Vous êtes sur la page 1sur 10

Safety Science 57 (2013) 108–117

Contents lists available at SciVerse ScienceDirect

Safety Science
journal homepage: www.elsevier.com/locate/ssci

Quantitative risk analysis of offshore drilling operations: A Bayesian approach

Nima Khakzad a, Faisal Khan a,⇑, Paul Amyotte b
Faculty of Engineering and Applied Science, Memorial University of Newfoundland, St. John’s, NL, Canada A1B 3X5
Department of Process Engineering and Applied Science, Dalhousie University, Halifax, NS, Canada B3J 2X4

a r t i c l e i n f o a b s t r a c t

Article history: Blowouts are among the most undesired and feared accidents during drilling operations. The dynamic
Received 26 May 2012 nature of blowout accidents, resulting from both rapidly changing physical parameters and time-depen-
Received in revised form 10 December 2012 dent failure of barriers, necessitates techniques capable of considering time dependencies and changes
Accepted 12 January 2013
during the lifetime of a well. The present work is aimed at demonstrating the application of bow-tie
Available online 1 March 2013
and Bayesian network methods in conducting quantitative risk analysis of drilling operations. Consider-
ing the former method, fault trees and an event tree are developed for potential accident scenarios, and
then combined to build a bow-tie model. In the latter method, first, individual Bayesian networks are
Risk analysis
developed for the accident scenarios and finally, an object-oriented Bayesian network is constructed
Kick by connecting these individual networks. The Bayesian network method provides greater value than
Blowout the bow-tie model since it can consider common cause failures and conditional dependencies along with
Bow-tie approach performing probability updating and sequential learning using accident precursors.
Object-oriented Bayesian network Ó 2013 Elsevier Ltd. All rights reserved.

1. Introduction the risk of LWC through kick prevention, kick detection, blowout
prevention and kill operations (Fig. 1).
Risk analysis is an important tool to develop strategies to pre- Fig. 1 shows the sequential steps followed to maintain well
vent accident and devise mitigative measures. It is of great rele- integrity. The first three steps are related to the loss of well control
vance and applicability in offshore drilling operations due to while the last one is related to the regain of well control and is per-
challenges in safety measures arising from the harsh environment formed only if a blowout can be prevented. Recently, a complex ser-
and remoteness. Further, typically known as compact areas enclos- ies of human errors and mechanical failures resulted in a LWC in the
ing a high density of equipment and personnel, offshore drilling Macondo Well on April 20, 2010, which finally led to a blowout,
rigs are complex systems having the potential for unexpectedly se- leaving deaths, injuries and a significant amount of hydrocarbon
vere consequences during an accident. Blowouts, though rare, are spill (BP, 2010). The fire and explosions that followed the blowout
the most feared and violent accidents significantly threatening hu- finally caused the Deepwater Horizon drilling rig to sink. According
man lives, environment and assets (Holand, 1997). to the report provided by the BP incident investigation team (BP,
A blowout is an uncontrolled flow of hydrocarbons (e.g., gas and 2010), a chain of events was to blame for the LWC. Of these events,
condensate) or even saltwater from a well to the surrounding envi- poor cementing caused a kick to occur (i.e., failure of step 1 in Fig. 1)
ronment as the ultimate consequence of a kick. This environment while failure to notice the kick indications such as changes in the
can be the atmosphere (surface blowout) or other underground flow rate and the wellbore pressure resulted in the kick not being
formations (underground blowout). A kick is an unwanted influx detected until it flowed up into the riser (i.e., failure of step 2 in
of formation fluids into the wellbore as a result of loss of well con- Fig. 1). The failure of the blowout preventer (BOP) to close in the
trol (LWC), in which the pressure of formation fluids, i.e. pore pres- well escalated the kick into a blowout (i.e., failure of step 3 in
sure (PP), exceeds the pressure exerted by the column of drilling Fig. 1). Since the kill lines as well as the choke lines of the BOP were
fluid on the bottom of the wellbore, i.e. bottom hole pressure damaged, it was also impossible to perform a kill procedure to re-
(BHP) (Andersen, 1998). A kick can result in a blowout if it is not establish well control (i.e., failure of step 4 in Fig. 1).
detected in a timely manner and properly prevented. Well control The risk of blowout cannot be eliminated, but can be reduced
operation, comprising technical, managerial and organizational through preventive and mitigative measures. Since risk is defined
measures, is aimed at maintaining the well integrity and reducing as the product of probability and consequence, preventive safety
measures are aimed at reducing the probability whereas mitigative
measures are applied to alleviate consequences. Priority is usually
⇑ Corresponding author.
given to the former, i.e., preventive measures (Holand, 1997).
E-mail addresses: nkhakzadrostami@mun.ca (N. Khakzad), fikhan@mun.ca (F.
Safety measures are normally contemplated and allocated to the

0925-7535/$ - see front matter Ó 2013 Elsevier Ltd. All rights reserved.
N. Khakzad et al. / Safety Science 57 (2013) 108–117 109

Bercha, 1978, 2010; Bercha et al., 2008; BP, 2010; Nilsen et al.,
2001; Worth et al., 2008), it is not the most appropriate technique
for large systems. Static FT fails to capture dependent failures and
common cause failures (Bobbio et al., 2001; Khakzad et al., 2011,
Fig. 1. Schematic of well control operation. 2013a,b). Further, aside from static parameters such as formation
porosity and permeability, there are dynamic parameters such as
formation temperature and pressure which vary over time as the
system of interest through risk analysis. Risk analysis not only well goes deeper. Also, drilling parameters such as the weight
determines if the risk is acceptable, but also identifies major risk and volume of drilling mud are always prone to unexpected
contributing factors for which reducing measures should be ap- changes because of unexpected gas pockets, losses in formation
plied. To conduct drilling operation risk analysis, blowout probabil- and improper wellbore fill-up in case of tripping (Holand, 1997).
ity estimation is the first task usually carried out using statistical More importantly, safety barriers change as the well proceeds from
methods and past historical data. one phase (e.g., drilling) to another (e.g., production); this needs to
Due to limited data and large uncertainty arising from data be taken into account when conducting risk analysis of drilling
source variability, blowout probability estimations using statistical operations.
data are often questioned (Holand, 1997). Data uncertainty is due to Bayesian network (BN) is a probabilistic inference technique for
wide ranges of data which differ in terms of the place of blowouts reasoning under uncertainty. It has been used in the field of risk
(e.g., North Sea or Canadian arctic waters), type of wells (e.g., analysis and safety assessment over the last decade. BNs apply d-
exploratory or development), depth of drilling (e.g., shallow or deep separation and the chain rule to represent causal relationships
water), and time of blowout (e.g., during drilling or tripping). From among a set of random variables considering local dependencies
the location point of view, factors such as weather conditions, (Jensen and Nielsen, 2007). Many authors have shown the parallels
formation temperature, pressure, permeability and porosity differ between FT and BN (Bobbio et al., 2001; Boudali and Dugan, 2005;
from place to place (Andersen, 1998; Holand, 1997; Nilsen et al., Khakzad et al., 2011; Torres-Toledano and Sucar, 1998) and dis-
2001). Therefore, data sources of blowout frequency estimation re- cussed how the limitations of the former technique are to a large
quire extreme caution in their use. For example, the ERCB database extent addressed by the latter. The main advantage of BN making
(http://www.ercb.ca) covers onshore blowouts while WOAD (1994) it a superior technique for risk analysis of dynamic systems such
contains offshore blowouts as well as other offshore accidents. SIN- as well control is the ability to perform probability updating.
TEF Offshore Blowout Database (1995) covers both exploratory and Applying Bayes’ theorem, BN updates the initial beliefs as new
development blowouts from the North Sea and the U.S. GoM OCS information about the system becomes available over time. There-
(Gulf of Mexico Outer Continental Shelf). fore, the risk analysis can be used as a decision-making tool to de-
Even with reliable and up-to-date historical blowout data, these cide between various scenarios at the design stage of well
generic data do not identify the series of events that finally re- operation. It can also be applied during the well lifecycle to identify
sulted in a blowout. Thus, not only well-specific data such as pore risk factors and allocate proper safety measures as changes take
pressure (PP), bottom hole pressure (BHP), fracturing pressure (FP) place in the well system. The merit of BN models in risk analysis
and the type of barriers are not taken into account, but also the of well control becomes accentuated as frequent accident precur-
causes of the blowout whether human errors or mechanical failure sors such as kicks can be used to update the likelihood of blowouts
are not considered in the frequency estimation. (Skogdalen et al., 2011).
To overcome the aforementioned drawback of statistical meth- The present work is aimed at demonstrating the application of
ods, there have been attempts to localize generic data to the case of BNs in risk analysis of drilling operations and making a comparison
interest using adjustment factors. These adjustment factors reflect with the bow-tie (BT) method. The scope of the work is limited to
well-specific data (e.g., pore pressure) as well as company-specific the first three steps of well control as shown in Fig. 1: investigating
data (e.g., kick management policies), the applications of which re- the probability of a kick and its propagation into a blowout. In
sult in site-specific blowout frequencies. As an example of such other words, well control regain is not covered in this study. The
statistical-based adjusting methods, BlowFAM (Dervo and Blom- current study has used the concept and blowout logic discussed
Jensen, 2004) is based on the SINTEF database and examines differ- by Andersen (1998) and Bercha (1978).
ent elements such as drilling activities, reservoir characteristics Well control events including the physical mechanism of kick,
and management parameters to identify a total adjustment factor. kick detection and the escalation of kick into blowout and the rel-
On the other hand, many researchers have studied the blowout evant barriers are discussed in Section 2. A brief description of risk
phenomenon through its components. Thus, causal relationships analysis methods, BT and BN, is given in Section 3. Section 4 is de-
among blowout components along with well-specific and com- voted to the application of BT and BN to well control risk analysis
pany-specific parameters can be analyzed in a systematic manner. while the conclusion is presented in Section 5.
Bercha (1978) used a fault tree (FT) model to estimate the blowout
probability of both exploratory and development wells in Canadian
arctic waters. The application of event trees (ET) was briefly dis-
cussed to represent a blowout as a potential consequence of a kick. 2. Well control
The whole accident, starting from the causes of the kick and ending
with the blowout however is modeled using FT in their work (Ber- 2.1. Kick mechanism
cha, 1978). Andersen (1998) proposed a stochastic model based on
the physical mechanism of the kick as the initiating event of the A kick is defined as an uncontrolled and unwanted influx of
blowout. The FT method was then applied to estimate the proba- formation fluids into the wellbore. It is the initial event that can
bility of the kick within each drilling sub-operation. Grouping of potentially escalate into a blowout. Even if a kick is controlled, it
the well drilling operation into sub-operations such as drilling, takes some time to circulate out the influx and re-establish the
tripping and casing was considered due to different primary causes wellbore pressure balance. Extra costs are inevitable due to
and safety barriers involved in each sub-operation. recovery works and several days of delay in resuming the drilling
Although static FT have been extensively used in risk analysis of procedure (Nilsen et al., 2001). In some cases, the kick-induced
kicks and blowouts (Andersen, 1998; Arild et al., 2008, 2009; damage is so severe that the well is plugged and abandoned.
110 N. Khakzad et al. / Safety Science 57 (2013) 108–117

A kick occurs as a result of the failure of the well’s primary thus a kick is likely to occur. It should be noted that a sudden in-
safety barrier, i.e. the column of drilling mud, in the drilling phase crease in BHP, for example due to Psg, would readily escalate an
of a well. The drilling mud, as a safety barrier, is aimed at maintain- overbalanced drilling into a major overbalanced drilling scenario.
ing the wellbore bottom hole pressure (BHP) greater than the pore On the contrary, although near-balanced drilling advanta-
pressure (PP) but less than the fracturing pressure (FP), i.e., PP < geously results in a higher rate of penetration, a sudden drop in
BHP < FP (Andersen, 1998). The reason is that a BHP value greater BHP, for example due to an unexpected gas pocket or circulation
than PP prevents the formation fluids from flowing into the well- cut off, would result in an underbalanced condition (DPL < 0) and
bore, whereas a BHP value smaller than FP assures that the forma- cause a kick to occur. However, from a kick detection perspective,
tion is not fractured and thus the drilling mud cannot escape from near-balanced drilling is recommended (see Section 2.2) (Nguyen,
the wellbore to the fractured formation. It should be noted that in 1996).
the case of a fracture, owing to annular losses (i.e., a drop in the
amount of drilling mud), the hydrostatic pressure as a main com- 2.2. Kick detection
ponent of BHP will decrease and a kick occurrence is likely.
While primarily provided by the drilling mud, BHP is composed Whether a kick escalates into a blowout is highly dependent on
of several pressure components (Eq. (1)) to better account for the how quickly it is detected and how properly and timely the mitiga-
variations in the drilling parameters and characteristics (Andersen, tive measures are implemented. A kick is controlled using kill oper-
1998; Arild et al., 2009). ations, circulated out, and well control is regained. In shallow
water drilling (depths less than 1200 m), however, priority is given
BHP ¼ Ph þ Pf  Psw þ Psg ð1Þ
to kick prevention rather than kick mitigation (Holand, 1997). The
where Ph is the hydrostatic pressure due to height of the drilling reason is that in shallow water drilling, due to insufficient strength
mud column above the wellbore bottom; Pf is the frictional pressure of the formation, it is not safe to use blowout preventers (BOP) to
due to pumping of the drilling mud through the drillstring; Psw and close in the well and control the kick. In other words, if the well is
Psg are the swabbing and surging pressures due to drillstring trip- shut in using a BOP, the risk of an underground blowout and ensu-
ping out and tripping in the wellbore, respectively. ing cratering is high. Cratering, in turn, can cause the drilling rig to
The drilling operation, whether exploratory or development can tilt or even capsize. This is why drilling companies have focused on
also be categorized into sub-operations such as drilling, tripping, diverting the kick (using diverter systems or riserless drilling
casing and cementing to explore the effective contribution of each methods) instead of trying to suppress them using a BOP (Holand,
pressure component on the entire BHP (Arild et al., 2009). For 1997). However, regardless of drilling companies’ policy to divert
example, during drilling sub-operation, where a column of drilling (common in shallow water drilling) or suppress (common in deep
mud is present (hydrostatic pressure) and pumps are circulating water drilling) a kick, early detection of the kick is crucial in terms
the mud in the wellbore (frictional pressure), BHP can be expected of well integrity and overall safety.
as BHP = Ph + Pf. Likewise, if the drillstring is pulled out of the well Drilling parameters such as rate of penetration and drillstring
(tripping out) to, for example, add a joint, and the pumps are off in torque, operational parameters such as volume of mud tanks,
the meanwhile, BHP would be as BHP = Ph  Psw. and mud characteristics such as temperature and gas content are
The hydrostatic pressure, Ph, is a function of drilling mud height continuously monitored and recorded through mud logging and
(h) and density (q). Therefore, factors that either cause h to de- wire-line logging. These data are then used to determine well
crease (e.g., annular losses) or q to decrease (e.g., gas cut mud) re- integrity and obtain geological information about the formation
sult in a decline in Ph and consequently in BHP. Likewise, since the during the drilling process (Nguyen, 1996).
frictional pressure, Pf, is related to the pumping rate, a pump failure Among drilling parameters, the rate of penetration is of great
or power outage would cause a drop in Pf and thus in BHP. When importance. An increase in rate of penetration implies that either
pulling the drillstring out of the wellbore, a negative pressure gra- the bit has reached a porous or fractured formation or the lower
dient, Psw, is created which may help a kick to occur by reducing drilling margin (DPL) has decreased due to a drop in BHP or a rise
BHP. This effect is called swabbing. The amount of Psw depends in PP. In either case, the risk of underbalanced pressure is immi-
on the speed of tripping, the viscosity of the mud and the diameter nent, and a kick is very likely to occur.
of the wellbore (Nguyen, 1996). The narrower the wellbore, the According to the relationship between rate of penetration and
more severe the swabbing effect would be. On the other hand, a drilling margin, as shown in Fig. 2 (Nguyen, 1996), when drilling
positive pressure gradient, Psg, is created when the drillstring is with a high differential pressure (e.g., point d in Fig. 2), a kick-in-
run into the wellbore (tripping in). This effect is called surging duced drop in pressure (e.g., the decrease in pressure from point
(Andersen, 1998). d to c) has a small effect on the penetration rate (i.e., D1), and is
Whether a decrease in BHP would cause a kick or not depends on not likely to be noticed. On the other hand, when drilling with a
the drilling margin or the down-hole differential pressure (Ander- low differential pressure (e.g. point b), a decrease in pressure
sen, 1998). The lower drilling margin, DPL, is defined as the differ- (e.g., the decrease in pressure from point b to a) has a noticeable
ence between the initial bottom hole pressure, BHP0, and the pore influence on the penetration rate (i.e., D2). Thus, from a kick detec-
pressure, i.e., DPL = BHP0  PP, while the upper drilling margin, tion point of view, the smaller the drilling differential pressure, the
DPU, is defined as the difference between the fracture pressure more probable the variation of the penetration rate, and conse-
and the initial bottom hole pressure, i.e., DPU = FP  BHP0. Assuming quently the kick, are to be noticed. Likewise, variations in drill-
both a constant pore pressure and a constant fracture pressure, as string torque and pumping pressure can be used to detect the kick.
long as the decrease in BHP is smaller than DPL, or the increase in Similar to drilling parameters, abnormal variations in opera-
BHP is smaller than DPU, neither a kick nor a fracture occurs. The tional parameters can be used to measure the extent to which well
drilling margins are decided considering the type of drilling. In shal- is exposed to LWC (particularly a kick). Accordingly, irregular
low waters an overbalanced drilling policy (DPL > 0) is usually taken changes in the volume of drilling mud in the mud tanks and trip
whereas in deep waters, near-balanced drilling (DPL  0) is pre- tank can be considered as kick signs. An anomalous decrease in
ferred since it results in a higher drilling speed. Although overbal- mud volume may indicate annular losses, possibly due to a frac-
anced drilling seems more desirable from a kick prevention point tured formation, while an increase in mud volume implies a water
of view, major overbalanced drilling (DPL P 0 or DPU  0) may give or gas influx into the wellbore, i.e., a kick occurrence. A more direct
rise to formation fracturing which in turn causes annular losses and way to monitor abnormal variations in mud volume is the use of
N. Khakzad et al. / Safety Science 57 (2013) 108–117 111

Dianous and Fievez, 2006; Khakzad et al., 2012, 2013a). Focused

on an undesired event as the pivot node, BT applies both a FT
and an ET to determine the potential causes and consequences of
the undesired event, respectively. The undesired event is the top
event of the FT.
The application of BT in the risk analysis of large systems, where
common cause failures and dependent failures (conditional depen-
dencies) are present, is limited. More importantly, because of being
composed of static methods such as FT and ET, BT has not widely
been recognized in the context of dynamic risk analysis (Khakzad
et al., 2012) where information about frequent accident precursors
(e.g. kick) can effectively be used to update the estimated risk of
rare major accidents (e.g., blowout) (Skogdalen et al., 2011). To
consider new information in the context of dynamic risk analysis,
the BT approach has been coupled with Bayes’ theorem (Khakzad
et al., 2012) or mapped into Bayesian networks (Ale et al., 2006,
Fig. 2. Relation between penetration rate and drilling margin (Nguyen, 1996). V0 is 2009, 2011; Khakzad et al., 2011, 2013a). In the present study,
the penetration rate when DP = 0. the focus is on the latter approach.

flow meters installed on the inlet and outlet of the mud flow with
3.2. Bayesian network
comparison of the differences (Bercha, 1978; Nguyen, 1996).
In addition to the abovementioned parameters, mud character-
BN is a graphical technique that has started to be widely applied
istics can also be examined for any trace of kick occurrence. In this
in the field of risk analysis. Known as an inference probabilistic
regard, monitoring the changes in mud density and conductivity is
method, BN is composed of nodes, arcs and probability tables to
of great importance. These changes can be due to water, gas or oil
represent a set of random variables and the conditional dependen-
influx into the well as a sign of kick. In the case of gas influx, aside
cies among them. Due to its flexible structure and probabilistic rea-
from the decreasing effect of the gas on mud density and conse-
soning engine, BN is a promising method for risk analysis of large
quently on hydrostatic pressure, the type of gas (e.g., CO2) may
and complex systems.
indicate the vicinity of an efficient hydrocarbon reservoir and thus
Considering the conditional dependencies of variables, BN
a high risk of kick (Nguyen, 1996).
represents the joint probability distribution P(U) of variables
U = {A1, . . . , An}, as:
2.3. Blowout

A blowout occurs as a result of failure of the well secondary bar- PðUÞ ¼ PðAi jPaðAi ÞÞ ð2Þ
riers. In fact, a kick can escalate into a blowout either due to
mechanical failure of the secondary barriers or due to non-detection where Pa (Ai) is the parent set of variable Ai (Jensen and Nielsen,
of the kick and consequently not putting the barriers into action. 2007). Accordingly, the probability of Ai is calculated as:
Aside from the casing as a passive secondary barrier which is pres- X
ent in most phases of well operation, other secondary barriers vary PðAi Þ ¼ PðUÞ ð3Þ
in type and placement during subsequent phases. For example, dur- UnAi
ing drilling operations, the BOP, Kelly valve and drillstring safety
valve are considered as secondary barriers. In the production phase, where the summation is taken over all the variables except Ai. The
on the other hand, a surface-controlled subsurface safety valve main application of BN is in probability updating. BN takes advan-
(SCSSV) and a Christmas tree are used as secondary barriers instead tage of Bayes’ theorem to update the prior probabilities of variables
of a BOP, while in the wire-line phase a wire-line BOP is added to the given new observations, called evidence E, rendering the updated or
safety barriers to compensate for the disabled SCSSV (Holand, 1997). posterior probabilities:
To account for the effect of secondary barriers on the well con- PðU; EÞ PðU; EÞ
trol process, it is also important to determine the blowout path. In PðU jEÞ ¼ ¼P ð4Þ
fact, a kick can rise up in the wellbore through various paths such
as the drillstring, the annulus and also the casing (Holand, 1997).
For example, in the case of an influx through the drillstring, the 3.3. Object-oriented Bayesian network
Kelly valve or string safety valve can prevent flow from entering
the atmosphere while in the case of an influx through the annulus, Object-oriented Bayesian network (OOBN) is a type of BN, com-
a BOP can be activated. The BOP comprises an annular preventer, prising both instance nodes and usual nodes. An instance node is a
pipe rams and a blind or shear ram to prevent the kick from exiting sub-network, representing another BN. Using OOBNs, a large com-
the wellbore (i.e., blowout), as well as choke lines and kill lines to plex BN can be constructed as a hierarchy of sub-networks with
circulate out the kick and regain well control. Generally, blowouts desired levels of abstraction (Kjaerullf and Madsen, 2008). There-
are more frequent during the drilling phase and through the annu- fore, model construction is facilitated and communication between
lus path (Holand, 1997). the model’s sub-networks is more effectively performed. Further,
the tedious task of repeating identical structure fragments and
3. Risk analysis methods probability tables is alleviated. Instance nodes are connected to
other nodes through interface nodes, including input and output
3.1. Bow-tie approach nodes. Input nodes accept the same probability values as their
immediate parents. Thus, each input node cannot have more than
Bow-tie (BT) is an effective graphical method commonly used one parent. In contrast, output nodes are ordinary nodes, convey-
for process accident risk analysis (Delvosalle et al., 2005, 2006; ing their probability values to other input nodes or affecting the
112 N. Khakzad et al. / Safety Science 57 (2013) 108–117

3 5

1 3
2 4


Fig. 3. Using OOBN to modularize BN into sub-networks. A BN (left) is constructed using hierarchical structures with arbitrary levels of abstraction (middle) and
consequently shown using instance nodes (right).

probabilities of other usual nodes. Therefore, each output node can purposes, risk analysis for drilling sub-operations is carried out in
have more than one child. which the wellbore is initially filled with drilling mud and circula-
Fig. 3 illustrates, as an example, how a BN (left) can be devel- tion is in progress, implying that both Ph and Pf contribute to BHP.
oped using a hierarchy of smaller and simpler BNs (middle). As
can be seen, node 4 is selected both as the output node (with thick
4.2. Blowout risk analysis using bow-tie approach
border) in instance node A and as the input node (with dashed
border) in instance node B to connect the instance nodes together.
4.2.1. Kick fault tree
The BN can finally be represented briefly using only instance nodes
A kick is the first undesired event in a series of events leading to
A and B (right).
LWC (see Fig. 1). Thus, a FT is developed in Fig. 4 to assess the kick
occurrence probability. It should be noted that due to a near-
4. Risk analysis of drilling operations balanced drilling scenario, a decrease in either Ph or Pf will cause
a decrease in BHP such that a negative differential pressure (i.e.,
4.1. Model description DPL < 0) would occur. This is why in the FT (Fig. 4), intermediate
events Low hydrostatic pressure and Lost circulation contribute to
To conduct risk analysis for a drilling operation, both the prob- Negative differential pressure via an OR gate. The FT basic events
ability and consequences of potential accident scenarios need to be and their occurrence probabilities are shown in Table 1 (Bercha,
identified. Considering a blowout as the most undesired among 1978; OREDA, 2002). Considering these probabilities, the probabil-
such accidents, its flow rate and duration have to be determined ity of the kick is calculated as 1.22E02.
to estimate the potential consequences.
Blowout flow rate as a function of time depends on a wide
4.2.2. Kick detection fault tree
variety of geological and technical parameters while blowout dura-
Following the kick indicators briefly described in Section 2.2, a
tion depends on the type of stopping procedures and controlling
FT is developed (Fig. 5) to estimate the failure probability of kick
mechanisms and how long it takes for these stopping measures
detection. As shown in Fig. 5, a variety of drilling parameters,
to cease the blowout (Arild et al., 2008). In this study, however,
operational parameters and mud characteristics is used to detect
the emphasis is on probability estimation of blowout accidents
kick occurrence. However, a combination of equipment failures
as an important factor in risk-based decision-making, and conse-
and human errors may result in kick non-detection. It is worth not-
quence analysis is not covered.
ing that the mud volume can be monitored using either mud tank
As a part of well control failure modeling, the phase of the well
indicators or flow meters installed on flow lines. Likewise, the rate
for risk analysis needs to be determined. The reason is that the type
of penetration and the pressure can be taken into consideration to
and placement of safety barriers for the drilling phase differ from
observe changes in the circulation pressure. The FT basic events
those of the production phase. Also, in the case of drilling, shallow
and their occurrence probabilities are listed in Table 2. Using these
water or deep water drilling and exploratory or development dril-
probabilities, the failure probability of kick detection is calculated
ling must be identified. Dividing the drilling phase into sub-opera-
as 8.60E06.
tions such as drilling, tripping, casing or cementing also helps to
better identify the primary causes of LWC.
In the present study, risk analysis is performed for the drilling 4.2.3. Safety barriers event tree
phase. Also, it is assumed that drilling is performed in deep waters In addition to kick detection, a high pressure 4-stage BOP stack
and for a development well. Therefore, both primary and second- including two pipe rams, a blind/shear ram and an annular pre-
ary barriers are present and also a near-balanced drilling policy venter is considered as a safety barrier (Nguyen, 1996). It should
is preferred to overbalance drilling. Further, as compared to explor- be noted that even if the kick is detected and the BOP is activated,
atory drilling, required information about formation properties the blowout may not be prevented unless the casing is strong
such as PP and FP is presumably available during development dril- enough to hold the kick inside the wellbore (Bercha, 1978). The
ling. The total risk of the drilling phase equals the sum of the risk of ET in Fig. 6 illustrates the sequence of safety barriers devised for
the respective drilling sub-operations. In this study, for illustrative blowout prevention. Considering the kick as the initiating event
N. Khakzad et al. / Safety Science 57 (2013) 108–117 113

4.2.4. Blowout bow-tie

Using the FTs and the ET developed in the previous sections; the
BT model for LWC is developed and shown in Fig. 7. Using the
probabilities listed in Tables 1–3, the probability of blowout is esti-
mated as 2.55E06.
Due to inherent limitations of BT, it is not possible to take into
account the probable common cause failures and conditional
10 Δ PL < 0 dependencies among the basic events of the FT and the safety bar-
riers of the ET (Khakzad et al., 2013a). For example, consider a case
Negative where the same density meter is used to measure the mud density
differential both when the mud is mixed and pumped into the wellbore and
when the mud is brought back to the surface to be tested for kick
signs. In this scenario, basic event 5 in the kick FT (Fig. 4) and basic
event 11 in the kick detection FT (Fig. 5) would have a common
cause failure, i.e. failure of the density meter with a probability
of 2.00E04. Consequently, the top events of the respective FTs
hydrostatic Lost circulation can no longer be considered independent from each other. In other
pressure words, both the initiating event (i.e. kick) and the first safety bar-
rier (i.e. kick detection) of the ET (Fig. 6) would become condition-
ally dependent. However this dependency cannot be captured in
traditional BTs.
Likewise, the same problem would arise if the annular losses of
drilling mud and casing failure are related to a poor cementing
Volume Density
reduction reduction 7 9 problem. In this case, basic event 1 in the kick FT (Fig. 4) and the
last safety barrier in the ET (Fig. 6) share poor cementing as a
8 common cause failure, making the top event Kick and safety barrier
Casing conditionally dependent. For illustrative purposes, it is as-
sumed that in the case of poor cementing, the probability of annu-
lar losses would increase from 0.01 (Table 1) to 0.1.

1 2 3 5
4.3. Bayesian network modeling

4.3.1. Mapping from bow-tie

4 6 To overcome the aforementioned limitations of BT in risk
analysis of drilling operations, a BN is developed as shown in
Fig. 8 (see Khakzad et al., 2013a for mapping algorithm from BT
Fig. 4. Kick fault tree.
into BN). The corresponding BNs of the previously developed FTs
and ET are included as instance nodes in Fig. 8.
In Fig. 8, instance nodes Kick and Kick_Detection are mapped
and kick detection as the first barrier, the failure probabilities of from the FTs in Figs. 4 and 5, respectively, while instance node
the barriers are shown in Table 3. Barriers is mapped from the ET in Fig. 6. Note that node BOP in

Kick detection

Mud volume Gas content Mud property
changes changes

Rate of Mud
Mud tanks Flow metering Pump pressure 9 10 Mud density
penetration conductivity

1 2 3 4 5 6 7 8 11 12 13 14

Fig. 5. Kick detection fault tree.

114 N. Khakzad et al. / Safety Science 57 (2013) 108–117

Annular preventer
Blind/shear ram
Lower pipe ram

Upper pipe ram

Kick detection

Success Near miss

Success Failure

Near miss

Success Success

Near miss
Kick Failure Near miss

Failure Blowout


Fig. 6. Escalation of kick into blowout event tree.

14 13 12 11 8 7 6 5 4 3 2 1

Mud 10 9 Rate of
Mud density Pump pressure Flow metering Mud tanks
conductivity penetration

Mud property Mud volume
Gas content pressure
changes changes
changes Annular preventer
Blind/shear ram
Lower pipe ram

Upper pipe ram

Kick detection


Success Near miss


Success Failure

Near miss

Success Success


Near miss




Failure Near miss





Δ PL < 0


Failure Blowout


Lost circulation

Fig. 7. Bow-tie model for loss of well control. PE5 in the kick FT and PE11 in the kick detection FT have common cause failures (colored in orange) as well as PE1 in the kick FT
and Casing in the safety barrier ET (colored in yellow). (For interpretation of the references to color in this figure legend, the reader is referred to the web version of this
N. Khakzad et al. / Safety Science 57 (2013) 108–117 115

Table 1
Components of the kick FT in Fig. 4 and their probabilities (Bercha, 1978; OREDA, 2002).

Index Description Probability Updated probability

1 Annular losses 1.00E02 5.46E01
2 Riser rupture 1.00E02 5.67E02
3 Temperature effects 2.50E03 1.42E02
4 Gas-cut mud 7.00E03 3.97E02
5 Failure in density measurement equipment 2.00E04 3.40E03
6 Operator failure in mixing right density 3.00E02 1.70E01
7 Pump failure 4.00E02 2.27E01
8 Power failure 2.70E04 1.50E03
9 Pump control failure 1.00E03 5.70E03
10 Efficient hydrocarbon formation 1.25E01 1.00E+00

Table 2
Components of the kick detection FT in Fig. 5 and their probabilities (Bercha, 1978; OREDA, 2002).

Index Description Probability Updated probability

1 Failure of tank level indicator (float system) 1.40E04 2.00E04
2 Failure of operator to notice tank level changes 1.00E01 1.21E01
3 Failure of flow meter 1.10E04 1.00E04
4 Failure of operator to notice flow meter 5.00E03 6.10E03
5 Failure of pressure gage 1.65E02 1.87E02
6 Failure of operator to notice pressure change 1.00E01 1.13E01
7 Failure of displacement sensor (related to penetration rate) 2.00E04 2.00E04
8 Failure of operator to notice change in penetration rate 5.00E02 5.65E02
9 Failure of gas detector 2.00E04 3.00E04
10 Failure of operator to notice gas 5.00E02 7.34E02
11 Failure of density meter (column-type) 2.00E04 3.40E03
12 Failure of operator to notice density changes 5.00E03 1.59E02
13 Failure of resistivity sensor 2.00E04 6.00E04
14 Failure of operator to notice conductivity changes 5.00E03 1.59E02

Table 3 4.3.2. Risk updating

Safety barriers of the ET in Fig. 6 and their probabilities. In addition to offering a flexible structure and a robust reason-
Index Top events Probability Updated probability ing engine, the main application of BN is in probability updating,
which cannot be done by BT unless equipped with other tech-
1 Kick non-detection 8.60E06 2.48E02
2 Lower pipe ram 1.00E04 2.49E02 niques such as Bayes’ theorem or physical models (e.g. see Khakzad
3 Upper pipe ram 1.00E04 2.49E02 et al., 2012). In risk updating, the probability of an accident sce-
4 Blind/shear ram 1.00E04 2.49E02 nario is updated; the probability updating is performed in terms
5 Annular preventer 1.00E04 2.49E02 of posterior probability of event xi given new evidence. This also
6 Casing 2.00E04 9.75E01
helps to identify the most probable configuration of events leading
to the evidence (Bobbio et al., 2001; Khakzad et al., 2011, 2013a).
The most common type of evidence used in probability updating
is knowledge about the top event or consequences.
instance node Barriers itself is an instance node comprising safety In the present study, the posterior probabilities of basic events
nodes Lower pipe ram, Upper pipe ram, Blind/shear ram and Annular given a blowout, i.e., P(xi|Consequence = Blowout), are estimated
preventer. and shown in the last columns of Tables 1–3. The most probable
In addition, an instance node – Common_cause_failures – is configuration of events is determined: failure of casing led to annu-
added to the network to account for conditional dependencies lar losses which in turn caused a negative differential pressure. Due
among the foregoing instance nodes. As mentioned earlier, the fail- to the presence of an effective hydrocarbon reservoir, this negative
ure of Density meter contributes to the failure probabilities of Kick pressure caused an influx of the reservoir fluids into the well,
and Kick_Detection through primary nodes 5 and 11, respectively, resulting in a kick. Although the kick was detected and the BOP
while Cementing affects the failure probabilities of Kick and Barrier was accordingly activated and functioned properly, the casing
through primary nodes 1 and Casing, respectively. The BOP cannot failed to hold the influx in the well and thus a blowout occurred.
be activated unless the kick is detected. This is why Kick_Detection The probability of this sequence of events is estimated as 0.35.
is connected to Barriers to account for such dependency. Note that
when mapping the BT into the OOBN, Kick is connected to Conse-
quence, adding another state, namely Safe state to node Conse- 4.3.3. Sequential learning: application of accident precursors
quence to account for the non-occurrence of Kick (Khakzad et al., The BN risk model also makes it possible to take advantage of
2013a). The developed OOBN is analyzed using HUGIN 7.4 software sequential learning (Kjaerullf and Madsen, 2008; Spiegelhalter
(http://www.hugin.com); the probability of blowout is calculated and Lauritzen, 1990) to adapt the probabilities of the system as
as 4.60E06. changes take place over time. This method is also known as proba-
As may be seen from Fig. 8, only interface nodes, i.e., input bility adapting, and is particularly useful when modeling dynamic
and output nodes, are presented for each instance node, making systems. Knowing the causal relationships and prior probability
the network less complex and more tractable. However, it is distributions of the system under study, sequential learning consid-
possible to further simplify the model by showing only the ers new observations, sequentially made over time, to revise the
instance nodes (Fig. 9). probability distributions of the nodes for which these observations
116 N. Khakzad et al. / Safety Science 57 (2013) 108–117

Fig. 8. OOBN for loss of well control, including instance nodes and the usual node consequence.

Fig. 10. Updated probabilities of kick and blowout based on sequential learning.

Fig. 9. Collapsed form of the OOBN for loss of well control. considered that the near misses and incidents are observed and re-
corded over the course of 5 weeks of drilling (Table 4).
Using these data, prior probability distributions of the observed
nodes Pump, Pump control, Power and Gas-cut mud are revised,
Table 4
Accident precursors during 5 weeks of drilling operation.
resulting in updated probabilities for the kick and blowout
(Fig. 10). As can be seen from Fig. 10, the probabilities of a kick
Week 1 2 3 4 5
and a blowout have increased by more than four and seven times,
Pump failure – 1 – – – respectively, compared to their initial estimates at the start of the
Pump control failure 1 – 2 1 – drilling operation, i.e., week 0. As can be seen from Fig. 10, sequen-
Power failure 1 – – – 1
Gas-cut mud – 1 – 1 2
tial learning provides an effective updating mechanism of blowout
probability and thus the conducted risk analysis.

5. Conclusion
have been recorded. While propagating new information through
the network, other nodes’ probability distributions also are updated In this work, risk analysis of drilling operations has been carried
unless they are d-separated from the observed nodes. out using both bow-tie and Bayesian network approaches. Bayes-
In risk analysis of drilling operations, sequential learning can be ian network is shown to take priority over bow-tie since it consid-
implemented based on accident precursor observations which are ers common cause failures as well as conditional dependencies
more frequently observed. Loss of circulation, loss of drilling mud among the primary events of the well control system. However,
and kicks can be used as accident precursors (Skogdalen et al., it is worth noting that BT is generally a more transparent and
2011). These observations are usually supplied by well logging pro- straightforward technique than BN, particularly in situations
cedures such as wire logs and mud logs (Nguyen, 1996) or safety where probability updating is not required. Also, BN approach, as
reports. In the present study, for illustrative purposes, it is opposed to BT, demands for more expertise in terms of either
N. Khakzad et al. / Safety Science 57 (2013) 108–117 117

conditional probability extraction from data resources or network 8th International Conference and Exhibition on Performance of Ships and
Structures in Ice (ICETECH 2008), Banff, Alberta, Canada, July 20–23.
construction based on causal relationships between components.
Bobbio, A., Portinale, L., Minichino, M., Ciancamerla, E., 2001. Improving the analysis
In the present study, object-oriented Bayesian network was of dependable systems by mapping fault trees into Bayesian networks.
used to model the complex and interlinked domain of well control Reliability Engineering and System Safety 71, 249–260.
with significant levels of abstraction. Thus, the model became trac- Boudali, H., Dugan, J.B., 2005. A discrete-time Bayesian network reliability modeling
and analysis framework. Reliability Engineering and System Safety 87, 337–
table, and dependencies among the model segments were better 349.
shown, resulting in more effective modeling and communication BP, 2010. Deepwater Horizon Accident Investigation Report.
with stakeholders. It is also observed that using Bayesian networks Delvosalle, C., Fievez, C., Pipart, A., Casal Fabrega, J., Planas, E., Christou, M.,
Mushtaq, F., 2005. Identification of reference accident scenarios in SEVESO
to model well control events makes it possible to update the prob- establishments. Reliability Engineering and System Safety 90, 238–246.
ability of blowout as new information becomes available. A Bayes- Delvosalle, C., Fievez, C., Pipart, A., Debray, B., 2006. ARAMIS project: a
ian network risk model also helps to identify the most probable comprehensive methodology for the identification of reference scenarios in
process industries. Journal of Hazardous Materials 130, 200–219.
configuration of events leading to a blowout. Dervo, H.J., Blom-Jensen, B., 2004. Comparison of quantitative blowout risk
This study has highlighted how sequential learning can be effec- assessment approaches. In: SPE 86706, The Seventh SPE International
tively applied for probability adapting while considering accident Conference on Health, Safety, and Environment in Oil and Gas Exploration
and Production, Calgary, Canada March 29–31.
precursors. The developed model was successfully applied to a Dianous, V.D., Fievez, C., 2006. ARAMIS project: a more explicit demonstration of
case-study, showing an effective method of decision-making and risk control through the use of bow-tie diagrams and the evaluation of safety
providing a better vision of well control safety issues. barrier performance. Journal of Hazardous Materials 130, 220–233.
ERCB (Energy Resources Conservation Board, Alberta, Canada). <http://
www.ercb.ca> (20.04.12).
Acknowledgments Holand, P., 1997. Offshore Blowouts: Causes and Control. Gulf Publishing Company,
Houston, Texas.
The authors gratefully acknowledge the financial support pro- HUGIN Expert Software Version 7.4, 2010. <http://www.hugin.com>.
Jensen, F.V., Nielsen, T.D., 2007. Bayesian Networks and Decision Graphs, second ed.
vided by the Natural Sciences and Engineering Research Council Springer, New York.
(NSERC) of Canada and Vale Inc. The first author also would like Khakzad, N., Khan, F., Amyotte, P., 2011. Safety analysis in process facilities:
to express his gratitude to Dr. Frank Bercha for providing this re- comparison of fault tree and Bayesian network approaches. Reliability
Engineering and System Safety 96, 925–932.
search with valuable resources and technical reports. Khakzad, N., Khan, F., Amyotte, P., 2013a. Dynamic safety analysis of process
systems by mapping bow-tie into Bayesian network. Process Safety and
References Environmental Protection 91, 46–53.
Khakzad, N., Khan, F., Amyotte, P., 2013. Dynamic risk analysis using bow-tie
approach. Reliability Engineering and System Safety 104, 36–44.
Ale, B.J.M., Bellamy, L.J., Cooke, R.M., Goossens, L.H.J., Hale, A.R., Roelen, A.L.C.,
Khakzad, N., Khan, F., Amyotte, P., 2013b. Risk-based design of process systems
Smith, E., 2006. Towards a causal model for air transport safety – an ongoing
using discrete-time Bayesian networks. Reliability Engineering and System
research project. Safety Science 44, 657–673.
Safety 109, 5–17.
Ale, B.J.M., Bellamy, L.J., Van Der Boom, R., Cooper, J., Cooke, R.M., Goossens, L.H.J.,
Kjaerullf, U.B., Madsen, A.L., 2008. Bayesian Networks and Influence Diagrams.
Hale, A.R., Kurowicka, D., Morales, O., Roelen, A.L.C., Spouge, J., 2009. Further
Springer, New York.
development of a causal model for air transport safety (CATS): building the
Nguyen, J.P., 1996. Drilling. Editions Technip, Paris.
mathematical heart. Reliability Engineering and System Safety 94, 1433–1441.
Nilsen, T., Sandoy, M., Rommetveit, R., 2001. Guarneri. Risk-based well control
Ale, B.J.M., Hanea, D., Van Gulijk, C., Lin, P.H., Sillem, S., Hudson, P., 2011. Towards an
planning: the integration of random and known quantities in a computerized
integrated risk model for hydrocarbon industry operation. Advances in safety,
risk management tool. In: SPE 68447, SPE/ICoTA Coiled Tubing Roundtable,
reliability and risk management. In: Proceedings of the European Safety and
Houston, USA, March 7–8.
Reliability Conference, ESREL 2011, pp. 1636–1643.
OREDA (Offshore Reliability Data Handbook), 2002. SINTEF Industrial Management.
Andersen, L.B., 1998. Stochastic modeling for the analysis of blowout risk in
Det Norske Veritas.
exploration drilling. Reliability Engineering and System Safety 61, 53–63.
SINTEF Offshore Blowout Database, 1995. Users’ Manual, Trondheim, Norway.
Arild, O., Fjelde, K.K., Merlo. A., Daireaux. B., Loberg. T., 2008. BlowFlow – a new tool
Skogdalen, J.E., Utne, I.B., Vinnem, J.E., 2011. Developing safety indicators for
within blowout risk management. In: SPE 114568, IADC/SPE Asia Pacific Drilling
preventing offshore oil and gas deepwater drilling blowouts. Safety Science 49,
Technology Conference and Exhibition, Jakarta, Indonesia, August 25–27.
Arild, O., Ford, E.P., Loberg, T., Baringbing, J.W.T., 2009. KickRisk – a well specific
Spiegelhalter, D.J., Lauritzen, S.L., 1990. Sequential updating of conditional
approach to the quantification of well control risks. In: SPE 124024, 2009 SPE
probabilities on directed graphical structures. Networks 20, 579–605.
Asia Pasific Oil and Gas Conference and Exhibition, Jakarta, Indonesia, August 4–
Torres-Toledano, J.G., Sucar, L.E., 1998. Bayesian networks for reliability analysis of
complex systems. Lecture Notes in Computer Science 1484, 195–206.
Bercha, F.G., 1978. Probabilities of Blowout in Canadian Arctic Waters. Canadian
WOAD (World Offshore Accident Databank), 1994. Statistical Report, DNV Technica,
Environmental Impact Control Directorate, Report No: EPS 3-EC-78-12.
Bercha, F.G., 2010. Arctic and Northern offshore oil spill probabilities. In: The 10th
Worth, D.J., Crepin, S., Alhanati, F., Lastiwka, M., 2008. Risk assessment for SAGD
International Conference and Exhibition on Performance of Ships and Structures
blowouts. In: SPE 117679, SPE International Thermal Operations and Heavy Oil
in Ice (ICETECH 2010), Anchorage, Alaska, USA, September 20–23.
Symposium, Calgary, Canada, October 20–23.
Bercha, F.G., Prentki, R., Smith, C., Cervosek, M., 2008. Prediction of oil spill
occurrence probabilities in the Alaskan Beaufort and Chukchi Seas OCS. In: The