Proceedings of the ASME 2019 38th International
Conference on Ocean, Offshore and Arctic Engineering
OPERATIONAL SAFETY RISK ASSESSMENT IN OFFSHORE OIL WELLS
Marcelo A. Jaculli1 Danilo Colombo
University of Campinas Petrobras
Campinas, Brazil Rio de Janeiro, Brazil
ABSTRACT
Identifying and analyzing hazards and their associated risks
have been a major concern of the oil industry since the Piper
Alpha incident in 1988, but techniques to assess risks were only
explored further in the last decade after the incident in Macondo.
It became clear that there were many hazards associated with oil
exploration and exploitation activities; therefore, these hazards
had to be identified and proper measures to contain their damage
had to be put in place. This led to a development in existing risk
analysis techniques such as bowtie diagrams, fault trees,
Bayesian networks and Markov methods, but also hybrid
techniques such as Markov chain Monte Carlo methods and
fuzzy fault trees. In this work, we presented and discussed a
literature review on these techniques, focusing on their
contributions to the oil industry, as well as existing legislation
and standards concerning safety. After comparing advantages
and disadvantages of these techniques, we proposed a
methodology using graphs to assess the safety level associated
to a standardized sequence of operations. This methodology is
based on an ontology of operations (which provides
standardization) and the concept of BIS (barrier integrated sets),
which are sets of elements from a well that ensure safety to
perform each operation. With available statistical data, or by
using fuzzy sets to cover their absence, this methodology is able
to quantify reliabilities and determine if a certain operation can
be performed safely based on a risk acceptance criterion. In
order to demonstrate this concept, we calculated the reliability
of two primary BIS during the intermediate drilling phase and
showed how the reliability changes based on the corresponding
drilling operational sequence.
Keywords: risk assessment, operational safety, barrier
integrated sets, well engineering.
1
Contact author: jaculli@cepetro.unicamp.br
OMAE2019
June 9-14, 2019, Glasgow, Scotland
OMAE2019-95069
José Ricardo P. Mendes
Cinara F. G. Marculino
Beethoven G. dos S. Costa
University of Campinas
Campinas, Brazil
INTRODUCTION
The global growth on energy demand has encouraged oil
and gas companies to invest into deepwater exploration
scenarios [1]. With advancements towards offshore
environments in search of new fields, operations now involve
high costs, since such fields possess great water depths and large
distances from the shore, require the usage of dynamic
positioning vessels and have great complexity from an
engineering standpoint. The main risk of building oil wells is the
possibility of uncontrolled hydrocarbon influxes into the well
and then to the environment, called a blowout. Regarding
offshore wells, blowouts can either be underground or reach the
surface. While the first one causes environmental damage due to
leakage of hydrocarbons on the bottom of the sea, the second one
is more critical because it can lead to fire and explosions on the
vessel and injuries and death to its workers.
Ensuring well integrity – i.e. avoiding any leaks – is of vital
importance during the complete well life cycle and during all
intervention operations. The phases of construction,
maintenance and decommissioning all include some kind of
intervention inside the well by using a rig. During interventions,
the rig is connected directly to the well, and thus any leakage can
reach the rig floor and cause fire and explosions. An example of
accident during drilling was the Macondo blowout on the Gulf
of Mexico in 2010. There were several consequences from this
incident, such as an oil spill of 5 million barrels, financial losses
in the order of dozens of billion dollars, 11 people dead and 17
injured, and damage to companies’ public images and to the
communities located close to the oil spill location. Thus,
exploring and producing oil involves environmental, economic,
social and individual risks.
Operational safety is one of the main concerns while
developing well building activities and it is usually measured in
terms of associated risks. In this context, developing a
quantitative risk analysis model is a way to support decision-
1 Copyright © 2019 by ASME
making during design. An effective methodology capable of
evaluating risk should answer questions such as: (I) Which
project is safer? (II) What are the most critical or most vulnerable
elements? (III) In which aspects should I invest efforts in order
to improve? Risk evaluation can also help in elaborating risk
prevention and mitigation plans when necessary.
Quantitative information obtained from well activities
usually possess some associated uncertainty. This stochastic
nature of data reflects on well operations and well components
reliabilities, which in turn will affect the reliability evaluation of
safety barriers. Besides, conventional risk analyses fail in
representing risk variability in dynamic cases, such as during
well interventions. Investigating uncertainties as well as
developing a dynamic risk analysis model will allow us to better
estimate the occurrence of degraded well states (when there is
the risk of losing a safety barrier). They should also help
identifying critical points of the system, which have higher
failure rates. Identifying critical components can even modify
the design phase of the well, in order to reduce later risks that
will affect operational safety and well integrity.
In this paper, we discuss the main available methodologies
on the literature used to analyze risks, identifying their
advantages and disadvantages and drawing comparisons. Then,
we propose our own methodology for a quantitative risk analysis
of an operational sequence, using graphs combined with fuzzy
sets. Finally, we apply our methodology for a drilling scenario
and show its usefulness.
1. Theoretical Foundation
While quantitative methods exist on the literature, including
with applications on the oil industry, there is no large evolution
on their application for well engineering, especially on the well
design and well building processes. Companies rely largely on
qualitative models, which are based on existing standards and
subjective evaluations from experts. Since quantitative methods
possess more restrict applications, they are usually employed in
special situations that require more efforts to evaluate risks. This
section explores both quantitative and qualitative methods, such
as bowtie diagrams, fault trees, Bayesian networks, Markov
methods, Monte Carlo simulations and fuzzy techniques, while
also discussing existing standards related to risk assessment.
1.1. Legislation and Standards
Relevant references regarding offshore wells integrity
appeared, not by coincidence, on regions with higher offshore oil
production, constituting a consolidated knowledge and thus
being called best practices. Three of these regions are the Gulf
of Mexico on the USA, the North Sea on UK and Norway and
the Campos and Santos basins in Brazil.
NORSOK D-010 [2] treats the topic of well integrity during
operations, being one of the main references on the subject. API
RP 96 [3] presents recommended practices for well design and
construction in deepwater environments. Both standards
consider the redundancy principle, i.e. the requirement of at least
two active barrier envelopes in order to ensure well integrity.
They also affirm that a system with multiple barriers must be
used to obtain a higher level of reliability, meaning that the
system reliability is obtained from a combination of individual
barriers and not through the failure rate of a single component.
NORSOK Z-013 [4] discusses risk analysis and preparation for
emergencies. The definition of risk analysis here is the usage of
available information to identify hazards and estimate risks, such
as blowouts, leakages, fire and explosions. Accordingly, a risk
acceptance criterion for these hazards must be adequate both for
decision-making and for easy communication. In addition, it
discusses uncertainties on risk analysis caused by lack of
available data, employed models, adopted hypotheses,
simplifications and judgment from experts. Thus, this standard
is conservative in the sense it employs safety margins.
In Brazil, ANP Regulation no 46 from 2016 [5] established
the SGIP (abbreviation in Portuguese for “System for Managing
Well Integrity”). This regulation is based on best practices from
the industry and much of its contents are similar to the
aforementioned standards. It establishes that during the entire
well life cycle two independent barrier integrated sets (BIS) must
be active. In case it is impossible to have two independent BIS
during construction, intervention or temporary abandonment
phases, the risk must be evaluated and control and mitigation
measures must be applied to keep the well under the ALARP (As
Low As Reasonably Practicable) level. It is a tendency for new
regulations to be non-prescriptive, in the sense that it is up to
operators to define safety objectives and risk acceptance criteria.
The risk level must be kept ALARP and improvements to further
reduce risk should be done over time, as technology and
experience develop.
1.2. Main Risk Analysis Techniques
Following, several techniques for safety analysis are
discussed. This listing is far from exhaustive, but intends to
provide an overview of main risk analysis techniques and,
whenever existent, their applications on the oil industry.
Bowtie Diagrams. Nielsen [6] propose the first concept of
what would later become a bowtie diagram, with de Dianous and
Fiévez [7] later employing the bowtie diagram methodology as
a tool for risk control while emphasizing the role and
performance of safety barriers.
In the oil industry, Abimbola et al. [8] propose a bowtie
analysis for evaluating the safety of offshore drilling under three
possible drilling procedures: overbalanced, underbalanced and
managed pressure drilling (MPD). Johansen and Rausand [9]
discuss the role of barrier management on the offshore oil
industry. Fraser et al. [10] recognize the effectiveness of the
bowtie analysis, but propose a step further, which they call the
multiple physical barrier approach, and then test their
methodology through examples taken from drilling and
completion scenarios. Ibrahim and Rao [11] discuss the
importance of the bowtie methodology for the oil industry, in
light of the Piper Alpha and Macondo incidents.
Fault Trees. According to the NUREG-0492 [12], methods
to perform risk analysis and reliability assessment originated in
2 Copyright © 2019 by ASME
the early 1960s in the USA, including the fault tree analysis
(FTA), which became quite popular. In the last two decades, FTA
has become a useful, respected and widely used methodology for
probabilistic risk assessment in several industries. According to
Ebeling [13], a FTA does not present all possible causes of failure
within a system; it is an analysis based on events themselves
rather than on its components, focusing the perspective into the
faults instead of the reliability. Constructing a fault tree and
performing a fault tree analysis require training and experience,
and thus, in order to aid in this process, several standard and
guidelines were published, such as the IEC 61025 [14], the
NUREG-0492 [12] and the Guidelines for Hazard Evaluation
Procedures [15].
In the oil and gas industry, the risks associated with
exploration and production operations gradually followed the
evolution on the complexity of well project scenarios and
maritime units. Holand [16-18] and Holand and Rausand [19]
estimate the availability of subsea BOP systems using the FTA.
Andersen [20] presents a fault tree model for stochastic analysis
of a kick as an initiating event to a blowout during exploration
drilling. Zulqarnian and Tyagy [21] propose to use available
equipment failure data in order to obtain blowout probabilities
using fault trees and investigate the importance and sensitivity of
different well barriers. Rausand [22] also discusses fault trees,
presenting their advantages and limitations.
Bayesian Networks. According to Charniak [23], Bayesian
networks find several applications, mostly outside the oil
industry, while Hamada et al. [24] say that the evolution of
computation resources and of the methodology itself allowed
Bayesian methods to be applied in a wider range of problems,
including complex problems that classical techniques have
trouble dealing with. Cai et al. [25] affirm that the technique can
perform both predictive and diagnostic analyses, i.e. it can both
identify problems in design stages but also fix problems in later
stages such as when executing operations themselves. Bobbio et
al. [26] propose a method to transform a fault tree into a Bayesian
network and compare the two methods through an example.
Weber and Jouffe [27] discuss dynamic Bayesian Networks,
which can be used to model complex systems. Torres-Toledano
and Succar [28] also discuss Bayesian networks applied to
complex systems, but through transformation of a reliability
block diagram into a Bayesian network.
Currently, no available standard in the oil industry suggests
using Bayesian networks as a tool for risk analysis, but the
methodology still found several recent applications. Cai et al.
[29] apply Bayesian networks to study a subsea BOP system. Cai
et al. [25] model the impact of human factors on offshore
blowouts. Khakzad et al. [30], Abimbola et al. [31] and Bhandari
et al. [32] apply Bayesian networks to evaluate risks associated
to well control when using MPD. Khakzad et al. [33] use data
from previous accidents to create a model that can predict major
accidents. Li et al. [34] use this approach to study failure on
submarine oil and gas pipelines due to leakage. Martins et al.
[35] propose a hybrid Bayesian network to study a regasification
system onboard a FSRU. Vinnem et al. [36] model the risk
associated to performing maintenance work on equipment from
offshore installations.
Markov Chain Monte Carlo Method. According to
Basharin et al. [37], a Markov chain is an infinite sequence of
variables that are independent of each other, and thus the
prediction of a future state is based solely on the present state
and is independent of past states. Rausand [22] claims that
Markov methods aim to evaluate system possessing
redundancies and/or interdependencies, system possessing
complex maintenance strategies and systems with sequential
failures. As the number of components in a system increases, the
larger will be the number of states, leading to great calculation
efforts. Meanwhile, Monte Carlo methods are techniques based
on random sampling, which provide accurate approximations in
problems involving uncertain parameters by performing a large
number of simulations. For Mostafavi et al. [38], all input
parameters have a certain level of uncertainty that is not
considered in deterministic models. The great advantage of
probabilistic models is to reduce this inconsistency, subjecting
results to uncertainties and increasing the precision of risk
analyses. Combined, these two techniques lead to the Markov
Chain Monte Carlo method (MCMC), a hybrid method that
circumvents some limitations. According to van Ravenzwaaij
[39], MCMC is able to represent any distribution through the
generation of random samples values, even when distribution
properties are lacking. The generation of random samples
follows a sequence in which each value depends exclusively on
the immediately preceding value, characterizing the chain.
Although Markov chain is an old method, its applications in
the oil industry are still very limited, relatively recent and
generally coupled to Monte Carlo simulations. According to
Peterson et al. [40], there was an initial resistance into using
stochastic models to quantify risks in the oil industry, until more
publications on techniques such as Monte Carlo became
available, leading to a rapid increase in use after their credibility
was verified. Li and Zhu [41] propose the utilization of the
MCMC to interpret the downhole pressure and temperature data
to describe the flow-rate profile in horizontal wells. Gasda et al.
[42] apply the MCMC to find the most suitable parameter
estimation approach in order to calculate wellbore permeability.
Chen et al. [43] suggest that MCMC can be applied in kick
detection problems. Formighieri and Freitas Filho [44] study the
determination of the Bourgoyne and Young Model (BYM)
coefficients, which are used to calculate the rate of penetration
(ROP) in well drilling, from probability distributions, whose
curves are constructed using the MCMC method. Muehlenbachs
[45] proposes the utilization of Markov processes in the
calculation of costs related to decommissioning operations in oil
wells.
Fuzzy Fault Tree. In a conventional FTA, all the
probabilities associated to basic events are known; they are,
therefore, considered as a crisp value. However, in many
practical systems, information on failure rates can be imprecise,
incomplete or even unknown. To circumvent this limitation,
3 Copyright © 2019 by ASME
fuzzy techniques can be applied to the FTA because they
transform subjective judgments into meaningful numerical data,
which in turn can be combined with other existing numerical
data. Liu et al. [46] propose five stages to describe the fuzzy fault
tree method. In the first, expert judgments of basic events are
provided and linguistic terms are converted into fuzzy numbers.
Then, the top event is converted to a collection of bottom events.
The third is converting fuzzy failure possibility into fuzzy failure
probability. After that, the defuzzyfication process is performed.
To finish the method, the last stage calculates the failure
probability of the top event.
Mentes and Helvacioglu [47] discuss that while several
researchers used the FFTA successfully in various areas, few
applications were found in the oil and gas industry. Lin and Wang
[48] combine fuzzy set theories and judgment from experts to
evaluate failure of an automated drilling system. Yuhua and
Datao [49] and Lavasani et al. [50] use FFTA to analyze failure
of oil and gas pipelines. Liu et al. [51] propose use of fuzzy sets
to assess risk in drilling projects. Wang et al. [52] use FFTA for
analyzing fire and explosion of oil tanks. Lavasani et al. [53]
employ the FFTA to identify leaking problems in abandoned
wells.
1.3. Summary of Advantages and Limitations
To illustrate the concepts of the main available quantitative
methodologies on the literature that are used for risk assessment,
Table 1 presents a summary of all the techniques, based on
Rausand [22], highlighting their advantages and limitations.
TABLE 1: SUMMARY OF THE TECHNIQUES ADVANTAGES AND LIMITATIONS.
Method Advantages
 Easy to use, with a logical form of  Treats only foreseeable critical events
presentation
Fault Tree Analyses
 Commonly used and widely accepted
 Suitable for different critical events
 Produces a graph with an intuitive
interpretation
Bayesian Networks  Can include quantitative and qualitative
information
 Can be updated in real-time
 Appropriate tool for complex systems with  Limited to small systems
dynamic properties
Markov Methods  Offers a state transition diagram, which
can provide a deeper understanding of the  Limited by requirements of constant
system
 Alternative solution to overcome weak
points of conventional approaches
Fuzzy Fault Tree  Useful in cases which subjective judgment
Analyses or estimation of an individual plays a
useful role in dealing with ambiguity or
uncertainty
2. Methodology
During the well building and repairing processes, any
executed operations modify the well state. In this sense, the
methodology proposed here aims to identify degraded well states
given a certain planned operational sequence. Once these states
are identified, recommendations or even modifications can be
proposed to the planned operational sequence, in order to
increase safety. A general view of this methodology can be seen
on Figure 1.
Given a planned sequence of standardized operations, one
should identify the available barriers and BIS. Each operation
modifies the well state and, consequently, the barriers and BIS.
This is shown, in Figure 1, for operation (k-4). The identified
barriers and BIS for this operation are modeled into a graph, and
then either exact or fuzzy reliability values are assigned to each
component. Finally, according to the relationships between
components as given by the graph, all these reliabilities are
composed into a single number called safety level, which is an
indicative of the overall safety of a certain operation. This
process is repeated for all operations, and then the values are
aggregated once more to provide the safety level of the entire
operational sequence, as illustrated by Figure 2. Thus, an
operation safety level can be expressed through its BIS
reliabilities. In this sense, assessing the system reliability is a
way of assessing its capability in maintaining integrity during
hazardous situations. It is important to note that an operation
reliability is given based on which components are present inside
the well during its execution.
Limitations
 Hard to apply for systems that cannot be
categorized into failed-or-working states
 Hard to apply for systems sensible to the
sequence of events
 Becomes complicated and time-
consuming for large systems
 Not suitable for dynamic systems
 Workload increase rapidly with an
increasing number of nodes
 Involves usage of a computer program,
even for small systems
 Becomes unproductive when the number
of states increases
failure rates and constant repair rates
 Subjected to judgments from experts for
basic events and, in some cases, for
hazardous events.
4 Copyright © 2019 by ASME
 FIGURE 1: DIAGRAM OF THE OPERATIONAL SEQUENCE ANALYSIS, EMPHASIZING A SPECIFIC OPERATION.
Besides, barriers, BIS and respective graphs can be defined
and stored beforehand, as long as a set of standardized operations
is used during their definition. In this work, we adopted the
ontology proposed by Miura [54] and Miura et al. [55]. This
ontology can transform any non-standardized sequence into a
standardized one, thus streamlining the process.
A few other tools will be necessary for the analysis. Firstly,
the concept of fuzzy sets, introduced by Zadeh [56]. This allows
us to treat vague or imprecise information, by associating
linguistic variables with numbers and by providing the
possibility of partial membership to a set, instead of the classical
binary membership possibilities. In other words, this means that
data can come as a number with an associated uncertainty given
by a probability distribution, or just as a linguistic term such as
low or high risk, which is then converted into a number with a
certain uncertainty using expert judgment. In this work,
triangular fuzzy numbers will be used.
Secondly, usage of the graph methodology provides a
graphical visualization of how barriers and their components are
connected to each other, which will be important when
calculating the reliability of the whole system. The graph
technique is thus a powerful visual tool, being capable of easily
conveying ideas to an audience. There is also an important
distinction from fault trees; while fault trees try to map all
possible events that lead to failure, graphs focus on detailing the
system components that prevent failure, and then these can be
activated or deactivated based on any possible event.
Finally, Boolean and fuzzy gates are used as logical
operators relating components of the graph, and thus indicating
what mathematical operations should be performed in order to
compose all reliabilities into a single value for the whole system.
Gates can be either “AND” (represented by a dot) or “OR”
(represented by a plus), depending if the components under them
work in unison or are redundant for the same function.
To sum up the process, firstly a graph is built for a particular
barrier and/or operation, detailing all the relationships between
components. Then, either crisp or fuzzy values are assigned to
each component, representing their respective reliabilities.
Lastly, these values are composed using mathematical operations
through Boolean and/or fuzzy gates, leading to a single
reliability value for the whole system (which can be a BIS, an
operation or an entire sequence).
In order to demonstrate the methodology, a case study was
selected based on an offshore well drilling operational sequence.
The barriers and BIS were modeled using fuzzy graphs based on
expert knowledge and experience from previous research
projects. The fuzzy data used for components reliabilities is
solely an example in order to test the methodology and the
treatment of uncertainties. This paper will focus on the existing
primary BIS inside a well during the intermediate drilling phase.
5 Copyright © 2019 by ASME
 FIGURE 2: DIAGRAM OF THE OPERATIONAL SEQUENCE ANALYSIS, EMPHASIZING THE WHOLE SEQUENCE.

3. Results and Discussion of 1.0, assuming that the rock is competent enough to not fail and
During the intermediate drilling phase, we must look at two this has been verified through the leakoff test):
primary BIS: one composed by the drilling fluid and one
composed by the cemented intermediate casing.  R1 – Drillpipe: (0.90; 0.95; 1.00)
 R2 – Riser: (0.80; 0.85; 0.90)
3.1. Drilling fluid during the intermediate drilling phase  R3 – Riser safety margin: (0.90; 0.95; 1.00)
Figure 3 presents the graph for the primary BIS composed  R4 – Drilling fluid at well: (0.75; 0.80; 0.85)
by the drilling fluid. In the “well and string” path, we have five  R5 – Mud cake: (0.90; 0.95; 1.00)
barriers: the drillpipe, the riser, the riser safety margin, the  R6 – Proper density: (0.80; 0.85; 0.90)
drilling fluid and the ability of replenishing drilling fluid (which  R7 – Extra volume: (0.75; 0.80; 0.85)
is further divided into components: capability of creating a mud
 R8 – Deep natural barrier: 1.0
cake, proper density for the drilling activity and extra available
volume in order to replenish circulation losses). In the “annulus
Based on these input values, fuzzy calculations are
and rock” path, we must have a deep natural barrier composed
performed using the Boolean gates, and the final reliability of
by the rock itself, whose integrity can be verified using a leakoff
this BIS is given as (0.39; 0.51; 0.65). This is also a triangular
test. All these paths must be secured to ensure well safety, and
fuzzy number, which can be interpreted as representing a 51%
thus they are connected through an “AND” gate.
reliability, but with possible values inside the 0.39-0.65 range.
The riser here works as a barrier that ensures both control
However, during a drilling operational sequence, one or
and monitoring of the fluid level, but also the safety of the well
more barriers from Figure 3 can be deactivated and/or
itself by isolating the well from the environment. It is an option
reactivated. This implies that the graph of Figure 3 will change
to other available barriers, thus being connected through an
based on each operation, since barriers and/or components can
“OR” gate to both paths. Concerning the fluid, the rig must be
be added and/or removed during the drilling process. Therefore,
able to produce and replenish 100% of the well volume at any
Figure 3 is a general graph for this BIS during the intermediate
given time.
drilling phase, and operation-specific graphs can be obtained
As an example, consider the following reliability values for
from it.
barriers and its components, which are given as fuzzy triangular
numbers (except for the natural barrier, which has a crisp value

6 Copyright © 2019 by ASME

 FIGURE 3: PRIMARY BIS FOR THE DRILLING FLUID DURING THE INTERMEDIATE DRILLING PHASE.

TABLE 2: ANALYSIS OF THE DRILLING FLUID BIS FOR AN Figure 3 by activating or deactivating components, and thus the
EXAMPLE OF OPERATIONAL SEQUENCE. reliability of the BIS changes since its components have
Sequence Operation Fuzzy Number changed.
31 Leakoff test (0.39; 0.51; 0.65)
3.2. Cemented intermediate casing
32 Reaming while drilling (0.39; 0.51; 0.65) Figure 4 presents the graph for the primary BIS composed
33 Well conditioning (0.39; 0.51; 0.65) by the cemented intermediate casing. This primary BIS has five
34 Pulling out BHA with bit (0.32; 0.44; 0.59) different paths, each one with its own barrier: operational barrier,
35 Well logging (0.32; 0.44; 0.59) well path, interconnection, annulus path and rock path. All these
paths must be secured to ensure well safety, and thus they are
36 Liner running (0.39; 0.51; 0.65) connected through an “AND” gate. In the well path, we have the
37 Cementing (0.32; 0.44; 0.59) shoe track at the well bottom; in the annulus path, we have the
38 BOP testing (0.32; 0.44; 0.59) intermediate casing cementing; in the rock path, we have a deep
Assembling and running natural barrier; and as an interconnection, we have the
39 (0.39; 0.51; 0.65) intermediate casing itself. Lastly, operational barriers are tests
BHA with bit
that must verify the integrity of the cement from the shoe track.
40 Kick control training (0.39; 0.51; 0.65) It can be verified through a pressure or an inflow test, leading to
Cement and rat hole an “OR” gate. The deep natural barrier can be verified through a
41 (0.39; 0.51; 0.65)
drilling leakoff test, and the fracture gradient of its weakest point is used
to design the kick tolerance.
Consider as an example the operational sequence given by As an example, consider the following reliability values for
Table 2. The last column provide the BIS reliability for each barriers, which are given as fuzzy triangular numbers (except for
operation. Notice that the reliability changes to (0.32; 0.44; 0.59) the intermediate casing and the natural barrier, which have a
in some operations – such as pulling out the bottom hole crisp value of 1.0):
assembly (BHA) – since the “drillpipe” barrier becomes inactive.
As aforementioned, operations may modify the graph from

7 Copyright © 2019 by ASME

  R1 – Pressure test: (0.90; 0.95; 1.00) the well for inflow. With the test done, the “inflow test” barrier
 R2 – Inflow test: (0.80; 0.85; 0.90) becomes active and thus the BIS is consequently activated as
 R3 – Shoe track: (0.85; 0.90; 0.95) well.
 R4 – Intermediate casing: 1.0
 R5 – Intermediate casing cement: (0.80; 0.85; 0.90) TABLE 3: ANALYSIS OF THE CEMENTED INTERMEDIATE
CASING BIS FOR AN EXAMPLE OF OPERATIONAL
 R6 – Deep natural barrier: 1.0
SEQUENCE.
Based on these input values, fuzzy calculations are Sequence Operation Fuzzy Number
performed using the Boolean gates, and the final reliability of 31 Leakoff test 0
this BIS is given as (0.67; 0.76; 0.86). This is also a triangular 32 Reaming while drilling 0
fuzzy number, which can be interpreted as representing a 76% 33 Well conditioning 0
reliability, but with possible values inside the 0.67-0.86 range.
Similarly to the previous BIS, one or more barriers from 34 Pulling out BHA with bit 0
Figure 4 can be deactivated and/or reactivated during a drilling 35 Well logging 0
operational sequence. As an example, we consider the same 36 Liner running 0
operational sequence from Table 2, but now with reliability
37 Cementing 0
values for the cemented intermediate casing BIS. Table 3
presents these values on its last column. This time, we have some 38 BOP testing (0.67; 0.76; 0.86)
lines in the table with a zero value; this implies that this BIS is Assembling and running
39 (0.67; 0.76; 0.86)
inactive during some operations. This happens because the BHA with bit
barriers are connected through an “AND” gate, and thus when a 40 Kick control training (0.67; 0.76; 0.86)
barrier is deactivated the entire BIS is deactivated. For this Cement and rat hole
particular scenario, the BIS only becomes active after the BOP 41 (0.67; 0.76; 0.86)
drilling
is installed, since the “BOP testing” operation includes testing

FIGURE 4: PRIMARY BIS FOR THE CEMENTED INTERMEDIATE CASING.

8 Copyright © 2019 by ASME

4. Conclusions
Risk assessment became a fundamental concern in oil
exploration activities, in light of recent major incidents and
subsequent stricter regulations. Thus, several risk analysis
techniques have been applied consistently in the oil industry over
the past decades, in order to ensure that such events no longer
occur.
This work focused on discussing existing methodologies
and their applications in the oil industry, but also on proposing a
new methodology based on fuzzy graphs for analyzing the
reliability of drilling operations. Assessing the reliability of
components, barriers, BIS and operations gives us a
measurement of the system capability in maintaining integrity
during hazardous situations. The identification of components,
barriers, BIS and operations was only possible thanks to an
ontology of standardized operations. A complete risk
assessment, including consequences, can then be performed
based on the failure probability of the system given by the
reliability analysis.
We showed a numerical example based on two primary BIS
present in a well during its intermediate drilling phase. Fuzzy
numbers have been used in order to demonstrate that such
analyses can accommodate uncertainties or even linguistic data.
Using example values provided for the components reliabilities,
the graph itself – with its gates showing the relationships
between components – and fuzzy algebra, the reliabilities of the
BIS were obtained for a general case representing the
intermediate drilling phase. Then, based on a drilling operational
sequence that modifies the components present inside the well,
BIS reliabilities were recalculated for each operation considering
the fact that some barriers and/or components might be
deactivated/reactivated during the operation execution.
Therefore, the methodology has shown that by having a
sequence composed of standardized operations and a
documented knowledge of components, barriers and BIS, the
reliability of the well can be obtained during any moment of the
well drilling process. With the BIS reliability for each operation
calculated, a comparison with some criterion can be drawn,
which will determine if the operation can be carried out safely or
not.
Naturally, data that are more accurate are needed in order to
obtain meaningful reliability values for BIS in these scenarios.
Companies often have failure rates of components and/or
barriers during the well life available to them through databases.
However, one must be careful when using failure rates collected
from the entire well life, as these are measured for long time
periods (several years) and would become negligible if applied
to operations spanning short time periods (a few hours).
Reliability analysis methods based on mechanics can be
performed for single components in order to obtain their failure
rates during operations, which in turn can replace collected
historical data and improve accuracy.
For future works and researches, the goal is to have detailed
graphs for all well drilling phases and test them for different
designs of drilling operational sequences, thus using the
methodology developed here as a tool for choosing the best
design based on the highest overall safety according to BIS
reliabilities. In addition, the methodology was applied only for
drilling operations, but can be extended to completion operations
as well, though these are more complex as there is a higher
number of standardized operations and they involve a higher
number of components and barriers.
ACKNOWLEDGEMENTS
The authors would like to acknowledge the support given by
the University of Campinas and the financial support provided
by Petrobras during this research project. This study was
financed partially by the Coordenação de Aperfeiçoamento de
Pessoal de Nível Superior - Brasil (CAPES) - Finance Code 001.
REFERENCES
[1] Rathnayaka, S., Khan, F. and Amayotte, P.. “Accident
modeling and risk assessment framework for safety critical
decision-making: application to deepwater drilling operation”.
Journal of Risk and Reliability Vol. 227 No. 1 (2013) pp 86-105.
DOI: 10.1177/1748006X12472158.
[2] NORSOK. Standard D-010 - Well integrity in drilling
and well operations. Rev. 4 (2012). Standard Norge, Norway.
[3] API RP 96. Deepwater Well Design and Construction.
1st edition (2013). API Publishing Services, Washington DC,
USA.
[4] NORSOK. Standard Z-013 - Risk and emergency
preparedness analysis. Rev. 2 (2001). Standard Norge, Norway.
[5] ANP. Resolução n° 46 (2016) (Regulation no. 46 – in
Portuguese). http://legislacao.anp.gov.br/?path=legislacao-
anp/resol-anp/2016/novembro&item=ranp-46--2016. Accessed
31 July 2018.
[6] Nielsen, D. S.. “The cause/consequence diagram method
as a basis for quantitative accident analysis”. (1971).
[7] de Dianous, V. and Fiévez, C.. “ARAMIS project: A
more explicit demonstration of risk control through the use of
bow–tie diagrams and the evaluation of safety barrier
performance”. Journal of Hazardous Materials Vol 130 (2006)
pp 220–233. DOI: 10.1016/j.jhazmat.2005.07.010.
[8] Abimbola, M., Khan, F. and Khakzad, N.. “Dynamic
safety risk analysis of offshore drilling”. Journal of Loss
Prevention in the Process Industries Vol 30 (2014) pp 74-85.
DOI: 10.1016/j.jlp.2014.05.002.
[9] Johansen, I. L. and Rausand, M.. “Barrier management
in the offshore oil and gas industry”. Journal of Loss Prevention
in the Process Industries Vol 34 (2015) pp 49-55. DOI:
10.1016/j.jlp.2015.01.023.
[10] Fraser, D., Braun, J., Cunningham, M., Marple, B.,
Moore, D. D., Sas-Jaworsky, A. and Wilson, J.. “Operational
Risk: Stepping Beyond Bow-Ties”. SPE Annual Technical
Conference and Exhibition, Houston, USA, September 28-30,
2015.
[11] Ibrahim, H. and Rao, P. J.. “Review of Practical
Applications of the Bow-Tie Approach Especially in Offshore
9 Copyright © 2019 by ASME
Oil and Gas Industry”. International Journal of Research in
Engineering & Advanced Technology Vol 5 (2017) pp 58-67.
[12] U.S. Nuclear Regulatory Commission. NUREG-0492 -
Fault Tree Handbook. (1981). U.S. Nuclear Regulatory
Commission, USA.
[13] Ebeling, C. E.. An Introduction to Reliability and
Maintainability Engineering. McGraw-Hill, USA (1997).
[14] IEC 61025. Fault tree analysis (FTA). 2nd edition
(2006). International Electrotechnical Commission, Geneva,
Switzerland.
[15] CCPS (Center for Chemical Process Safety).
Guidelines for Hazard Evaluation Procedures. 3rd edition
(2008). John Wiley & Sons, Inc., New Jersey, USA.
[16] Holand, P.. “Subsea Blowout-Preventer Systems:
Reliability and Testing”. SPE Drilling Engineering Vol 6 (1991)
pp 293-298. DOI: 10.2118/17083-PA.
[17] Holand, P.. Reliability of Subsea BOP Systems for
Deepwater Application Phase II DW. (1999). SINTEF,
Trondheim, Norway.
[18] Holand, P.. “Reliability of Deepwater Subsea Blowout
Preventers”. SPE Drilling & Completion Vol 16 (2001) pp 12-
18. DOI: 10.2118/70129-PA.
[19] Holand, P. and Rausand, M.. “Reliability of Subsea
BOP Systems”. Reliability Engineering Vol 19 (1987) pp 263-
275. DOI: 10.1016/0143-8174(87)90058-8.
[20] Andersen, L. B.. “Stochastic modelling for the analysis
of blowout risk in exploration drilling”. Reliability Engineering
and System Safety Vol 61 (1998) pp 53-63. DOI: 10.1016/S0951-
8320(97)00067-7.
[21] Zulqarnain, M. and Tyagi, M.. “Quantification of Risks
Associated With a Representative Production Well in the Gulf of
Mexico”. Proceedings of the ASME 2015 34th International
Conference on Ocean, Offshore and Arctic Engineering –
OMAE2015, St. John's, Canada, May 31-June 5, 2015. DOI:
10.1115/OMAE2015-42115.
[22] Rausand, M.. Risk Assessment: Theory, Methods, and
Applications. John Wiley and Sons, New Jersey, USA (2011).
[23] Charniak, E.. “Bayesian networks without tears:
making Bayesian networks more accessible to the
probabilistically unsophisticated”. AI Magazine Vol 12 (1991)
pp 50-63.
[24] Hamada, M. S., Wilson, A. G., Reese, C. S. and Martz,
H. F.. Bayesian Reliability. Springer, New York, USA (2008).
[25] Cai, B., Liu, Y., Liu, Z., Tian, X., Zhang, Y. and Ji, R..
“Application of Bayesian Networks in Quantitative Risk
Assessment of Subsea Blowout Preventer Operations”. Risk
Analysis Vol 33 (2013) pp 1293–1311. DOI: 10.1111/j.1539-
6924.2012.01918.x.
[26] Bobbio, A., Portinale, L., Minichino, M. and
Ciancamerla, E.. “Improving the analysis of dependable systems
by mapping fault trees into Bayesian networks”. Reliability
Engineering and System Safety Vol 71 (2011) pp 249–260.
DOI:10.1016/S0951-8320(00)00077-6.
[27] Weber, P. and Jouffe, L.. “Complex system reliability
modelling with Dynamic Object Oriented Bayesian Networks
(DOOBN)”. Reliability Engineering and System Safety Vol 91
(2006) pp 149–162. DOI: 10.1016/j.ress.2005.03.006.
[28] Torres-Toledano, J. G. and Succar, L. E.. “Bayesian
Networks for Reliability Analysis of Complex Systems”. In:
Coelho H. Progress in Artificial Intelligence — IBERAMIA 98.
Lecture Notes in Computer Science Vol 1484 (1998) pp 195-206.
DOI: 10.1007/3-540-49795-1_17.
[29] Cai, B., Liu, Y., Ma, Y., Liu, Z., Zhou, Y. and Sun, J..
“Real-time reliability evaluation methodology based on dynamic
Bayesian networks: A case study of a subsea pipe ram BOP
system”. ISA Transactions Vol 58 (2015) pp 595-604. DOI:
10.1016/j.isatra.2015.06.011.
[30] Khakzad, N., Khan, F. and Amyotte, P.. “Quantitative
risk analysis of offshore drilling operations: A Bayesian
approach”. Safety Science Vol 57 (2013) pp 108–117. DOI:
10.1016/j.ssci.2013.01.022.
[31] Abimbola, M., Khan, F., Khakzad, N. and Butt, S..
“Safety and risk analysis of managed pressure drilling operation
using Bayesian network”. Safety Science Vol 76 (2015) pp 133-
144. DOI: 10.1016/j.ssci.2015.01.010.
[32] Bhandari, J., Abbassi, R., Garaniya, V. and Khan, F..
“Risk analysis of deepwater drilling operations using Bayesian
network”. Journal of Loss Prevention in the Process Industries
Vol 38 (2015) pp 11-23. DOI: 10.1016/j.jlp.2015.08.004.
[33] Khakzad, N., Khan, F. and Paltrinieri, N.. “On the
application of near accident data to risk analysis of major
accidents”. Reliability Engineering and System Safety Vol 126
(2014) pp 116–125. DOI: 10.1016/j.ress.2014.01.015.
[34] Li, X., Chen, G. and Zhu, H.. “Quantitative risk
analysis on leakage failure of submarine oil and gas pipelines
using Bayesian network”. Process Safety and Environmental
Protection Vol 103 (2016) pp 163–173. DOI:
10.1016/j.psep.2016.06.006.
[35] Martins, M. R., Schleder, A. M. and Droguett, E. L.. “A
Methodology for Risk Analysis Based on Hybrid Bayesian
Networks: Application to the Regasification System of Liquefied
Natural Gas Onboard a Floating Storage and Regasification
Unit”. Risk Analysis Vol 34 (2014) pp 2098-2120. DOI:
10.1111/risa.12245.
[36] Vinnem, J. E., Bye, R., Gran, B. A., Kongsvik, T.,
Nyheim, O. M., Okstad, E. H., Seljelid, J. and Vatn, J.. “Risk
modelling of maintenance work on major process equipment on
offshore petroleum installations”. Journal of Loss Prevention in
the Process Industries Vol 25 (2012) pp 274-292. DOI:
10.1016/j.jlp.2011.11.001.
[37] Basharin, G. P., Langville, A. N. and Naumov, V. A..
“The life and work of A. A. Markov”. Linear Algebra and its
Applications Vol 386 (2004) pp 3–26. DOI:
10.1016/j.laa.2003.12.041.
[38] Mostafavi, V. and Hareland, G.. “Assessment and
Mitigation of Drilling Risks Using ROP Model Coupled with
Monte – Carlo Simulation”. 45th US Rock Mechanics /
Geomechanics Symposium, San Francisco, USA, June 26–29,
2011.
[39] van Ravenzwaaij, D., Cassey, P. and Brown, S. D.. “A
simple introduction to Markov Chain Monte–Carlo sampling”.
10 Copyright © 2019 by ASME
Psychonomic Bulletin & Review Vol 25 (2016) pp 143-154. DOI: [52] Wang, D., Zhang, P. and Chen, L.. “Fuzzy fault tree
10.3758/s13423-016-1015-8. analysis for fire and explosion of crude oil tanks”. Journal of
[40] Peterson, S. K., Murtha, J. A. and Schneider, F. F.. Loss Prevention in the Process Industries Vol 26 (2013) pp 1390-
“Risk Analysis and Monte Carlo Simulation Applied to the 1398. DOI: 10.1016/j.jlp.2013.08.022.
Generation of Drilling AFE Estimates”. SPE Annual Technical [53] Lavasani, S. M., Ramzali, N., Sabzalipour, F. and
Conference and Exhibition, Houston, USA, October 3-6, 1993. Akyuz, E.. “Utilisation of Fuzzy Fault Tree Analysis (FFTA) for
DOI: 10.2118/26339-MS. quantified risk analysis of leakage in abandoned oil and natural-
[41] Li, Z. and Zhu, D.. “Predicting Flow Profile of gas wells”. Ocean Engineering Vol 108 (2015) pp 729–737.
Horizontal Well by Downhole Pressure and Distributed- DOI: 10.1016/j.oceaneng.2015.09.008.
Temperature Data for Waterdrive Reservoir”. SPE Production & [54] Miura, K.. “Um Estudo sobre a Segurança Operacional
Operations Vol 25 (2010) pp 296-304. DOI: 10.2118/124873- na Construção e Reparo de Poços Marítimos de Petróleo” (A
PA. Study on Safety of Construction and Repair in Offshore Oil and
[42] Gasda, S. E., Wang, J. Z. and Celia, M. A.. “Analysis Gas Wells - in Portuguese). Ph.D. thesis. University of
of in-situ wellbore integrity data for existing wells with long- Campinas, Campinas, Brazil. 2004.
term exposure to CO2”. Energy Procedia Vol 4 (2011) pp 5406– [55] Miura, K., Morooka, C. K., Mendes, J. R. P. and
5413. DOI: 10.1016/j.egypro.2011.02.525. Guilherme, I. R.. “Characterization of operational safety in
[43] Chen, Y., Kuruoglu, E. E. and So, H. C.. “Estimation offshore oil wells”. Journal of Petroleum Science and
under Additive Cauchy-Gaussian noise using Markov chain Engineering Vol 51 (2006) pp 111–126. DOI:
Monte Carlo”. 2014 IEEE Workshop on Statistical Signal 10.1016/j.petrol.2005.11.018.
Processing, Gold Coast, Australia, June 29-July 2, 2014. DOI: [56] Zadeh, L. A.. “Fuzzy Sets”. Information and Control
10.1109/SSP.2014.6884644. Vol 8 (1965) pp 338–353. DOI: 10.1016/S0019-9958(65)90241-
[44] Formighieri, S. and Freitas Filho, P. J.. “Estimation of X.
Bourgoyne and Young Model Coefficients using Markov chain
Monte Carlo simulation”. Proceedings of the 2015 Winter
Simulation Conference, Huntington Beach, USA, December 6-
9, 2015. DOI: 10.1109/WSC.2015.7408243.
[45] Muehlenbachs, L.. “A dynamic model of cleanup:
Estimating sunk costs in oil and gas production”. International
Economic Review Vol 56 (2015) pp 155-185. DOI:
10.1111/iere.12098.
[46] Liu, H., Liu, L. and Lin, Q.. “Fuzzy Failure Mode and
Effects Analysis Using Fuzzy Evidential Reasoning and Belief
Rule-Based Methodology”. IEEE Transactions on Reliability
Vol 62 (2013) pp 23-36. DOI: 10.1109/TR.2013.2241251.
[47] Mentes, A. and Helvacioglu, I. H.. “Review of Fuzzy
Set Theory Applications in Safety Assessment for Marine and
Offshore Industries”. Proceedings of the ASME 2011 30th
International Conference on Ocean, Offshore and Arctic
Engineering – OMAE2011, Rotterdam, The Netherlands, June
19-24, 2011. DOI: 10.1115/OMAE2011-50244.
[48] Lin, C. and Wang, M.. “Hybrid fault tree analysis using
fuzzy sets”. Reliability Engineering and System Safety Vol 58
(1997) pp 205-213. DOI: 10.1016/S0951-8320(97)00072-0.
[49] Yuhua, D. and Datao, Y.. “Estimation of failure
probability of oil and gas transmission pipelines by fuzzy fault
tree analysis”. Journal of Loss Prevention in the Process
Industries Vol 18 (2005) pp 83–88. DOI:
10.1016/j.jlp.2004.12.003.
[50] Lavasani, M. R. M., Wang, J., Yang, Z. and Finlay, J..
“Application of Fuzzy Fault Tree Analysis on Oil and Gas
Offshore Pipelines”. International Journal of Marine Science
and Engineering Vol 1 No 1 (2011) pp 29-42.
[51] Liu, J., Li, Q. and Wang, Y.. “Risk analysis in ultra deep
scientific drilling project - A fuzzy synthetic evaluation
approach”. International Journal of Project Management Vol 31
(2013) pp 449–458. DOI: 10.1016/j.ijproman.2012.09.015.

11 Copyright © 2019 by ASME