Bowtie Analysis for Well Control Events: Building a Kick Scenario from the Ground Up
A kick that goes undetected for even a short period can escalate into a blowout. The consequences are well documented: loss of life, well destruction, environmental damage, and regulatory shutdown. Despite decades of barrier management improvement following Macondo, loss of well control events continue to occur across the industry. The IRF Offshore Safety analysis of these events confirms that the barriers intended to stop escalation frequently fail not because the technology is absent, but because barrier status is poorly understood, inadequately verified, or not communicated across the crew (IRF, 2020).
Bowtie analysis addresses this gap directly. It forces a drilling team to name every barrier, assign ownership, identify degradation factors, and visualise the full escalation pathway on one page. This article walks through building a bowtie for a kick scenario with concrete barrier examples, not abstract theory.
What a Bowtie Is and Is Not
A bowtie is a barrier-based risk diagram. The narrow centre is the top event — the moment control is lost. The left side maps threats and their preventive barriers. The right side maps consequences and their mitigating barriers. Escalation factors (sometimes called degradation factors) sit on the barrier lines to show what can undermine each barrier.
A bowtie is not a fault tree, not a quantitative risk assessment, and not a substitute for a well barrier schematic. It is a communication and verification tool. Its value is in making the full risk picture visible to everyone from the driller to the well integrity engineer.
The OpenRisk model for loss of well control (OpenRisk/Presight, v.2) captures this precisely: the bowtie is built around preventive barriers such as blowout preventers and kick detection systems, with the explicit recognition that gaining and maintaining control of those barriers is the core task.
Defining the Top Event
For a well control bowtie, the top event is:
Uncontrolled flow of formation fluids into the wellbore (kick not contained).
This is the precise moment the first well barrier envelope has been breached and the second has not yet stopped escalation. It is not the blowout — that is a consequence on the right side. Placing the top event correctly is critical; too early and you lose the preventive barriers, too late and the diagram conflates prevention with mitigation.
Left Side: Threats and Preventive Barriers
Each threat is a credible route to the top event. For a kick scenario, the primary threats are:
- Insufficient mud weight to balance formation pressure
- Failure to detect influx during drilling or tripping
- Swab pressure during tripping that reduces effective bottom-hole pressure
- Lost circulation creating an underbalanced condition
- Wellbore fluid migration during static periods (e.g., cement job)
Preventive Barriers for Each Threat
| Threat | Primary Preventive Barrier | Secondary Preventive Barrier |
|---|---|---|
| Insufficient mud weight | Pore pressure prediction and mud weight programme | Real-time pore pressure monitoring while drilling |
| Undetected influx | Pit volume totaliser and flow-out monitoring | Drill string pressure trend monitoring |
| Swab during tripping | Controlled trip speed and fill-up procedures | Continuous hole fill monitoring |
| Lost circulation | Correct mud weight and LCM programme | ECD management and monitoring |
| Fluid migration (static) | Cement job design with positive TOC | Pressure test of cement and casing shoe |
Each cell above is a physical or procedural barrier — something that, if functioning, prevents the threat from reaching the top event.
Escalation Factors on Preventive Barriers
An escalation factor is a condition that degrades a barrier without eliminating it. For the pit volume totaliser barrier, escalation factors include:
- Sensor calibration not current
- Alarm bypassed during cementing operations without formal override record
- Display not visible from driller's position
The SPE paper on barrier management (SPE-184668-MS, 2017) emphasises that barrier verification — having confidence the barrier will function when called upon — requires active monitoring of these degradation conditions, not just confirmation that the equipment is installed.
The Top Event Node
At the centre of the diagram sits the top event. In a well control bowtie, this node should carry:
- The well identifier and phase (e.g., 12¼-inch section, intermediate casing)
- The barrier envelope reference (first envelope breached)
- The date of last BOP function test
This contextualisation ensures the diagram is a live operational document, not a generic template filed in a management system and never opened again.
Right Side: Consequences and Mitigating Barriers
Once a kick is in the wellbore, the escalation pathway branches into distinct consequences:
- Consequence 1: Controlled well kill — kick circulated out safely
- Consequence 2: Surface release — gas at surface without ignition
- Consequence 3: Ignition and fire or explosion
- Consequence 4: Blowout — sustained uncontrolled flow
These are the right-side endpoints the mitigating barriers must prevent.
Mitigating Barriers
| Consequence Pathway | Mitigating Barrier | Escalation Factor |
|---|---|---|
| Kick escalates to surface release | BOP closure on detection | BOP function test overdue; ram seals worn |
| Surface release escalates to ignition | Gas detection and ignition source control | Detector calibration lapsed; hot work permit not enforced |
| Ignition escalates to blowout | Well kill procedures (driller's method / wait-and-weight) | Crew not drilled; kill sheet not current |
| Blowout escalates to fatality | Emergency shutdown and muster | ESD logic inhibited; muster drill not completed |
The result is a closed loop between the diagram and field activity.
Illustrative Scenario: North Sea Exploration Well (Illustrative)
The following scenario is illustrative and does not represent a specific incident.
During a trip out of hole on a high-pressure gas exploration well, the driller observes a slow gain in the active pit. The kick detection barrier — pit volume monitoring — is functioning, and the gain is identified early. The driller shuts in on the annular preventer per procedure. The BOP closure barrier holds.
On the bowtie, this outcome sits between the top event and Consequence 1: the kick is contained and will be circulated out. The mitigating barrier — BOP closure — has functioned. Now consider the escalation factors: if the annular preventer had not been function-tested within the required interval, or if the driller had not been drilled on shut-in procedures within the campaign, the same kick could have escalated to Consequence 2 or beyond.
This is precisely what the bowtie makes visible: not just that a barrier exists, but whether it is in a verified, functional state at the moment it is needed.
Practical Verification Checklist
Before spudding or entering a new hole section, the well control bowtie should be reviewed against the following:
- All preventive barriers on the left side are identified for this specific well phase and formation
- Each barrier has a named owner (position, not individual) responsible for verification
- Escalation factors for each barrier are listed and their current status assessed
- BOP function test records are current and results documented
- Kick detection alarms are active, calibrated, and visible at the driller's console
- Pit volume totaliser and flow-out sensors have been zeroed and baselined for this section
- Kill sheet is prepared, checked, and posted at the driller's workstation
- Crew has completed a well control drill for this well phase within the campaign
- Any barrier that is degraded or impaired is formally recorded and a compensating measure is in place
- The bowtie is accessible to all crew members, not filed only in the office system
The checklist above is designed to close that gap.
Standards Context
Well control barrier management sits within the scope of NORSOK D-010 (Well integrity in drilling and well operations), which defines the two-barrier principle and the requirements for barrier element verification. The applicable API standard for well control equipment is API Standard 53 (Blowout Prevention Equipment Systems for Drilling Wells), which governs testing frequencies and acceptance criteria for BOP systems. Where safety instrumented functions such as automated well control shutdowns are involved, functional safety standards apply; these may include IEC 61511 (Functional safety — Safety instrumented systems for the process industry sector) or IEC 61508 (generic functional safety), depending on equipment classification and jurisdiction. SIL assessment and proof-test requirements must be confirmed against the applicable standard for the well's operating region.
Conclusion and Next Steps
A bowtie for a kick scenario is only useful if it reflects the actual barriers on the actual well, with current verification status attached to each one. Generic industry templates are a starting point, not a deliverable.
The practical next steps for a drilling team are:
- Take the bowtie template from your well control management system and adapt it to the specific formation, BOP configuration, and hole section before the section begins.
- Assign barrier ownership by position and integrate verification into the pre-tour meeting agenda.
- Use the bowtie in post-kick reviews — not just to confirm what happened, but to identify which escalation factors were present before the event and whether they were visible in the barrier verification record.
- Feed findings back into the next well programme so the diagram improves with operational experience.
That is the outcome worth pursuing.