INTRODUCTION

Since the advent of the Santa Barbara Unocal Blowout which occurred in January 1969, safety in the oil and gas
industry has become a salient concern of the oil majors and the general public (ETHW 2015). For this reason, the
integration of risk management practices into the oil and gas industry became necessary. Risk is the combination or
the likelihood of the occurrence of a harm and the severity of that harm. When a list of tasks is generated for a particular
job, a list of hazards is also developed for each task.

FIGURE 1.1: Risk Management Cycle (ANAO 2018)

According to Osabutey et. al. (2013), “Risk management is a term applied to logical and systematic method
of establishing the context, identifying, analyzing, treating, monitoring and communicating risks associated with any
activity, function or process in a way that will enable organizations to minimize losses and maximize opportunities.
Risk management is as such about identifying opportunities as avoiding or mitigating losses”. In the event of an
accident, not only major economic loses but also serious environmental pollution will be caused because of the high
risk of petroleum operations. Therefore, risk management is important for petroleum enterprise. It is a top priority for
petroleum enterprise to establish the risk management system and risk control mechanism according to the
characteristics of the petroleum operations to meet the needs of modern management (Zang and Liyun 2011).

The risk assessment cycle has been explained in the steps following thus;

 Establish the context: Establish the context in which the rest of the process will take place. The criteria against
which risk will be evaluated should be established and the structure of the analysis defined.
 Identify risks: Identify what, why and how things can arise as the basis for further analysis.
 Analyze risks: Determine the existing controls and analyze risks in terms of consequence and likelihood in the
context of those controls the analysis should consider the range of potential consequences and how likely those
consequences are to occur.
 Evaluate risks: Compare estimated levels of risk against the pre-established criteria so risks can be ranked and
management priorities identified
 Treat risks: Low-priority risks should be monitored and reviewed. For higher consequence risks, develop and
implement a specific management plan or procedure that includes consideration of all aspects required to mitigate
the risk to an acceptable level
 Monitor and review: Monitor and review the performance of the risk management system and changes that might
affect it
 Communicate and consult: Communicate and consult with internal and external stakeholders as appropriate at
each stage of the risk management process as well as the process as a whole

IMPORTANCE OF RISK MANAGEMENT

The risk of blowout is one of the major threat for the safe operation of both offshore and onshore drilling and
production operations. Although, conventional risk assessment methods have played an important role in identifying
major risk in oil and gas facilities, they have several advantages and disadvantages due to their structural limitations.
The complex dynamic mechanism of blowout, well-specific risk factors due to specific reservoir and underground,
environmental and operational uncertainties, complexities of the decisions needed to respond to well control incidents,
and time-dependent degradation of blowout barriers require the development and implementation of advanced risk
assessment and management techniques to incorporate these risk factors (Khan et. al. 2018). Consequently, the
importance of risk management in a blowout scenario can include but not limited to the following:

 Risk management helps in setting up objectives thereby properly defining the future of an oil firm. If a company
defines objectives without taking the risks into consideration, chances are that they will lose direction once any of
these risks hit home.
 With a risk management plan, you can prepare for the unexpected, minimizing risks and extra costs before they
eventually happen while also Saving valuable resources: time, income, assets, people and property can be saved if
fewer claims occur.
 Reducing threat of possible litigation
 Reducing legal liability and increasing the stability of your operations

USES/EFFECTIVENESS OF BOWTIE AND HAZOP PROCESSES

The Bowtie and HAZOP processes for risk assessment are widely used in the oil and gas industry. A HAZOP
study carefully reviews a process or operation in a systematic manner to determine whether deviations from the design
or operational intent can lead to undesirable consequences. This technique can be used for continuous or batch
processes and can be adopted to evaluate written procedures. A HAZOP analysis lists potential causes and
consequences of the deviation from the normal operability as well as existing safeguards protecting against the
deviation. When an analysis determines that inadequate safeguards exist for a credible deviation, recommendations
are usually made concerning the action(s) to be taken to reduce the risk (Cholarisk 2019). The general objectives of a
HAZOP include; scrutiny of a design, decide whether and where to build, choose whether to buy a piece of equipment,
to obtain a list of questions to put to a supplier, to check running instructions and to improve the safety of existing
facilities.

Bow tie analysis is a hazard analysis technique which is combination of fault tree analysis (FTA) and event tree
analysis (ETA). Fault tree analysis (FTA) is identifying basic events that can lead to an accident event, whereas an
Event tree analysis (ETA) is identifying the event sequences from initiating events to accident scenarios. The benefits
of a Bowtie analysis include;

 Highly effective for initial Process Hazard Analysis, ensures identification of high probability-high consequence
events.
 Combined application of a high-level fault/event trees
 Representation of the causes of a hazardous scenario event, likely outcomes, and the measures in place to prevent,
mitigate, or control hazards
 Existing safeguards (barriers) identified and evaluated
 Typical cause scenarios identified and depicted on the pre-event side (left side) of the bow-tie diagram
 Credible consequences and scenario outcomes are depicted on the post-event side (right side) of the diagram
 Associated barrier safeguards are included in the analysis.

To understand these risk analysis methodologies, two case studies have been reviewed in this subsection. A Bowtie
analysis of the Piper Alpha disaster in 1988 and a HAZOP study of blowout contingency and risk-reduction for high-
rate subsea gas wells in Mexilhao.

HAZOP Study of Blowout Contingency and Risk-Reduction for High-Rate Subsea Gas Wells in Mexilhao

In 2006, a HAZOP study was done in the field of Mexilhao, the largest undeveloped gas accumulation as at that
time. The study presented the identification and prioritization of potential/probable hazards and the measures for
 reducing the overall operational risks. With the HAZOP study, blowout contingency plans such as the bubble plume
calculations, relief well planning and the dynamic killing design were determined.

The HAZOP team was made up of more than twenty (20) professionals from five different companies. The process
started with the identification of the hazards or operational problems that can cause adverse consequences or
degenerate to such (Lage et. al. 2006). This was done on all installations, procedures and processes to ensure that all
potential hazards are effectively identified and managed with adequate control measures properly formulated. From
the technical review, a hundred and eleven (111) operational scenarios were identified and further evaluated
individually. A prioritization of the scenarios through a critical analysis using a Risk Priority Number (RPN) method.
The RPN classified these scenarios into three levels of criticality – Level I, Level II and Level III. Level I comprised
of thirty-seven (37) scenarios, Level II covered seventy (70) scenarios and Level III scenarios were four (4) in
number. The three levels of criticality are explained were drafted according to the following reasons;

 LEVEL I: The probability of occurrence is remote thus, the chances of detecting the problem in early stages of
development are very high. Level I scenarios are trivial in terms of affecting the overall operation.
 LEVEL II: The probability of occurrence is moderate. This level of scenarios may compromise the execution of
operations with no expectations regarding the disturbance of HSE operational standards. A high probability of
detecting issues in the early development stages is feasible.
 LEVEL III: Level III scenarios have significant probabilities of occurrence. Operational standards may be
compromised which could ultimately lead to the loss of fatalities, environmental damages and loss of tangible
assets. Responding to the occurrence of these scenarios even in cases of prompt detection is usually difficult.

Priority was directed to Level III scenarios because of the criticality of their occurrence. The four (4) Level III
scenarios potentially analyzed were;

i. The presence of geological fault which connected the reservoir to a shallower formation existed, this meant that
drilling 12-1/4” hole section would bare the reservoir.
ii. A possible well control event while drilling the 8-1/2” pilot hole.
iii. A possible well control occurrence during swabbing operations.
iv. Well control event during a formation test operation.

Fault trees were constructed for the Level III scenarios for the identification of the minimum cut sets and for the
purpose of quantifying the probabilities. The fault tree was characterized by a top event, the and gates, the or gates,
intermediate events and the basic events. To determine whether a top event will occur, the tree structure was
combined in accordance with the events. The HAZOP team provided a list and description of possible events and the
probabilities of their occurrence. Figure 1.2 shows the structure of the fault tree.
 FIGURE 1.2: Representation of A Well Control Event While Performing a Formation Test Using a Fault
Tree (Lage 2006)

To mitigate the associated risks of the Level III scenarios which were basically related to blowout occurrences,
several recommendations were. Firstly, an adoption of a strict well control procedure was recommended by the
HAZOP team. Concerted focus was to be placed on the reliability of the well control equipment and the development
of a specific training program. The training program was suggested to be conducted before starting drilling operations.
The resources/materials for the training were provided for all crew members, supervisors and for all personnel
involved. Blowout contingency plans were drafted by the HAZOP team. These included; the gas bubble plume during
a subsea blowout, relief well planning and dynamic killing operation.

Bowtie Analysis of the Piper Alpha Disaster in 1988

Following the 1988 disaster on the Piper Alpha Platform which claimed the life of about 167 personnel’s, the oil
and gas industry was under great pressure to exert more efforts in systemic hazard analysis and risk assessment of
their operations. As a result, the Bow-Tie methodology began to appear was used to identify the accident sequences
based on the 1988 Piper Alpha accident. This Bowtie analysis framework was extended to include the human decisions
and actions, organizational and management factors that influenced the occurrence of these basic events, and their
organizational roots. The outcomes of the bow tie analysis allow for the identification of a wide spectrum of possible
risk reduction measures, ranging from conventional technical solutions such as addition of redundancies down to
organizational improvements such as a change in the maintenance procedures. An explicit Bowtie analysis model was
developed to evaluate the benefits of some of these safety measures firstly, based on its original contribution to the
overall risk of the failure scenarios that these measures are designed to avert, and then secondly, on the degree to
which they can reduce the probabilities of these failure scenarios. The bow tie analysis was then used as a management
tool, allowing optimization of risk management strategies based on both the qualitative information about causalities
provided by the accident and on the quantitative information about failure probabilities updated in the light of new
events. It was also made known how the Bowtie analysis can be used to assess the cost-effectiveness of safety measures
designed to decrease the probability of severe accidental damages onboard platforms similar to Piper Alpha (Pate-
Cornell 1993).

Bow-tie diagrams are a simple and effective tool for communicating risk assessment results to employees at all
levels of an organization (James Sneddon n.d.). The diagrams clearly display the links between the potential causes,
preventative and mitigative controls and consequences of a major accident. Bow-tie diagrams may also be used to
display the results of different types of risk assessments methods and are useful training aids for employees at all
levels of an organization. Bow-tie diagrams may also be integrated with semi-quantitative analysis techniques such as
Layers of Protections Analysis (LOPA) depending on the level of complexity required. The general structure of a
bow-tie diagram is represented in the diagram below which Provides an idea on the relationships between CEMP of
an adverse event; Enhances connection of risk controls to Management system; Combination of FTA & ETA on its
left and right respectively and undesired event in the middle; Benefits: Easy to understand, no tech knowledge
required, often used for accident investigation. Later to Piper Alpha disaster, most of the companies have integrated
Bow-Tie methodology in their business practices.

Gap between the HAZOP Analysis and The Bowtie Methodology:

The gap between Bowtie and HAZOP can be identified using the following criterions, but may not be limited to just
these criterions alone;

 Graphical Representation: Bowtie Methodology allows for a much clearer, easier to understand representation
of the risks and how they are managed as compared to the HAZOP methodology which might be peculiar to only
specialist of a particular systematic procedure.
 Flexibility: Bowtie method of risk assessment are a very flexible and universal method of risk assessment that can
be used in many fields and in addition to looking at process risks (which is generally where HAZOPs are
employed), are also applied to a far wider range of risks including logistics, construction, security, etc. whereas
HAZOP method is limited to scenarios involving process risks.
 Barrier Identification: HAZOPs tend to concentrate on the engineered safeguards in place, whereas Bowties will
consider a wider range of safeguards e.g. training & competency, external protection, inspection & maintenance,
etc.
 Internal vs. External: HAZOPs tend to concentrate on what is happening inside the process, whereas Bowties
allow for consideration of external occurrences and events as well e.g. external impact, weather, human error etc.
 Preventative vs. Mitigative: HAZOPs tend to concentrate on the preventative safeguards employed to stop a
sequence or event from happening future there by employing a futuristic approach to risk assessment but Bowties
allow for a more thorough consideration also of the mitigative controls that tend to limit the severity of the impact
in a consequential occurrence.
AIM AND OBJECTIVES

AIM

 To compare and contrast between the Bowtie and HAZOP methodologies of risk management using the Macondo
oil well blowout as case study.

OBJECTIVES

 To evaluate risk management of the Macondo blow out using the Bowtie methodology.
 To evaluate risk management of the Macondo blow out using the HAZOP methodology.
 To prioritize risk assessment methodology within the risk management process.

METHODS/MATERIALS
2.1: Search Engines

The search engines used are as follows:

 Google Search
 Google Scholar
 Yahoo Search

Additional sources of data;

 Schlumberger Glossaries
 OnePetro
 PetroWiki

2.2: Equipment Used

The equipment used are as follows:
 Bowtie XP
 A Laptop
 A Mobile Hotspot Device
 Microsoft Word
2.3: Procedure
A content analysis of related journals was utilized in the preparation of this work. A total of about 60-hours was
used in the analysis of the sourced data. Journals were sourced for using the above stated search engines (Google
Search, Google Scholar and Yahoo Search). Direct links to useful resources were obtained from the additional sources
of data - Schlumberger Glossaries, OnePetro and PetroWiki.

To perform the Bowtie Analysis, several steps were followed to ensure an accurate representation of the Bowtie
Diagram. Firstly, A Top Event was established. This was the most critical step. The choice of the Top Event was
guided by some questions: What is the risk event? At what point was the safety control lost? At what point did
the root causes lead to, and that eventually results in the top event? Next, the preceding events and root causes
threats were established. The choices made addressed answered questions relating to the risk controls which failed,
the human factors and behavior which played a role in the elevation of danger and the root causes of the top event.
Following the listing of the threats, appropriate control measures for the respective threats were determined. Suffice
to note is that some control measures were found to be peculiar to more than one (1) of the identified threats.
Furthermore, the consequences (impact or damages) were established. Recovery methods suitable for each
consequence were finally established.

The "Guide-Word" HAZOP was used in the HAZOP analysis of the Macondo Blowout. Focus was placed on
precise outcomes of the top event (called "study nodes"), one at a time. For each of these study nodes, deviations in
the process strictures were examined using the guide words. The guide words ensured that the outcomes were explored
in every conceivable way. With this thought, several deviations were established, each of which was considered
carefully so that their potential causes and consequences was identified. Two guide-words were used in this study
because only two possible outcomes were possible for each of the presented deviations.
 RESULTS/DISCUSSION

TABLE 3.1: HAZOP Diagram of the Macondo Blowout of April 20, 2010.

GUIDE-WORDS
DEVIATION CONSEQUENCES CAUSES ACTIONS

No Other Than

Formation Fluid
Bottom Hole Cement,
Invasion into
Fault During Kick leading to a Drilling Fluid Column,
N/A wellbore (Kick) Poor Abandonment Procedure
Abandonment possible blowout Manual Activation of
leading to a
BOP
blowout

Formation Fluid Correction of Cement

Poor Slurry Design, Improper Hole
Invasion into Formulation, Integrity
Cement Seal Kick leading to a Cleaning Prior to Cementing, Poor
N/A wellbore (Kick) Tests, Use of Drilling
Fails possible blowout Cement Job, Insufficient Slurry
leading to a Fluid Column, Manual
Volume
blowout BOP Activation
ECD Loss, Surface Drilling
Fluid Dilution,
Cement Density Reduction,
Correct Mud Density,
Formation Fluid Drilling Process Releasing
Well Control
Invasion into Formation Fluids,
Inadequate Kick leading to a Procedures, Use of
N/A wellbore (Kick) Weighting Material Movement
Fluid Column possible blowout Drilling Fluid Column,
leading to a from Mud Cleaning
Manual Activation of
blowout Equipment,
BOP
Drilled Cuttings or Mud
Weighting Materials Settling

Knowing the Design

Limitations Identified
in a Hazard Analysis,
Failure to Self-Activate, Late
BOP Fails Kick leading to a Routine Inspection and
N/A Blowout Response of Drilling Crew to
When Needed possible blowout Maintenance, Drilling
Activate BOP.
Crew Vigilance and
Response, Manual
Activation of BOP
FIGURE 1.3: BOWTIE METHODOLOGY OF RISK ASSESSMENT USED FOR THE MACONDO OIL WELL BLOWOUT
 The Left Hand Side of the bowtie diagram being the fault tree, highlights the possible threats and risks imposed
on the Macondo oil well while drilling operations were being carried out. These threats came in forms of Cement
integrity fails, BOP fails and drilling fluid inadequacies. From the bowtie analysis diagram, necessary threat barriers
were setup in place which acts as the preventive control measures of the entire process/procedure thus, seeming not
to allow the escalation of the known threats in to the top event (Blowout).

However, it is imperative to note that the threat barriers of the Macondo oil well failed and as a result several
consequences were incurred. The consequences include fire outbreak, explosions, environmental pollution and fatal
loss of lives. It becomes necessary to bring in several mitigative control/ recovery methods into play all attempting to
realize if the already occurred top event can be limited and salvaged thereby reducing severity and damage to the
barest minimum.

The "Guide-Word" HAZOP was used in the HAZOP analysis of the Macondo Blowout. Focus was placed on
precise outcomes of the top event (called "study nodes"), one at a time. For each of these study nodes, deviations in
the process strictures were examined using the guide words. The guide words ensured that the outcomes were explored
in every conceivable way. With this thought, several deviations were established, each of which was considered
carefully so that their potential causes and consequences was identified. Two guide-words were used in this study
because only two possible outcomes were possible for each of the presented deviations.

None of this is intended to say the Bowties should replace HAZOP. They are complementary tools. There is
nothing better than HAZOP for ensuring that process systems are designed fit for purpose. Bowties follow on from
this to allow for a through life picture, applicable to all levels of personnel, that can be applied to all risks.

RECOMMENDATIONS

When conducting a Bowtie Analysis, the procedures to arrive at the final analytical diagram is very crucial, as the
flow of the graphical representation starts from the top event after which the possible threats lading to the top event is
analyzed alongside their preventive control measures thus, leading to the determination of the consequences after the
event barriers fail it ends with possible recovery measures that is meant to mitigate the severity of the consequences.

Furthermore, it is imperative to note that this research does not intended to show that Bowtie methodology should
replace HAZOP. They are complementary tools. There is nothing better than HAZOP for ensuring that process
systems are designed fit for purpose. Bowties follow on from this to allow for a through life picture, applicable to all
levels of personnel, that can be applied to all risks.

For which ever case of risk assessment, the Bowtie methodology and the HAZOP Analysis can be used to present
valuable information on the threats, consequences and actions that would help mitigate the impacts. However so, the
HAZOP is best utilized for futuristic risk assessment while the Bowtie is more useful in the risk assessment of already
occurred accidents.
 REFERENCES

ETHW (2015) First-Hand: History of Operational Safety Awareness in the US Gulf of Mexico 1964 to 2014: A
personal recollection by Kenneth E. (KEN) Arnold. <http://ethw.org/First-
Hand:History_of_Operational_Safety_Awareness_in_the_US_Gulf_of_Mexico_1964_to_2014:_A_personal
_recollection_by_Kenneth_E._(KEN)_Arnold> [13 March 2019]

ANAO (2018) ANAO Risk Management Framework 2017-2018 [online] available from
<https://www.anao.gov.au/work/corporate/anao-risk-management-framework-2016-17> [13 March 2018]

Osabutey, D., Obro-Adibo, G., Agbodohu, W. and Kumi, P. (2013) ‘Analysis of Risk Management Practices in the
Oil and Gas Industry in Ghana. Case Study of Tema Oil Refinery (Tor)’ European Journal of Business and
Management 5(29), 67- 79.
Zhang, Y and Liyun, X. (2011) ‘Research on Risk Management of Petroleum Operations’ Energy Procedia 5(3),
2330-2334.

Khan, F. Abimbola, M. and Hashemi, S.J. (2018) ‘Blowout Risk in Drilling and Production’. Encyclopedia of
Maritime and Offshore Engineering 3(4), 45-63.

Cholarisk (2019) Practical Application of Bowtie Analysis [online] available from

<http://www.cholarisk.com/services/process-safety/qra-hazop/hazard-operability-study-hazop/> [14 March
2019]

Lage, C.V.M, Jacinto, M.C., Martins, S.B., Vanni, S., Otto, L.A. and Moreieas, RF. (2006) ‘Blowout Contingency
and Risk-Reduction for High-Rate Subsea Gas Wells in Mexilhao’. Journal of Petroleum Technology

Pate-Cornell, M.E. (1993) ‘Risk Analysis and Risk Management for Offshore Platforms: Lessons from the Piper Alpha
Disaster’. Journal of Offshore Mechanics and Arctic Engineering 3(3), 115.

James, S. (n.d.) Practical Application of Bowtie Analysis