Energy Excursions

Course Content
Course Home Expand All

Introduction to Barriers for Mitigating Risk

Engineers and geologists often use different assessment methods to ensure all barriers are met for well containment. These models take into account risk and mitigation practices, ensuring a well is constructed and operated in a safe manner, adhering to necessary design standards, in an effort to avoid potential containment loss. One method that we will focus on is referred to as the “Bowtie Method of Risk Assessment and Mitigation.” Several large companies within the oil and gas industry follow these methods to a tee for safe operational standards, such as the Royal Dutch Shell Group, one of the largest players in the Gulf of Mexico. However, there are also several other risk mitigation methods such as the Swiss Cheese Model of Accident and Causation that we will also touch on. 

Bowtie Model of Risk Assessment and Mitigation

This bowtie model assesses loss of containment risk in regard to foreseeable hazards and outcomes, as well as the various barriers. On the Deepwater Horizon, once hydrocarbons had entered the riser, and hazards were recognizable, barriers were breached, and the result was an ignited blowout.

Royal Dutch Shell Group (Shell) was one of the first large companies in the oil and gas industry to initially utilize the Bowtie Method. Shell’s primary motivation was the necessity of ensuring that appropriate risk barriers were in place throughout all worldwide operations. Because of their inherently larger and more dispersed organization, major operators must have a thorough company-wide plan set in place to mitigate risks of their high level of activity. As a result of this need, Shell adopted the Bowtie Method, and many other companies within the industry have since followed the same path. The figure below shows an example of  Bowtie Model to showcase the various hazards and barriers in place on the Deepwater Horizon rig that, when breached, led to disastrous consequences once hydrocarbons had entered the riser. 

Swiss Cheese Model of Accident and Causation 

Under the Swiss Cheese Model, each layer of protection against loss has holes. By using multiple layers of defense, the ‘holes’ in one layer may be covered by the ‘cheese’ in the other layers but if the holes in different layers happen to align, it is still possible for loss to occur.

Two barriers are the minimum generally required when applying the Swiss Cheese Model; however, the more layers, the more prepared for possible risks and consequences. Again, similar to the Bowtie Method, this model entails a defense-in-depth strategy, with use of both hardware and human disaster prevention. 

Swiss Cheese Model of Accident and Causation Practice Problem

Now that we have a foundation for the Swiss Cheese Model, let’s apply it to a “real world” scenario below. 

A new non-major company has recently begun exploring the Gulf of Mexico for drilling operations and they want to implement the Swiss Cheese Model of Accident and Causation to mitigate any plausible risks during drilling operations and production. They are currently assessing how many barriers to use that would result in the least amount of risk. At some point adding barriers may cost money, but not significantly reduce risk. The risks they are most worried about include failure of blowout preventers given they are currently operating in deepwater blocks that have historically encompassed highly pressurized reservoirs.

Hint: You will learn more about blowout preventers in the following lessons. However, for a brief introduction the purpose of a blowout preventer is to cap a well before flow out of the well becomes uncontrolled if hydrocarbons were to unanticipatedly enter the wellbore during drilling operations (production has not yet begun and the crew does not want hydrocarbons flowing up the wellbore yet). There are various types of blowout preventers that are used and you can explore items #30-34 on the drilling rig interactive to learn more about them.

Currently, the company has calculated the probability of failure to the blowout preventer for the three separate barriers they will use including:

  1. Human Barriers
  2. Equipment Barriers (often referred to as “hardware barriers”) and
  3. Monitoring Barriers.

Shown below is the probability of an event to occur (=associated risk) with each barrier. Using simple multiplication, multiply the probability of an event occurring within each barrier to assess the probability that an event will occur throughout the entire system. 

Human Barrier 
Equipment Barrier 
Monitoring Barrier 
0.15 risk of failure
0.01 risk of failure
0.14 risk of failure

What is the probability of blowout preventer failure through the entire system? (Hint: multiply the probability of each barrier together to get the system risk.)



\[0.15\times 0.01 \times 0.14=0.00021\times 100=0.02\%\]

As you can see, the more barriers, the less risk there is for an event to occur. Here, with three barriers and the associated probability of risk, risk of the entire system is low - as you calculated. However, let’s take away one of the barriers? What is the probability of system risk and failure to the blowout preventer with only the human and monitoring barriers? Now the risk is roughly 2%, much higher than when three barriers were instituted! 



\[0.15\times 0.01 \times 0.14=x\times 100=x\%\]



\[0.15\times 0.01 \times 0.14=x\times 100=x\%\]



\[0.15\times 0.01 \times 0.14=x\times 100=x\%\]

Oklahoma Academic Standards
TEKS Standards
College Board Units and Topics
Next Generation Science Standards