Data learning and expert judgment in a Bayesian belief network for aiding human reliability assessment in offshore decommissioning risk assessment

Mei Ling Fm ,,,Dimitrios Konovessis ,XuHong He ,Lin Seng Ong

a Lloyds Register Singapore,1 Fusionopolis Place,09-11 Galaxis,Singapore 138522,Singapore

b Singapore Institute of Technology SIT@Dover,10 Dover Drive Singapore 138683,Singapore

c Lloyd’s Register Consulting,Landsvaegen 50A,172 63,Sundbyberg,Sweden

d School of Mechanical and Aerospace Engineering,Nanyang Technological University,50 Nanyang Avenue,Singapore 639798,Singapore

Abstract Decommissioning of offshore facilities involve changing risk profiles at different decommissioning phases.Bayesian Belief Networks(BBN) are used as part of the proposed risk assessment method to capture the multiple interactions of a decommissioning activity.The BBN is structured from the data learning of an accident database and a modification of the BBN nodes to incorporate human reliability and barrier performance modelling.The analysis covers one case study of one area of decommissioning operations by extrapolating well workover data to well plugging and abandonment.Initial analysis from well workover data,of a 5-node BBN provided insights on two different levels of severity of an accident,the ’Accident’ and ’Incident’ level,and on its respective profiles of the initiating events and the investigation-reported human causes.The initial results demonstrate that the data learnt from the database can be used to structure the BBN,give insights on how human reliability pertaining to well activities can be modelled,and that the relative frequencies from the count analysis can act as initial data input for the proposed nodes.It is also proposed that the integrated treatment of various sources of information (database and expert judgement) through a BBN model can support the risk assessment of a dynamic situation such as offshore decommissioning.

Keywords: Bayesian belief network;Human reliability assessment;Expert judgement;Data learning.

1.Introduction

Decommissioning of offshore facilities takes place in different phases which can include the warm suspension phase,the cold suspension phases and the removal phase.Some examples of the warm suspension phase activities are pipeline decontamination and sectional removal or well plugging and abandonment.Well plugging and abandonment involves multiple tasks at the same time,and the assessment of location specific risks such as reservoir profile,and presence of gas deposits from its drilling history.Location-specific historical information can be used to model risks more specifically.Bayesian Belief Network (BBN) is defined as an acyclic graphical network that is capable of representing qualitative and quantitative relationships between factors of interest defined in it.The nature of the relationships can be defined by whether there exists a (i) causal (ii) functional or (iii) statistical relationship.The BBN model structure can be derived by experts’ judgement or statistically,or through a combination of both.The proposed model in this paper is structured from the data learning of an accident database and the BBN nodes are modified to incorporate human factors and barrier performance modelling.The analysis considers one case study of well workover data extrapolated to well plugging and abandonment activities.The information fed into the BBN consists of relative frequencies from data learning from the database and are expert-elicited where there are data gaps.The desired output of the model is a probabilistic risk profile of human reliability of a particular decommissioning activity,and one that has considered and can trace different sources of information: generic historical data and expert-judgement,instead of only historical data in most existing methods.

2.Proposed statistical model for structure learning

2.1.Data types

One of the most comprehensive offshore safety databases is the World Offshore Accident Database (WOAD) [1]that has been collecting data since 1976 by the Norwegian company DNV GL.The WOAD database provides principle information such as accident causes and its chain of consecutive events (for e.g.a dropped object resulting in fire and oil spill),location of accident facility,year of accident etc.The WOAD database has also been built on merging information from existing databases such as the Offshore Blowout Database (SINTEF,Norway),MAIB accident database (UK Marine Accident Investigation Branch) and the COIN/ORION database (UK HSE - offshore Safety Division).

The data in WOAD appears as a discrete,’count’ nature,such that each time there is an accident reported,it is updated.Also,some factors have order in its states,such as the severity of events,where ’Accident’ is more severe than a ’Near Miss’.While the database began with collecting information on accidents,it evolved into looking into more in-depth into the stages before an accident occurs,such as the consideration of near misses or minor incidents.The database has its own coding system for accidents,incidents,near-misses and insignificant events.Accidents refer to situations that causes fatalities and severe injuries.Incidents refer to situations that involves low degree of damage,but repairs/replacements are required and minor health injuries.Near-misses are defined as events (whereby there is no damage and thus no repairs required) that might have or could have developed into an accidental situation.

2.2.Statistical model - generalised linear models

The proposed model should be able to accept the updating of information and would be able to present the risk picture as per the most updated snapshot.The Beta and Dirichlet density function allows the quantification of the prior data and updating new information (beliefs).For analysis where only binary variables are involved,such as in a Fault Tree/Event Tree where there are only ’True’ or ’False’ status,or the location of vessels such as ’In the port’ or ’At sea’,the Beta density function can be used.The beta density functionfwith parametersa,b,N=a+b,whereaandbare real numbers ＞ 0,is 2,p.306]:

With updated information,tandM=s+t,and consideringdas the dataset,the updated beta density function,with respect to obtaining the probability of having datasetdcan be written as 2,p.306]:

For analysis of multinomial variables,the Dirichlet density function can be used to provide equal counts for all statuses to be studied.For example,the severity of a consequence can be ’Near miss’,’Injury/Accident’ or ’Fatality’.The Beta density function is,in fact,a special case of the more generic Dirichlet density function.

Similarly,consideringdas the dataset,the probability of having the datasetdby assuming all statuses are Dirichletdistributed is shown below 2,p.306,386]:

Offshore safety data is based mainly on response and explanatory variables of non-metric,discrete forms,such as operation sections on a platform (Drilling and/or Production area) or initiating events of accidents (Falling Load,Leak etc).A common response variable would refer to consequence status differing in levels of severity,and in this case,the order of the status is important,such as ’Fatality’ having more severe considerations than a ’Near Miss’.A statistical model suitable for offshore safety data should be required to be able to handle multivariate data or non-metric format,and hence the classical regression models are unsuitable.The proposed statistical model able to handle ordered,categorical data is a loglinear model that falls under the classification of a Generalised Linear Model (GLM) 3,p.125].A GLM extend ordinary regression models to encompass non-normal response distributions and modelling functions of the mean and has three components (similar to classical regression models) consisting of a random component (response variable),a systematic component (explanatory variables) and a link function that transforms the mean to the natural parameter.The categorical data is arranged in a table form with its frequency information,and the log-linear modelling involves fitting models to the cell count in the cross-tabulation of categorical variables to derive the association and interaction patterns among variables.

For a table of response variableyand explanatory variablex(or two categorical responses),in a table with rowiand columnj,the cell probabilities areπijand the expected frequencies areμij=nπij.

Whererefers to the row effect andrefers to the column effect.

Assuming there are interaction effects,then a saturated model with statistically dependent variables would be 3,p.316]:

Whererefers to deviations from independence.

Table1 Loglinear Models for Three-Dimensional tables.

When extrapolating the assessment from a two factor to a three factor contingency table,the following summarised log-linear models (see Table1) illustrate the combination of potential interactions.

The modelling process begins with a saturated model,i.e.with the highest order interaction between the variables,before systematically and sequentially removing a higher-order interaction term so that model complexity is reduced without any significant loss in accuracy.The removal stops at a point where any removal leads to a poor fit of the data.The threshold of removal is considered by comparing the test model against the saturated model based on the difference of its deviances.Deviance is the likelihood-ratio statistics for testing the null hypothesis that the simplified model would hold against the saturated model.For a particular GLM for observationsy=(y1,...,yN),letL(μ;y) denote the log-likelihood function expressed in terms of the meansμ=(μ1,...,μN).Letdenote the maximum of the log-likelihood for the model,i.e.a saturated model,which can provide a baseline for comparison with other model fits.In this saturated modeland the deviance,D,of a Poisson GLM is defined to be 3,p.119]:

Consider two models,M0with fitted valuesμoand a saturated modelM1with fitted valuesμ1.SinceM0has lesser interactions considered thanM1,a smaller set of parameter values satisfiesM0as compared toM1.Maximizing the log likelihood over a smaller space cannot yield a larger maximum,thusContinuing from Eq.6 3,p.141],and assuming that modelM1holds,the likelihoodratio test of the hypothesis thatM0holds uses the test statistic3,p.141]:

Under regularity conditions,this difference has approximately aχ2null distribution with degrees of freedom equal to the difference between the numbers of parameters in the two models in comparison.The difference of the models’ deviances follows aχ2null distribution 3,p.142].

Before determining the factors with the loglinear model,it is proposed to use a two-variable dependency test based on the Pearson’sχ2model in order to shortlist the factors for consideration of a 3-variable analysis.The Pearson’sχ2test compares the frequencies observed in certain categories to the frequencies that might be expected in the same categories by chance,with respect to the degrees of freedom given by the(number of rows -1) multiplied by (number of columns -1)4,pp.802-803].

Similar to regression,the residual is simply the error between what the model predicts (the expected frequency) and the data actually observed (the observed frequency):

Through determining statistical dependencies between factors,the nodes of the BBNs are then established,and from which the base structure of a BBN can be defined.

3.Case study - well workover to well p&a

3.1.Well workover

Well workover data from the UKHSE database refers to operations in which a well is re-entered for any purpose,for example,maintenance related activities’ of replacing retrievable downhole safety valves,or malfunctioned electrical submersible pumps or worn out tubings.Before any well workover,the well must be killed,which requires the removal of the well head,flowline,packers and lifting the tubing hanger from the casing head,before putting a column of heavy fluid into a well bore to prevent the flow of reservoir fluids up the well,without the need for pressure control equipment at the surface (which have been removed,a part of the well kill process).Such an operation usually requires a drilling rig to be involved.While this data is strictly not well abandonment and plugging work for a decommissioning process,well plugging and abandonment work includes removing casing and other downhole equipment,thus suggesting the similarities with wireline operation.Before a well is to be killed or quelled,well logs need to be reviewed in order to understand potential gas pockets,or if there are angled deviations in the well.The operator then monitors the lowering of tools through the driller’s cabin where there is a console highlighting the depth,the pressure in the well and other pertinent information.Though different tools are lowered into the well between a well workover event and a well plugging and abandonment event,the same judgement by the operator is required to assess if the well is safe for re-entry.Thus,the risks of well killing can also be comparable to a well plugging and abandonment procedure which involves cement being injected to plug the well,while in the well kill event;heavy fluid is injected into the well.

The factors in WOAD database [1]relating to Well Workover activities are (see Table2): (i) Schedule quarter (ii) Human causes (iii) Initiating event (iv) Evacuation and (v) Severity of accident.

Thus the five factors from Table2 will be analysed to understand its dependency relationships.

Table2 Tableof factors to be analysed in the Bayesian Belief Networks.

Table3 Snapshot of ‘cleaned’ data to be processed in the software R for the dependency analysis between 5 factors: (i) Schedule quarter (ii) Human causes (iii)Initiating event (iv) Evacuation and (v) Severity of accident (not all factors are shown in below).

3.2.Results of well workover data analysis from two-variable and three-variable dependency analysis

Dependency analysis between two variables is performed for all possible combinations in order to generate an initial list of dependency relationships.The analysis is based on the Pearson’sχ2test which was elaborated in Section 2.2.With theχ2value,and the corresponding number of degree of freedoms,theP-value can be obtained.The confidence interval then plays an important role on the significance test on the hypothesis of independence.The most commonly set confidence interval is at 95%,i.e.aP-value exceeding 0.05.For this data set (see Table3),the confidence interval is set at 95%,and if the obtainedP-value from the dependency analysis is less than 0.05,this implies a dependency between the two factors being investigated.

Within the five factors,a 2 × 2 frequency table and its ten combinations of the pair-wise comparison of the five factors,has been extrapolated from the data source,and the Pearson’sχ2test ran on R to calculate the P-value.The results tabulated in Table4 only reflect the results where theP-Value has been found to be less than 0.05 and indicates a ’dependent’ relationship.Other independent results have been omitted since they do not have an impact on how the BBN can be structured.The pairs of variables thus provide the background for the three variable independency analyses (see Table5).

Based on the results from the two-way dependency analysis of the remaining variables,the following three-way dependency analyses have been grouped (see Table5).

The modelling of a three-variable dependency begins with a saturated model for (A,B,C) which consists of the individual effects from each factor alone,and the secondary interactions AB,BC,AC as well as the highest order which is the effects of ABC.Backwards elimination is initiated from the saturated model,by removing the highest order interaction.The model with the highest order removed,is compared with the saturated model by considering the differences in the deviance[5].The most minimised deviance value suggests the least damaging effect to the model in spite of removing the more complex interactions.

Table4 Dependency relationships between two variables.

Table5 Proposed three-way dependency analysis.

Table6 Summary table of conditional independency analysis.

Fig.1.Snapshot of proposed BBN structure using GeNie [7].

From the analysis from R [6]and summarised in Table6,it can be observed that the model considering the interactions(Human Causes: Initiating Event+Human Causes: Evacuation+Initiating Event: Evacuation) has the most minimised deviance value of 0.33.Thus this suggests a conditionally independent relationship in Human Causes given the occurrence of the Initiating Event and Evacuation,which can be noted asI(Human Causes|Evacuation,Initiating Event).

Similar operations have been performed for the remaining three-way combinations numbered from 2 to 5 in Table4.As an example,the second three-way combination in Table4 identified as (Initiating Event - IE,Human Causes - H,Schedule Quarter -S) is also investigated in the same manner,in that it considers the saturated model ofH*I*Swhich consists of the following interactions of(H+IE+S+H:IE+H:S+IE:S+H:IE:S),followed by comparing the performance of the(H:IE+H:S+IE:S)model with the higher order interaction termH:IE:Sremoved,and subsequently proceeding towards the simplest independent model of just H+IE+S.The best fitting model,not necessarily the most complex,is then chosen based on minimised differences in deviance in a similar process as documented in Table6,which referred to the three-way dependency analysis of the factors (Human Causes: Initiating Event+Initiating Event:Evacuation).Having investigated the relationships between the factors and in creating the nodes,the next step is to put together the node network (see Fig.1),and its corresponding joint probability distribution through Bayesian Belief Networks (BBNs).

In order to analyse the data in a BBN,the data obtained from the database needs to be transformed into probabilities and/or conditional probabilities.For any node,the probabilities can be represented by the Dirichlet Density Function,which can be looked at as a ratio of a status,against the total number of statuses for that event.If an event has a parent event,then the conditional probability distribution should be used.The resulting BBN can then represent the relative frequencies of the occurrence of events as in Fig.2.

It can be noticed that ’Accident’ takes up 24% of the most severe consequence,with ’Incident’ forming the majority at 74%,which does not agree with the accident triangle where the most severe consequences should be at the top of the triangle,comprising the least percentage.The least severe should be the base of the triangle and comprise the highest percentage.The most likely explanation for this is that WOAD is a database managed by DNV GL,and non-severe accidents like near-misses and insignificant events are not required to be reported in the public domain,and are usually not accessible by DNV GL unless the information is shared with them.However this does not impact the analysis,as accidents and incidents are more crucial to be investigated due to the severe consequences involved.

4.Expert elicitation to BBN structure &conditional probability data

4.1.Risk profile categorised by severity of accidents

The BBN also allows an identification of the types of initiating events associated with the ’Incident’ level of severity of event (see Fig.3: which reflects that ’Falling Load /Dropped Objects’ make up the majority of the initiating event,with ’Release of fluids /gas’ the next most common initiating event,and that ’Well problems leading to no blow outs’is the least common initiating event.It is also interesting to identify that unsafe act carried out stemming from the lack of procedures is the most common documented human cause in the investigation reports.

In terms of ’Accident’ level of the severity of incidents (see Fig.4),’Fire’ as a triggering event makes up the majority of the initiating event.The next most common is a ’Blow-out’followed by ’out of position’ and lastly the ’Release of fluid or gas’.It is also interesting to identify that unsafe procedures is the most common documented human cause in the investigation reports.It can be noted that the documented human cause between different levels of severities of an incident reflects the trends in the procedural level.At the ’Incident’level,most of the time no procedures were in place,while in the ’Accident level’,procedures were in place but needed to be improved.In both cases,human action against procedures makes up a small percentage.

4.2.Combining human reliability assessment,location specific risks and equipment reliability in the model

The data from the database is of insufficient resolution to map a BBN into risk models developed for quantitative risk assessment.Thus,it is proposed to use part of the BBN structure learnt to prioritise performance shaping factors (PSFs)which are often used in determining human error probabilities.

Fig.2.Snapshot of BBN with distribution of respective factors based on the data from WOAD.

Fig.3.Risk profile when ‘Incident’ in the Severity node is reflected as 100% (observed to have happened).

In the nuclear industry,Human Reliability Assessment(HRA) methods are established and most adaptation of HRA methods used in other industries are modified from those found in the nuclear industry.In the petroleum industry,the Petro-HRA method published in 2017 [8]adopted the SPARH methodology [9]for assessing human error probabilities in the petroleum industry based on a nominal HEP that is adjusted by performance shaping factors.Some examples of performance shaping factors are summarised below (see Table7):

In a commonly used Bowtie model (see Fig.5) of conducting quantitative risk assessment,it is common to begin the assessment with a Initiating Event,such as the ’failure to perforate casing’ which could lead to ’uncontrolled release of fluids/gases’.Mkrtchyan et al.[10]reviewed the ap-proach of BBN for human reliability analysis and highlighted that there are (non-exhaustive) areas where BBN is agile at demonstrating: analysis of the relationships between PSFs or the assessment of dependence among Human Failure events(HFEs).

Table7 Performance shaping factors (PSFs) in SPAR-H and Petro-HRA.

Fig.4.Risk profile when ‘Accident’ in the Severity node is reflected as 100% (observed to have happened).

Fig.5.Proposed BBN with structure/information learned from database,and expert judgement input.

A frequent assumption of HRA methods is that the effects of PSFs on the HEP are mutually independent.Typically,when multiple PSFs are assumed to influence the HEP,HRA methods model the joint influence of the PSFs by cumulating the effect of each factor,as each of them would act independently on the HEP.Indeed,this assumption largely simplifies the development of the HEP quantification models(such as SPAR-H or Petro-HRA,an adaptation of the SPARH for the offshore industry).An example of a BBN model considering an assessment of PSFs relationships is Podofillini and Dang [11]’s model,which tries to capture joint PSF effects.Joint PSF effects refer to an operator working under a combination of good performing conditions together with poor performing conditions.For example,good support from the procedural guidance and an experienced crew can compensate for the challenges of performing a complex task such that a relatively low error probability can be expected (even if associated with a complex task).On the other hand,if a complex task is performed with limited support from procedural guidance and/or without experience,then the failure probability may become very high (much higher than if each of the three factors would be present singularly).In Fig.8,it is visible that the model can have a combination of different performing conditions.In HRA,dependence analysis refers to assessing the influence of the failure of the operators to perform one task on the failure probabilities of subsequent tasks.There are decision trees designed to evaluate dependencies.A typical approach to model this in the HRA practice is to determine successive conditional probabilities associated with each task along the modelled operator response.The THERP handbook [12]suggests general rules to determine the appropriate dependence level,which is qualified in terms of levels: zero,low,moderate,high,complete.Podofillini et al.[13]have used BBN to link the similarities of cues and goals to a range of dependency level in order to adjust the HEPs.In Fig.8,the dependence of the PSF ’Procedures’ between HFE1 and HFE3 is visible.BBNs are a natural tool to capture these influences,because of their graphical formalism,which explicitly shows the direct,indirect and general multilevel influences,as well as their modelling approach based on decomposing complex and interrelated relationships into conditionally independent influences.

Fig.6.Risk profile when ‘Release of Fluid/Gas’ in the Initiating Event node is reflected as 100% (observed to have happened).

In reflecting the initiating event in which there is an uncontrolled release of fluids/gases,it is observed that an unsafe act due to lack of procedures is the most common reason leading to this initiating event (see Fig.6).

It can be observed that the retrievable information from the database is quite limited,however it provides some indication of PSFs to be included or removed from the HRA.The probability of an operator purposely going against procedures is very low (0.02),thus the PSF of ’Attitudes towards Safety,Work and Management Support’ can be removed from the analysis.The contributing cause of ’Improper Design’ is explained in WOAD as engineering flaws in the design process leading to the malfunctioning of equipment.Such scenarios are normally considered under system reliability risk analysis where reliability of equipment is investigated from engineering perspectives.The next two contributing causes ’Unsafe act due to lack of procedures’ and ’Unsafe Procedures’ both refer to the quality of procedures.

The other node of interest is the schedule quarters in which the ’Uncontrolled release of fluid or gas’ occurred.This provides an indication of when in the shift the incident occurred.Each quarter represents 6 hours.The 1st Quarter represents the first 6 hours of the day shift.The 4th quarter represents the last 6 hours of the night shift.Each shift lasts 12 hours.The 5th Quarter refers to an unspecified time when the accident occurred (It was indicated as such to ease the data cleansing step).It can be noted that most of the uncontrolled releases occurred in the 2nd half of both the day and night shift,thus indicating that Fatigue can be a performance shaping factor of interest.

In summary,two performance shaping factors (Fatigue and Procedures) have been identified from the BBN whose structure has been learnt from statistical methods.The probability values (0.74 to 0.75) in the respective nodes of interest (See Fig.6) can be used as a prior probability for quantitative risk analysis.

4.3.Expert judgment and elicitation of information in nodes of BBN

In the Petro-HRA or SPAR-H method,the PSFs are calculated from numbers corresponding to PSF levels and multipliers applied to a base human error probability.However,the method proposed in this paper utilises an elicitation method by Podofillini et al.[13].Thus,the PSFs are not calculated from the proposed levels and multipliers from Petro-HRA.The PSFs are instead characterised by four ranked states:Misleading/Error-forcing,Poor,Nominal and Good together with the expert judgement elicitation aggregation approach by Podofillini et al.[13].The risk assessment is evaluated in a Bayesian Belief Network in order to capture dependencies(arising from the same event,or consideration of a temporal dependency) and the ability to compute a so-named Hybrid BBN consisting of continuous and discrete probability distributions.

Table8 The qualitative impact scale with respect to failure probability values.

A literature review conducted by Mkrtchyan et al.[14]identified eleven methods of the assessment of conditional probability information,in which the methods vary in terms of whether a probability elicitation is direct or indirect,or whether it allowed multiple expert aggregation.

The elicitation method by Podofillini et al.[13]is proposed to be used as the conditional probability information building methodology needs to meet two criteria of allowing combination effects such as error-forcing effects where two factors in consideration are working on the same polarity,or the opposite end of the combination effect such as a compensation effect from a poor factor in combination with a good factor.The said effects have been published in Mkrtchyan et al.[14].

4.3.1.Descriptionofstatesofhumanfailureevents

The qualitative scale used for the PSFs are referenced from[15],in which the probability values ranges from Very Low to Very High in 5 ranked states (see Table8).Each state corresponds to an order of magnitude of failure probability anchored to the initial calibration points for the experts mentioned in the ANTHENA method 16,pp.3-75].

This provides a scale of reference for the expert,and in which order of magnitude the HEP might lie.In the case of HFE1,a total of 4 ×4 ×4 ×5=320 conditional probabilities need to be provided.The first to third ’4’ refers to the number of states in PSF1 to PSF3.The ’5’ refers to the number of states in the child node - HFE.However,with Podofillini et al.[17]’s linear interpolation method,the elicitation burden is reduced significantly.

4.3.2.Elicitationofexpertjudgement

This section discusses how HFE1 can be elicited with respect to three parent nodes of ’Procedures - PSF1’,’Fatigue- PSF2’ and ’Threat Stress - PSF3’.Based on the number of states of the parent and child nodes,the following table (see Table9 and Fig.7) is required to be filled with conditional probabilities.

At any rate, she was now all eagerness to see the mysterious stranger, and hastily throwing on her royal mantle76, popped her second-best diamond crown over her night-cap, put a liberal dab77 of rouge78 upon each cheek, and holding up her largest fan before her nose--for she was not used to appearing in broad daylight--she went mincing79 into the great hall

For an expert-passed judgement that a HEP is Very High,the distribution derived is such that it represents a distribution across the other possible HEP levels.The general idea is that the state that was described as most possible by the expert,would have the greatest probability density to it.

The model by Podofillini and Dang [11]is one that ’represents the human error probability as an inherently variable quantity’.The variability is a result of people performance,type of tasks and effect from influencing factors.In the paper of Podofillini et al.[18],the elicitation was carried out over a combination of negative performance conditions on a branch point of an event tree.The exercise carried out in this paper is similar,in which the PSFs are selected based on how it drives a negative performance.

Fig.7.Probability elicited from an expert judgement of HEP=Very High.

The model assumes that the failure probability is lognormally distributed with unknown median.Usually the expert selects the error factor (square root of 95th and 5th percentile).In this model the error factor is selected to be 5,a typically accepted value in HRA [11].With the error factor defined,the median of the lognormal distribution can be obtained,thus providing a distribution based on a single input of the error factor.

The elicitation of the HEP also depends on two matrices which are used to provide the expert’s confidence in terms of his ability to assess the correct HEP or assess it to be one or more orders of magnitude off the correct HEP.The reader is referred to Podofillini and Dang [11]for more details.

After some of the elicitation is conducted,the bar charts are ’shaped’ graphically to a normal curve which gives it some form of graphing estimates.The so-called mean and standard deviation (curve fitting estimates,marked in red in Fig.7) from this curve matching exercise is then put in a table similar to Table9 and a linear interpolation [17]is conducted horizontally for the first and last row,and vertically for the first and last columns.The middle rows are interpolated horizontally.From the interpolated values of the ’mean’and ’standard deviation’,the elicited HEP can be re-obtained from these graphing indices.

4.3.3.RepresentingthedistributionofHEPobtainedintoa medianHEPvalue

The end result for the node HFE1 would be a distribution of the elicited human error probability across the 5 levels of HEP,ranging from the states ’Very High’ to ’Very Low’(Fig.8).This represents the posterior probability distribution of the knowledge of the median HEP that has considered ex-pert judgement.In most qualitative exercises,the median HEP is of the highest interest.Thus,the median value of the expected density function of the HEP is obtained by weighing the probability density function with the median and error factor 5.The probabilities in HFE1,2 and 3 which are expressed in percentages are the weights used for each corresponding distribution.A summary of the numerical details for HFE1 is found in Table10.

Table9 HEP elicited for HFE1 based on 3 parent nodes of ‘Procedures - PSF1’,‘Fatigue - PSF2’ and ‘Threat Stress- PSF3’.For example,the expert assesses qualitatively that if PSF1,2,and 3=Error-forcing and the HEP should be ‘Very High’.The model will generate the corresponding probability distribution as seen in Fig.7.The full CPT for HFE1 derived from the elicitation process can be found in Appendix 1.

Fig.8.How the PSFs link to the Human Failure Event,HFE1,and a median Human Error Probability obtained from the distribution of HFE1.

Table10 Summary of details used for obtaining the expected density function based on the HEP elicited.The mean is based on the natural logarithm of the mean of the varying states;the standard deviation is based on the error factor.

The software AGENARISK has been used for modelling the BBN [19],as it allows a form of hybrid modelling shown in this case (Fig.8) where there is a combination of discrete and continuous variables expressed in the same network.The main benefit of presenting the elicited HEP in this manner is the ability to (1) represent uncertainty,and if it is required to quantify a HFE,a weighted sum of the distribution is considered which provides (2) a single median valuewith considerations of uncertainty already incorporated in it.

Table11 PSFs and the assessed levels.

Table12 Prior probability values used in the PSFs nodes.

Table13 Posterior probabilities of HFE1-3.

Table14 Posterior probabilities of HFE1 - 3.HFEs 1 and 2 are observed to have failed and set to the value of 1.

5.Results

The probabilities obtained from the data learning process outlined in Fig.6 provided some initial prior probabilities values to be used for the ’Procedure’ and ’Fatigue’ PSFs (0.74- 0.75).This suggests that the state of ’Nominal’ and ’Errorforcing’ for ’Fatigue’ and ’Procedures’ equals to 0.75,and the remaining states take up the remaining 1-0.75=0.25.The expert judgement elicitation for the PSFs ’Threat stress’and ’Task Complexity’ is obtained from the same elicitation procedure outlined in Section 4.3.2 and has the peak state value at 0.9,with the remainder 0.1 split among the remaining states.

The model is run when the following information is available: (i) the prior probabilities are set as in Table12;(ii) the conditional probabilities of HFE1,HFE2 and HFE3 set according to the elicitation method in Table9 and Fig.7;and(iii) the results in HFE1,2,3 can be weighted into respective median HEP values as seen in Table10.

The probabilities of the median HEPs based on the performance shaping factors are summarised in the second column of Table7.This can be considered as the result from the initial risk analysis.

After reviewing this initial result,some changes can be made,for example,by looking at procedures specific to well workover activities.After a review has been conducted,and improvements made,the quality of the procedures can be improved from ’Misleading’ to ’Nominal’.One of the PSFs refer to the improvement in the procedures.Strand and Lundteigen[20]highlighted that the early detection of a well kick is beneficial so as to take preventive measures before a kick occurs.Kick stress is a function of reservoir pore pressure,effective reservoir fluid density,productivity index,and reservoir volume.These indices are monitored in the drilling cabin and procedures can be updated to increase the frequency of checkinginsituwellbore flowrates andinsitupressures along the wellbore,and for the operator to make only one change at a time to well drilling parameters so as to have time to interpret the effects from a single change.

The second PSF that can be improved is in the complexity of tasks.Some examples of complexity of tasks are those that involve multiple system malfunctions,multiple procedures,inexplicable facility response,and multiple indication errors,i.e.the complexity of the situation.When a well kick occurs,the operator needs to detect and acknowledge the symptoms of a well kick (usually drastic changes in well pressure) and then to implement measures to control the kick.Some actions include clearing tools from the blind shear ram position in the BOP,shutting down mud pumps to stop circulation of mud in the well,and ’pushing the button’ to close the BOP.Thereafter,the well barrier restoration activities that follows next typically include the (i) estimation of the reservoir pore pressure,(ii) preparation of kill mud with sufficient density to control reservoir pressure,and (iii) circulation of kill mud into the well to restore the mud column as a primary well barrier.

Entering a well involves an assessment of when it is safe to enter a well and involves processing multiple pieces of information at the same time.The complexity of the task can be reduced by automating the process of estimating the kill mud pressure through investment in software that automates the estimation of the kill mud pressure.The corresponding improvements in human error probabilities are reflected in the second column of Table7.Further improvements are made by improving up to 3 PSFs and are documented in Table7.

Fig.9.Results from Table12 and 13 in the same plot to demonstrate the improvement in probabilities after amending the quality of the PSFS.The chart marked in dots refer to the Baseline;the chart marked in vertical stripes refer to the improvement of 1 PSF (Procedures);the chart marked in checkers refer to the improvement of 2 PSFs (Procedures and Task Complexity)and the chart marked in blue colour refers to the improvement of 3 PSFs(Procedures,Task Complexity and Fatigue).The chart marked in grey refers to when dependent failure is considered.(For interpretation of the references to colour in this figure legend,the reader is referred to the web version of this article.)

In some aspects of HRA,dependent failures are also of interest.The failure of the first human barrier could impact the performance of the second human barrier.This dependence can be passed on through the dependencies modelled in the form of the common performance shaping factors.

Setting P(HFE1) and P(HFE2)=Failure=1 provides with updated values of P(HFE3) in which the failure dependencies are propagated via the common performance shaping factor’Procedures’ and ’Fatigue’.It can be observed that P(HFE3)has increased significantly to 1.17E-1 (see Table14 and Fig.9)

Dependence assessment in THERP [12]suggests that a’Moderate’ Dependence level should reflect a median conditional HEP of 1.5E-1,and a ’High’ Dependence level should reflect a median conditional HEP of 5E-1,when evaluating the probability of failure of one task when it is known that the previous task has failed.One possible reason for the relatively low conditional median HEP at HFE3 is that there are only 3 dependent PSFs linked between HFE2 and HFE3.The THERP method considers 4 inputs (Crew,Time,Location,Cues) for analysing dependency,while the SPAR-H[12]method involves 5 different inputs.The result of 1.17E-1 obtained shows that the HEP derived from considering conditional dependency is in the right order of magnitude,while only considering 3 dependent inputs.

This suggests that this model can consider temporal dependency,but a holistic dependence assessment ought to be included,such as by increasing the dependency relationship by considering more PSFs or by considering similarities of cue,similarity of crew etc.Further nodes discussed in Podofillini et al.[13]can be added to consider this additional dependence,and ensure results are comparable to established methods.

Fig.10.Plot of sensitive analysis for the median human error probability of HFE3.The upper plot in dark blue refers to the scenario without considering conditional independence.The lower plot in light blue refers to the scenario with conditional dependence.(For interpretation of the references to colour in this figure legend,the reader is referred to the web version of this article.)

A 1-way sensitive analysis was also conducted for the median HEP from HFE3 with respect to the three PSFS: HMI,Time and Threat stress,one PSF at a time.The results are summarised in Fig.10.The intervals refer to the range that the median HEP could be impacted,depending on the state of the chosen PSF.It can be observed that prior to the consideration of temporal dependencies,the widths of the intervals are lesser,i.e.that the median HEP is less sensitive to the PSFs.

In Fig.10,the horizontal axis shows the absolute change in the posterior probability of HFE3 when the probability of each PSF changes by 10%.The length of the sensitive analysis plot indicates the probability interval of the respective PSF which affects the median HEP of HFE3.The wider the interval,the more sensitive the PSF is,in affecting the HFE3 value.In considering dependency (lighter blue plot of Fig.10),the interval widths have increased,and this shifted the median value to 1.17E-1.The PSF Threat Stress has the largest increase in sensitivity.The temporary dependency incorporated in the calculation of the median HEP thus led to a higher median HEP.

6.Conclusion

It is proposed in this paper to use data learning techniques to provide insights to a BBN model for studying human reliability in offshore activities.The study of the WOAD database for well workover activities with a focus on a particular barrier failure (’Release of fluids and gas’) has been conducted and indicated that ’Procedures’ and ’Fatigue’ are relevant performance shaping factors.The count information from the database is also used as an initial data input.It has also been proposed to integrate various sources of information to the BBN model,i.e.to include expert judgement in addition to the database information.The expert judgement elicitation process is adopted from Podofillini et al,and meets two criteria of allowing combination effects such as error-forcing effects where two factors in consideration are working on the same polarity,or the opposite end of the combination effect such as a compensation effect from a poor factor in combination with a good factor.

The median HEP results obtained demonstrate that the model is sensitive to changes in the states of PSFs.In addition,from the initial modelling of the BBNs with consideration of conditional dependency,the results are of the same magnitude of that in a published HRA method (THERP).Most HRA methods have no real validation as it is solely derived from expert judgement.

This model thus forms the base structure of adapting the initial BBN model to include also barrier performance,such as the performance of kick detection,and potentially include human factors analysis for high operator involvement work,such as well plugging and abandonment and heavy lifting.This analysis also meets one aspect of the QRA framework requirements in demonstrating how the performance of barriers changes with different conditions.The model indicates the source of historical data and expert judgement,and is able to keep track of how data used in the model affects the results.Existing risk assessment methods are often based on generic failure statistics alone,which may not be reflective of an existing risk picture of a location.The model combining generic failure statistic,location-specific historical data,and expert judgement of a particular work task could provide a more updated risk picture.

Declaration of Competing Interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Acknowledgements

The authors would like to acknowledge the support of Lloyd’s Register Singapore,Lloyd’s Register Consulting Energy AB (Sweden),Nanyang Technological University,Singapore Institute of Technology and the Singapore Economic Development Board (EDB) under the Industrial Postgraduate Program in the undertaking of this work (RCA - 15/424).The authors are grateful for the extensive support and knowledge sharing from Dr.Luca Podofillini of the Paul Scherrer Institute.The authors also appreciate the comments from the reviewers to improve the manuscript.

Appendix A

TableA1

TableA1 Full conditional probabilities/HEP elicited for HFE1 based on 3 parent nodes of ‘Procedures - PSF1’,‘Fatigue - PSF2’ and ‘Threat Stress - PSF3’.