You are on page 1of 8


OTC 2369
ng Barriers, Bridging Docu
uments an
nd SEMs using th
he Bow-Tiie
Scott Randall, PlusAlpha Risk
R Managem
ment Solutions, LLC

Copyright 2012, Offshore Technology Confere
This paper was prepare
ed for presentation at the Offshore Technolog
gy Conference held in Houston, Texas, USA , 30 April3 May 2012 .
This paper was selected for presentation by an
a OTC program comm
mittee following review
w of information containned in an abstract subm
mitted by the author(s)). Contents of the pape
er have not been
eviewed by the Offshore Technology Confere
ence and are subject to
o correction by the autthor(s). The material dooes not necessarily re
eflect any position of the Offshore Technologyy Conference, its
officers, or members. Electronic
n, distribution, or stora
age of any part of this paper without the wriitten consent of the O
Offshore Technology C
Conference is prohibite
ed. Permission to
eproduce in print is res
stricted to an abstract of
o not more than 300 words;
illustrations mayy not be copied. The abbstract must contain co
onspicuous acknowled
dgment of OTC copyrig


The post-M
Macondo ressponse has included new regulaations, new
w industry standards aand new
rrecommendeed practices such as AP
UL 97 and thhe Workplace Safety R
Rule (per thee existing
RP75) for Offshore
Saafety and Environmentaal Managem
ment (SEMss). These are nominally cross
rreferenced, but
b it is still not clear wh
hat holds theem together aand makes thhem work as a system for well
ddesign, consttruction and
d operation. Furthermoree, there are iinherent inteerface issuess because RP
P96 deals
aacross different phases of
o the projectt delivery prrocess (well design and cconstructionn), while BU
UL 97 and
RP75 cover different paarticipants (ccontractor/op
perator). Thhe theme of this paper hhow to deal with the
ttwo issues off systematic integration and
a interfacees using the bow-tie systtem.
Even though
h well desig
gn and consstruction pro
oject particiipants may have differring commerrcial and
ccultural persspectives, they all have an interest in avoidingg major acciident events. Implemennting and
maintaining barriers su
upports this interest. This paperr discusses an analysiis of how barriers,
perator bridg
ging documeents and saffety and envvironmental managemennt plans havee worked
oor not workeed in 28 diffferent offsho
ore well con
ntrol disasterrs. It will alsso show how
w the bow-tiie system
ccan improve risk commu
unication by providing a lingua frannca between the variouus project parrticipants
aand at different phases of
o the projecct. The lesso
ons from theese case studdies will offeer a path forrward for
tthe industry to successffully implem
ment post-M
Macondo reqquirements bbased upon API RP96, BUL97,
SEMs and otther referencce standards dealing with
h Major Acccident Events offshore.
do Developm
ments in Barrriers, Bridgin
ng Documentts and SEMs
The response to the Apriil 2010 Macon
ndo disaster by
b the oil and gas industry includes new oil and gas rregulations,
rrecommended practices
and guidelines.
mong these are two draft (as oof January 20112) American P
Petroleum Insttitute (API)
ppublications: API
A RP96, BU
UL 97 and thee 2010 US Wo
orkplace Safetyy Rule (which incorporates A
API RP75 by rreference) .
IIn this paper I will refer to th
hese as standaards a genericc sense, in that I expect them
m all to becomee standard pracctice for oil
aand gas operations in the US GoM
over the coming years.
The main ellements drawn
n from each staandard which this
t paper connsiders are: 1. H
How well conttrol barriers arre designed
aand maintained
d (RP96), 2. The
T new temp
plate for bridg
ging documennts between leease operators and drilling ccontractors
((BUL97) and 3.
3 Effective im
mplementation of
o the Octoberr, 2010 US offfshore regulation mandating a 13 element Safety and

Deepwater Well
W Design and Construction
n, 1st edition-API Recommendded Practice 966, draft for com
mmittee ballotting
purposes only.
Well Constru
uction Interface
e Document Guidelines, API Bulletin 97, Thhis draft is for ccommittee balloting purposees only.
Federal Registter/Vol. 75, No
o. 199/Friday, October
15,2010, Final Rule, 30 CFR Part 2550

OTC 23692

Environmental Management System (SEM
Ms). The key elements
of eaach standard ass well as a shhort critique off each as a
rresponse to Maacondo are show
wn in the diagrrams below:
Figure 1. Summ
mary of Relevan
nt Elements of R

RP96 is sim
milar to a detailled performan
nce type of technical specifiication. It provvides a good prrimer on offshore facility
ddesign and con
nstruction from
m the standpoin
nt of mechanicaal integrity andd well control barriers. Unfortunately it does not deal
well with human factors, maanagement of change,
safety culture or riskk communicattion. Thus, RP
P96 in its curreent version
pprovides only a partial respon
nse to the failin
ngs of the Maco
ondo disaster.
The second standard, BUL
L97, is one whiich was develo
oped in responsse to recommenndations in onee of the Departtment of
IInteriors post Macondo
reporrts calling for a Safety Case4 with a separatte bridging to cconnect the safe
fety case to exissting well
ddesign and construction docum
ments.i Figuree 2 illustrates th
he main elemennts of API-(draaft) BUL97.
2. Summ
mary of Relevantt Elements of B

BUL97 prov
vides a standarrd template forr operator/drilliing contractor bbridging docum
ments. It describes an approaach for

A Safety Case
e is a docume
ented body of evidence-usua
lly a series of vvoluminous haard copy reportts that demonsstrate how
aan organization
n intends to ap
pply systematicc risk managem
ment to maintaain and improvve its HSE and o
performance. The
T most widely accepted saffety case guide
elines for drillinng contractorss is the IADC Heealth Safety an
EEnvironment Ca
ase Guideline for
f Mobile Offsshore Drilling Units.

OTC 23692

Management of Change, Risk Assessment and Barriers, Division of Responsibilities and documentation of technical
information. However, as with RP96, it is weak on effective ways to communicate barriers and runs the risk of creating
another document that no one reads.
The 2010 Workplace Safety Rule is the US Governments regulatory response to the Macondo disaster. Figure 3 below
shows the main features of this new regulation.
Figure 3. Summary of Relevant Elements of Workplace Safety Rule & RP75

The 2010 regulation uses API RP75 as a reference to establish a standard management system template for lease operators
and it calls for strict regulatory compliance verified by audits. Most major operators that have experienced safety and/or
environmental problems over the past five years, including BP in the Gulf of Mexico, PTTEP in Australia, Chevron in Brazil
and ConocoPhilips in Bohai Bay, had management systems that would comply with RP75. The main weaknesses of this
standard are that it is not risk based, does not effectively deal with human factors or communication and does not address
barrier failures. Regardless of its shortfalls, it is US law, so operators should try to make it useful rather than simply another
regulatory burden.
Given the strengths and weaknesses of the above standards, are they likely to make a positive difference? To research this
issue, we decided to look to some historical case studies for answers. One place to start is with accidents that have occurred,
and then see if (supposedly) new safeguards in the 3 new standards might have prevented them.
The US Department of Interior (DOI), Bureau of Safety and Environmental Enforcement (BSEE) is responsible for
conducting investigations and preparing reports of oil and gas accidents in the US Gulf of Mexico Outer Continental Shelf
(OCS). Based on the severity and complexity of the accident, the Bureau decides whether to perform the investigation using
only its District office staff or to launch a more comprehensive Panel Investigation using both its Regional and District staff.
For this analysis, I considered approximately 1200 OCS District and Panel accident investigations performed by the DOI
over a 25 year period. From the list of 1200, for barrier failure analysis I selected those Panel investigated events involving a
loss of well control. These occurred over the period between1984 and 2009 and spanned the six different types of drilling and
production activities described in the new (draft) standard for well design and construction, API-RP96. In this way, the
barrier analysis focused on 26iii of the most serious and complex of recent OCS well control events in an attempt to uncover
commonalities in the maintenance of barriers. For purposes of this analysis, workovers were considered a production activity
and considered under the Flowback through Production Tubing category. To perform the analysis, I developed and Access
database around Annex A of RP96 and loaded it with the 26 accident investigation results so I could carefully classify and
analyze each well control barrier failure.
This initial dataset was supplemented by non-BSEE investigations of the Montara and Macondo events of 2009 and 2010
respectively. I included these in order to look more closely at the relationship between barrier failure, management systems
and bridging documents relative to what would be required to comply with the three standards that are the subject of this

OTC 23692

Results of the GoM Well Control Event Analysis

After analyzing all 26 events across six different types of offshore operations, I found that hydrostatic fluid and cement
behind casing or liner were the most common RP96 barriers that failed (for 69% and 27% of the cases respectively). This is
should not surprise anyone. For as long as people have been drilling offshore these have been known to be the main
contributors to the loss of well control. However, what was surprising is the sequence of events and the preconditions
leading failure of these barriers. Usually they did not have to do with the existence or absence of solid well design standards,
bridging documents or a management system. In some cases these were present and in others they were absent. Would a
merely having a BUL97 style bridging document or an RP75 style management system have helped? Based on the accident
reports I investigated, it is doubtful they would have avoided the events. The problem in many cases was poor information
about subsurface conditions, absence of risk analysis before changes were made, or in the worst cases carelessness and
incompetence in verifying that barriers were in place. Often, the onshore/offshore teams (operators and contractor) in these
26 cases seemed to not have a common understanding of the potential hazards and barriers behind the activity they were
Considering the PTT Montara event in Australia, the analysis is yet more revealing. The following were the conclusions
of the Australian government authorities who investigated this 2009 well control event:

Well control practices approved by the delegate of Australias Northern Territory state government, most likely would
have been sufficient to prevent the blowout if the operator had adhered to them and to its own Well Construction
There were no tested and verified barriers in place at the time of the Montara blowout
There was a systemic failure of communication between PTTEPAA(the operator) and Atlas(the contractor) personnel,
particularly with the Offshore Installation Manager (the OIM) and between rig and onshore personnel of both companies.
It is clear that on two critical procedures, the poor cementing job and the removal of the 9 PCCC, Atlas personnel,
both onrig and onshore, were not involved in the actual decisionmaking. The decisions were all taken by key operator
personnel and the operator needs to bear primary responsibility. The contractors onshore personnel (Messrs Gouldin and
Millar) nevertheless conceded during the public hearing its personnel should have subsequently picked up deficiencies,
particularly in the cementing job.iv

How could a bridging document as prescribed by BUL97 have made a difference in the communication between the
operator and the contractor? To answer this question, I performed a gap analysis of the requirements of BUL97 vs. the
Montara Bridging document they called the Montara Safety Case Addendum. The results are shown in the Table 1 below.
Table 1. Bridging Document Comparison
API-BUL97 (WCID) vs. PTTEP/Atlas (Montara) Development

Bridging Document
Safety and Environmental
Management Systems
(SEMS) Who Does What?


Montara Safety Case Addendum

Division of Responsibilities for the 13

element SMS

Where do they do it?

Onshore, Topside, Subsea, Subsurface


When do they do it?

In-transit, on-location, in case of emergency

Who is responsible for risk

management and barriers?

Description of who is responsible for Risk

Analysis and Barriers

Operator and Contractor had safety

management systems. Contractor
Management System was incoherent
(in pieces); Operator Management
System mentioned only by
reference. Lack of a clear division of
Management System responsibilities
Operator responsible for most
activities, but mixed-back and forth
responsibility depending upon the
task, not the location
Mixed operator/contractor team and
split responsibilities during
Operator takes the lead on this but
both parties are always responsible
for working together

OTC 23692

Table 1. Bridging Document Comparison

API-BUL97 (WCID) vs. PTTEP/Atlas (Montara) Development(contd)

Bridging Document
Who does MOC, when?

How are risk assessment and

stop-work authority
Technical Well Design
Details: Description of the
expected conditions
downhole and how the
barriers were designed
Construction of the Barriers
Maintenance &
Communication of the


Montara Safety Case Addendum

Emphasis on Management of Change

(MOC) during well construction and for
personnel/organizational changes

MOC procedures not explicit, but

incorporated by reference.
Contractor MOC policy governs for
procedural and day-to-day
operational changes; operator MOC
policy governs design/drilling
program execution changes.
unclear; stop work authority not
specifically outlined

When a risk assessment and work stoppage

is done during well construction and for
personnel/organizational changes
Includes basis of design and well design,
subsurface drilling hazards, pore
pressure/fracture gradient, temperature
Well Execution Plan: a step-by-step plan
describing well construction activities
Well Execution Risk Assessment including
risk ID, mitigation plan, risk
communication plan


Very high level and generic. Text
and verbally transmitted information
(vs. graphic).

After looking at these comparisons and studying the details of the accident, I concluded the following:

The operator and contractor management systems were not the same as nor as explicit as the 13 elements of SEMs.
The operator/contractor bridging document did not meet the requirements of BUL97- particularly as it relates to
technical details of the well design and construction.
If the Montara Bridging Document had met these WCID requirements the accident would probably still have
occurred. This is because the problem was lack of competence and sensible oilfield practice 101 as it relates to
verification and maintenance of barriers.
The causes of the accident had very little to do with the bridging document.

The evidence shows that in the 27 events analyzed (including the Montara event), there was a general lack of acceptance
of responsibility by the drilling contractors for barrier installation, verification and maintenance. Anecdotally, a few years
ago, prior to the Macondo event, a middle manager from (a now) infamous drilling contractor repeatedly told me that the
drilling contractors job was only to be a limousine bus driver. By this he meant that they were responsible for driving the
passenger (i.e. operator) anywhere he chose to go-even if it was into a dangerous neighborhood. If, as some have suggested,
deeper drilling is akin to space exploration (admittedly a hyperbole), then offshore leases are indeed dangerous
neighborhoods. Dangerous neighborhoods require more of a pilot than a chauffeur.
On the other hand, operators often seemed to treat contractors like another factor of production entitled to well
information only on an as-needed basis. Maybe this type of working relationship is a result of the way legal responsibility is
placed on the leaseholder for safe execution of the drilling program. But the underlying problem is poor communication
concerning barrier design, verification and maintenance between the operator and drilling contractor. Given the events of the
past three years, drilling contractors should begin to act more like aircraft pilots than limousine bus drivers. Operators in turn
should begin to treat contractors more like technical partners concerning well design, construction, risk management and
management of change. Each of the three recent standards provides part of the solution, but what is missing is the
communication link between them that makes the standards work together as a system to achieve safer offshore drilling and
production. Using the previous graphics, Figure 4 illustrates the question of the missing link we are trying to achieve.

OTC 23692

Figure 4 - Th
he Question of the Missing Lin

The missing lin
nk is an approaach called The Bow-tie
Bow-Ties Dia
agrams, The Bow-Tie Sys
stem and Offfshore Risk C
A BowTie diagram is a hazard analysis technique which
graphicaally demonstraates the cause and effect reelationships
bbehind a majorr accident even
nt in one, easy--to-understand
d picture. Whenn Bow-ties aree used as a hazzard managemeent system,
inncluding an electronic
dataabase, portablee graphic disp
play and reall time developpment, they bbecome a pow
werful risk
n tool. A full deescription of th
he bow-tie metthod and its appplication is beeyond the scopee of this paper. However,
thhe following provides
enough background to
t understand how
h they couldd be used in thhis application.
The basic diagram
is (no
ot surprisingly
y) shaped like a bow-tie- w
with different sides of the ddiagram creatiing a clear
ddistinction betw
ween proactivee and reactive hazard
manageement scenarioos. The power of a bow-tie ddiagram is that it shows a
ssummary of sev
veral plausiblee risk scenarioss in a single piicture and it cllearly demonsttrates the barrriers along varrious threat
ppaths. Figure 5 is a simple illustration off the bow-tie concept
with ssome probing questions useed to develop each of its
ure 5-The Develo
opment of a Bo
ow-Tie Diagram

2. What happ
pens when
the hazard is released ?

1. W
What are
azards ?

3. What
causes the
hazarrd to be released ?

4. What are the potentiial


Threat 3

Threat 1

quence 1

op Event

equence 3

Threat 2

Escalation Factor

6.How might
controls fail
leading to
o an escalation ?

quence 2

on Factor

5. How do we prevent the

hazard from being released ?

OTC 23692

Outside of the
t US, bow-tiee diagrams hav
ve been widely
y used as a hazaard assessmentt technique. Thhey are one of tthe key
ssupporting methodologies beh
hind the aforem
mentioned, Saffety Case approoach used in oiil and gas deveelopment in thee North
Sea, Australia and
a other non-U
US jurisdiction
ns. Because th
hey are graphicc (as opposed too textual), bow
w-ties can be a vvery
eeffective form of
o risk and hazzard communiccation across diifferent levels oof employees w
within an organnization.
ould bow-ties aid in risk co
ommunication and major acccident prevenntion? By prooviding the m
missing link
But how co
bbetween RP96,, BUL97 and SEMs. The key
k is to tie everything
backk to barriers, management ssystem elemennts and the
bbridging docum
ment. Figure 6 conceptually
y illustrates ho
ow this might w
work with RP775 managemennt system elem
ments and a
hhazard scenario
o from Annex A of RP96.
Figure 6-The
Ms link Using a Bow-Tie Diagra

This type off diagram coulld be the basis of discussion for many deciisions that conntractors and opperators face dduring well
ddesign, constru
uction and operration. The doccuments supporting SEMs, R
RP96 and BUL997 would of coourse still existt, but bowtiie diagrams co
ould act as a co
ommon languag
ge, the lingua franca
betweeen operator andd drilling contrractor, betweenn engineers
aand toolpusherrs and between
n the OIM and
d company maan. Before maj
ajor changes arre made, the eexisting bow-ttie diagram
would be conssulted (or a neew one develop
ped) for the situation-alway
ys keeping in m
mind the mannagement systeem and the
bbridging docum
ment. This is true
awareness and communiication of barriiers. This is trrue understandding of the reasson behind
eelements of thee management system. This is
i effective, risk
k based comm
munication of m
major hazards.
Bow-Ties as the Lingua Franca
in Pra
If bow-ties have been in use
u for so long in non-US jurrisdictions, whyy has no one eever used them
m in this way? T
The answer
is that bow-ties have been mis-used
and under-used.
nfortunately, I have seen thhe bow-tie diaagrams developped a year
bbefore the Maccondo disaster illustrating how
w the Macondo accident wouuld eventually occur-includinng the failed barriers that
aactually did faiil! The Montaara Safety Casee also containeed numerous boow-tie diagram
ms. In both casses, the problem
m was that
thhey were never effectively used by rig personnel,
or as
a a universal risk communnication graphiic between opperator and
ccontractor, eng
gineer and toolpusher or OIM
M and company man. Howeever there is a very promisinng example off the use of
bbow-tie diagram
ms by Maersk Drilling. The following
vides an insighht into integratiion of barriers,, bridging docuuments and
SEMS using th
he Bow-Tie Sysstem.

OTC 23692

Last year, in addition to use for Major Accident Events, Maersk Drilling undertook the implementation of bow-tie
diagrams on its rigs for the purpose of Job Safety Analyses(JSAs). This required training rig personnel in basic hazard
analysis and in the bow-tie software tool, Bow-TieXP. Maersk is now in the process of rolling this bow-tie system out
worldwide for JSAs on its rigs. By using the bow-ties in this way, they have created the link between safety barriers(similar
to those in RP96 for process events), the Safe Work Practices management system element of SEMs, and the bridging
documents between Maersk and its operators which assigns the responsibility for work permits and safe work practices to the
Maersk Drilling. In this way it actually moves the responsibility for this type of hazard management down to those who will
be implementing it. Maersk Drillings approach is precisely the approach needed to achieve the holy grail of effective
implementation of barriers maintenance, bridging documents and SEMs.

Increased Safety Measures for Energy Development on the Outer Continental Shelf, May 27, 2010, Section III, B,
Recommendation 2
BSEE website, Listing and Status of Accident Investigations Generated 10-03-2011 11:40:41 AM,
BSEE website: Panel Investigation Reports,
Montara Commission of Inquiry, June 2010, ISBN: 978-0-9808190-1-4