific job at hand. The bottom row of Table 3 is the sum, or aggregate score,
of each column. Figure 1 shows a graphical illustration of the measured score in relation to the lower limit
(red line) and the upper limit (blue line) for this mock case.

SPE-173569-MS

Figure 1Mock Case Chart

In summary, the application of this process requires a thorough assessment of the risks involved with
a given operation, the identification of barriers, and the determination of the lowest acceptable level of
barrier assurance as well as the best anticipated level of barrier assurance in the planning phase. At the
well site, the process requires verification of barriers combined with recording the method of verification
for each barrier, calculating the Barrier Assurance Metric (BAM), and determining where the measured
level of assurance stands relative to the pre-determined baseline level of assurance. The gap between the
BAM and the best anticipated assurance can be addressed post-job as part of continual improvement
efforts.

Advantages of BAM
The BAM plays a crucial part in driving safe practices at wellsite. Personnel can gauge the risk involved
for that operation based on the Barrier Assurance Metric (BAM) and whether it lies in the acceptable range
or not. Personnel can also make a decision to introduce additional barriers, or enhance verification
methods, to bring this metric into an acceptable range.
Each person has his or her own acceptable window of risk and hence empowering them with STOP
WORK authority with directions to stop when they see risk is highly subjective. Furthermore, this
acceptable window of risk is a function of demographics, geographic location, organization safety culture
and government regulation & other compliance standards relevant to the location. This Barrier Assurance
Metric (BAM) assists personnel in decisions to STOP WORK. If this metric lies outside the acceptable
window, STOP WORK is justified because the minimum level of assurance has been defined by the
organization and is not dependent on personal interpretations of risk acceptability. So, across the
organization, for each service being provided, the STOP WORK criteria pertaining to matters of barrier
assurance are well defined, and thus a higher level of barrier assurance and procedural compliance can be
achieved.
The BAM also helps to identify gaps and areas of improvement. The closer this metric lays to the
lower threshold value, the higher the room for improvement is as the goal is to meet, or stay as close as
possible, to upper threshold. The closer we are to upper threshold value, the higher the level of barrier
assurance is, and also, the higher measure of ALARP (As Low As Reasonably Practicable) is.

SPE-173569-MS

Future Potential of BAM - Future Prospects

BAM could very well be used as the leading indicator. At first it will give an early indication of any
barrier failures that could lead into threats to realize the top event. Also in case barriers on left side of
bowties have been defeated and top event is realized one still has the assurance of mitigative barriers to
help prevent or minimize the impact of the consequences. This is due to the assurance provided by the
quality of barrier verification measured through this metric.
This metric would be dynamic in nature as every time barrier statuses change, either due to
failure/degradation/ temporary removal, this number would be updated. So the user of these metrics would
have a forward looking, ongoing dynamic measure of barrier assurance for that specific operation and
would be able to anticipate and mitigate risks.
The BAM could be a measure of quality of barrier verification and assurance for contractor selection.
An operator could use this to further gauge the risk of the operation being undertaken based on service
company being selected and will also provide operator with a yardstick of overall risk to compare to their
organization acceptable threshold limit for that operation.