E P Forum QRA Data Directory

E&P Forum Quantitative Risk Assessment Data Directory Report No 11.8/250 1996

Introduction

E&P Forum QRA Datasheet Directory

Rev 0

INTRODUCTION

13/06/2003

INTROD.DOC

Page 1

Introduction


Rev 0

The E&P Forum’s “Guidelines for the Development and Application of Health, Safety and Environmental Management Systems” (HSEMS) [1], identifies “Evaluation and Risk Management” as a key element of an HSE management system. The use of formal risk assessment in achieving the goal-setting objectives of this element is becoming widely accepted in E&P companies and an essential framework in recent legislative acts. Experience shows that the application of risk assessment is important to both improved plant and system integrity and cost effectiveness by providing valuable information for risk management decision-making. Formal risk assessment is a structured, systematic process which supplements traditional design and risk management processes. It can be based on qualitative or quantitative methods or a combination, thereof. The objective of formal risk assessment is to analyze and evaluate risk. Risk assessment is made up of three fundamental steps: hazard identification to identify what could go wrong, consequence assessment to address the potential effects and frequency assessment to determine the underlying causes and likelihood or probability of occurrence of the hazardous event. In risk assessment, frequency is estimated based on knowledge and expert judgment, historical experience, and analytical methods combined together to support judgments made by risk assessment teams. Historical experience is expressed in terms of statistical data gathered from existing operations, generally in the form of incidents, base failure rates and failure probabilities. A key issue when using risk assessment is the uncertainties associated with the results and hence, the confidence with which the information can be used to influence decisions. Therein lies the need for reliable data to support E&P risk assessment work. Since incident data are important to providing insight into incident scenarios, the availability of suitable data is a key need of all E&P companies using HSE management systems, regardless of whether the company performs qualitative or quantitative risk assessments. Given the common E&P company need and relatively large resource requirement for data collection and assessment, the E&P Forum formed the QRA Subcommittee in 1989. One of its first project’s was to produce a position paper on Quantitative Risk Assessment [2]. Upon completion of this work, the need for better data to support E&P risk assessments was determined to be a primary work objective of the QRA subcommittee. Activities of the QRA subcommittee include: Workshop on Data in Oil and Gas Quantitative Risk Assessments [3], the Hydrocarbon Leak and Ignition Project (HCLIP) [4] and, most recently, the Risk Assessment Data Directory. Risk Assessment Data Directory The objective of the Risk Assessment Data Directory is to provide a catalogue of information that can be used to improve the quality and consistency of risk assessments with readily available benchmark data and references for common incidents analyzed in upstream production operations. Typical incidents analyzed in E&P risk assessments were identified and divided into four major categories for which twenty six individual datasheets were developed. Each datasheet contains: information describing the event; incident frequency, population and causal data; and a discussion of the data sources, range, availability and application. The directory is intended to be a reference document for estimating screening level and order of magnitude incident frequencies. The directory also provides reference lists of data sources that can be called upon for more detailed information. Its primary applications are for reviewing risk assessments performed by others (e.g., consultants, design contractors, etc.) and evaluating risk in Quantified Risk Assessments (QRAs) and qualitative assessments. As 13/06/2003

INTROD.DOC

Page 2

Introduction


Rev 0

such, the directory is not intended to be a comprehensive catalogue of incident data. Applications requiring more comprehensive data should refer to the original references as well as other publicly available information and company data sources that may be available. The project was carried out as a Subcommittee activity to take advantage of the pooling of knowledge and expertise between participants representing various major E&P companies and other E&P Forum members. Sources for the data include information available to the public and industry such as may be obtained from industry projects and the literature. That is, the directory contains organized publicly available information and data contributed by individual companies which has been previously submitted by other venues. While every reasonable effort has been made to ensure the quality and accuracy of the information and data provided, it is the responsibility of each company or organization using the data to review the information and assure themselves that the data is suitable for their specific application. Development Process The approach for developing the directory was to prepare the data sheets as a QRA Subcommittee activity without any central funding of external consultants. The Shell document, “Guidelines for Risk Assessment Data” developed by SIEP’s E&P HSE Department in 1992 [5] was made available to all members on a confidential basis and acted as the foundation for this new directory. First, the QRA Subcommittee developed a prioritized list of datasheets, generated a data index, and prepared a pro-forma for the contents and organization. Next, a member of the QRA Subcommittee was designated the focal point for each datasheet. The focal points were responsible for coordinating the development of their assigned datasheet. The focal points called on expertise within their own organizations and, in some cases, employed the assistance of various outside consultants. Other QRA Subcommittee members contributed data and reviewed draft data sheets. QRA Subcommittee meetings were held quarterly to peer review and finalize the draft datasheets. This process commenced in November 1994. The final draft datasheets were completed and the draft directory was assembled in second quarter of 1996. As a quality assurance check, the draft directory was then reviewed by an independent expert, and after approval from the E&P Forum Safety, Health and Personnel Competence (SHAPC) committee was issued in fourth quarter of 1996. As with all E&P Forum documents, the directory is available to the public at no charge.

13/06/2003

INTROD.DOC

Page 3

Introduction


Rev 0

Directory Scope and Content The directory covers both onshore and offshore E&P activities. The data have been collated under four major categories: Accident Data:

Collated statistical data of accidents (i.e., events that have led to detrimental effects in terms of loss of life, environmental damage or property damage)

Event Data:

Collated statistical data of hazardous events (i.e., events that led to or had the potential to lead to an accident)

Safety Systems:

Collated statistical data on the effectiveness of various safety systems employed to prevent and/or mitigate hazardous events.

Vulnerabilities:

Criteria for assessing the vulnerability of plant and humans to hazardous events.

Under each category, a series of individual data sheets are presented. Human factors have been organized into four datasheets to address the human factors contribution to each category. A total of twenty four datasheets were developed as listed below: Accident Data:

Major Accidents Work-related Accidents Land Transport Air Transport Water Transport Construction Accidents

Event Data:

Process Releases Risers and Pipelines Storage Tanks Blowouts Mechanical Lifting Failures Collisions Human Factors in the Calculation of Loss of Containment Frequencies

Safety Systems:

Fire & Gas Detection ESD & Blowdown Emergency Systems Blowout Prevention Active Fire Protection Human Factors in the Determination of Event Outcomes

Vulnerabilities:

Vulnerability of Humans Vulnerability of Plants Escape, Evacuation and Rescue Human Factors in the Assessment of Fatalities during Escape and Sheltering Human Factors in the Assessment of Fatalities during Evacuation and Rescue

13/06/2003

INTROD.DOC

Page 4

Introduction


Rev 0

The basic content of each data sheet is as follows: Scope:

Brief outline of data presented in datasheet.

Application:

Details of the situation for which the datasheet would be applicable including statements regarding where care should be exercised in its use.

Key Data:

Data presented in a tabular and/or graphical format. Discussion covering data source, data range, availability, strengths and limitations, applicability, estimating frequencies.

Ongoing Research:

Ongoing work which may be used later to update datasheet.

References:

Detailed list of references.

Note that the format presented above is general, individual datasheets vary to some extent, depending on relevance and availability of information. The objective has been to identify as far as practical data available in the public domain and to discuss its applicability. However in a few isolated cases, reference is made to data held by an E&P Forum member that is not available publicly. Where this is the case the judgment of the QRA Subcommittee is that this data is sufficiently robust to include even though the user is not able to source the data directly. It is not the intention of the Directory to in any way address or comment on the best approach or methods for risk assessment studies. In some of the data sheets, particularly for Safety Systems, the key data presented is in terms of how ‘reliable’ these systems are. “Reliability Analysis” is a distinct specialist area. Any detailed assessment would require expert assistance. Another area that is recognized as directly influencing the frequency of accidents and events is “Human Factors.” Again, this is a distinct specialist area which would require expert assistance if any detailed assessment work was to be undertaken. “Human Factor” data sheets have been included within the “Event Data,” “Safety Systems” and “Vulnerabilities” categories. It should also be noted that there are many other areas where expert assistance would be needed to undertake an in-depth study, e.g., assessing structural vulnerabilities, marine hazards. Directory Application The intention is that this document may facilitate the systematic assessment of risks within individual E&P Forum member companies and across the E&P industry. It is hoped that the directory will be a valuable reference document. Examples of specific applications of the directory include: • • • • •

Estimating screening level and order of magnitude incident frequencies Reviewing external risk assessment (e.g. those performed by consultants, design contractors, etc.) Evaluating risk in QRAs and qualitative assessments Comparing industry and corporate performance Identifying important risk contributors

13/06/2003

INTROD.DOC

Page 5

Introduction


Rev 0

Updating Plans It is recognized and accepted that the data presented in the “E&P Forum Risk Assessment Data Directory” will become out of date. Nevertheless, many of the data bases identified are actively maintained and; hence, by directly accessing these source databases, up-to-date information can be obtained. In the future, this directory may be updated. The E&P Forum will maintain a file for each data sheet. There is an open invitation to forward any new or better information, or data from other geographic areas, to the E&P Forum. It would also be appreciated if the E&P Forum could be notified of any errors identified. This information will be periodically reviewed by the QRA Subcommittee.

13/06/2003

INTROD.DOC

Page 6

Introduction


Rev 0

REFERENCES 1. E&P Forum, “Guidelines for the Development and Application of Health, Safety and Environmental Management Systems”, Report No. 6.36/210, July 1994. 2. E&P Forum, “Quantitative Risk Assessment, A Position Paper Issued by the E&P Forum”, Report No. 11.2/150, May 1989. 3. E&P Forum, “Workshop on Data in Oil and Gas Quantitative Risk Assessments”, Report No. 11.7/205, January 1994. 4. E&P Forum, “Hydrocarbon Leak and Ignition Database”, DNV Technica, March 1992. 5. Shell Internationale Petroleum Maatschappij B. V., “Guidelines for Risk Assessment Data”, May 1992.

13/06/2003

INTROD.DOC

Page 7

Introduction

13/06/2003


INTROD.DOC

Rev 0

Page 8

Major Accidents


Rev 0

MAJOR ACCIDENTS

13/06/2003

MAJORACC.DOC

Page 1

Major Accidents


Rev 0

TABLE OF CONTENTS

1. SUMMARY--------------------------------------------------------------------------------------------- 3 2. MAJOR OFFSHORE ACCIDENTS INVOLVING FATALITIES -------------------------- 3 3. MAJOR ONSHORE ACCIDENTS WITH HIGH PROPERTY DAMAGE LOSSES- 3 4. MAJOR OFFSHORE ENVIRONMENTAL ACCIDENTS---------------------------------- 4 REFERENCES----------------------------------------------------------------------------------------- 16

13/06/2003

MAJORACC.DOC

Page 2

Major Accidents

1.


Rev 0

SUMMARY

This datasheet provides a summary of major offshore and onshore accidents over the past 20-25 years. The offshore accidents pertain to the upstream oil and gas production industry; the onshore accidents involve the petrochemical industry. The offshore accidents are analyzed based on the fatalities involved, whereas the onshore accidents are based on the property damage losses involved. In addition, this datasheet also lists the most severe offshore environmental accidents associated with platform spills, blowouts, and tanker spills. For all the different major accident analyses (whether based on fatalities, property damage, or environmental damage) this datasheet provides a list of the worst accidents involved and subsequently provides an analysis of all the accidents in that accident category using bar diagrams.

2.

MAJOR OFFSHORE ACCIDENTS INVOLVING FATALITIES

The Worldwide Offshore Accident Databank (WOAD) project was launched in 1983 and at present includes accident data from 1970 and onwards [1]. This database is maintained by DNV Technica, which collects data on major offshore accidents from public sources worldwide. Although the database attempts to cover worldwide accidents, there are areas of the world for which limited information is available, e.g. countries with a fully state-owned offshore industry. For such areas only accidents to units owned by private, foreign operators is normally known. Further, although WOAD includes accidents in the US Gulf of Mexico, a more detailed listing of these accidents is maintained by the US Minerals Management Service (MMS). Therefore, the WOAD analysis in this section pertaining to US Gulf of Mexico has been updated with MMS data [3]. The WOAD database [1] was searched for all accidents involving fatalities. The period covered was 1970 through June 1995, in which there were a total of 446 accidents. The total number of fatalities involved was 1893. Table 2.1 lists all accidents with 10 or more fatalities along with the operating mode, the main event that caused the accident, the extent of damage involved, and the geographic area where the platform was operating. Table 2.2 breaks down the fatalities by the type of unit involved. Table 2.3 provides a breakdown of fatalities by 5Year periods, whereas Table 2.4 provides a breakdown of fatalities by geographic area.

3.

MAJOR ONSHORE ACCIDENTS WITH HIGH PROPERTY DAMAGE LOSSES

Tables 3.1 and 3.2 list the worst property damage losses for onshore accidents in the hydrocarbon-chemical industry. These data were obtained from Marsh & McLennan Protection Consultants [2], who maintain information on the top 100 industrial property damage losses [5] but do not provide information on any fatalities or injuries involved.

13/06/2003

MAJORACC.DOC

Page 3

Major Accidents

4.


Rev 0

MAJOR OFFSHORE ENVIRONMENTAL ACCIDENTS

Tables 4.1 through 4.5 provide information on the major offshore environmental accidents involving platform spills, blowout spills and major tanker spills. Information pertaining to platform and blowout spills was obtained from [3] and applies only to the US Gulf of Mexico. Tables 4.4, 4.5 and 4.6 data from [4] pertain to tanker spills on a worldwide basis. Table 4.7 provides a comparison between the various environmental spills for the three 5-year periods between 1976 and 1990 for the US. The data were obtained [3] & [4]. The data show that the bulk of the volume in offshore spills came from tankers. The following abbreviations for geographical areas are used in the tables: US GOM Europe NS

13/06/2003

= =

US Gulf of Mexico Europe North Sea

MAJORACC.DOC

Page 4

Major Accidents


Rev 0

Table 2.1: Top Offshore Incidents Listed in Decreasing Order of Fatalities Involved (Worldwide, 1970 - 1995) ([1]: WOAD ‘95, DNV Technica)

Date(yr/mo/da) 88/07/06 80/03/27 89/11/03 82/02/15 83/10/25 79/11/25 86/11/06 84/08/16 91/08/15 80/10/02 74/10/09 78/06/26 77/12/08 77/12/08 71/10/13 78/06/03 87/12/21 87/12/21 82/11/17 85/10/17 80/03/20 90/11/25 83/03/20 81/08/13 82/04/30 76/04/16 77/11/23 89/10/03 80/06/04 85/05/20 72/05/29 92/03/14 89/05/05 95/01/18 89/07/31 82/05/27 90/12/06 85/11/04

Type of Unit Jacket Semi-Sub Drill Ship Semi-Sub Drill Ship Jackup Helicopter Jacket Lay Barge Jackup Jackup Helicopter Helicopter Jacket Drill Barge Helicopter Helicopter Jackup Helicopter Mobile Helicopter Helicopter Barge Helicopter Helicopter Jackup Helicopter Pipeline Helicopter Drill Barge Helicopter Helicopter Helicopter Jacket Barge Helicopter Helicopter Barge

Oper. Mode Production Accomodation Expl. Drill Expl. Drill Drilling Transfer, Wet Other Develop. Drill Construct. Expl. Drill Drilling Other Other Production Expl. Drill Other Other Stacked Other Construct. Other Other Construct. Other Other Transfer, Wet Other Production Other Transfer, Wet Other Other Other Repair Transfer, Wet Other Other Construct.

Damage Total Loss Total Loss Severe Total Loss Total Loss Total Loss Total Loss Significant Total Loss Minor Severe Total Loss Total Loss Minor Severe Total Loss Total Loss Minor Total Loss Severe Total Loss Total Loss Severe Total Loss Total Loss Total Loss Total Loss Significant Total Loss Severe Total Loss Total Loss Total Loss Severe Total Loss Total Loss Total Loss Total Loss

Main Event Fire Capsizing Capsizing Capsizing Capsizing Capsizing Other Fire Capsizing Blowout Capsizing Other Collision Helicopter Fire Other Collision Helicopter Other Explosion Other Other Fire Other Other Capsizing Other Fire Other Capsizing Other Other Other Explosion Capsizing Other Other Capsizing

Note 1: Fatalities and Injuries includes crew members and contract workers 13/06/2003

MAJORACC.DOC

Fatalities1 167 123 91 84 81 72 45 42 22 19 18 18 17 17 16 15 15 15 15 14 14 13 13 13 13 13 12 11 11 11 11 11 10 10 10 10 10 10

Injuries1 60 NA 0 0 0 0 2 19 NA 19 0 0 1 0 0 0 0 0 0 0 0 0 32 0 0 0 0 4 0 0 NA 1 0 NA 0 0 2 0

Area Europe NS Europe NS Asia South America NE Asia East Asia East Europe NS America SE Asia East Middle East Middle East Europe NS US GOM US GOM America SW Middle East US GOM US GOM Asia East Central America America SE Europe East Africa West Europe NS Asia South US GOM Europe NS US GOM Africa West US GOM US GOM Europe NS Asia East Africa West US GOM Asia South Asia South Europe NS

NA = Not Available Page 5

Major Accidents


Rev 0

Table 2.2: Breakdown of Incidents and Fatalities by Type of Unit (Worldwide, 1970-June 95) [1]) Type of Unit

AI BA BO CO

DB

DS

FI

FL

1

42

72

124

6

2

% of Total Units

0

1

1

10

2

4

0

0

5

34

5

1

6

11

47

1

0

77

No. of Units

1

26 303

HE

JT

JU

LB

MO PI RI

SC

SH

SS

SU TE TL WS OT Totals

150 975 515

33

28

3

8

429

24 10 18

18

1

1

2

0

0

0

15

1

0

187

48

4

6

3

0

0

12

27

3

42

63 0

70

2

2904

1

2

0

100

3

1

3

1

446

No. of Fatal Incidents

0

% of Total Fat. Incidents

0

1

0

1

2

11

0

0

17

11

1

1

1

0

0

3

6

1

1

0

1

0

100

Total Fatalities

0

35

6

16

55

236

2

0

450 504 231

28

21

14 0

0

17

255

3

14

1

4

1

1893

% of Total Fatalities

0

2

0

1

3

12

0

0

24

1

1

1

0

1

13

0

1

0

0

0

100

27

12

0

Note 1: Since WOAD is an incident database only (i.e., it does not provide unit operating years), the numbers in this row represent the frequency of the unit in the incident database.

SC

Subsea install./complet.

SH

Ship: e.g., FSU, FPSO

SS

Semi-submersible

SU

Submersible

TE

Drilling tender

TL

Tension leg platform

WS

Well support structure

OT

Other

13/06/2003

10 0 OT

Platform rig

WS

Pipeline

RI

TL

PI

20

TE

Mobile unit (not drilling)

SU

MO

SS

Lay barge

SH

Jackup

LB

SC

Jacket

JU

RI

JT

30

PI

Helicopter-Offshore duty

MO

HE

LB

Flare

JU

FL

40

JT

Other/Unkn. fixed structure

HE

Drill ship

FI

FL

Drill barge

DS

FI

Concrete structure

DB

DS

Loading buoy

CO

DB

BO

Breakdownof Number of FatalitiesandNumber of IncidentsbyType of Unit (Worldwide, 1970- June 95)

CO

Barge (not drilling)

BO

BA

BA

Artificial Island

AI

Type of Unit

AI

Percent

Code

Type of Unit %of Total Incidents %of Total Fatalities

MAJORACC.DOC

Page 6

Major Accidents


Rev 0

Table 2.3: Breakdown of Fatalities by 5-Year Periods (Worldwide, 1970 - June 95) [1]) 5-Year Period

1970-75

1976-80

1981-85

1986-90

1991-95

No. of Incidents

95

111

115

86

39

1

Total 446

% of Total Incidents

21

25

26

19

8.7

100

Total Fatalities

190

348

650

591

114

1893

34

31

6

100

10 18 % of Total Fatalities Note 1: For 1995 data was available only up to June 1995.

Breakdown of Number of Fatalitiesand Number of Incidentsin 5-Year Periods (Worldwide, 1970 - June 1995) 35 30

Percent

25 20 15 10 5 0 1970-75

1976-80

1981-85

1986-90

1991- June 95

5-Year Period % of Total Incidents

13/06/2003

%of Total Fatalities

MAJORACC.DOC

Page 7

Major Accidents


Rev 0

Table 2.4: Breakdown of Fatalities by Geographic Area (Worldwide, 1970 - June 95) [1]) 1

Geographic Area No. of Incidents % of Total Incidents Total Fatalities


US GOM 297 67 570 30

Europe N.S. 58 13 511 27

Asia 27 6.1 373 20

Australia 5 1.121 10 0.528

Other 59 13.2 429 22.7

Totals 446 100 1893 100

Bre a kdow n of Num be r of Incide nts a nd Num be r of Fa ta litie s by Are a (W orldw ide , 1970 - June 95) 70 60

Percent

50 40 30 20 10 0 US GOM

Europe NS

A sia

A ustralia

Other

Ar e a % of Total Incidents

13/06/2003


MAJORACC.DOC

Page 8

Major Accidents


Rev 0

Table 3.1: Top Property Damage Losses in the Hydrocarbon-Chemical Industry [2] [5]) Date

Name of Unit

Type of Unit

Operating Mode

Main Event

Cost (106 US $)a

Area

PETROCHEM

OPERATING

EXPLOSION

675 / 716

America South West

REFINERY

OPERATING

FIRE

300 / 327

America South East

PETROCHEM

OPERATING

FIRE/

215 / 243

America South West

REFINERY

OPERATING

FIRE

190 / 192

Europe West

89/10/23

High Density Polyethylene Reactor

88/05/05

Depropanizer Column

87/11/14

Treating Section-Gas Processing

92/11/09

Fluidized Catalytic Cracking Unit

92/10/16

Hydrodesulfurization Unit

REFINERY

STARTUP

FIRE

161 / 162

Asia East

74/06/01

Cyclohexane Oxidation Reactor

PETROCHEM

OPERATING

FIRE

66 / 161

Europe West

91/03/11

Chlorine Unit-VCM Plant

PETROCHEM

OPERATING

EXPLOSION

150 / 153

Central America West

84/07/23

Monoethanolamine Absorber Column

REFINERY

OPERATING

FIRE

127 / 152

America North East

77/04/03

Refrigerated Propane Storage

GAS PROCESSING

OPERATING

FIRE

76 / 149

Middle East

81/08/21

Naphtha Storage Tanks

REFINERY

STORAGE

FIRE

100 / 141

Middle East

68/01/20

Slop Tank

REFINERY

OPERATING

FIRE

28 / 117

Europe West

79/09/01

Ethanol Storage Tank/DWT Tanker

REFINERY

TRANSFER

EXPLOSION

68 / 114

America South West

64/06/14

Crude/Product Storage

REFINERY

STORAGE

FIRE

22 / 111

Asia East

91/05/01

Nitroparaffin Unit

PETROCHEM

OPERATING

EXPLOSION

105 / 107

America South East

77/05/11

Crude Oil Pipeline

GAS PROCESSING

TRANSFER

FIRE

55 / 106

Asia East

89/04/10

Hydrocracker Unit

REFINERY

OPERATING

FIRE

95 / 101

America North West

EXPLOSION

13/06/2003

MAJORACC.DOC

Page 9

Major Accidents


Rev 0

Table 3.1 (continued): Top Property Damage Losses in the Hydrocarbon-Chemical Industry [2] [5])

Name of Unit

Type of Unit

Operating Mode

Main Event

Cost (106 US $)a

Area

78/05/30

Alkylation Tank Farm

REFINERY

STORAGE

FIRE

55 / 100

America South West

78/04/15

Gas Transmission Pipeline

GAS PROCESSING

TRANSFER

EXPLOSION

54 / 97

Middle East

70/12/05

Hydrocracking Unit

REFINERY

OPERATING

EXPLOSION

27 / 95

America North East

84/08/15

Fluid Bed Coking Unit

REFINERY

OPERATING

FIRE

76 / 91

Canada

87/03/22

Hydrocracking Unit

REFINERY

STARTUP

FIRE

79 / 89

Europe West

66/01/04

Butane Sphere

REFINERY

STORAGE

FIRE

18 / 84

Europe West

91/03/12

Ethylene Oxide Unit

PETROCHEM

OPERATING

EXPLOSION

80 / 82

America South West

89/03/07

Aldehyde Column

PETROCHEM

OPERATING

EXPLOSION

77 / 82

Europe West

85/05/19

Ethylene Plant

PETROCHEM

OPERATING

FIRE

65 / 77

Europe South, Mediterranean

77/07/08

Pipeline

PIPELINE

STARTUP

FIRE

40 / 77

Arctic, America

67/08/08

Isobutane Pipeline

REFINERY

TRANSFER

FIRE

17 / 77

America South East

Date

a

Two cost figures are listed: the first figure is the accident cost at the time the accident occurred. The second figure is the trended accident cost in 1993 dollars.

13/06/2003

MAJORACC.DOC

Page 10

Major Accidents


Rev 0

Table 3.2: Summary of Top 100 Major Onshore Incidents (1963-1993) [2]) Industry

Total US $ Loss (106)* 2,899

Percent of Total US $ 45

No. of Incidents

Percent of Incidents

44

44

Petrochemical

2,391

37

36

36

Gas Processing

621

10

8

8

Terminal

243

4

7

7

Miscellaneous

249

4

5

5

Refining

*

Based on 1993 US dollars.

Summary of Top 100 Major Onshore Incidents(1963-1993)

Percent

60 40 20 0 Refining

Petrochemical

Gas Processing

Terminal

Miscellaneous

Industry Type %of Total Property Damage %of Total Number of Accidents

13/06/2003

MAJORACC.DOC

Page 11

Major Accidents


Rev 0

Table 4.1: Large Spills (> 1000 BBL) from Platforms in the Gulf of Mexico (1970-1990) [3] Date 70/12/01 70/10/02 74/04/17 88/02/07 90/01/24 70/01/09 73/01/26 81/12/11 73/05/12 90/05/06 76/12/18 74/09/11 79/11/24 80/11/14

Spill Size 53,000 30,000 19,833 15,576 14,423 9,935 7,000 5,100 5,000 4,569 4,000 3,500 1,500 1,456

Material Oil Oil Oil Oil Condensate Oil Oil Oil Oil Oil Oil Oil Diesel Oil

Table 4.2: Large GOM Spill (>1000 bbl) Statistics (1970-1990) [3]) Material Number of Small Spills Amount Spilled (bbl)

Oil 12 158,969

Diesel 1 1,500

Condensate 1 14,423

Total 14 174,892

Large GOM Spill (>1000 bbl) Statistics (1970-1990) 100

Percent

80 60 40 20 0 Oil

Diesel

Condensate

Material Spilled % of Total Number of Spills

13/06/2003

% of Total Volume of Spills

MAJORACC.DOC

Page 12

Major Accidents


Rev 0

Table 4.3: Blowout Spills in the Gulf of Mexico (1970-1990) [3]) Date

Spill Size (BBL)

Material

70/12/01

53,000

Oil

70/02/10

30,000

Oil

71/10/16

450

Oil

74/12/22

200

Oil

74/09/07

75

Oil

81/11/28

64

Oil

87/03/20

60

Condensate

85/02/23

40

Oil

90/05/30

12

Oil/Mud

90/09/09

8

Condensate

Table 4.4: GOM Blowout Spill Statistics (1970-1990) [3] Material Number of Small Spills Amount Spilled (bbl)

Oil 8 83,841

Condensate 2 68

No Reportable Spill 136 0

Total 146 83,909

Percent

GOM Blowout Spill Statistics (1970-1990) 100 50 0 Oil

Condensate

No Reportable Spill

Material % of Total Number of Blowouts

13/06/2003

% of Total Volume of Blowout Spill

MAJORACC.DOC

Page 13

Major Accidents


Rev 0

Table 4.5: Major Tanker Spills Worldwide (1974-1992) [3]) Date 83/08/05 78/03/16 79/07/19 79/08/02 88/11/10 77/02/23 79/11/15 76/05/12 80/02/23 89/12/19 92/12/03 85/12/06 75/05/13 92/04/17 74/11/09 83/01/07 78/12/31 75/01/10 74/08/09 83/12/10 78/12/07 75/01/29

Spill Location/Marsden Sq. 75km NW of Cape Town/442 Off Portsall, Brittany NW France/145 30km NE of Trinidad Tobago/43 450km East of Barbados/42 800 Mi. NE St. Johns, Newfoundland/185 320 Mi. W of Kauai Island/89 Bosporus Strait/178 North Coast of Spain/145 Off Pilos, Greece/142 Atlantic, 100 Mi. from Morocco/109 Port of La Coruna Spain/145 Arabian Gulf/103 Caribbean Sea 60 Mi. NW of Puerto Rico/43 Maputo Bay, Mozambique/404 Tokyo Bay/131 58 Mi. from Muscat, Oman/103 Bay of Biscay, Spain/145 180 Mi. W of Iwo Jima/95 Magellan Strait, Chile/486 Arabian Gulf/103 Strait of Malacca, Indonesia/26 Port Leixoes, Portugal/145

Spill Size (bbls) 1,760,000 1,628,000 1,016,761 987,714 952,900 742,000 696,000 670,000 600,000 560,000 521,429 500,000 420,000 380,952 375,000 370,000 350,000 337,000 330,000 324,000 314,142 300,000

Material Arabian Crude Lt. Arabian Crude Arabian Crude Arabian Crude North Sea Crude Indonesian Crude Libyan Crude Kuwait Crude Libyan Crude Iranian Lt. Crude Brent Lt. Crude Iranian Lt. Crude Venezuela Crude Heavy #6 Fuel Oil Naphtha Iranian Crude Iranian Crude Crude Lt. Arabian Crude Lt. Arabian Crude Crude Iranian Crude

Table 4.6: Worldwide Tanker Spill Statistics (1974-1992) [3]) Spill Size (BBL)

Number

1000-14,999 15,000-49,999 50,000-199,999 200,000+

108 38 33 34

Totals

213

Total Volume Spilled (BBLs) 566,500 1,024,000 3,548,500 16,789,500 21,928,500

Worldwide Tanker Spill Statistics (1974-1992)

Percent

80 60 40 20 0 1000-14,999

15,000-49,999

50,000-199,999

200,000+

Individual Spill Size (bbl) % of Total Number of Spills

13/06/2003

% of Total Volume Spilled

MAJORACC.DOC

Page 14

Major Accidents


Rev 0

Table 4.7: Comparison of Spills During 5-Year Periods [3] [4]) 5-Year Period

1976-80 1981-85 1986-90 Number of Volume of Number of Volume of Number of Volume of Spill Category Spills Spills (bbl) Spills Spills Spills Spills Small GOM Spill 21 4243 27 4747 9.0 1073.0 % of Total 22.83 1 28.7 2.5 13.8 0.2 3 6956 1.0 5100.0 3.0 34568.0 Large GOM Spill % of Total 3.26 1 1.1 2.7 4.6 7.2 Blowouts GOM** 40 0 44.0 104.0 33.0 80.0 % of Total 43.48 0 46.8 0.1 50.8 0.0 Tanker Spills US 28 770000 22.0 180000.0 20.0 445000.0 % of Total 30.43 99 23.4 94.8 30.8 92.6 Total 92 781199 94 189951 65 480721 **

Blowouts that have oil releases are also counted in the small or large spill results.

Comparison of US Spills During 5-Year Periods 100.00 80.00 60.00 40.00

Percent 20.00 0.00 # of Spills

Vol. of Spills

1976-80

Small Platform Spills in US GOM

13/06/2003

# of Spills

Vol. of Spills

# of Spills

1981-85 5-Year Periods Large Platform Spills in US GOM

Blowout Spills in US GOM

MAJORACC.DOC

Vol. of Spills

1986-90 Tanker Spills in US Waters

Page 15

Major Accidents


Rev 0

REFERENCES

1. WOAD - Worldwide Offshore Accident Databank Version 4.10 - DNV Technica 2. A. Manuele, “One Hundred Largest Losses - A Thirty Year Review of Property Damage Losses in the Hydrocarbon - Chemical Industries”, Marsh & McLennan Protection Consultants, April 1986. 3. “Accidents Associated with Oil and Gas Operations”, OCS 1956-1990, OCS MMS 920058, October 1992, U.S. Minerals Management Services, Department of Interior. 4. Worldwide Tanker Spill Database, US Mineral Management Services, US Department of Interior. 5. D. Mahoney, “Large Property Damage Losses in the Hydrocarbon - Chemical Industries.” A Thirty-year Review, Sixteenth Edition, Marsh & McLennan Protection Consultants, 1995

13/06/2003

MAJORACC.DOC

Page 16

Major Accidents


Rev 0

6.

13/06/2003

MAJORACC.DOC

Page 17

Work Related Accidents


Rev 0

WORK RELATED ACCIDENTS

13/06/2003

WRKRLACC.DOC

Page 1



Rev 0

TABLE OF CONTENTS

1. WORK RELATED FATAL ACCIDENT RATES 1.1 SUMMARY------------------------------------------------------------------------------------------- 3 1.1.1 Scope -------------------------------------------------------------------------------------------------------------------3 1.1.2 Application------------------------------------------------------------------------------------------------------------3

1.2 KEY DATA ------------------------------------------------------------------------------------------- 3

2. WORK RELATED LOST TIME ACCIDENT RATES 2.1 SUMMARY----------------------------------------------------------------------------------------- 10 2.1.1 Scope ----------------------------------------------------------------------------------------------------------------- 10 2.1.2 Application---------------------------------------------------------------------------------------------------------- 10

2.2 KEY DATA ----------------------------------------------------------------------------------------- 10 REFERENCES----------------------------------------------------------------------------------------- 14

13/06/2003

WRKRLACC.DOC

Page 2



1.

WORK RELATED FATAL ACCIDENT RATES

1.1

SUMMARY

1.1.1

Scope

Rev 0

This datasheet provides data on work related Fatal Accident Rates (FAR’s) that arise in the Exploration and Production Industry. The data are subdivided to provide guidance on typical FAR’s that are experienced by activity, offshore, onshore, and by region. Where data are available from more than one source, multiple tables are included. Although transport and fire/explosion induced fatalities are not technically work related, they have been included for information. 1.1.2

Application

The data presented are applicable for work related accidents when undertaking QRA relating to exploration and production. Wherever possible the data selected should be those that most closely resemble the situation being modelled, rather than the more generic type of data given in the first few tables. The original data sources present the data in a variety of different ways - e.g. as FAR’s, per 100,000 workers, per 1000 man years - and these have all been adjusted to Fatality Rate per 108 exposed hours to facilitate comparison and use.

1.2

KEY DATA

Data Tables Table 1: Overall Fatal Accident Rates from Reference 1 FUNCTION Exploration Production Drilling TOTAL

1991

1992

1993

8.1 9.1 13.4 9.6

7.2 10.1 10.8 9.9

5.9 11.1 10.4 10.4

10 YEAR AVERAGE 13.94 10.27 20.46 12.04

Note that in this table the FAR’s for each function are calculated from the fatalities and exposed hours for that function, whilst the total is all fatalities and exposed hours. This explains why the total FAR’s are not the sum of the individual function FAR’s. These data are generic, containing as they do offshore, onshore, Company personnel, Contractor personnel, and regional components. The data are broken down into more specific values in the following tables. The data from years 1991 and 1992 have been included for comparative purposes, and this approach is retained wherever possible. 13/06/2003

WRKRLACC.DOC

Page 3



Rev 0

Table 2: Fatal Accident Rates by Accident Type from [1] ACCIDENT TYPE Falls Motor Vehicle Drowning Explosion/Fire Struck by Caught Between Electrocution Helicopters All Others TOTAL

1991

1992

1993

10 year AVERAGE

0.85 1.49 0.85 0.85 1.60 0.21 0.85 1.81 1.06 9.6

0.95 2.33 1.06 1.06 1.38 0.32 0.21 1.38 1.16 9.9

0.87 1.31 2.28 1.74 2.07 0.76 0.65 0.0 0.76 10.4

1.29 1.74 1.39 1.58 1.93 0.47 0.49 1.57 1.56 12.04

Table 3: Fatal Accident Rate by Region from [1] REGION Europe USA Canada South America Africa Middle East Australasia ALL REGIONS

1991 3.2 7.3 3.2 17.8 23.5 10.1 3.9 9.6

1992 8.5 3.4 4.0 15.7 12.3 23.1 5.1 9.9

1993 4.6 4.8 5.2 26.7 12.1 11.8 8.5 10.4

10 year AVERAGE 10.02 5.93 7.81 28.69 18.55 17.01 11.46 12.04

Table 4: FAR’s for 1993 by Region and Location from [1] REGION Europe USA Canada South America Africa Middle East Australasia ALL REGIONS

ONSHORE 2.5 6.0 5.5 27.0 11.1 12.5 5.1 11.2

OFFSHORE 6.2 N/A N/A N/A 21.8 N/A 14.7 8.1

Discussion The data produced by the E&P Forum [1] are probably the most comprehensive in this area as they are developed from returns by over 33 member companies world wide. It should be noted, however, that these returns are voluntary, so that the data may not be as accurate as those presented in references 2 and 3, which use statutory returns as the basis for their results. The wide ranging nature of this data source means that the results presented here may be used with a fair degree of confidence for estimating the risk of fatality from work related accidents. They should not be treated as anything other than generic figures, for indicative use when 13/06/2003

WRKRLACC.DOC

Page 4



Rev 0

more detailed risk figures (e.g. risk of fatality from dropped objects) are not available from site specific studies. Table 5: Overall Fatal Accidents from [2] and [3] (UK) FUNCTION Construction(1) Drilling Production Maintenance Diving Helicopters Boats Cranes Domestic(2) Structures(3) Unallocated TOTAL FAR Notes: (1) (2) (3) (*)

1991 0 0 0 0 0 11 1 0 0 0 1 13 15.28

1992 1 1 0 1 0 1 0 1 0 0 0 5 6.61

1993 1 0 0 0 0 0 0 0 0 0 0 1 1.14

10 year AVERAGE 0.3 0.7 0.4(*) 1.7 0.1 1.8 0.6 0.6 0 0 1.2 7.4(*) 9.05(*)

Includes commissioning Includes catering Includes plant and structure modifications Excludes Piper Alpha

Table 6: Fatal Accidents by Accident Type from [2] and [3] (UK) TYPE Fire/Explosion Air Transport Sea Transport Slips/Trips/Fall Falling Objects Handling Goods Crane Ops Use of Machinery Electrical Other TOTAL FAR (*)

1991 0 11 1 0 0 0 0 0 0 1 13 15.28

1992 0 1 0 0 1 2 1 0 0 0 5 6.61

1993 0 0 0 1 0 0 0 0 0 0 1 1.14

10 year AVERAGE 0.4(*) 1.7 0.2 0.5 0.1 0.3 0.2 1 0.1 2.9 7.4(*) 9.05(*)

Excludes Piper Alpha

Note that the values in the table are the number of fatalities - data are not available on the exposed hours for each function, so the individual FAR’s cannot be calculated. If the fatalities from Piper Alpha are included in the 10 year average then the mean FAR rises to 31.29, and the average number of fatalities per year becomes 23.9. Discussion The data presented in tables 5 and 6 have been developed from accident returns made on a statutory basis to the UK regulators. As such they provide accurate FAR data for use in 13/06/2003

WRKRLACC.DOC

Page 5



Rev 0

analyses of installations on the UK continental shelf. They are only applicable to offshore operations. The data quoted in the references are based on an exposed population rather than an exposure time. In order to make these data comparable with those from reference 1, therefore, they have been converted to the FAR base of “per 108 exposed hours”. The following assumptions were used in making the conversion: · · ·

A two week on/two week off rota is standard. Exposure time is 14 hours per day. Off duty hours are ‘non-exposed’.

Where work patterns do not fit these assumptions then the figures quoted in the tables should be adjusted accordingly. Table 7: Overall Fatal Accident Rates from [4] (Norway) FUNCTION Drilling Production TOTAL

1991 0 0 0

1992 0 0 0

1993 6.75 6.75 13.51

10 year AVERAGE N/A N/A 2.69

Discussion These data are obtained from the Norwegian Petroleum Directorate Annual Report, and are, therefore, only applicable to operations in the Norwegian sector. The FAR values in table 7 are based on the total number of exposed hours in the Norwegian sector. A more detailed analysis shows that the number of production hours exceeds significantly those of drilling. Using the function specific values generates the values given in table 8. Table 8: Function Specific Fatal Accident Rates from [4] (Norway) FUNCTION Drilling Production TOTAL

1991 0 0 0

1992 0 0 0

1993 47.56 7.87 13.51

10 year AVERAGE N/A N/A 2.69

The data are reported on a “per 1000 man years” basis, and have been converted to 108 exposed hours by making the following assumptions: • • •

A two week on/two week off rota is standard. Exposure time is 14 hours per day. Off duty hours are ‘non-exposed’.

Where work patterns do not fit these assumptions then the figures quoted in the tables should be adjusted accordingly.

13/06/2003

WRKRLACC.DOC

Page 6



Rev 0

Table 9: Fatal Accidents from [5] (Alberta Occupational Health & Safety) TYPE Worksite Highway Disease TOTAL FAR

1989 3 2 0 5 4.1

1990 3 11 0 14 11.35

1991 7 1 1 9 7.36

10 year AVERAGE 8.1 5.1 1 14.2 10.71

Discussion The data presented in table 9 are valid for onshore exploration and production in Alberta. The statistics are not comprehensive so it is not possible to develop the FAR’s for the various categories. The values in the table are numbers of fatalities, whilst the FAR is the overall fatal accident rate for that year. The base exposure hour data are presented as man years, with the qualification that 100 man years is equivalent to 200,000 man hours. This implies an average exposure time of 2,000 hours each year. These data are probably not particularly useful for use in QRA, except at a coarse level. Should analysts be interested in more detailed fatality frequencies for this part of the world then they should contact Alberta Occupational Health and Safety, whose address is in the reference. Table 10: Overall Fatal Accident Rates from [6] (Vessels, UK Sector) TYPE Merchant Vessels FAR

1990 5 10.3

1991 9 19.3

1992 4 9.9

1993 3 6.0

AVERAGE 5.25 11.4

Discussion The data presented in table 10 are for merchant vessel seamen on UK registered vessels only, and excludes fishermen. These figures are not rigorous, and should only be used for coarse estimates and comparisons. In [7] the overall FAR for merchant seamen on UK registered vessels is given as 9. Estimating Frequencies The data presented in the tables above may be used for one of two objectives: ·

To enable a Company to compare its risk figures for a specific site with typical values achieved by the Exploration and Production Industry as a whole.

·

Estimating the frequency of fatalities resulting from work related accidents. Their use in this area should be as a first pass only, unless more detailed work is intractable. It will have been noted that - especially in sector specific reports such as [2], [3], and [4] 13/06/2003

WRKRLACC.DOC

Page 7



Rev 0

- the FAR values vary significantly from one year to the next, and this severely limits their use as a definitive tool. The following short example (using imaginary numbers) demonstrates how to use FAR’s to estimate a fatality frequency: There is a particular work activity that exposes 2 personnel to risk for 6 hours a day for 50% of the year, and has a historical FAR of 5. The number of exposed hours

= 2 men x 6 hrs x 182 days = 2,184 hours per year.

The risk of fatality is the exposed hours multiplied by the FAR (fatalities per 108 exposed hours). Thus the risk of fatality = 2,184 x (5/108) per year = 1.1 x 10-4 per year. It should be stressed that although there are some fatality rates for explosions and burns included, such events are normally considered as major hazards and should, therefore, be subjected to detailed and site specific analysis. Comparative Statistics Tables 11 and 12 below, contains a listing of FAR’s from other UK industries, to enable comparisons to be drawn between the fatality rates for the Exploration and Production sector and other types of industry. The values presented are developed from statistics published by the Royal Society for the Prevention of Accidents. Table 11: Fatal Accident Rates for Employees in Selected Onshore Industries INDUSTRY Agriculture1 Energy & Water2 Manufacturing Construction Service Industries All Industries

1991 4.78 3.24 0.96 4.95 0.37 0.90

1992 3.56 3.94 0.80 4.68 0.32 0.75

1993 4.36 3.03 0.80 4.26 0.37 0.69

(1) Includes forestry and fishing, but excludes sea fishing. (2) Includes offshore fatalities from the UKCS.

Table 12: Fatal Accident Rates for Self-Employed in Selected Onshore Industries INDUSTRY Agriculture1 Energy & Water2 Manufacturing Construction Service Industries All Industries

1991 5.80 N/A 1.97 2.07 0.59 1.44

1992 6.91 N/A 1.49 1.33 0.37 1.22

1993 3.67 N/A 0.48 2.13 0.43 1.06

(1) Includes forestry and fishing, but excludes sea fishing. (2) Includes offshore fatalities from the UKCS.

13/06/2003

WRKRLACC.DOC

Page 8



Rev 0

These data are presented on a “per 100,000” basis, and have been converted to FAR’s using the following assumptions: · 8 hours exposure per day. · 5 days exposure per week. · 20 days holiday per worker, and 8 statutory holiday days per year. This results in a exposure time of 1,880 hours per worker per year. If appropriate the values in the table should be adjusted when used for comparative purposes. Ongoing Research Although the term research is not particularly appropriate, it is fair to say that fatality statistics are collected and published on an ongoing, annual, basis. It is entirely possible, therefore, to track the performance of the industry, or a particular sector within it, to assess and analyse the trends in safety performance.

13/06/2003

WRKRLACC.DOC

Page 9



Rev 0

2.

WORK RELATED LOST TIME ACCIDENT RATES

2.1

SUMMARY

2.1.1

Scope

This datasheet provides data on work related Lost Time Incident Rates (LTIR’s) that arise in the Exploration and Production Industry. The data are subdivided to provide guidance on typical LTIR’s that are experienced by activity, offshore, onshore, and by region. Where data are available from more than one source, multiple tables are included. Although transport and fire/explosion induced fatalities are not technically work related, they have been included for information. 2.1.2

Application

The data presented are applicable for work related accidents when undertaking QRA relating to exploration and production. Wherever possible the data selected should be those that most closely resemble the situation being modelled, rather than the more generic type of data given in the first few tables. The original data sources present the data in a variety of different ways - e.g. as LTIR’s, per 100,000 workers, per 1000 man years. These have all been adjusted to Lost Time Injury Rate per 106 exposed hours (LTIR) to facilitate comparison and use. Should it be desired to compare the FAR and the LTIR to ascertain the relative magnitude of these two indicators in a given area then the LTIR must be multiplied by 100, or the FAR divided by 100. 2.2

KEY DATA

Data Tables Table 13: Overall Lost Time Injury Rates from [1] FUNCTION Exploration Production Drilling TOTAL

1991 2.6 4.1 8.3 4.5

1992 2.0 4.2 6.2 4.2

1993 1.3 3.8 6.5 3.8

10 year AVERAGE 3.76 4.79 9.77 5.31

Note that in this table the LTIR’s for each function are calculated from the injuries and exposed hours for that function, whilst the total is all injuries and exposed hours. This explains why the total LTIR’s are not the sum of the individual function LTIR’s. Discussion The data produced by the E&P Forum [1] are probably the most comprehensive in this area as they are developed from returns by over 33 member companies world wide. It should be 13/06/2003

WRKRLACC.DOC

Page 10



Rev 0

noted, however, that these returns are voluntary, so that the data may not be as accurate as those presented in [2] and [3], which use statutory returns as the basis for their results. These data are generic, containing as they do offshore, onshore, Company personnel, Contractor personnel, and regional components. If a more detailed breakdown of the data is required, reference should be made to the original reports. Owing to the amount of data that would have to be manipulated, the E&P Forum reports do not sub-classify LTI’s further into accident type. Thus they should not be treated as anything other than generic figures, for indicative use when more detailed risk figures are not available from site specific studies. Table 14: Lost Time Injuries from [2] and [8] (UK) FUNCTION Production Drilling Maintenance Diving Construction(1) Deck Ops Domestic(2) Structures(3) Transport Other TOTAL FAR Notes: (1) (2) (3)

1991 38 149 111 5 98 68 57 22 6 90 644 7.57

1992 46 98 102 12 133 48 37 9 12 93 590 7.80

1993 55 72 85 21 84 39 29 11 16 52 464 5.30

AVERAGE 46.33 106.33 99.33 12.67 105.00 51.67 41.00 14.00 11.33 78.33 566.00 6.89

Includes commissioning Includes catering Includes plant and structural modifications

Discussion The validity of these values is quite high as they are developed from “voluntary” reports to the UK Health and Safety Executive. Nonetheless they should be used with care, as the average figure - included for comparative purposes - is only the mean of the values presented in the table. This is because the HSE have only been recording offshore incidents since 1991, and, prior to that, the Department of Energy only recorded serious injuries. These LTIR figures are applicable to the UK sector of the North Sea, having been collected and collated by the authorities. It would only be appropriate to use these data when considering offshore exploration and production.

13/06/2003

WRKRLACC.DOC

Page 11



Rev 0

Table 15: Overall Lost Time Injury Rates from [5] (Alberta) INDUSTRY Exploration Drilling Service Rigs Other Field Services Well Operations Gas Plants TOTAL

1989 85.5 35.3 44.5 15.5

1990 89.5 28.0 37.5 19.5

1991 64.5 25.0 28.5 17.0

10 year AVERAGE 73.8 55.6 68.4 21.4

2.0 3.0 12.0

2.0 3.0 12.2

2.0 2.0 10.0

2.3 4.7 17.2

It is important to note that the definition of a lost time injury in Alberta, British Columbia and Saskatchewan is one that results in the injured being off work for 1 day or more. In most other statistics the definition of an LTI is one that entails being off work for 3 days or more. Table 16: Overall Lost Time Injury Rates from [5] (British Columbia) INDUSTRY Production Geo-seismic Drilling Service Rigs Other Services TOTAL

1989 10.5 43.5 33.5 33.5 34.5 28.0

1990 8.5 46.0 39.5 30.0 34.0 32.0

1991 8.0 45.5 25.1 7.0 20.5 21.0

5 year AVERAGE 8.3 49.9 42.9 29.3 32.1 28.3

Note that in Tables 15 and 16 the LTIR’s for each function are calculated from the injuries and exposed hours for that function, whilst the total is all injuries and exposed hours. This explains why the total LTIR’s are not the sum of the individual function LTIR’s. Discussion These data are applicable for onshore exploration and production only. It should also be remembered that the climate in the hydrocarbon producing areas of Canada can be severe, which has an adverse effect on the injury rate. These data are very accurate for the areas of Alberta and British Columbia, as they are developed from data compiled by the Worker compensation Boards in the relative provinces. The data from Alberta includes statistics from operations extracting oil from tar sands, but excludes those applicable to refineries and pipelines. The British Columbia and Saskatchewan figures apply to a similar range as appropriate. Estimating Frequencies The data presented in the tables above may be used for one of two objectives: •

To enable a Company to compare its risk figures for a specific site with typical values achieved by the Exploration and Production Industry as a whole.

13/06/2003

WRKRLACC.DOC

Page 12


•


Rev 0

Estimating the frequency of injuries resulting from work related accidents. Their use in this area should be as a first pass only, unless more detailed work is intractable. In this regard the LTIR data are slightly less varied from year to year than those for fatalities, so a greater degree of confidence may be attached to such analyses.

The frequency estimation is performed in the same way as indicated in section 1.2 above: There is a particular work activity that exposes 2 personnel to a risk of injury for 6 hours a day for 50% of the year, and has a historical LTIR of 24. The number of exposed hours

= 2 men x 6 hrs x 182 days = 2,184 hours per year.

The frequency of injury is the exposed hours multiplied by the LTIR (injuries per 106 exposed hours). Thus the frequency of injury = 2,184 x (24/106) per year = 5.24 x 10-2 per year. This is equivalent to 1 injury every 19 years. Note, however, that this is a less frequent use of these data and must be approached with a great deal of caution. This is because the LTIR cannot be used to estimate the risk of a particular injury. The outcome of a fatal accident is known - death, and risk values may be developed quite readily. With non-fatal accidents, however, there may be a multitude of consequences - for a fall these may range from a bruised arm to a broken back - which makes this analysis of less significance. The frequency of accidents may be estimated, but not their risk, unless a conditional probability can be assigned to each possible injury that may occur as a result of the accident. Comparative Statistics Comparative statistics have not been included for lost time injuries owing to their multiplicity and diversity. Analysts needing these data should approach the appropriate authorities in the areas of interest, or local accident prevention societies. Ongoing Research As with fatality statistics, the term research is not particularly appropriate. Injury statistics are collected and published on an ongoing, annual, basis by most regulatory authorities and many accident prevention societies (E.g. RoSPA in the UK). It is entirely possible, therefore, to track the performance of the industry, or a particular sector within it, to assess and analyse the trends in safety performance.

13/06/2003

WRKRLACC.DOC

Page 13



Rev 0

REFERENCES 1.

Accident Data 1993, E&P Forum Report No. 6.37/212, August 1994, back to Accident Data 1985, E&P Forum Report No. 6.8/131, December 1986.

2.

Offshore Accident and Incident Statistics Report 1993, UK Health and Safety Executive Offshore Technology Report No. OTO 94/010, October 1994

3.

Development of the Oil and Gas Resources of the United Kingdom, Department of Energy, 1991, ISBN 0 11 413705 6

4.

Norwegian Petroleum Directorate, Annual Report 1993

5.

Lost Time Injuries and Illnesses, Upstream Oil and Gas Industries, Alberta 1982 1991. Alberta Occupational Health and Safety, December 1992.

6.

Casualties to Vessels and Accidents to Men, Return for 1993, Marine Accident Investigation Board.

7.

E&P Forum Member.

8.

Offshore Accident and Incident Statistics Report 1994, UK Health and Safety Executive Offshore Technology Report No. OTO 95/953, 1995

13/06/2003

WRKRLACC.DOC

Page 14


13/06/2003


WRKRLACC.DOC

Rev 0

Page 15

Land Transport


Rev 0

LAND TRANSPORT

13/06/2003

LANDTRAN.DOC

Page 1

Land Transport


Rev 0

TABLE OF CONTENTS 1.

SUMMARY 1.1 Scope 1.2 Application

3 3 3

2.

WORLDWIDE STATISTICAL DATA 2.1 Road Accidents 2.2 International Comparison of Road Deaths 5

4 4

3.

UNITED KINGDOM: TRANSPORT STATISTICS 3.1 Road Transport 3.2 Risk Comparison of Transport Modes 3.3 Transport of Dangerous Substances

6 6 7 7

4.

DESERT DRIVING STATISTICS

8

5.

TRAFFIC ACCIDENTS DURING TRANSPORT OF PETROLEUM PRODUCTS

8

6.

U.S.A. DATA 6.1 Introduction 6.2 Available Data 6.2.1 Road Transport - Trucks 6.2.2 Rail Transport

9 9 9 9 10

7.

FURTHER DATA AVAILABLE

10

REFERENCES

13/06/2003

11

LANDTRAN.DOC

Page 2

Land Transport

1.

SUMMARY

1.1

Scope


Rev 0

This data sheet provides information on land transport accident statistics for use in Quantitative Risk Assessment (QRA). The data sheet includes guidelines for the interpretation of data sources, references of which are given. Most of the data concern motor vehicles and rail transport, although some data for cyclists and pedestrians are also presented. 1.2

Application

This data sheet contains global data plus more detailed data from the USA and the United Kingdom. When using these data, it should be realised that they may not be directly applicable to the specific location under study. It is therefore strongly recommended that local data sources on accidents and transport risk from governmental or other national or regional institutions are accessed before using the data given in this sheet. Should these local data not be accessible, or their reliability/applicability be questioned, then the data in this data sheet could be used after factoring for local circumstances. The statistical information from the UK with certain assumptions can be used to derive general rules for areas elsewhere in Europe or the world: for example the influence of age and road type on accident rates. However, data which have been adjusted to allow for local circumstances should always be used with caution: the assumptions made are likely to be highly judgemental and hence may reduce the reliability of the adjusted data vis a vis reality. Each assumption shall be clearly documented so that an auditable trail is maintained.

13/06/2003

LANDTRAN.DOC

Page 3

Land Transport


2.

WORLDWIDE STATISTICAL DATA

2.1

Road Accidents

Rev 0

The International Road Federation in Geneva collects world road statistics including data on road accidents from a large number of countries, [1]. The data include the annual number of accidents, annual number of injured and killed people as well as the number of injury accidents, persons injured or killed per 100 million vehicle kilometers (108 V Kms). A selection (from table VII, [1]) is given in Table 2.1 below. This table includes all those injured or killed as a result of road accidents (ie. vehicle occupants, pedestrians and other road users). It should be noted that the percentage of injury accidents in built-up areas and at night is not given below but appears in table VII, [1]. The associated traffic volume in 100 million vehicle kilometers is also given to provide an indication of the size of the sample and hence the significance (statistical reliability) of the accident rates. Table 2.1: Road Accident Fatality and Injury Rate, Selected Countries, All Vehicles, [1] Country Europe Belgium Denmark Finland 5 France 1 Germany (FRG) Great Britain Italy1 The Netherlands 2 Portugal Spain Turkey Africa Egypt Kenya Morocco 3 South Africa1 Zimbabwe 1 America Colombia Mexico USA Asia/Middle East Bahrain Hong Kong Japan 1 Kuwait Oman Yemen Oceania New Zealand

13/06/2003

Year

Traffic Volume (in108 V Kms)6 7 574.0

1991 1992 1993 1993 1991 1992 1991 1993 1993 1992 1993

383.6 8 439.0 4590.0 4618.0 4480.0 3868.2 1000.0 9 340.0 1029.0 7 308.1

1992 1990 1991 1991 1993

Injury Accident Rate (per 108 V Kms)

Injury Rate

(per 108 V Kms)

Fatality Rate

(per 108 V Kms)

101.4 23.0 14.7 29.9 69.0 55.0 44.6 172.7 69.9 189.0

143.2 27.0 18.6 41.1 90.0 76.0 62.9 48.0 233.6 104.1 336.0

3.3 1.5 1.2 2.0 1.6 1.0 1.9 1.3 7.5 4.8 21.0

4,7,9 57.0 7 52.0 nav nav 5,7 74.0

181.1 199.0 99.0 85.7 19.7

217.0 330.0 207.0 129.3 32.1

43.2 36.0 21.0 10.4 2.8

1990 1990 1992

7 509.0 554.0 36039.0

240.0 31.7 62.5

53.0 65.7 95.7

5.0 10.0 1.1

1993 1993 1993 1989 1993 1993

7 33.0 101.0 5,7 6782.0 7 148.0 5 110.0 7 103.0

50.8 157.0 106.9 137.3 24.0 83.1

79.5 209.0 129.6 20.0 53.2 76.2

1.7 4.0 1.6 2.03 4.2 13.0

1993

10 310.0

35.0

50.0

2.0

LANDTRAN.DOC

Page 4

Land Transport Notes: 1


Rev 0

2 3 4 5 6 7 8 9 10

In accordance with the commonly agreed international definition, most countries define a fatality as being due to a road accident if death occurs within 30 days of the accident. The official road accident statistics of some countries however limit the fatalities to those occurring within shorter periods after the accident. Where different, the actual definitions are given below and should be taken into account when comparing the data in the above table: France (6 days), Italy (7 days), Spain (24 hours), South Africa (6 days), Zimbabwe (on the spot) and Japan (24 hours). Excluding casualties among cyclists. Outside cities. 1993 figure. 1992 figure. Total number of vehicle kilometers derived from table V, [1] by adding figures for each vehicle type. 2 wheeler kilometers not included (not available). 2 wheeler kilometers 1992 figure. Goods vehicle kilometers not included (not available). E&P Forum member data.

2.2

International Comparison of Road Deaths

The UK Department of Transport also provides an international comparison, namely by car user deaths (includes driver and passengers) per 100 million car kilometers, [2], table 48. The numbers will be different from those in table 1 as they exclude any pedestrians and other road users killed in the accident. A selection of this information is given in Table 2.2 below. Table 2.2: International Comparison of Road Deaths: Death Rate for Car Users by selected Countries 1992 1 [2]

Great Britain Denmark Germany Irish Republic Netherlands Finland Switzerland Australia 3 Japan 2 USA

Traffic Volume (in 108 V Kms) 4 4104 421 4618 258 950 433 473 nav nav 34844

Car User Fatality Rate (per 108 V Kms) 0.6 0.8 1.4 0.8 0.7 0.9 0.9 1.3 1.5 0.9

Notes : 1 Source: International Road Traffic and Accident Database, IRTAD, (from the Organisation for Economic Co-operation and Development, OECD). 2 Reference also note 1, table 1. To allow for the difference in definition of an accident fatality, the number of car user deaths (and therefore the car user death rate) has been adjusted according to factors used by the Economic Commission for Europe and the European Conference of Ministers of Transport, to represent standardised 30-day deaths: Japan (1 day) + 30%. 3 1991 data. 4 The total number of car kilometers was taken from table 8.4 in [3]. The car user fatality rate in column 3 is actually calculated based on total car kilometers from the International Road and Traffic Accident Database which was not available to derive car kilometers. Having the right number of car kilometers is not so relevant as it is the order of magnitude which indicates the sample size and hence the significance of the accident rates.

13/06/2003

LANDTRAN.DOC

Page 5

Land Transport


3.

UNITED KINGDOM: TRANSPORT STATISTICS

3.1

Road Transport

Rev 0

The UK Department of Transport collects statistical data on transport (air, road, rail and water) and also specifically on road accidents. Only a small proportion of these are published, [3] and [1] respectively. The published information contains a great amount of detail and variety in presenting accident rates: eg. distinction is made between road types, road user types, age and sex of drivers, weather conditions etc. Table 3.1a below presents the casualty and accident rates by road type and is taken directly from [2], Table 26. The information also includes the rates at which pedestrians are either seriously injured or killed in accidents. Also available, [2], are data on the casualty rates (drivers or passengers) by age bands, road user type and severity. This information is given in Table 3.1b below. Table 3.1 a: UK Road Accident Fatality/Injury Rates: Rates by Road Class, Road User Type, Injury Severity and Pedestrian Involvement [2] Built up Roads1 Vehicle Type Pedal Cycle

Motor Cycle

Car

Bus or Coach

LGV6

HGV6

All Vehicles7

Motorways

All Roads

User3

3.3

Serious4 Inj. 87.2

Pedestr.

0.1

2.8

0.1

0.6

-

-

0.1

2.3

User

7.6

177.8

15.2

136.6

2.8

35.7

10.2

153.9

Pedestr.

1.9

17.7

0.6

1.1

-

-

1.3

10.4

User

0.3

5.8

0.9

8.3

0.2

2.0

0.5

6.3

Pedestr.

0.4

5.8

0.1

0.4

0.0

0.0

0.3

2.8

User

0.6

20.4

0.5

6.1

2.3

5.3

0.8

15.1

Pedestr.

2.0

11.7

0.2

0.9

0.0

0.2

1.3

7.6

User

0.1

2.3

0.4

3.6

0.2

1.6

0.3

2.7

Pedestr.

0.5

3.5

0.1

0.2

0.0

0.0

0.2

1.6

User

0.1

1.8

0.2

2.5

0.2

1.5

0.2

2.0

Pedestr.

1.3

2.9

0.3

0.2

0.1

0.1

0.5

0.9

User

0.4

9.5

1.0

9.1

0.3

0.2

0.6

8.2

Pedestr.

0.5

5.8

0.1

0.4

0.1

0.1

0.3

2.8

Person

Death5

Non Built up Roads1 Death Serious Inj. 6.7 57.0

Death

Death

-

Serious Inj. -

4.1

Serious Inj. 79.9

All Rates in deaths or injuries per 100 million vehicle kilometers 2.

13/06/2003

LANDTRAN.DOC

Page 6

Land Transport


Rev 0

Notes to table 3.1a: 1 Built up roads are roads with speed limits (ignoring temporary limits) of 40 mph or less, non-built up roads with speed limit of over 40 mph, but excluding motorways. Numbers include road class not reported. 2 Total amount of kilometers for the particular vehicle type on all road types, table 1 (b) in [2]. Numbers are included in the table to provide an indication of the sample size, hence significance (reliability) of the derived casualty rates. 3 User of a vehicle covers all occupants, i.e. driver (or rider) and passengers. 4 Serious injury is an injury for which a person is detained in hospital as an 'in-patient', or fractures, concussion, internal injuries, crushings, severe cuts and lacerations, severe general shock or injuries causing death 30 or more days after the accident. 5 Within 30 days after the accident. 6 Heavy Goods Vehicles (HGV) are those over 1.524 tonnes unloaded weight. Light Good Vehicles (LGV) are those under 1.524 tonnes unloaded weight. From 1 January onwards the border line will be 3.5 tonnes. 7 All motor and non-motor vehicles (include those mentioned in Table 3.1a). Examples of other such motor vehicles are ambulances, fire engines, pedestrian controlled vehicles with a motor, railway trains or engines, refuse vehicles, road rollers, tractores, excavators, mobile cranes, tower wagons, army tanks etc. The rate of occurrence of injury accidents for “all Vehicules” is derived using a higher total vehicular mileage, that being the mileage for all vehicles.

Table 3.1 b: UK Road Transport Accident Rates 1993 Casualty Rates (per 108 V Kms) Male Age 17-20 21-24 25-28 29-33 34-38 39-43 44-48 49-53 54-58 59-63 64-68 69-73 74+ All

3.2

Fatal 1.8 0.6 0.4 0.3 0.2 0.2 0.2 0.2 0.3 0.2 0.3 0.5 2.0 0.4

Fat.al/Serious Injuries 20 7 5 4 2 2 2 2 3 3 3 5 12 4

Female All Severities 134 53 33 28 20 17 14 15 16 17 18 25 54 27

Fatal 0.8 0.2 0.2 0.2 0.2 0.1 0.2 0.1 0.2 0.3 0.9 1.2 2.8 0.3

Fatal/Serious Injuries 15 7 5 5 4 3 3 4 4 4 7 11 20 5

All Severities 155 80 61 55 43 36 35 36 37 35 44 55 92 53

Risk Comparison of Transport Modes

Howard Collins, Statistics Directorate, UK Department of Transport, gives useful guidelines in an article in [3] for comparing various modes of passenger transport and concludes that the type of casualty rate used will influence the results of the comparison. On the basis of casualty rate per passenger kilometer driving in a car appears to be much more dangerous than travelling by air. However, on the basis of casualty rate per passenger hours the risk is the same and calculated in passenger journeys the travelling by air is more dangerous. It is hence important when choosing the type of casualty rate for a comparative study, to establish which type best describes the risk perceived relevant for the study. 3.3

Transport of Dangerous Substances

[20] Provides a comprehensive overview and risk assessment of major hazard aspects of transport of dangerous substances in the UK. The scope covered not only the consideration of major hazard aspects of the transport of dangerous substances, but also the identification of 13/06/2003

LANDTRAN.DOC

Page 7

Land Transport


Rev 0

appropriate control measures and advice on any additional action that might be necessary. It does not include radioactive substances, transport by air or by pipelines or risks to the environment. 4.

DESERT DRIVING STATISTICS

One of the E&P Forum member companies collects statistical data on accidents from which accident rates for desert driving conditions can be calculated. This data covers a period between 1992 and 1994. The derived desert driving accident and fatality rates are shown in Table 4 below and relate to company and contractor work related accidents. Table 4: Desert Driving Accident and Fatality Rates (Graded Road and Off Road) Year

Road Traffic Accidents 137

Injuries

Fatalities

1992

Road Traffic (108 V Km) 1 0.79

56

4

Fatality Rate (per 108 V Kms) 5.1

1993

0.89

135

42

2

2.3

1994

0.86

111

26

0

0.0

Note: 1 As the number of kilometers driven on graded roads & off road is not reported separately, this number is derived from the total number of kilometers by assuming that 75% of the driving takes place on graded roads or off road.

The downward trend in the Fatality Rate is considered to be the result of improved induction training, the fitting of roll-over bars and speed governors to all LGV's and the near 100% usage of seat-belts. This needs to be taken into account when applying the rates for desert driving at other locations. 5.

TRAFFIC ACCIDENTS DURING PETROLEUM PRODUCTS TRANSPORT

One E&P Forum member collected data on accidents involving Heavy Goods Vehicles carrying petroleum products including fatal accident rates, for various areas in the world. This is presented in Table 5 below. Table 5: 1993 Fatal Accident Rates for Heavy Goods Vehicles carrying Petroleum Products Area

Number of Vehicles

Vehicle Traffic (in 108 V Kms)

Number of Accidents

Number of Fatal Accidents

Western Hemisphere and Africa Europe

5917

3.3

710

44

Fatality Rate (in 108 V Kms) 13.5

5255

3.1

529

7

2.3

Far East and Australia Middle East, Francophone Africa and South Asia CIS, Central and East Europe All Areas

5026

3.2

248

32

10.1

818

4.0

56

3

7.5

119

0.4

49

0

0

17135

10.0

1592

86

8.7

13/06/2003

LANDTRAN.DOC

Page 8

Land Transport


6.

U.S.A. DATA

6.1

Introduction

Rev 0

This section provides gives information about land transport risks in the USA, as informed by an E&P Forum member. The information presented in this section has been extracted from a report compilation, [4]. Reference [4] provides information for explosive, flammable and otherwise dangerous chemicals. The handbook provides methodologies for assessing the potential impacts of hazardous material releases and addresses hazard analysis (hazard identification, vulnerability analysis and risk analysis). This section presents failure rates which originate from several sources. The age of the background data and the individual sources may no longer reflect the reliability of transport vehicles on the roads and railways today because of stricter safety regulations for both vehicles and materials transportation. 6.2

Available Data

6.2.1

Road Transport - Trucks

Table 6.2.1:

Frequently Cited Average Accident Rates from various Literature Sources, compiled by FEMA [4] Vehicle

Accident Rate (per mile) 5.0 x 10-6

Trucks in the petroleum industry.

Reference API, 1983 [5]

Trucks.

2.5 x 10-6

All trucks.

1.2 x 10-5

Dennis at al 1978 [6] Rhoads et at 1978 [7] National Safety Council, 1988 [9]

Bulk hazardous materials trucks.

1.5 x 10-6

Ichniowski, 1984 [10]

The rate of accidents can be a function of road type (urban, rural, etc), number of lanes, traffic density, average speeds, type of vehicle, number of intersections, road conditions, weather conditions, geometry of the road, grade, etc. However, differences attributed to these various causes tend to give results that are within roughly one order of magnitude, with the range usually being 1 to 10 x 10-6/mile or between one and ten accidents per million miles driven, [11], [5], [8] and [9]. Rates have been reported for specific locations or road types. Much of the variation in these average rates can be explained by level or compliance with reporting requirements and different reporting thresholds in terms of damages sustained for the various data bases, as well as the road and weather conditions in the subject area. Table 6.2.2: Reference

Fraction of all reported accidents resulting in a spill or discharge Source

Fraction Resulting in a Spill or Discharge

[12]

US Environment Protection Agency

0.2

[13]

OTA, Office of Technology Assessment

0.115

[14]

U.S. Department of Energy

0.3

13/06/2003

LANDTRAN.DOC

Page 9

Land Transport [15]

E&P Forum QRA Datasheet Directory U.S. Department of Transportation

Rev 0 0.46

Others

<0.01 up to 0.5

Reference [6] states that 0.3 - 1.2 percent (0.003 - 0.012) of most types of truck accidents result in a fire. Some data sources combine the accident rate with prespecified levels of accident severity, for example, Clarke et al [16]. Minor Moderate Severe Extra severe Extreme

2.4 x 10-6/mile. 4.5 x 10-8/mile. 7.2 x 10-9/mile. 3.5 x 10-9/mile. 1.2 x 10-9/mile.

A review of hazardous material accidents on highways over the five-year period 1981 through 1985 was carried out by Midwest Research Institute (MRI), [17]. This study concluded that, based on truck accidents reported to the Bureau of Motor Carrier Safety (BMCS) of the Federal Highway Administration, 15.2 percent of accidents involving hazardous materialcarrying vehicles resulted in a release. Accidents involving tank trucks resulted in releases 16.6 percent of the time based on 1984-1985 BMCS reported accident data. It is not clear whether accidents involving empty trucks that normally carry hazardous material were included in the data base. The implication in this study, however, is that only loaded trucks are included. 6.2.2

Rail Transport

The overall accident rate for US railroads has been reported as being 4.6 x 10-6 accidents per train-mile travelled in 1987. This rate was comprised of 4.9 x 10-7 collisions per train-mile, 3.2 x 10-6 derailments per train-mile, and 8.6 x 10-7 other types of accidents per train-mile. The general trend has been a reduction in the overall accident rate, the collision rate, and the derailment rate, with only the rate for "other" accidents holding at about one per million trainmiles, Federal Railroads Administration (FRA) [18], as might be expected due to the many new regulations adopted since 1984 to improve railroad safety. For example, the overall accidents rates reported for the period 1979-1984 were: Year

Accident (per 108 train-miles)

1984 1983 1982 1981 1980 1979

6.6 7.0 8.0 8.6 11.8 12.8

Note: Some adjustments were made in the rates to account for changes in reporting thresholds.

The overall rate of 4.6 x 10-6 accidents per train-mile can be sub-divided into a rate of about 2.9 x 10-6 per train-mile for mainline track and 1.3 x 10-5 per train-mile for rail yards, FRA [18]. For a 5-year period, the average number of cars per freight train has been about 70 [19] and the average number of cars involved in each accident has been estimated at between 10 and 20 percent of these.

13/06/2003

LANDTRAN.DOC

Page 10

Land Transport


Rev 0

Railway data for the UK [21] exhibit accident rates and trends similar to US railroads. In both cases however, when undertaking studies involving the transport of dangerous substances, a better source of information is the UK Health & Safety Commission’s “Major Hazard Aspects of the Transport of dangerous Substances” [20]. 7.

FURTHER DATA AVAILABLE

Also, in addition to the data sources already used, the sources [22], [23], [24], [25] and [26] might contain more useful information, subject to specific needs (and location).

13/06/2003

LANDTRAN.DOC

Page 11

Land Transport


Rev 0

REFERENCES -1 [1]

"World Road Statistics 1980-1993", International Road Federation (IRF) in Geneva, edition 1994, ISSN 0444-1419.

[2]

"Road Accidents Great Britain 1993", The Casualty Report, London HMSO, ISBN 011551291-8.

[3]

"Transport Statistics Great Britain 1979-1989", The Department of Transport, London HMSO, September 1994, ISBN 0-11-551633-6.

[4]

Federal Emergency Management Agency, "Handbook of Chemical Hazard Analysis Procedures", available from Federal Emergency Management Agency, Publications Office, 500 C Street, SW, Washington, DC 20472.

[5]

American Petroleum Institute, "Summary of Motor Vehicle Accidents in the Petroleum Industry for 1982", June 1983.

[6]

Dennis, A.W. et al, "Severities of Transportation Accidents Involving Large Packages", Sandia Laboratories, NTIS SAND-77-0001, May 1978.

[7]

Rhoads, R.E. et al, "An Assessment of the Risk of Transporting Gasoline by Truck", prepared by Pacific Northwest Laboratory for the U.S. Department of Energy, PNL2133, November 1978.

[8]

Smith, R.N. and E.L. Wilmot, "Truck Accident and Fatality Rates Calculated from California Highway Accident Statistics for 1980 and 1981", prepared by Sandia National Laboratories for the U.S. Department of Energy, SAND-82-7066, November 1982.

[9]

National Safety Council, "Accident Facts", 1988 Edition.

[10]

Ichniowski T., "New Measures to Bolster Safety in Transportation", Chemical Engineering, November 12, 1984, pp. 35-39.

[11]

Urbanek, G.L. and E.J. Barber, "Development of Criteria to Designate Routes for Transporting Hazardous Materials", prepared by Peat, Marwick, Mitchell and Co. for the Federal Highway Administration, NTIS PB81-164725, September 1980.

[12]

ICF, Inc., "Assessing the Releases and Costs Associated with Truck Transport of Hazardous Wastes", U.S. Environmental Protection Agency, NTIS PB84-224468, 1984.

[13]

Office of Technology Assessment, "Transportation of Hazardous Materials", OTASET-340, U.S. Government Printing Office, Washington D.C., July 1986.

13/06/2003

LANDTRAN.DOC

Page 12

Land Transport


Rev 0

REFERENCES - 2 [14]

Elder, H.K. et al, "An Assessment of the Risk of Transporting Spent Nuclear Fuel by Truck", prepared by Pacific Northwest Laboratory for the U.S. Department of Energy, PNL-2588, November 1978.

[15]

Arthur D. Little, Inc., "Assessment of Risks and Risk Control Options Associated with Liquefied Natural Gas Trucking Operations from Distrigas Terminal, Everett, Massachusetts", prepared for the U.S. Department of Transportation, Contract No. DOT-RC-82037, June 1979.

[16]

Clarke, R.K. et al, "Severities of Transportation Accidents", Sandia National Laboratories, NTIS SLA-74-0001, July 1976.

[17]

Midwest Research Institute, "Present Practices of Highway Transportation of Hazardous Materials, Task B Interim Report, Literature Review", prepared for the Federal Highway Administration, DTFH61-86-C-00039, January 30, 1987.

[18]

Federal Railroad Administration, "Accident/Incident Bulletin, No. 152, Calendar Year 1983", July 1983.

[19]

Association of American Railroads, "Railroad Facts, 1985 Edition", August 1985.

[20]

"Major Hazard Aspects of the Transport of dangerous Substances", Advisory Committee on Dangerous Substances, UK HSC (Health & Safety Commission), ISBN 011-8856995, 1991.

[21]

“Railway Safety. Report on the safety record of the railways in Great Britain during 1994/95”. Health & Safety Executive.

[22]

"Annual Bulletin of Transport Statistics for Europe", published in Geneva by the United Nations Economic Commission for Europe (UNECE).

[23]

"Statistical Trends in Transport", published by the European Conference of Ministers of Transport (ECMT).

[24]

"Transport Statistical Yearbook", published by the Statistical Office of the European Community (EC).

[25]

National Highway Traffic Safety Administration, Washington, USA.

[26]

National Safety Council, "Accident Facts", Chicago, USA.

13/06/2003

LANDTRAN.DOC

Page 13

Risk Assessment Data For Accidents Involving Aircrafts And Helicopters


Rev 0

AIR TRANSPORT RISK ASSESSMENT DATA FOR ACCIDENTS INVOLVING AIRCRAFTS AND HELICOPTERS

13/06/2003

AIRTRANS.DOC

Page 1



Rev 0

TABLE OF CONTENTS

1. SUMMARY -------------------------------------------------------------------------------------------- 3 1.1 Scope---------------------------------------------------------------------------------------------------------------------3 1.2 Application -------------------------------------------------------------------------------------------------------------3

2. KEY DATA--------------------------------------------------------------------------------------------- 4 ONGOING RESEARCH ------------------------------------------------------------------------------- 9 REFERENCES----------------------------------------------------------------------------------------- 10

13/06/2003

AIRTRANS.DOC

Page 2


1.

SUMMARY

1.1

Scope


Rev 0

This data sheet gives information about Fatal Accidents Rates (FARs) for aircraft and helicopters in exploration and production. As oil industry aviation is a relatively small data set, the data sheet includes data for comparison purpose from other types of aviation (e.g. scheduled flights). 1.2

Application

The data presented in table 1 through 6 are applicable for Quantitative Risk Assessment (QRA) relating to offshore helicopter transportation, helicopter operations in other areas and fixed wing operations in general. Wherever possible the data selected should be those that most closely resemble the situation being modelled. The original data sources present the data in a variety of different ways - e.g. as Fatal Accident Rates (FARs) per 100 000 passenger kilometres, per 100 000 aircraft hours - and these have all been adjusted to Fatality Rate per 108 exposed hours to facilitate comparison and use. Adjustment procedures are described in [1]. The FARs which have been developed represent average figures over a large population. There are major variations between scheduled carrier services and non-scheduled services, and between amateur flying and professional flying. The scale of these differences is shown in Table 2. All reviews of air safety stress the importance of pilot ability and training in achieving safe flying. However, there are considerable differences in the various helicopter safety reviews regarding the proportion of accidents which are considered to result mainly from human error (e.g. the 1984 HARP world-wide review [2] estimated 60-65% compared to SINTEF North Sea review [3] which estimated only 14%). In fact, the SINTEF review attributed 55% of accidents to technical failure. An amateur pilot might be considered to increase the chance of fatal accident 10 fold which is the ratio between fatal accident rates for private and business flying (2.40 per 100 000 flying hours) to that of non-commercial public carriers (0.21 per 100 000 flying hours). Users can therefore consider a range of accident rate multipliers from 1-10 depending on the circumstances.

13/06/2003

AIRTRANS.DOC

Page 3


2.


Rev 0

KEY DATA

Data Tables Table 1: FARs (Fatalities per 108 person flight hours) of Helicopters and Fixed Wing Aircrafts. TYPE OF OPERATION Helicopters

FAR

Helicopter operation in the North Sea All sectors Norway UK Denmark Netherlands

340 280 380 210 320

US Civil helicopter operations All types of engines Turbine powered Single Multi Reciprocating

425 299 411 203 614

DATA SOURCE Civil Aviation Authority (CAA) in UK [4]. Estimation procedure is described in [1]

Helicopter Association International (HAI) in US [1]. Estimation procedure is described in [1]

Fixed wing aircrafts Scheduled services UK and Europe Scheduled services whole world Non-scheduled services whole world

13/06/2003

17 24 70

AIRTRANS.DOC

CAA [2] and International Civil Aviation Organization (ICAO) [3]. Estimation procedure described in [1]

Page 4



Rev 0

Table 2: Accident rates (accidents per 105 aircraft flight hours) of helicopters and Aviation in General. TYPE OF OPERATION

ACCIDENTS Fatal Total

DATA SOURCE

Helicopters Helicopter operation in the North Sea All sectors Norway UK Denmark Netherlands

0.42 0.35 0.42 0.78 0.56

US Civil helicopter operations All types of engines Turbine powered Single Multi Reciprocating

1.53 0.91 1.25 0.58 2.74

Civil Aviation Authority (CAA) in UK [4]. Estimation procedure is described in [1]

9.89 5.28 4.96 1.91 23.00

National Transportation Safety Board (NTSB) [4]

General aviation in US Types of engines All Turboprop Turbojet Single reciprocating engine Multi reciprocating engine Type of flying Public carrier Commercial Non-Commercial Non-public carrier Private/business Corporate/executive Aerial application Instruction

13/06/2003

Helicopter Association International (HAI) in US [1].

1.56 0.89 0.21 1.70 1.54

8.45 2.60 0.96 9.85 5.46

NTSB [4]

0.020 0.212 2.40 0.08 0.96 0.49

AIRTRANS.DOC

Page 5



Rev 0

Table 3: Helicopter operation in the North Sea - Accident Rate by Flight Phase FLIGHT PHASE

ACCIDENT RATE

DATA SOURCE CAA [4]. Estimation procedure in [1]

Cruise

1.35

per 105 aircraft flying hours

Departure/Arrival

0.74

per 105 flight stage CAA [4] Estimation procedure in [1]

Table 4: Helicopter operation in the North Sea - Probability of Injury Accident FLIGHT PHASE

VALUE

DATA SOURCE

Cruise

0.15

CAA [4]. Estimation procedure in [1]

Departure/Arrival

0.35


Table 5: Helicopter operation in the North Sea - Probability of Injury for each individual in an Injury Accident FLIGHT PHASE Injury

VALUE Fatalit Either y

DATA SOURCE

Cruise

0.11

0.82

0.93


Departure/Arrival

0.20

0.48

0.69


Table 6: Other data about helicopter accidents CATEGORY

VALUE

Proportion of crew and passengers killed in fatal accidents The least probability of fire as part of the chain of events in a helicopter accident

0.75

13/06/2003

0.11

AIRTRANS.DOC

DATA SOURCE World Aircraft Accident Statistics (WAAS) [5] WAAS [5], Estimation procedure in [1]

Page 6



Rev 0

Discussion Data Source The FAR estimation for offshore helicopter operations is based on data collected by the Civil Aviation Authority (CAA) in UK. CAA, by their Safety & Analysis Unit, have published statistical reports on offshore helicopter operations since 1985. In addition to the statistical reports from CAA, data and estimates from the Helicopter Safety Study [3] are used in order to obtain estimates for the period 1973-1995. These data sources are considered as very valid, especially with respect to the number of fatalities. The FAR estimation for civil aviation in general is based on data collected by the International Civil Aviation Organization (ICAO) and published in their statistical yearbook; "Civil Aviation Statistics of the World". The data cover the period 1984 -1993, and include scheduled and non-scheduled services. The ICAO data are considered as very valid with respect to scheduled and non-scheduled commercial air transport. Another source is the "Annual Review of Aircraft Accident Data published" by the National Transport Safety Board in US. The data include all helicopter accidents in all types of rotorcraft application. The data cover the period 1976-1986. The FAR estimation for US civil helicopter operation is based on data from Helicopter Association International in US. Data about fatalities and aircraft flying hours is considered as very valid. However, the exact number of passenger flying hours is not available and has to be estimated. The data cover the period 1975-1994. Data Range The exact number of person flight hours is not available. The numbers in Table 1 have been estimated, based on some data, supplied with judgements. For the helicopter operations in the North Sea, the relative uncertainty in these numbers is judged to be within the range of 10% for Norway and UK, and 30% for the Netherlands and Denmark. The uncertainty in the overall figures is judged to be within the range of 10% - 15%. Availability Data about offshore helicopter operations in the Norwegian, UK and Danish sector in the North Sea are readily available from CAA. Data about civil helicopter operations in US is available from HAI. Data about civil aviation is readily available from ICAO. However, exact data about person flight hours is not recorded in any of the sources and has to be estimated.

13/06/2003

AIRTRANS.DOC

Page 7



Rev 0

Strengths The strength of the presented data is that detailed information about fatal accidents has been collected since the start of the petroleum activities and exact data about aircraft hours and passenger kilometres have been collected since 1985. ICAO has a well-organised system for the collection of aviation data that has been running since 1944. Limitations The FAR values for helicopter operations in the North Sea are limited to scheduled and nonscheduled transport operations in the North Sea. The data are not representative for special operations like; lifting, search and rescue, training, etc. The FAR values for fixed wing aircrafts are only valid for scheduled and non-scheduled services. Another limitation is that ICAO does not separate between fixed and rotary wing services. However, the data are dominated by fixed wing services and is therefore most applicable for this kind of services. Applicability The presented data can be used to calculate the potential number of fatalities per year from a given helicopter transportation. Estimating Frequencies The frequency (per year) of fatal accidents involving helicopter transport and of fatalities may be approached in two ways using the data. 1. Calculate the exposure hours using the number of flights per year, the likely duration of the flight and the expected number of passengers. Many widely used helicopters carry 24 passengers. Multiply by the FAR given in Table 1. This gives a direct figure for deaths per year for helicopter flying. 2. Work out the expected number of flights per year for various purposes. Group them according to the duration and the likely number of passengers. For each group apply the accident rate per 100 000 hours flown from Table 2 (US data). The number of deaths per accident is calculated from the number of passengers and crew multiplied by 0.75, which is the proportion of passengers getting killed in a fatal accident (see Table 6). The sum of all types of flight gives potential deaths per year due to helicopter operations. The second method is a little more complex but can take account of adjustment factors more "visibly". However, users should note that fine adjustments are not usually worth the effort; uncertainties in the base data are usually far larger than any plausible adjustment factors. Example Calculation A development in the Norwegian sector in the North Sea will require 28 helicopter flights per week to and from the field, each flight lasting 1.5 hours and carrying 26 passengers and crew. In-field movements will require 56 flights a week, each with 14 passengers and lasting 0.5 hours. Estimate the potential number of fatalities per year from this helicopter operation.

13/06/2003

AIRTRANS.DOC

Page 8


1.


Rev 0

Total person exposure hours 28 × 26 × 1.5 + 56 × 14 × 0.5 = =

1484 exposure hours per week 77168 exposure hours per year

Expected fatality rate

exposure hours × FAR x 10-8

=

From Table 1, FAR for Norwegian sector is 280. 77168 × 280 x 10-8 = 0.22 accident fatalities per year from helicopter accidents. 2.

Flying hours times accident rate Probability of a fatal accident involving a turbine powered helicopter is taken from Table 2. The general aviation rate of 0.91 fatal accidents per 105 flying hours is reduced by 50% for the offshore sector giving a rate of 0.46 fatal accidents per 105 flying hours. From Table 6 it is noted that 75% of passengers will probably be killed in a fatal accident; however we judge that in this case this might be reduced by 75% for the infield flights because of rapid response by rescue boats and first aid giving a rate of 0.2 of the passengers likely to be killed in an in-field fatal accident.

Flying hours per week Flying hours per year Fatal accident rate Accidents per year Persons per flight Proportion killed Fatalities per year

Base to field 42 2184 460/108 hr 10.1/103 hr 28 0.75 0.21

In field 28 1456 460/108 hr 6.7/103 hr 14 0.2 0.02

Predicted fatality rate = 0.23 fatalities per year from helicopter accidents. Comparative Statistics The overall figure of 340 10-8 fatalities per person flight hour for helicopter operations in the North Sea, is approximately 10% less than the figure of 380 x 10-8 reported in the Helicopter Safety Study [3]. The figure is about 20% less than the figure of 430 x 10-8 reported for Norway and UK up to August 1982 [6]. Thus, there seems to be an improvement in the experienced FAR. Some trend tests have been performed, indicating that improvements have taken place [1]. ONGOING RESEARCH Although the term research is not particularly appropriate, it is fair to say that fatality statistics are collected and published on an ongoing, annual basis. It is therefore entirely possible to track the performance of the offshore helicopter transport operations and to analyse the trends in safety performance. In this connection it can be mentioned that CAA in 1982 predicted that the FAR value for scheduled services in 1990 would be of the order of 24 for fixed wing scheduled aircraft [7]. 13/06/2003

AIRTRANS.DOC

Page 9



Rev 0

REFERENCES [1]

Paulsen, T and Lydersen, S. (1995) Risk Assessment Data - Accidents Involving Aircrafts and Helicopters. SINTEF Report No. STF75 F95018, Restricted., Trondheim, Norway.

[2]

Civil Aviation Authority (1984) Review of helicopter airworthiness. Report of the helicopter Airworthiness Review Panel of Airworthiness Requirements Board (HARP Report), CAP 491, June 1984 (HMSO)

[3]

Ingstad, I., Rosness, R., Sten, T., Ulleberg, T., Rausand, M., Lydersen, S. and Schølberg, P.(1990) Helicopter Safety Study, Detailed Results. SINTEF Report STF75 F90009 Trondheim (Confidential)

[4]

CAA (1985-1994) Offshore Helicopter Operations Statistical Reports. Civil Aviation Authorities, Safety and Analysis Group.

[1]

Helicopter Association International (1995). Data received on fax by request. The data are obtained from the statistics published by The Federal Aviation Administration in US.

[2]

Civil Aviation Authority (1987) Reportable Accidents to British Registered Aircraft, and to Foreign Registered Aircraft in UK Air Space, CAP 547, February 1989 (HMSO).

[3]

ICAO (1984-1993) Statistical Year Book. Civil Aviation Statistics of the World. International Civil Aviation Organization Publications.

[4]

National Transportation Safety Board (1989) Annual Review of Aircraft Accident Data, NTSB PB89-121453.

[5]

World Aircraft Accident Statistics

[6]

Lydersen, S.: (1982) Fatal Accident Rate in Helicopter Transportation. SINTEF Project Memo, project no 880354.11, 1982- 10- 11.

[7]

Lloyd,E. and Tye, W. (1982) Systematic Safety. Safety Assessment of Aircraft Systems. Civil Aviation Authority London July 1982

13/06/2003

AIRTRANS.DOC

Page 10


13/06/2003


AIRTRANS.DOC

Rev 0

Page 11

Water Transport

E&P Forum QRA Directory -

Rev 0

WATER TRANSPORT

13/06/2003

WATERTR.DOC

Page 1

Water Transport


Rev 0

TABLE OF CONTENTS

1. SUMMARY -------------------------------------------------------------------------------------------- 3 1.1 Scope ---------------------------------------------------------------------------------------------------------------------3 1.2 Application--------------------------------------------------------------------------------------------------------------3

2. KEY DATA INVOLVING ACCIDENTS TO VESSELS/SHIPS--------------------------- 4 2.1 Accidents at sea --------------------------------------------------------------------------------------------------------4 2.2 Total loss/major accidents -------------------------------------------------------------------------------------------5 2.2.1 Accident Causes--------------------------------------------------------------------------------------------------------5 2.2.2 Total loss/major accidents (Norway) -------------------------------------------------------------------------------5 2.2.3 Age contribution -------------------------------------------------------------------------------------------------------5 2.2.4 Total loss world-wide vs. Tonnage ---------------------------------------------------------------------------------6 2.2.5 Loss by flag (country of registration)-------------------------------------------------------------------------------6

3. KEY DATA INVOLVING ACCIDENT TO SEAMEN ---------------------------------------- 7 3.1 FARs for marine accidents-------------------------------------------------------------------------------------------7 3.2 Type of Accidents to Crew Members - Merchant vessels ------------------------------------------------------ 7 3.3 Accidents to seamen ---------------------------------------------------------------------------------------------------8

4. KEY DATA INVOLVING RELEASE/SPILL INTO THE SEA----------------------------- 9 4.1 Pollution Incidents related to Offshore Loading (UK - Non-CALM systems) -----------------------------9 4.2 Pollution Incidents Frequency Rates per lifting -----------------------------------------------------------------9 4.3 Release/spills from tankers - world-wide------------------------------------------------------------------------ 10

5. REFERENCES ------------------------------------------------------------------------------------- 12

13/06/2003

WATERTR.DOC

Page 2

Water Transport


1.

SUMMARY

1.1

Scope

Rev 0

This data sheet provides data on water transports risk in relation to activities within the Exploration and Production Industry. The activities constitute supply vessels, shuttle tankers, workboats, vessels (e.g. cranes, diving etc) and standby-vessels. Drilling rigs, flotels, production ships etc are not included. 1.2

Application

The data presented are applicable to activities in support of operations within exploration for and production of hydrocarbon. Very few statistics exist as a comprehensive system for collection and verification of data in this field has not been established. The data given may have to be corrected or adjusted to fit the specific circumstances one attempts to analyse. Statistics dealing with total loss may give lower figures for the latest years due to the fact that not all vessels will be written off immediately after an accident. In some cases, the vessel may be categorised as ‘out of service’, and after some time a decision to write it off or bring it back in service will be made. There is a lack of consistency as to the year the vessel may be written off; i.e. the year when the accident took place or the year when the decision was made. In some cases the source may change the rules as to which year the vessel will be classified as total loss without correcting the previous data. Accordingly, total loss and major accident cases are grouped together, as major accident cases are candidates for being written off and thus become a total loss (see item 2.2). The total population with regard to vessels and personnel is difficult to assess. Most statistics available have been collected and registered with regard to the flag, and not the region where the vessels were sailing or where the accident took place. The same difficulty exists with regard to crew members, particularly since comprehensive statistics on the workforce on the vessels are not available, and only estimations can be made. The workforce are mainly registered according to the flag of the vessel, and not the nationality of the persons involved. It should be noted that some of the references and sources of information are issued on an annual or regular basis (e.g. [2] [4]) and it is advised that data in this datasheet should be checked agianst a more updated version from the source. 1.3

Abbreviations in this datasheet

FAR UKCS

13/06/2003

Fatal Accident Rate (defined as fatal accidents per 108 exposed hours) United Kingdom Continental Shelf

WATERTR.DOC

Page 3

Water Transport


Rev 0

2.

KEY DATA INVOLVING ACCIDENTS TO VESSELS/SHIPS

2.1

Accidents at sea

2.1.1

Accidents at sea - contribution by causes

The single largest contributor to accidents at sea (not only loss or damage) is associated with human factors such as human reaction, evaluation of the situation etc. In general human factor accounts for some 40%. The human factor is predominant in situations such as vessel collision, grounding and accidents involving personnel. Table 1: Accidents - contribution by causes - Norwegian merchant vessels (1981-1994) [3] Condition s outside the ship Ship collision Drilling rig collision Collision with drifting objects Damage by contact Grounding Capsizing Stability failure Seawater leak Pollution Rough weather Engine breakdown Fire/expl. Electrical fire Injury/fat./ poison Helicopter accidents Missing vessel Near miss Others

13/06/2003

Ship constr./ equipment

Technical conditions

Use/design of equip.

Securing/ handling of cargo

Communic organisat. procedures

Human factors,

Other

Unknow n

29

128

situation evaluation 216

6

2

1

4

50

2

5

7

3

3

50

71

7

30

83

7

8

286

1

23

25 1

280 22 4

2 9 4

156 3 1

5 1

2 39 14

213 4 2

1218 10

37 2

83 15

10

30

12

2

2

11

7

9

49

3 47

2 4

14

3

4 4

43 1

16 1

25

39 2

74

1

2

3

4

5

10

2 9

20

115 28

11

15

52 2

17 2

23 1

182 4

24

9

32

46

15

98

114

73

60

1

1

1

1

12

12

20

6

7

14

20

8

22

1 5

1

19

1

3

25

4

7

2

WATERTR.DOC

10

Page 4

Water Transport


2.2

Total loss/major accidents

2.2.1

Accident Causes

Rev 0

Table 2 - World total loss by causes during 1989-93 [2A] 1989

Nature of causes

1990

Weather

56

1000 grt/gt 299.2

Stranding

17

124.5

15

Collision/ contact

21

69.1

23

Fire/expl.

26

206.9

32

Machinery

9

46.3

8

Other

16

67.7

25

Total

145

813.7

147

No

No 44

1991

1000 grt/gt 463.3

1992

58

1000 grt/gt 551.8

169.9

17

119.9

19

291.2 124.2 213.4 1381.9

1993

Average '89/93

31

1000 grt/gt 322.2

157.3

20

117.1

8

34.3

15

120.6

10.6

70.6

18

267.0

12

47.7

19

114.9

10.1

42

597.7

28

147.8

28

178.4

31

284.4

25.0

10

41.4

9

145.8

6

115.4

8

94.6

8.3

27

333.7

28

97.7

20

70.9

23

156.7

13.7

173

1752.5

134

1097.6

121

652.4

143

1139.6

100.0

No

No

1000 grt/gt 205.7

No 47

47

1000 grt/gt 368.4

% share 32.3

No

World Tonn. (103))

400697

413515

425656

433984

442715

423314

Loss ratio%

0.20

0.33

0.41

0.25

0.15

0.27

Note:

- grt - gt -

Gross Register Tonnage Gross Tonnage

2.2.2

Total loss/major accidents (Norway)

The numbers given in the table below include major accidents in addition to total loss. Table 3 - Total loss/major accidents (Vessels registered in Norway - NIS) per 1000 vesselyears [5]

Nos. pr 1000 vessels per year

2.2.3

1987

1988

1989

1990

1991

1992

1993

1994

15

32

18

41

22

26

24

17

Age contribution

Vessels older than 15 years have a higher risk exposure than younger vessels. Of total 103 vessel total loss (in 1994) only 20 were younger than 15 years, and 63 vessel were older than 20 years. The causes for the changing risk exposure with age may be attributed to two factors; (1) ageing of vessels and maintenance problem causing reduced structural strength, and (2) introduction of new technology/technical solutions (an example is the introduction in tanker design in the early 70’s of inert gas system and segregated ballast tanks/double bottoms). Table 4 - Total loss world-wide vs. age of vessel involved (1994) [4]

13/06/2003

WATERTR.DOC

Page 5

Water Transport

Age # total loss

2.2.4


0-4 1

5-9 2

10-14 17

15-19 20

Rev 0

20-24 36

>24 27

Total 103

Total loss world-wide vs. Tonnage

Of 103 total losses in 1994, 56 vessels were 4000 gross ton or less. Table 5 - Tonnage vs. casualty - world-wide (1994) [4] Gross tons

5001000

10012000

20014000

40016000

600110000

1000115000

1500130000

3000150000

> 50001

Total

# total loss

23

18

15

7

11

11

9

2

7

103

2.2.5

Loss by flag (country of registration)

Tonnage loss as percentage of flag fleet varies considerably between the shipping countries. Countries such as Cyprus and Malta have percentage loss in the order of 1.3, while countries as USA and Denmark have losses in the order of 0.06-0.09. At the low end, countries such as Norway and Greece have losses in the order of 0.005 (in 1994). Table 6 - Loss by flag - world-wide (1994) [4] Flag

1991 No.

20 Cyprus 13 Malta 3 USA 1 Denmark 6 Norway 7 Greece World average

1992

Gr.tons 254,218 99,242 18,980 1,167 36,749 176,008

No. 4 8 1 1 6 7

1993

Gr.tons 21,407 140,460 1,472 1,599 10,638 104,384

No. 5 8 3 1 6 4

1994

Gr.tons 115,019 35,170 22,916 1,354 68,233 85,340

No. 10 6 2 3 1 1

1994

Gr.tons 291,156 198,776 11,053 3,077 1,196 910

% of fleet 1.287 1.385 0.086 0.058 0.005 0.003 0.271

Note: Gr.tons - Gross tonnage total for all vessels involved in the loss

13/06/2003

WATERTR.DOC

Page 6

Water Transport


Rev 0

3.

KEY DATA INVOLVING ACCIDENT TO SEAMEN

3.1

FARs for marine accidents

Table 7 - FARs for marine accidents - World-wide (per108 exposure hours) [1] [2] Parameter

5 years 1983-87

Best estimate figures

Average

Standard deviation

Supply vessel

Standby vessel

FAR - all causes (incl. accidents and vessel casualty)

27.5

12.5

20

15

FAR for small accidents

5.8

2.16

6

2

FAR due to vessel casualty

1.79*

2.59*

4

4

Note: *denotes that the Herald of Free Enterprise accident (06.03.87) is excluded. Ref. [5] gives the number of fatalities as follows: 1991 - 7; 1992 - 9; 1993 - 10; 1994 - 2. Few if any quality statistics seems available on FAR values broken down on type of offshore vessels or activities. Ref. [9] gives FAR values for the UKCS over the years 1976-88 as follows: Table 8 - Boat crew FARs for accidents at installation (1976-88) - UKCS [9] Vessel type Supply Anchor handling Standby Total

Fatalities 1976-88 8 6 2 16

Man years 1976-88 9650 1930 13300 24880

FAR 9.5 35.5 1.7 7.3

Ref. 5.9 The numbers does not include accidents away from the installation, in port or similar, nor does it include engine room crew. A later study [10] covering the years 1977-1991 on the UKCS has considerable lower FAR numbers: supply 3.9; anchor handling 6.5; and standby 1.4. One explanation for the uncertainty in the numbers may be lack of consistency in calculating the population or exposure. 3.2

Type of Accidents to Crew Members - Merchant vessels

Table 10 - Type of Accidents to Crew members - UK vessels (1993) [6] Type of accident Collision, foundering or stranding

Number of Accidents

1

Fire Embarking/disembarking Slip/fall on ship - same level 13/06/2003

1 7 91 WATERTR.DOC

Page 7

Water Transport


Rev 0

Slip/fall on ship - different level Fall overboard Missing at sea Manual handling Open/closing hatches Involving rope/hawser Involving winches/lifting plant Hit by moving object he was not using Exposure to noxious substance Electric shock/burns Involving machinery/equipment/tools Personal violence Other TOTAL

51 5 54 4 18 16 23 12 3 55 1 64 406

Ref. [6] indicates 406 accidents involving 411 persons, which gives accident rate per 1000 at risk as 16.4 (1993). The definition of ‘accidents’ is in accordance with UK regulations. 3.3

Accidents to seamen

Table 11 - Accidents to seamen - World-wide [1] Year

FARS - 5 years average (-/108 hrs)

Exposure

Number of deaths

106 hrs

All

Vessel casualty

Small accident

All

Vessel

Accident

1986

133

31

0

13

24.5

1.8

6.9

1987

111

57

39

5

27.5

7.4

5.8

Note: Vessel casualty defines any type of accidents involving the vessel such as collision, fire, grounding etc, and does not indicate the degree of damage to the vessel itself. The reference [1] does not specify the number of exposure hours. Exposure hours have been derived from the number of UK registered seamen with the assumption that their basic exposure to risk is 4000 hours per year. This figure has been used for all the FARs. the information on accidents on vessels does not distinguish between accidents on duty and those off duty - it has been assumed, for the purpose of this data sheet, that the seamen are exposed 24 hours per day whilst on board. If the majority of accidents involve seamen on duty, then the FAR for death due to accidents shown in Table 11 will be too low. The reference does not define all possible causes of death to seamen, but the data include persons lost overboard and death due to illness. The figures under ‘vessels’ are those described in the source as connected to “Casualties to vessels”. In Department of Transport Marine Directorate documents casualties to vessels means incidents in which a ship is damaged or sinks. For example, 38 of the 39 deaths (crew only) in the ‘vessel’ column for 1987 are those on the Herald of Free Enterprise. "All" under number of deaths includes deaths due to disease. Ref. [6] gives the death rate per 1000 at risk as 0.12 for 1993 (based on three fatalities).

13/06/2003

WATERTR.DOC

Page 8

Water Transport


Rev 0

4.

KEY DATA INVOLVING RELEASE/SPILL INTO THE SEA

4.1

Pollution Incidents related to Offshore Loading (UK: Non-CALM systems)

Release or spill into the sea from vessels engaged in the offshore activities may have as its source spills during oil lifting/loading, accidental discharges overboard or ruptured tanks. Most reporting systems of accidental release or spill into the sea have few details of the unit involved or the cause of the accident. No reliable data has been found on accidental discharges or ruptured tanks. However, one study on lifting/loading has been identified. It was noted that pollution incidents associated with lifting should be grouped according to the lifting system; and the study mainly covers non-CALM (Catenary Anchor Leg Mooring) systems, as the CALM system was a first generation system and have been phased out. Table 12 - Pollution Incidents - UK Offshore Loading 1975-93 (non-CALM systems) [8] Spill source Storage Pipeline System Hose Tanker TOTALS

Definition: loading

Total number 36 1 10 14 2 63

storage pipeline system hose tanker -

Total vol (bbls) 4,343 19 9,455 1088 7 14,912

Min size (bbls) 0.1 19 0.25 0.5 2 0.1

Max size (bbls) 4,000 19 9,400 500 5 9,400

Ave. size (bbls) 121 19 946 78 4 237

storage containment, either on production installation or facility, pipelines between production, storage and loading facilities, loading buoy or facility, e.g. pipework, swivels etc, but excluding storage, hose system from loading facility to tanker, including coupler, on board tanker.

The total volume loaded over the above systems between 1977 and end-1993 is about 1700 million barrels, via 3409 liftings. Ref. [8] has based its UKCS offshore loading statistics on Department of Trade & Industry (DTI) pollution reports over the years 1977-93 (Offshore Pollution Reports from Field Operators over 1977-93). This data has been broken down into separate risk factors for different components of the loading system, and is expressed in frequency per cargo transfer. These risk factors represent only the pollution risks relating to operation of the offshore loading system. 4.2

Pollution Incidents Frequency per lifting

Table 13 - Spill frequency vs. Spill Type - UK Offshore Loading [8] Spill type Frequency

13/06/2003

Storage 1.1x10-2

Pipeline 3.0x10-4

System 3.0x10-3

WATERTR.DOC

Hose 4.1x10-3

Tanker 6.0x10-4

TOTAL 18.7x10-3

Page 9

Water Transport

4.3


Rev 0

Release/spills from tankers - world-wide

Table 14A - Spill rates - Spills greater than or equal to 1000 barrels, 1974-1989 [11] Tanker spills In port At sea All spills

Number of spills 64 124 188

Average spill size - bbl 55,000 136,500 109,000

Median spill size bbl 7,500 23,000 15,000

Spill rate spills/Bbl 0.47 0.90 1.37

N.B. Bbl = 1 billion (i.e. 109) bbl Table 14B - Spill rates - Spills greater than or equal to 10,000 barrels, 1974-1989 [11] Tanker spills In port At sea All spills

Number of spills 28 83 111




Table 14C - Spill rates - Spills greater than or equal to 100,000 barrels, 1974-1989 [11] Tanker spills

Number of spills

In port At sea All spills

9 38 47




The Minerals Management Service (MMS) has made the estimation of spill rates based on a number of sources, and in total 188 world-wide crude oil spills from tankers over the years 1974 - 89 has been registered (barge spills and inland tanker spills have been excluded). Spill rate are calculated by dividing the number of observed spills between 1974 and 1989 by the volume of crude oil transported during that time period. The world-wide tanker spill rate of 1.37 spills/Bbl (see table 14A) was obtained by dividing 188 observed spills by 137.2 Bbl of oil moved over the same time period. The Minerals Management Service (MMS) has recorded 213 crude oil spills greater or equal to 1,000 barrels (bbl) between 1974 and 1992 (excluding barges and inland spills). The smallest size category accounts for approx. 51 percent of spills overall, however, the category accounts for only about 3 percent of the volume. In comparison, the other three categories, although almost uniformly balanced in terms of the number of spills in each, account for roughly 5 percent (smaller size category), 16 percent, and 77 percent (largest size category) of the volume spilled. Table 15 - Oil Spill from Tankers World-wide by Size Category, 1974-1989 [11] Spill size category - bbl 1,000 - 14,999 15,000 - 49,999 50,000 - 199,999 200,000 + All spills

13/06/2003

Number of spills 108 38 33 34 213

WATERTR.DOC

Volume spilled - bbl 566,500 1,024,000 3,548,500 16,789,500 21,928,500

Page 10

Water Transport


Rev 0

The Minerals Management Service (MMS) has reviewed all world-wide petroleum product spills between 1974 and 1992 (greater than or equal to 1,000 barrels excluding inland and barge spills) - in total 550 spills, and total volume 29.1 million barrels (all petroleum products). In attempting to track if weather was a contributing factor to the incident, it was realised that reporting of weather for spill events is not always available; therefore, weather as a contributing factor is probably underreported. In many cases, weather could have been the primary factor, such as heavy fog causing a collision. However, reports of these instances have identified collision as being the primary cause of spills, with weather being the contributing factor. Having identified the primary cause for the spill, the next cause in the cause/casualty sequence has been identified as the contributing factor. As an example the primary cause may be collision, and the contributing factor for the spill may be structural failure. In the table, structural failure is the largest contributing factor (163 out of 372 events with contributing factors). Table 16 - Cause for Tanker Spills World-wide, 1974 - 1992 [11] Cause for spills Collision/contact Grounding Explosion/fire Personnel error/machine failure Structural failure/leak Other/unknown

13/06/2003

Primary cause (Weather contributing) 159 (26) 138 (28) 94 (12) 62 (10) 61 (35) 45 (7)

WATERTR.DOC

Contributing factor 5 51 44 2 163 107

Page 11

Water Transport


Rev 0

5.

REFERENCES

[1]

Casualties to vessels and accidents to men Vessels registered in the United Kingdom - 1987 UK Department of Transport Marine Directorate, HMSO.

[2]

Shipping statistics year book 1988 Institute of Shipping Economics and Logistics, Bremen.

[2A]

Shipping statistics year book 1994 Institute of Shipping Economics and Logistics, Bremen.

[3]

Skipsfarts statistikk 1994 - 2. Sj ulykker (Shipping statistics - 2. Accidents at sea) Sj fartsdirektoratet (Norwegian Maritime Directorate), Oslo.

[4]

ILU Casualty Statistics 1994 The Institute of London Underwriters, London.

[5]

Sjøfartsdirektoratet Årsmelding 1994 (Norwegian Maritime Directorate Annual Report 1994), Oslo.

[6]

Marine Accident Investigation Branch Annual Report 1993, Department of Transport, Southampton, 1994.

[7]

Norwegian Petroleum Directorate Annual Report 1994, Stavanger, 1995.

[8]

Report "Offshore Loading and Shuttle Tanker Risks - April 1995" held by an E&P Forum member

[9]

DnV Technica Report C2709; May 1991.

[10]

DnV Technica Report C3896; January 1993.

[11]

US Minerals Management Service - MMS Worldwide Tanker Spill Database 1993.

13/06/2003

WATERTR.DOC

Page 12

Water Transport

13/06/2003


Rev 0

WATERTR.DOC

Page 13

Fabrication, Construction and Installation


Rev 0

FABRICATION, CONSTRUCTION AND INSTALLATION

13/06/2003

FABRI.DOC

Page 1



Rev 0

TABLE OF CONTENTS

1 SCOPE -------------------------------------------------------------------------------------------------- 3 2 APPLICATION ---------------------------------------------------------------------------------------- 4 2.1 Major Accidents -------------------------------------------------------------------------------------------------------5 2.2 Occupational/personal injury accidents---------------------------------------------------------------------------6

3 KEY DATA---------------------------------------------------------------------------------------------- 9 3.1 Historical Frequencies of Major Accidents ----------------------------------------------------------------------9 3.2 Contributors to Major Accidents--------------------------------------------------------------------------------- 14 3.2.1 Dropped objects frequencies--------------------------------------------------------------------------------------- 14 3.2.1.1 Single Heavy Lifts---------------------------------------------------------------------------------------------- 14 3.2.1.2 Tandem Heavy Lifts ------------------------------------------------------------------------------------------- 15 3.2.1.3 Smaller Lifts (e.g. lifting of piles, hammers, modules, etc.)--------------------------------------------- 15 3.2.2 Mooring failure frequencies---------------------------------------------------------------------------------------- 15 3.2.2.1 Moored at a quay ----------------------------------------------------------------------------------------------- 15 3.2.2.2 Mooring/anchor lines at the installation site --------------------------------------------------------------- 15 3.2.3 Dynamic positioning failure frequency--------------------------------------------------------------------------- 16 3.2.4 Floating unit collisions with installations ------------------------------------------------------------------------ 17 3.2.5 Ballasting failure frequency ---------------------------------------------------------------------------------------- 18 3.2.6 Weather window forecasting failure ------------------------------------------------------------------------------ 18

4 REFERENCES -------------------------------------------------------------------------------------- 20

13/06/2003

FABRI.DOC

Page 2


1.


Rev 0

SCOPE

The data in this sheet are concerned with the quantification of fabrication, construction and installation risks in respect of personnel safety and asset integrity. The data sheet has not been designed to assist with the quantification of general project management uncertainties for the purpose of estimating the likelihood of project schedule and cost overruns. This is considered to be a separate subject. Measured in terms of the life-cycle of a project, the fabrication, construction and installation phases have a short duration and can be characterised as: • • • •

labour intensive involving a large number of one-off tasks requiring temporary work arrangements and working environments exposing components/structures to non-design loading condition.

In terms of the last of these, structures can be designed to withstand extreme loadings when in-situ, such as an offshore installation being designed for a one-hundred year return wave (a storm having an annual probability of occurrence of 10-2). However, their tolerance can be considerably lower during the temporary phases. In addition, ancillary systems such as semisubmersible crane vessels, can be in a condition which makes them vulnerable to adverse weather for the period of an operation. In regard to the QRA of an onshore facility there may be no need to treat the three phases as distinct. All hazardous operations could take place at the one site and the phases could overlap in the project schedule. For an offshore installation, the first two phases - fabrication and construction - are similar and likewise there may be no need to differentiate between them. For example, in the UK Offshore Installation and Wells (Design & Construction, etc) Regulations [1], which propose the requirement for consideration of risks throughout the lifecycle of an offshore installation, no distinction is made and the two phases are grouped under the heading of “construction and other work”. However, the installation phase is distinct. Due to the variety of projects, definitions of the three phases can be in functional terms only. Definitions of the phases are: • Fabrication Activities performed in producing significant sub-components, packages, or modules which will be combined during the construction phase. •

Construction Activities performed to combine the sub-components, packages, or modules, in readiness for final installation. With this definition, construction may involve the assembly of relatively large sections of an installation. Examples would include: • • •

13/06/2003

assembly of process packages , lifting of modules onto a module support frame (MSF), mechanical outfitting of a concrete gravity based structure (GBS). FABRI.DOC

Page 3



Rev 0

Fabrication activities need not take place in the same location as the construction activities. Therefore, construction could involve the transport of substantial sections of the installation between sites. The hazards and risks associated with these activities may need to be considered and analysed within the framework of a “total” risk analysis. •

Installation Activities performed to transfer the structure to, and position at, the designated site. This definition is tailored to offshore developments, where one or more structures are transported and assembled at the site. An onshore facility may have no equivalent activities. For an offshore jacket platform this phase can include the lifting or load-out of the jacket and deck, onto transport barges. Some structures, such as concrete gravity based structures, can be towed without the assistance of a transport barge.

2.

APPLICATION

This data sheet can be used in risk assessments oriented to either quantifying risks to personnel or to quantifying risks to asset integrity. Major accidents are considered to have the potential for multiple loss of life and/or asset damage. Accordingly, an event which had no potential for human impact but resulted in significant repair or replacement of an asset, would be classified as a major accident. Therefore the term major accident is used here in a broader way than by the UK Health & Safety Executive [15], in which there is a focus on causing serious injury or loss of life to five or more persons. However, it is a narrower definition than used by the Norwegian Petroleum Directorate for an “accidental event”: “An uncontrolled event which may lead to loss of human life, personal injury, damage to the environment and loss of assets and financial interests”. [16] It is not intended that this data sheet contains all data necessary to calculate major accident frequencies. Its primary role is to indicate the types of accidents which can occur in the fabrication, construction and installation phases and to present pertinent data which may not be in other data sheets. The majority of data items presented are relevant to the QRA of offshore installation activities. This bias is due to the complexity of offshore operations for which specific data are necessary. In comparison, the data requirements for onshore projects are generic - such as dropped object frequencies - and data can be taken from elsewhere in the data directory. Fatal accident rate (FAR) statistics are presented and estimates of FAR for each phase are given. These estimates should not be regarded as recommendations for acceptable project FAR.

13/06/2003

FABRI.DOC

Page 4


2.1


Rev 0

Major Accidents

The manufacture and assembly of one or more structures, in a changeable and hazardous environment, involve possibilities of damaging assets and incurring fatalities. Although major accidents could occur in all phases, the scope of major accidents tends to increase through the phases. For example, an in-situ pipeline can be at risk during the installation of an offshore structure. At a high level, types of incidents which can occur are: • • • •

impacts between objects/structures over-stress of either the structure or of equipment/vessels being used in the activity fire and explosion events and in the case of offshore activities: loss of buoyancy, either of the structure or of equipment/vessels being used in the activity

The following is an indicative list of events per phase. By the nature of accidents, the events listed are not mutually exclusive as some can be the cause or outcome of others. A necessary stage in an analysis is to check that all risks are covered but not double counted. Structured approaches have been developed for quantified risk assessment of the construction and installation [2]. Note: Due to the similarity between the fabrication and construction phases, the two have been combined.

•

Fabrication/Construction: dropped object (e.g. dropped module when lifting onto a module support frame) over-stressing of the structure, due to: - design fault - failure of a supporting structure (e.g axle failure during transporting) - collision during transportation - ballasting failure - exposure to adverse weather conditions - missile impact of a ruptured gas bottle - explosion as a result of one or more ruptured gas bottles loss of buoyancy of a floating structure during fabrication/construction such as the capsizing of a concrete mixing barge) fire caused by loss of containment of flammable material (such as rupture of temporary fuel tanks)

•

Installation: In general, the types of events listed above for the fabrication and construction phases are relevant also to the installation phase, particularly in regard to onshore installation activities. The proximity of in-situ or prior installed equipment creates hazards which may not be present during fabrication and construction, in particular the escalation potential from live or shut-in equipment.

13/06/2003

FABRI.DOC

Page 5



Rev 0

Listed below are incidents relevant to installing an offshore structure, the nature of which is distinct from onshore installation: • • •

failure during load-out, which could result in over-stressing of the structure dropping the structure when lifting onto a transport barge towing failure during the transfer of the installation to site, which could lead to the loss of the installation grounding of the structure during transport to site (e.g. during tow) failure of the transport barge (e.g. ballasting failure) during the tow to site premature detonation of explosive charges when launching a jacket collision between an attendant vessel (such as a semi-submersible crane barge) and the structure during the installation dropped object at the installation site (e.g. dropped jacket, dropped pile). This could lead to: - impact with pre-installed equipment, such as a sub-sea template - impact with “live” in-situ equipment, such as a pipeline exposure to adverse weather (i.e. weather conditions which exceed stability or structural limitations) structural failure of a construction vessel (e.g. overstress of the crane boom)

• • • • •

• • 2.2

Occupational/personal injury accidents

In terms of occupational hazards, the temporary nature of these phases tends to give rise to relatively “uncontrolled” working environments. This aspect, in combination with the intensity of the activities, results in occupational risks which are greater than in the subsequent operational phase. Occupational hazards, such as working at height, swinging objects, unguarded machinery, are not unique to these phases, though the frequency of exposure is likely to be higher than in others. Also, there is higher probability for workers to be exposed to simultaneous activities. It is logical to expect that occupational risks are greater for offshore activities compared to the equivalent onshore activities: • • • •

greater likelihood of working at height; increased chance of physical interference between activities due to a compact “worksite”; greater need for simultaneous activities due to time constraints (weather windows); harsher environmental conditions.

In assessing the occupational risks to offshore workers, there are hazards which are unique to offshore operations: • • •

diving operations helicopter transfer use of evacuation and rescue systems (with consideration given to false alarm evacuation)

Using the data presented in Tables 2 and 3 and the assumptions regarding the differences between onshore and offshore occupational risks, estimates of Fatal Accident Rates (FAR) per phase are put forward in Table 1. Specific data for diving risks are presented in Table 4.

13/06/2003

FABRI.DOC

Page 6



Rev 0

Table 1: Suggested FAR per Phase Phase

Location

Fabrication

Onshore

Suggested FAR 4.5

Construction

Onshore

6

Offshore (e.g. transportation, floating struct.)

10

Onshore

6

Offshore

12

Installation

Comment This phase most closely approximates to “construction” or “shipbuilding” sectors (table 2) -Norwegian data (table 3) are assumed to be biased by the construction of floating concrete structures, therefore the typical onshore construction FAR is less than 9.6 - Oil & gas construction activities create more risk than corresponding activities in “construction” or “shipbuilding” sectors (table 2). For example, lifted loads are of greater mass. - Increased exposure to environmental hazards, compared to onshore construction - assumed to be comparable to Norwegian data (table 3) due to biasing by construction of floating concrete structures - considered to be equivalent to the onshore construction phase. - offshore installation activities are the most complex of all the phases. - greatest exposure to environmental hazards compared to earlier phases.

Table 2: Sector comparative fatal/serious injury frequency rate data [3] Category

Sector

1988/7

1987/8

1986/7

1985

1984

1983

Fatal injury frequency rate (FIFR)

Chemical

n/a

0.8-1.0

1.1-1.3

0.7-0.8

0.7-0.8

1.4-1.6

Construction

n/a

4.7-5.6

4.6-5.5

4.9-5.9

4.5-5.4

5.2-6.3

Shipbuilding

n/a

n/a

n/a

3.1-3.7

3.6-4.3

1.4-1.7

Coal mining

n/a

n/a

6.8

7.8

9.8

6.8

Offshore

9.7

4.8

11.4

15.4

13.2

Chemical

247.6 8.6* n/a

73-87

75-90

52-63

50-60

51-61

Construction

n/a n/a

119143 n/a

102123 52-62

102122 43-51

97-116

Shipbuilding

120148 n/a

Coal mining

n/a

n/a

400

426

251

117

Offshore

118.8 103.0*

93.8

161.7

142.6

75.6

95.3

Serious injury frequency rate (SIFR)

40-58

* Excludes Piper Alpha 13/06/2003

FABRI.DOC

Page 7



Rev 0

Number of fatal incidents / (number of employees * hours per employee) * 108 Number of serious incidents / (number of employees * hours per employee) * 108 A serious incident is defined as: - fracture of the skull, spine or pelvis - fracture of any bone: in the arm, other than a bone in the wrist or hand; in the leg other than in a bone in the ankle or foot - amputation of a hand or foot - the loss of sight of an eye - any other injury which results in the injured person being admitted into hospital as an in-patient for more than 24 hours, unless the person is detained only for observation

FIFR SIFR

Table 3: Onshore construction in the petroleum industry, Norway [14]

-

Year

Fatalities

Man-hours (x107)

FAR

1983

1

2.87

3.5

1984

1

2.94

3.4

1985

10

3.10

32.3

1986

4

2.79

14.3

1987

2

3.08

3.2

1988

0

2.77

0

1989

0

1.80

0

1990

2

2.2.5

8.9

1991

3

2.39

12.6

1983 - 1991

23

23.99

9.6

Man-hours include personnel involved in direct and indirect construction activities (i.e. construction staff and support staff)

Table 4: Diving Fatal Accident Rate (FAR) [14] Area

Period

Norway

1978 - 1991

UK

1975 - 1982

13/06/2003

Estimated FAR (per 108 saturation hours) 218 580

FABRI.DOC

Comment

Majority of accidents occurred in the initial years

Page 8



3.

KEY DATA

3.1

Historical Frequencies of Major Accidents

Rev 0

This section gives a historical picture of major accidents in the fabrication, construction and installation phases of offshore projects. The review is limited to offshore incidents due to the accessibility of relevant accident/incident records. Three hundred and twelve records from WOAD, satisfied the following criteria: • •

installation type operation mode

fixed OR semisubmersible OR jackup transfer OR repair/construction

Examinations of the records found the majority did not occur in the phases as defined by this data sheet. In WOAD, “construction” can cover temporary work on the platform at any point in its lifecycle. Therefore it was necessary to review each entry to find relevant incidents. It was also found not to be possible to differentiate with confidence between the fabrication or construction phases of a project. Overall estimates of incident/accident frequencies for all phases are given in Table 5 along with the assumptions underlying the estimates. The relevant entries from WOAD are listed in Tables 6 and 7. Table 5: Summary of WOAD search [4] Type

Concrete

Jacket

Note 1:

Note 2:

Note 3: Note 4: 13/06/2003

Area

Number of reported incidents (in WOAD)

Estimated population

Fabrication or Construction phases

Installation phase

Total

North Sea (ENS) Other

3

1

4

36

1

-

1

300

North Sea (ENS) Other

3

8

11

320

2

9

11

5850

3

4

1

Estimated frequency of incident/acci d. (per project)

-1

1 x 10

2 1

2

-3

3 x 10

-2

3 x 10

-3

1 x 10

Based on total of 290 fixed units installed in North Sea, 1975-91 [WOAD]. Assumptions: - 90% jacket, 10% concrete - approximately 10 units installed per year in period 1970-74 - approximately 5 units installed per year in period 1991-95 Based on total of 4155 fixed units installed worldwide, other than North Sea, 1975-91 [WOAD]. Assumptions: - 95% jacket, 5% concrete - approximately 250 units installed per year in period 1970-74 and 1991-95 Two incidents reported in the fabrication/construction of the Sleipner jacket Three incidents reported in the installation of the Platform SA FABRI.DOC

Page 9


Table 6:

Rev 0

List of Accidents to Concrete Structures, Worldwide, 1970-1995 [4]

Name SLEIPNER, 15/9,A

Date 910823

STATFJORD, 33/9A,A

780225

GULLFAKS, 34/10,A

851108

GULLFAKS, 34/10,B

851104

13/06/2003


Description Water intrusion into one of the drillshafts caused the sinking of the 600,000 tons concrete base of Sleipner 'a' platform. 22 workers onboard were evacuated when the water flooding started. 15 mins later the base sank in water 200 m deep. The base was crushed against the sea bottom and destroyed. Investigations have revealed that the concrete base in some places was underdesigned and hence not able to support the exposed loads. Three separate mistakes led to the sinking: 1: design forces in cracked areas were underestimated; 2: reinforcing steel in those areas was incorrectly designed; 3: some joints were not separately designed. The accident may delay startup of the Sleipner field and it would take approx. 12-15 months to build a new gravity base structure. Insurance claims worth NOK2.3 billion arising from the loss of the platform was settled in October 1993. This sum covers a new base structure, outfitting lost with the original, the cost of temporarily storing the topsides and additional hook-up work. The amount will be covered by insurance companies Vesta (Norway) and Lloyd's of London. During installation of platform four workers were doing welding and grinding at the 49.5 m level of the utility shaft. A liquid surface was 2 m below the workers. Protective coating was added to the water from time to time. Diesel was trapped on top of the surface. Probably due to breakage of acetylene hose a sudden fire ignited the diesel and heavy smoke and fire developed. Air hose to grinding tool was probably melted and escaping air fed the fire. Escape stair tube behaved as a chimney with high flame intensity. 2 men tried to escape by elevator, but this stopped probably due to optical endstop switches activated by heavy smoke. One man was found in the control room, an other at the 49.5m deck. The only man wearing a breathing apparatus was found at 55.5 m deck with only 5 min emergency air left. The smoke divers were forced back at the 61.5m level due to the strong heat. Water from hoses and deluge system cooled down heat and the fire was under control after about 2 hours. Steel shock absorbers between the 41.000 ton deck and the legs failed and the deck started tilting. The deck was evacuated. The deck was raised 0.02 m during a 10 hour successful jackup operation Nov.11 and the shock absorbers were replaced by steel plates so that weight was evenly distributed on the four legs. Work was then resumed. The barge 'CONCEM' was offloading cement into the Gullfaks “C” platform during slipforming when barge capsized and sank (ref accident id. No 8601100). The barge's 10m high construction tower struck platform and containers on barge's deck clipped side of platform base and caused damage to riser supports. Additional damage resulted from power failure which affected slipforming equipment on platform.

FABRI.DOC

Area ENS

Phase C

ENS

I

ENS

C

ENS

F

Page 10


NINIAN NORTH, 3/3, CENTRAL

13/06/2003

761006


The concrete batching plants barges "no. 3" and "no. 4" and generator barge "H.D. barge no. 3" ranged against fendering of the partly constructed platform (see accident id. Nos. 9403113, 7610141 and 9403112, respectively). The platform suffered damage to temporarily installed anti-scouring fenderings and water ingress. No further info available.

FABRI.DOC

Rev 0

EUW

F

Page 11


Table 7:


List of Accidents to Jacket Structures, Worldwide, 1970-1995 [4]

Name UNKNOWN, TRINIDAD JACKET TYRA,5504/6.2, TE-E VALHALL,2/8A, PCP

Date 750312

BRUCE,9/8A,D

920113

CHEVRON JACKET UNKNOWN SAMAAN

860714

FRIGG,10/1,DP1

741025

EKOFISK,2/4,A

730205

PLATFORM SA

800816

PNT ARGUELLO 316,HERMOSA

851204

PLATFORM SA

800417

13/06/2003

Rev 0

820225 810700

740606

Description Jacket on barge '299'. Delivery to Amoco Trinidad oil co.. during launching, the jacket slipped off the barge and subsequently floated in an angular position. Platform was to be launched in sheltered water due to prolonging storm. It was under way to be installed when interrupted by storm. Damage to jacket due to storm during tow out.

Area ACE

Phase C

ENS

I

During installation of the jacket in July 1981, a pile hammer was accidentally dropped on the east side of the jacket. An investigation survey by use of rov showed no damage to jacket structure. During an annual underwater insp. In June 85,a puncture in the subject diagonal was revealed during close visual inspection. The repair offshore is scheduled to start mid-September 85. An explosion occurred to the drilling platform under construction at the Eiffel yard at St.. Louis du Rhone near Fos (Marseille). The explosion occurred in one of the mud tanks. It is speculated that inflammable gas built up in the tank during the weekend and was ignited when normal construction activities restarted Monday morning. The walls of the module and the scaffolding were hit by the blast. BP states that the accident did not affect the schedule for the project. The platform installed by Brown & Root tipped over while the structure was being set. The incident was believed to be caused by a hole left in the seafloor where the drilling rig had been. The jacket was uprighted and there was no damage. Barge 'MM 151' transporting platform overturned and sank. No attempts to recover jacket.

ENS

I

ENS

C

AGM

I

ACE

I

The buoyancy tanks failed as the platform was tilted from a horizontal to a vertical position about 3 km from the installation site. A new 20 mill usd platform is under construction. Field production delayed about one year. Platform was refloated July 7 1975. Will be used for other purposes Half the deck section dropped into the water. The wire broke while lifting the deck section from the building site to the pontoon for transport to Ekofisk. Repaired March 22,expected cost several million NOK. Accident occurred when deck was lifted from barge to place it onto the jacket. There were two unsuccessful attempts, and in each attempt the ropes gave way resulting in damage to the barge in the first and to the deck in the second Repairs will be handled locally. Jacket contacted lock in Panama canal during voyage from Morgan city to port Hueneme loaded on barge "450-10". One gantry crane needs to be renewed, two turbo generator casings reconditioned and partly renewed, 2 sets of electric conduits and one air winch clutch renewed. Repairs deferred. Jacket fell into sea while being fitted onto leg of rig.

ENS

I

ENS

I

AIS

I

ANW

C

AIS

I

FABRI.DOC

Page 12



PLATFORM SA

800111

NORTH RANKIN,A

820609

OSEBERG 2,30/6,C

900899

MAGNUS,211/12, PRODUCTION

820401

LOGGS GGS, ACCOMMODATION GRAND ISLE,102

870517

GOODWYN A

921099

HEATHER,2/5,A

770601

HARRIET B

860626

SLEIPNER,15/9,A

920514

SLEIPNER,15/9,A

920809

13/06/2003

931027

Rev 0

The jacket of the "platform SA" sank while it was launched at Bombay High oilfield. Mishap probably due to a leakage in the compressor system at the time of the mechanical launching. Jacket was salvaged with the help of cranes and divers and was then installed at the site. Damage to valve removal track during launching.

AIS

I

AUW

I

During piling of the platform, brace no. 7015 was dented. The damage does not affect platform integrity in the period until installation of modules in spring 1991.Corrective actions have been taken. Installation of the 40000 tonne structure halted because several steel piles fell off the structure altering the balance of the structure. The piles were needed to secure it to the seabed. The piles were discovered 100 yards clear of the platform target location. The platform was finally sited on Magnus field Apr. 4. One of the newest offshore platforms may have to be cut from the seabed by explosive charges. During piling work severe vibrations caused damage to the jacket. The pile-driving equipment broke down. A substitute pile-driver proved to be too powerful for the piles needed. During installation the platform jacket toppled. Certain problems with the jacket's mud mats and inclement weather were encountered during the installation. The jacket is being surveyed for damage. It is expected that the jacket will be salvaged and reinstalled after being repaired at the fabrication yard of "gulf island fabrication" in Houma. During installation of the platform, the pile foundations (20 off, 130 m long),which were to secure the platform to the sea floor, were damaged. After sinking through a soft layer of sand, the piles were supposed to pierce into a thin layer of rock before sinking further into bedrock. However, the piles did not pierce neatly through and were bent and buckled approximately 86 m below the sea bed. A programme aimed at repairing the piles was started immediately so that the topsides installation, hook-up and commissioning could proceed. Initial production is set to October 1994, one year later than expected. Suffered damage during piling operation when a steel pile was accidentally dropped, striking one of the "bottle" legs and fracturing pile sleeves. Production delayed probably six months (to February 1978). The deck structure of Harriet B tilted apx. 20 deg. on barge Intermac 256. Towed to shallow water for safety. The barge's deck received some holes. Salvage required a giant derrick barge and salvage cost estimated to USD1mill. Value of monopod cargo of 350 tonne is US$4 mill. The Aker Verdal yard experienced a construction accident during assembly of the platform jacket. The accident occurred during roll-up and lifting of the upper part of the "row 2" jacket frame (weight 700te). One of the two lift slings parted and the frame leaned slowly over and stopped at a 450 .Angle without hitting "row 1". No injuries or damage. A fire occurred in a 440v emergency switchboard. The fire did not hamper the completion of the platform. The replacements and repair work were completed during September.

ENS

I

ENS

I

ENS

I

AGM

I

AUW

I

ENS

I

AUW

I

ENS

F or C

ENS

F or C

FABRI.DOC

Page 13


3.2


Rev 0

Contributors to Major Accidents

From the combination of a shortfall in historical data and the need to gain insight into the causes of accidents, there stems a requirement for data on the failure modes which contribute to accidents. The nature of construction activities is such that systems will be in use, including temporary systems, which could fail and contribute to accidents. For example, temporary power generation consisting of temporary fuel tanks linked to generators via hoses, could leak fuel and initiate a fire. Although the failure of all such systems is of concern to a QRA analyst, this section focuses on systems which are synonymous with construction activities and on data that may not be found in other data sheets. The failure data presented concern the frequency of overall system failure rather than component failures. Failure data at system level are most useful for a “first pass” QRA, with the function of gauging the overall risk level and estimating the relative contribution of specific activities. Data are provided for the following systems: • Dropped object frequencies • Mooring failure frequencies • Dynamic positioning failure frequency • Floating unit collisions with installations • Ballasting failure frequency • Weather window forecasting failure 3.2.1

Dropped objects frequencies

The types of lifts during these phases vary significantly. This section consists of: • Single heavy lifts • Tandem heavy lifts • Small lifts For a detailed analysis of historical data for offshore lifting activities, see the datasheet on Mechanical Lifting Failures. 3.2.1.1 Single Heavy Lifts Table 8: Data on falling objects and crane failure for pedestal cranes Data Freq Comment Load droppage

Slippage

13/06/2003

11 per 106 hours (calendar time) 307 per 106 hours (operating time) 147 per 106 hours (calendar time) 4167 per 106 hours (operating time)

Diesel hydraulic driven pedestal cranes covering a total service time of 0.6482 x 106 hours calendar time or 0.0228 x 106 hours operating time. Number of failures - 7. Diesel hydraulic driven pedestal cranes covering a total service time of 0.6482 x 106 hours calendar time or 0.0228 x 106 hours operating time. Number of failures - 95.

FABRI.DOC

Ref 5

5

Page 14



Rev 0

These data should be used carefully for heavy lift cranes. First, most heavy offshore lifts take relatively more time than pedestal crane lifts. Since the most hazardous period is lifting off and touching down of the load (which only occurs once regardless of lift duration), the failure rates given above, expressed in operating hours, would overestimate the failure rate for heavy lift cranes. Furthermore, heavy lifts are subject to more stringent supervision than ordinary offshore lifts. 3.2.1.2 Tandem Heavy Lifts There is no known case of the dropping of a tandem heavy lift. This implies that the drop frequency is low or that the total number of tandem lifts to date is small. 3.2.1.3 Smaller Lifts (e.g. lifting of piles, hammers, modules, etc.) The number of minor lifts per North Sea platform depends on the platform type. For a typical jacket, the number of minor lifts would be some 20 to 32. Additionally, add-ons and hammers would have to be handled by the cranes. The number of minor lifting operations per platform is therefore estimated to be on the order of 100. Using data from one company, the minor dropped object frequency is estimated to be in the range of 10-4 to 10-5 per lift. [17] 3.2.2

Mooring failure frequencies

3.2.2.1

Moored at a quay

The construction and installation phases can include the transfer of components to and from barges moored at the quayside. Failure data are found in the table below. Table 9: Failure rate data for mooring failure at a quay Data

Freq

Tankers moored at a jetty 3.2.2.2

-5

3 x 10 per visit

Comment

Ref

Number of mooring lines unknown

6

Mooring/anchor lines at the installation site

Single mooring line failure Table 10: Single mooring line failure Data

Freq

Comment

Ref

Failure of a single mooring line

0.18 per year

Derived from mooring line failures for rigs classified with DNV during 19821986

7

Multiple mooring line failure If the unit is moored alongside a platform, multiple anchor line failure is a necessary precursor to a unit-platform collision. A multiple anchor line failure is always induced by a single anchor line failure. 13/06/2003

FABRI.DOC

Page 15



Rev 0

Table 11: Multiple mooring line failure Data

Freq

Comment

Ref

multiple anchor line failure

3

2 x 10/year

Event tree analysis using failure rate of 0.18 per year for single mooring line

7

3.2.3

Dynamic positioning failure frequency

Mooring Assist Systems (APM) are also included with Dynamic Positioning Systems (DPS). WOAD [8] gives various failure data for mobile units, e.g., drilling ships, drill barges, submersibles, semi-submersibles etc. A total of 431 accidents with mobile units occurred worldwide between 1970 and 1989 [8]. Of these incidents 102 accidents (24%) took place during transfer, with the remainder (329) while the unit was on location (e.g during drilling or production, providing supporting or accommodation facilities). Of the 329 incidents while on location, 130 can be related to the positioning system - 26 categorised as involving a machinery malfunction, 104 involving some other form of failure. Further analysis of these two categories is provided in tables 12 & 13. Table 12: "Machinery Malfunctioning", i.e. propulsion or pumping machinery failure, from WOAD [8] Data Freq Comment Ref Some form of accident due to machinery malfunction Major damage/loss due to machinery malfunction Minor damage due to machinery malfunction

-3

3 x 10 per unit-year -3

1 x 10 per unit-year -3

1 x 10 per unit-year

The total number of accidents worldwide in the period 1970-1989 is 26, of which 23 can be classified as an initiating event Seven (7) of these incidents caused substantial damage or induced unit loss

8

North Sea data. Period 1980-1989. One event

8

8

The DoE [9] gives a frequency of reported failures of DPS for the period of 1980 to 1989 resulting in loss of position, i.e. movement outside the permissible range of deviation for the operation at hand. It is based on data for diving support vessels. A normalised annual frequency of failure per vessel between 1.5 and 2.0 is quoted. Some vessels have reported up to three incidents in one year. Almost half (46%) of the reported incidents have operator error identified as the primary cause. One third (33%) have position reference or computer failure as the primary cause, 21% have failure of vessel systems including thrusters, power generation or power supply as the initial cause.

13/06/2003

FABRI.DOC

Page 16



Rev 0

Table 13: "Off Position", i.e. a mobile unit out of its expected position or drifting out of control, but not categorised as due to machinery failure, from WOAD [8] Data

Freq

Off position incident


Total loss of the unit, or severe and significant damage to the unit due to off-position Significant damage


3.2.4

-3

-3

-3


Comment

Ref

The number of off position accidents worldwide between 1970 and 1989 is 104 over 8587 unit-years. Of these incidents only 25 were initiating events (the remaining incidents were the outcome of another incident) Of the 25 cases above only 15 involved total loss of the unit, or severe and significant damage

8

North Sea data. Period 1980-1989 (823 unit-years). One initiating event out of 18 incidents

8

8

Floating unit collisions with installations

Various types of floating units can come in close proximity to the structure during the installation phase. A collision has consequences for personnel and the structural integrity. Table 14: Collision between mobile floating unit and fixed installation Data Mobile unit-fixed platform collision frequency, for second generation semi-subs Mobile unit-fixed platform collision frequency, for third generation semi-subs Flotel-platform collision for flotels with a mooring assist system Flotel-platform collision for flotels with a twelve-point passive chain mooring (i.e. no mooring assist system)

Freq

Comment

Ref

-

Estimate

10

-

Estimate

10

-

Estimate based on the combination of bad weather, mooring line failure, unfavourable wind direction, and unsuccessful remedial manoeuvring Estimate based on the combination of bad weather, mooring line failure, unfavourable wind direction, and unsuccessful remedial manoeuvring

11

2 x 10 /year

5

1 x 10 5 /year 4 x 10 6 /year

-

7 x 10 /year

5

11

Note: A semi-sub constructed in the early 1980s, based on the specifications developed following the Alexander Kielland accident, would be a typical second generation design. It is characterised by an eight point mooring system, a limited thruster capacity and a ballast system with a limited degree of redundancy. The main characteristics of the third generation semi-sub are a twelve point mooring line system, and a ballast system according to the latest NMD requirements.

13/06/2003

FABRI.DOC

Page 17


3.2.5


Rev 0

Ballasting failure frequency

The only known incident of a semi-submersible capsizing due to ballast system failure is the Ocean Ranger (1982). The crew of the Ocean Ranger failed to respond correctly after water had entered the ballast control room. Table 15: Ballasting Failure Frequency Data Data

Freq

Capsize frequency due to ballast system failure

5x10 / unit-year

Impairment of overall integrity for an eight column semi-submersible due to ballast system failures Severe damage (i.e. extreme listing or loss) for second generation semisubs Severe damage (i.e. extreme listing or loss) for third generation semisubs Human errors frequency for filling one ballast tank

4x10 / unit-year

Human errors frequency for filling two tanks erroneously

1x10 / operation

-4

-5

Comment

Ref

number of active semisubmersible years (i.e. 2080 years over the period 1970-89 fault tree and event tree analysis

8

12

-4

10

-5

10

1x10 / year 5x10 / year -5

6x10 / operation -6

Fault tree analysis showed importance of human errors for ballast system failure Fault tree analysis showed importance of human errors for ballast system failure

7

7

Note: A semi-sub constructed in the early 1980s, based on the specifications developed following the Alexander Kielland accident, would be a typical second generation design. It is characterised by an eight point mooring system, a limited thruster capacity and a ballast system with a limited degree of redundancy. The main characteristics of the third generation semi-sub are a twelve point mooring line system, and a ballast system according to the latest NMD requirements.

3.2.6

Weather window forecasting failure

A structure or vessel involved in marine operations can tolerate only a certain range of weather conditions. During construction or installation, the structure or vessel may be in a condition which makes it particularly vulnerable. For example, an un-piled jacket has a significantly greater sensitivity to environmental loads than when piled. If exposed to weather which exceeds the tolerable threshold, the structure or vessel could be adversely affected. In the extreme an asset could be damaged or even lost and/or fatalities incurred. The accuracy of weather forecasting decreases with the length of the forecast. Therefore, from the moment of commencing an operation the likelihood of the weather deviating from the forecast value increases over time.

13/06/2003

FABRI.DOC

Page 18



Rev 0

Recent research has quantified the accuracy of forecasting wave conditions in the North Sea [13]. The data presented in table below are for wave heights between 0 and 3m in the winter period. Table 16: North Sea Forecast Accuracy for 0-3m (Hs) Waves in the Winter Period Time since forecast (hrs)

13/06/2003

Likelihood of wave height exceeding the forecast value (%) 0.5 m exceedance

1 m exceedance

1.5 m exceedance

6

21.0

7.0

2.0

12

23.0

9.0

3.0

18

25.0

10.5

4.0

24

27.5

12.0

5.0

36

30.0

16.0

7.0

48

33.0

20.0

10.0

FABRI.DOC

Page 19


4.


Rev 0

REFERENCES

1.

UK Health & Safety Executive, The Offshore Installations and Wells (Design & Construction, etc) Regulations, 1996 No913.

2

Trbojevic V.M., Bellamy L.J., Brabazon P.G., Gudmestad T., Rettedal W.K., “Methodology for the analysis of risks during the construction and installation phases of an offshore platform”, J Loss Prev. Process Ind., 1994, Vol 7, No 4

3.

Institute of Offshore Engineering; “Offshore Accident Statistics, an analysis and review”, 1990, UKOOA

4.

Worldwide Offshore Accident Databank (WOAD) Search

5.

OREDA; "Offshore Reliability Data"; Hovik, Norway, 1984

6.

UK Health & Safety Executive, “Canvey, A Second Report, A Review of Potential Hazards From Operations in the Canvey Island/Thurrock Area Three Years After Publication of the Canvey Report”, 1978, HMSO.

7.

Department of Energy; "Comparative Safety Evaluation of Arrangements for Accommodating Personnel Offshore"; Report ref. OTN-88-175; December 1988

8.

Worldwide Offshore Accident Databank (WOAD); "WOAD Statistical Report 1990"; Hovik, Norway, 1990

9.

Department of Energy; "Dynamic Positioning Incidents 1980-1988", Prepared by Global Maritime Limited, Report no OTO-87-005; 1989

10.

J.E. Vinnem and B. Hope; "Offshore Safety Management (Theoretical Fundament and Practical Experiences)"; Trondheim, Norway, 1986

11.

Safe Offshore AB; "Bridge a Way to Safety"; Sweden, November 1988

12.

Risk Assessment of Buoyancy Loss (RABL), Report No. 3, Ship-MODU Collision Frequency, Siktec a/s, Trondheim, 1987

13.

Brabazon P.G., Hopkins J.S., Gudmestad O.T., “Estimating the likelihood of weather criteria exceedance during marine operations”, in press

14.

Data provided by E&P Forum Member

15.

UK Health & Safety Executive, Offshore Installations (Safety Case) Regulations, 1992.

16.

Norwegian Petroleum Directorate, Regulations relating to implementation and use of risk analyses in the petroleum activities. 4 December 1990.

17.

Data provided by E&P Forum Member

13/06/2003

FABRI.DOC

Page 20


13/06/2003


FABRI.DOC

Rev 0

Page 21

Process Release & Ignition


Rev 0

PROCESS RELEASE AND IGNITION

13/06/2003

PROCSREL.DOC

Page 1



Rev 0

TABLE OF CONTENTS

1. SUMMARY-------------------------------------------------------------------------------------------- 3 1.1 Scope --------------------------------------------------------------------------------------------------------------------- 3 1.2 Application -------------------------------------------------------------------------------------------------------------3

2. RELEASES ------------------------------------------------------------------------------------------- 4 2.1 Historical data ---------------------------------------------------------------------------------------------------------4 2.1.1 Location of leaks-------------------------------------------------------------------------------------------------------4 2.1.2 Source of Leaks --------------------------------------------------------------------------------------------------------5 2.1.3 Frequency of Major Releases ----------------------------------------------------------------------------------------8 2.2 Models for Prediction of Release and Dispersion---------------------------------------------------------------9 2.2.1 Models for Release Frequencies-------------------------------------------------------------------------------------9 2.2.2 Models for Dispersion from a Release --------------------------------------------------------------------------- 14

3. IGNITION -------------------------------------------------------------------------------------------- 10 3.1 Historical Data ------------------------------------------------------------------------------------------------------- 10 3.2 Probability of Ignition on Platforms ----------------------------------------------------------------------------- 12 3.3 Models for Prediction of Fire and Explosion Consequences ------------------------------------------------ 14 3.3.1 Models for Ignition -------------------------------------------------------------------------------------------------- 14 3.3.2 Models for Fire and Explosions ----------------------------------------------------------------------------------- 14

4. MISCELLANEOUS ------------------------------------------------------------------------------- 15 4.1 Vapour Cloud Explosions ----------------------------------------------------------------------------------------- 15 4.2 Research -------------------------------------------------------------------------------------------------------------- 23

5. REFERENCES ------------------------------------------------------------------------------------- 24

13/06/2003

PROCSREL.DOC

Page 2


1.

SUMMARY

1.1

Scope


Rev 0

This datasheet summarises information about the frequency of releases from hydrocarbon processing equipment and the ignition of such releases. It addresses frequencies based on historical data as well as by calculation and suggests frequencies which may be suitable for risk assessment.

1.2

Application

Existing hydrocarbon leak and ignition data are not very reliable. Quality data on a detailed level are scarce. There are many ways in which historical data may not match the particular platform under consideration. Some of the factors which may affect overall probability for release are: • • • • • • • •

-Engineering standards applied to critical items -Complexity of unit and process -Plant spacing and access -Maintenance standards and inspection/preventive systems -Overall grouping and spacing of functions -Age of equipment -Degree of process loading and other operating patterns -Quality of operating staff

This has been recognised by E&P Forum members who have set up a project to improve the data available for the industry. The project is expected to be operational; i.e. collection and distribution of data, in 1996. With a continuous data collection system it is expected that the E&P Forum database will make much improved data available for the industry within a few years. Application of the data presented in this datasheet poses the challenge of assessing the relevance of the data to the technology and operating condition of the case being reviewed or assessed.

13/06/2003

PROCSREL.DOC

Page 3


2.

RELEASES

2.1

Historical data

2.1.1

Location of leaks


Rev 0

The data of Table 2.1, based on UK North Sea experience, presents the proportion of releases in different sections of a platform. It can be used as guidance for other geographical regions, but does not take account of possible differences in process equipment and developments in technology, such as mechanical seals for gas compression which avoid potential for gas release in seal oil systems. Table 2.1 Leaks and ignition on production platforms. Location of leaks. References: [4] - E&P Forum member

Area of platform concerned (North Sea data)

19 2 23 3 26 2 2 23 ------100%

Well heads Drilling Separation/stabilization Gas processing Gas compression Risers Electrical Others

13/06/2003

Percentage of incidents

PROCSREL.DOC

Page 4


2.1.2


Rev 0

Source of Leaks

Table 2.2 Data, on equipment sources in the Gulf of Mexico, is from a comprehensive review by DNV. The review used actual event records. There is evidence of differences in descriptions in the reports which may be confusing. Table 2.2

Leaks and ignition on production platforms. Source of leak. References: [5] - (DNV Gulf of Mexico)

Incidents Number

Percent

Static equipment Leaks, internal release, venting Electrical Pipes/valves/leaks/rupture Spills

45 8 68 8

13.8 2.5 20.8 2.5

Subtotal

129

39.6

Rotating and fired equipment Engines Glycol equipment Generator/turbine generator (fuel system) Gas compressors (e.g. seals) Line heaters Pumps and special drivers Other equipment

12 17 11 43 5 16 29

3.6 5.2 3.7 13.2 1.5 4.8 8.8

Subtotal

133

40.8

Others Unknown Human error Kicks and blowouts Collision Overload/lifting device

22 24 14 3 1

6.7 7.4 4.3 0.9 0.3

Subtotal

64

19.6

Total

326

100

13/06/2003

PROCSREL.DOC

Page 5



Rev 0

E&P Forum intiated in 1990-92 a study on best available data for hydrocarbon leaks worldwide. The following table (Table 2.3), summarises leak frequencies from various sources. Table 2.3 Hydrocarbon release frequency data References: [10]- (Hydrocarbon leak and ignition data base) Equipment

Release frequency

Oil/gas well, development drilling phase

1.6E-03 per well drilled

Oil/gas well, completion phase

5.4E-04 per well completion

Gas well, production phase

1.4E-04 per producing gas well year

Oil well, production phase

4.6E-05 per producing oil well year

Workover on gas well

7.3E-04 per workover

Workover on oil well

4.0E-04 per workover

Gas compression, reciprocating

6.6E-01 per compressor year

Gas compression, centrifugal

1.4E-02 per compressor year

Pump, centrifugal

1.7E-02 per pump year

Pump, reciprocating

3.1E-01 per pump year

Pressure vessel

1.5E-04 per vessel year

Heat exchangers, shell and tube type direct shell leaks


tube rupture


Process piping, less than or equal to 3"

7.0E-05 per metre pipe year

Process piping, between 4" and 11" (inclusive)


Process piping, larger than or equal to 12"


Flange

8.8E-05 per flange year

Valve

2.3E-04 per valve year

Small bore fitting

4.7E-04 per fitting year

In Ref. [10] Hydrocarbon Leak and Ignition Database the data has been taken from both the onshore and the offshore industry. In the data base the events caused by improper operations (such as left open etc) have been left out when calculating the frequencies. The reference document provides probabilities on hole sizes in a leak situation.

13/06/2003

PROCSREL.DOC

Page 6



Rev 0

Another, more updated database [14] is available from the UK Health and Safety Executive, however, the data is limited to the UK continental shelf. Table 2.4 gives the percentage distribution of offshore leaks over the years 1992-95 broken down by system.

Table 2.4

Leaks - broken down by system type UK continental shelf References: [14]- The UK Offshore Hydrocarbon Releases (HCR) Database System type Nos. of events Percentage Drilling activities 48 7.7 Wells 33 5.3 Flowlines, oil included 27 4.3 Flowlines, gas 26 4.2 Manifolds 15 2.4 Separation, oil 42 6.8 Separation, gas 13 2.1 Processing, oil 32 5.2 Processing, gas 40 6.4 Utilities, oil 22 3.5 Utilities, gas 60 9.7 Gas compression 100 16.1 Metering 19 3.1 Export, oil / condensate 57 9.2 Export, gas 15 2.4 Import 19 3.1 Drains 24 3.9 Vent/flare 28 4.5 Blowdown 1 0.2 Total 100 The total number of releases (events) in the database is 621; grouped into 19 system types. It should be noted that the figures still are preliminary and cover the the period 01.10.92 to 31.03.95.

13/06/2003

PROCSREL.DOC

Page 7


2.1.3


Rev 0

Frequency of Major Releases

The rates for leakage from process equipment quoted below are based on broad figures proposed by consultant organizations. Consultants use different methods, but often arrive at similar results for the predicted frequency of major hydrocarbon release in a given development. The user will find that pipework releases dominate such calculations. The large variations in suggested equipment leakage rates are relatively insignificant. It is often helpful to verify physical effects for a range of possible leak sizes and relate consequences to the possible duration of a release based on inventory assessment. Whether allowance is made for blowdown is a decision for the responsible engineer in each case. Table 2.5 References:

Frequency of major releases from process equipment/pipework [9]- DNV Technica, ARF Technical Note T5 Annual frequency of leaks Comments

Small leaks 0.1-1 kg/sec 7 mm

Medium leaks 1-10 kg/sec 22 mm

Large leaks >10 kg/sec 70 mm

Valves < 2" > 2"

6.13 x 10-4 6.13 x 10-4

2.62 x 10-4 1.51 x 10-4

0 1.11 x 10-4

Flanges < 2" > 2"

3.96 x 10-4 3.96 x 10-4

1.31 x 10-4 9.79 x 10-5

0 3.26 x 10-5

Process piping > 2"

1.14 x 10-5

2.82 x 10-6

1.31 x 10-6

Instrument connections/small bore fittings < 3/4" > 3/4"

1.64 x 10-5 1.35 x 10-4

4.08 x 10-4 1.87 x 10-4

0 0

Pressure vessels

0.89 x 10-4

1.3 x 10-4

1.5 x 10-4

Excluding all valves, piping, fittings beyond the first flange and the flange itself

Centrifugal pumps

2.49 x 10-2

1.27 x 10-3

1.11 x 10-4


Heat exchangers

5.8 x 10-3

6.8 x 10-3

6.81 x 10-3


Centrifugal compressors

1.65 x 10-2

8.42 x 10-4

1.03 x 10-4


Leak category Leak rate Typical hole size Equipment

Including flange joints

Excluding any flanges and valves

A pipe section is defined as a length of pipe with two welds and three flanges. The application of this to estimating release frequencies requires judgement. If the data areavailable, an approach by counting flanges is more transparent, but also rather time consuming. Given potential variations resulting from different fabrication, installation and maintenance, it may be questioned whether additional effort will be reflected in the accuracy of the final results. 13/06/2003

PROCSREL.DOC

Page 8



Rev 0

The leak sizes described as medium and large are given typical sizes of 860 mm2 (33 mm dia) and 4300 mm2 (74 mm dia) respectively.

2.2

Models for Prediction of Release and Dispersion

2.2.1

Models for Release Frequencies

The release frequencies given in table 2.5 and other sources are normally based on historical failure data for a given population combined with use of expert judgement. The release frequencies from any particular type of mechanical equipment are normally regarded as constant for the time period covered by a risk analysis.

13/06/2003

PROCSREL.DOC

Page 9



3.

IGNITION

3.1

Fire/Explosion: Historical Data

Rev 0

Historical data for ignitions (fire and explosion) on offshore production and processing installations are shown in Table 2.1. Table 3.1

Typical frequency of process release and ignition for offshore production and processing

Type of Event

Facility Type

Area

Ref.

Rate (x10-3 unit yr)

All fires/explosions

fixed floating

Worldwide Worldwide

A A

Significant release Ignited release

fixed fixed

UK North Sea UK North Sea

B B

2 600 250

Fires Explosions

fixed fixed

UK North Sea UK North Sea

C C

280 50

All fires/explosions Severe fires/explosions

fixed fixed

Norw.+UK North Sea Norw.+UK North Sea

D D

180 6.5

All fire/explosion

fixed

Gulf of Mexico

E

20

Fires/explosions (severe local damage)

fixed

Gulf of Mexico

E

1.2

Fires/explosions (severe platform damage)

fixed

Gulf of Mexico

E

0.4

Fires/explosions (platform lost)

fixed

Gulf of Mexico

E

0.1

3.7 13

References: A - [2]- WOAD (1990); B - [4]-E&P Forum member; C - [6]- Ashmore; D - [8]- Veritec; E - [5]- DNV Gulf of Mexico Because WOAD collects data from public domain reports it is judged that it will be biased towards major accidents (i.e. minor accidents will not feature in newspapers or radio/TV reports). The values in Table 3.1 should therefore be used as global values, applicable to large integrated platforms. Another source of global data is shown in Table 3.2 ([1]- E&P Forum member), which shows the difference between old and modern installations, as well as various platform sizes.

13/06/2003

PROCSREL.DOC

Page 10


Table 3.2


Rev 0

Fire/explosion frequency by installation type No of fires/ explosions

Platform years

Fire/explosion per platform-year

Large, oil, pre 1980 Large, oil, 1980-90 Gas complex Small integrated Unmanned

13 1 1 1 0

264 81 300 170 245

0.049 0.012 0.003 0.006 <0.004

Total

16

1060

0.015

Platform type

Table 3.3 presents number of fires and explosions for different categories of platform damage, for fixed and mobile installations, for North Sea and Gulf of Mexico, for the period 1980-93, ([3]- DNV, 1994). Table 3.4 [3] presents the number of platform years, and the resulting frequencies, for mobile units, whereas unit years for fixed units are not available. Table 3.3

Number of fires and explosions for fixed and mobile installations, North Sea and Gulf of Mexico, 1980-93

Type of unit and geographical area

Number of fires/explosions causing damage Total loss

Severe damage

Significant damage

Minor damage

Mobile units North Sea Gulf of Mexico

6 32

11 34

48 84

50 42

Fixed units North Sea Gulf of Mexico

2 7

3 78

58 52

152 77

13/06/2003

PROCSREL.DOC

Page 11


Table 3.4

Rev 0

Platform years and damage frequencies due to fires and explosions for mobile installations, North Sea and Gulf of Mexico, 1980-93

Type of unit and geographical area

Mobile units North Sea Gulf of Mexico

3.2


Platform years 1980-93

1264 2126

Damage frequency due to fires/explosions

Total loss

Severe damage

Significant damage

Minor damage

0.0047 0.0151

0.0087 0.0160

0.038 0.040

0.040 0.0198

Probability of Ignition on Platforms

Table 3.5 presents distribution of ignition sources, based on worldwide statistical data ([3]- WOAD 1994) for 73 cases of ignition on fixed installations. Table 3.5

Distribution of ignition sources

Ignition type

Percentage

Electrical equipment

9%

Hot work

39%

Rotating machinery

26%

Exhaust

17%

Ignition by rupture

9%

Total

100 %

Table 3.6 presents ignition probabilities for leaks on North Sea platforms [2] and Gulf of Mexico platforms compared with worldwide blowouts. The leaks are small (approx. 1 kg/sec), and the number of platforms may be somewhat limited. Table 3.6

Probability of ignition of small leaks on North Sea and GoM platforms

Release type Ignition probability Worldwide blowouts 0.3 North Sea platform leaks Small gas leak 0.005 Small oil leaks 0.03 GoM platform leaks Gas 0.8 Oil 0.07 Ref. [10] Hydrocarbon Leak & Ignition Database The data from the Gulf of Mexico are thought to overpredict the ignition probability, because unignitied releases where no harm is done are likely to be under-reported. The statistics on blowouts and the data on two offshore North Sea platforms are considered to be complete. 13/06/2003

PROCSREL.DOC

Page 12



Rev 0

The UK Health and Safety Executive started collection of ignition data as part of its Offshore Hydrocarbon Release (HCR) Database in 1992 [14]. The database is based on collection of data over the period 01.10.92 to 31.03.95. The figures, being still preliminary, are as follows: Table 3.7 Reference:

Ignition distibution - UK shelf [14]- The UK Offshore Hydrocarbon Release (HCR) Database

Non-process ignitions 31

Oil ignitions 6

Condensate ignitions 4

Gas ignitions 18

Two-phase ignitions 0

The total number of ignitions are 59, or approximately 9 % of all releases (total 621). Table 3.8 presents ignition probabilities for gas and oil releases, for a range of release sizes. Table 3.8 Reference:

Probability of ignition of a hydrocarbon release on large integrated platforms (North Sea) [7]- Technica riser studies (1990) Typical probability of ignited gas releases (large integrated platform)

Location of release Large (in a module) Medium (in a module) Small (in a module) Riser above sea (jet) Subsea

Massive gas release (> 20 kg/sec)

Major gas release (2-20 kg/sec)

Minor gas release (< 2 kg/sec)

0.439 0.364 0.256 0.168 0.443

0.114 0.105 0.043 0.026 0.130

0.012 0.030 0.005 0.043

Typical probability of ignition of gas releases (bridge linked platform) Location of release Lower deck (Riser above sea Subsea

Massive gas release (> 20 kg/sec)

Major gas release (2-20 kg/sec)

Minor gas release (< 2 kg/sec)

0.046 0.078 0.140

0.006 0.013 0.051

0.001 0.002 0.002)

Typical probability of ignition of oil releases (calculate gas flash and treat as gas release) Location of release Module Riser above sea Subsea

Massive oil release (> 20 kg/sec)

Major oil release (2-20 kg/sec)

Minor oil release (< 2 kg/sec)

0.121 0.051 0.005

0.091 0.009 0.001

0.003 0.003 -

Probabilities of ignited gas releases associated with releases from risers, subsea installation and pipelines are also given in the data sheet on Risers and pipelines. It follows that statistics associated with risers etc. should be verified with both Table 3.8 and that Datasheet.

13/06/2003

PROCSREL.DOC

Page 13



3.3

Models for Prediction of Fire and Explosion Consequences

3.3.1

Models for Ignition

Rev 0

The minimum ignition energy for different flammable gases differs significantly, but for Methane, Ethane, Propane and other relevant natural gases these energies are generally low. Sparks generated from static electricity may therefore easily ignite a flammable gas cloud. Hot surfaces and open flames are other potential ignition sources. Ignition models include these and other sources and they are based on experimental data combined with expert judgement. Several computer programmes include models for ignition of flammable gases and liquids. The models are based on theoretical assessments and, only to a minor extent, empirical data. The prediction of ignition probabilities as a function of gas dispersion, reflecting the equipment and activities in the areas, is uncertain and in considerable need of more refined modelling. A Joint Industry Project carried out by DNV Technica (N), Scandpower (N), AEA Technology (UK) and COWIconsult (DK) is directed at improvement of the modelling in this field. The project is scheduled to be complete at the end of 1996. It is expected that the historical data for ignitions will improve when the E&P Forum project on HC leak and ignition data collection is further progressed. [10] [11] [12].

3.3.2

Models for Fire and Explosions

As for dispersion, there are several models for fire and explosion calculations. For fire calculations the models cover jet fires, fireballs (BLEVEs), pool fires, flash fires etc. For explosion calculations, there are also several models depending on physical or chemical energy sources, and for gas explosions (deflagration, detonation). There are several computer programmes that can calculate fire and explosion phenomena based on the above mentioned types. The models used by the programmes include simple models of the release phenomena, to detailed state of the art Computational Fluid Dynamics (CFD) calculations.

3.3.3

Models for Release Consequence Analysis

When modelling accidental releases the most critical step is to estimate the amount released per second and the dependence of the release rate with time. The nature of the release will depend on the state of the material within the containment; gaseous, 2-phase, liquid, a boiling liquid or sub-cooled liquid. The dispersion of jet releases, plume releases, area sources and instantaneous releases are calculated using models specific to the mode of release and the density of the gas. Models of evaporation from a pool on the ground or spill on water are also available. The released substance can either be flammable or toxic or both. Reference [13], (pages 431-439) gives further explanation of parameters which affect dispersion. There are several computer codes that can calculate dispersion based on the above mentioned release types. The models used by the computer codes include simple to detailed models of the release phenomena, and state of the art CFD calculation.

13/06/2003

PROCSREL.DOC

Page 14



4.

MISCELLANEOUS

4.1

Vapour Cloud Explosions

Rev 0

Table 4.1 Vapour cloud explosions 1920-1985 (onshore) [13] Material involved Methane LPG Petroleum Spirit Propane Butane Others Circumstances Incidental release Operational release Ignition source Permanently present Incidentally present

Number of cases 167 46 39 35 30 93

Percentage 41 11 10 9 7 22

Causes Leakage Careless handling Bursting/rupture Continuous Instantaneous

Percentage 27 22 44 1 6

Normally expected Not expected Normally expected Not expected

49 3 44 4

Delay before ignition Delay time (min) <1 1-5 6-15 16-20 >30 Unknown

Percentage 19 40 12 5 6 18

Drift distance (m) <100 100-1000 >1000

58 38 4

The table is based on a total of 410 vapour clouds explosions forming a database covering onshore incidents in the period 1920-1985. The incidents were selected on the basis of causing serious material damage due to explosion (not just flash fire). The data indicates that most explosions ignite early and that delayed ignition reduces the likelihood of an explosion. However, delay does not by itself eliminate the chance of a vapour cloud explosion, as some explosions have been ignited over 1 kilometre from the vapour source.

13/06/2003

PROCSREL.DOC

Page 15



Rev 0

Table 4.2

Release and dispersion Outflow calculations, typical for organic liquids and for vapour methane and propane

Reference

FRED 2.2 software package (Liquid/Vapour outflow from a hole)

The calculations include several assumptions and parameters: CH4: Cp/Cv = 1.31 C3H8:

Cp/Cv

= 1.13

m

= 16 kg/kmol

m

= 44 kg/kmol

CD

= 0.8

CD

= 0.8

t

= 25 °C

t

= 25 °C

CD

= 1000 kg/m3 = 0.61

CD

= 700 kg/m3 = 0.61

Head

=5m

Head

=5m

Liquid 1:

Liquid 2:

Caution: pressure in bara Do not use the values given in this table for design! Source Pressure [bara]

Release rate [kg/s], steady state for release hole sizes in [inches] Liquid 1 Liquid 2 Vapour CH4 =1000 =700 1"

2"

1"

2"

1"

Vapour C3H8 2"

1"

2"

2

5.3

21.

4.4

18.

0.14

0.55

0.22

0.87

5

9.2

37.

7.7

31.

0.34

1.4

0.54

2.2 4.3

10

13.

54.

11.

45.

0.69

2.8

1.1

25

22.

86.

18.

72.

1.7

6.9

2.7

11.

50

31.

123.

26.

103.

3.4

5.4

22.

14.

75

38.

151.

32.

126.

5.2

21.

100

44.

174.

36.

146.

6.9

28.

11.

8.1

43.

32.

125

49.

195.

41.

163.

8.6

34.

14.

54.

150

53.

214.

45.

179.

10.

41.

16.

65.

175

58.

231.

48.

193.

12.

48.

19.

76.

200

62.

247.

52.

207.

14.

55.

22.

87.

Notes 1

The calculations shown in Table 4.2 are from the FRED package, release 2.2 , a non commercial PC based package. FRED stands for 'Fire, Release, Explosion, Dispersion' and is a suit of validated PC based physical effects models.

2

The calculations indicate the scale of release for a given hole size (Table 4.2) and the potential size of the resulting flammable zones (Table 4.3). They should not be used as a basis for engineering; the specific calculations appropriate to a given engineering situation should be calculated on a case specific basis.

13/06/2003

PROCSREL.DOC

Page 16



Rev 0

Table 4.3

Release and dispersion Distance to LFL in open air plume

Reference

FRED 2.2 software package (AEROPLUME: Jet dispersion model from Shell HGSYSTEM)

The calculations include several assumptions and parameters: CH4: LFL = 53,000 ppm C3H8: m

= 16 kg/kmol

LFL

= 22,000 ppm

m

= 44 kg/kmol

Ambient Temperature Humidity

20 °C 70 %

Reference Height Sample Time

10 m 18.75 seconds

Surface Roughness

0.3 m

Reservoir Pressure

1.2 bara

Release Height

10 m

Reservoir Temperature

20 °C

Note: Release is oriented downwind for worse case Hole size is minimum for required mass flow rate Do not use the values given in this table for design! Mass Flow

Hole Size

Rate

[mm]

Distance to LFL [m] Methane 2D

5D

Hole Size 2F

1 1.5

90.7 111

9 11

9 11

10 12

2

128

13

12

14

3

157

15

15

4

181

17

5

203

6 7

[mm] 73.1 89.5

Distance to LFL [m] Propane 2D

5D

2F

10 12

10 12

12 14

103

14

14

16

17

127

17

16

20

17

19

146

19

18

22

19

18

21

163

22

20

25

222

21

20

23

179

23

22

27

240

23

21

25

193

25

23

29

8

256

24

22

26

207

27

24

31

9

272

25

23

28

219

28

26

33

10

287

27

25

29

231

30

27

34

12.5

321

30

27

33

258

33

29

38

15

351

32

29

36

283

36

32

41

17.5

379

35

31

38

306

39

34

44

20

405

37

33

41

327

41

36

47

30

497

44

39

49

400

50

42

57

40

573

51

45

56

462

57

48

64

50

641

56

49

62

517

63

52

71

75

785

68

58

75

633

92

62

102

100

907

78

66

86

731

115

78

125

Notes 1

In the calculations in Table 4.2, the reference height was 10m for the source, and the distances given are centre-line distances.

13/06/2003

PROCSREL.DOC

Page 17



Rev 0

Table 4.3

Release and dispersion Cloud dimensions of a dense propane vapour cloud

Reference

FRED 2.2 software package (HEGADAS: dense gas model from Shell HGSYSTEM, steady state)

The calculations include several assumptions and parameters: Air Temperature Gas Temperature 20 °C

-42 °C

Surface Temperature

20 °C

Specific Heat

106 J/mol K

Humidity

70 %

Molecular Weight

44 kg/kmol

Surface Code

3 (land with heat exch.)

Reference Height

10 m

Surface Roughness

0.3 m

Sample Time

Instantaneous

LFL conc.

22,000 ppm

Heat Group for nat conv

29.00

Do not use the values given in this table for design! Source Dimension Rate

Cloud dimension, for LFL contour [m] 5D Length

2F

[m]

[kg/s]

Half width

Length

Half width

2.2 5

1 5

13 31

5 12

21 54

36 85

7.1

10

45

17

80

120

11.2

25

76

27

137

200

15.8

50

112

39

204

290

Notes 1

In the presented calculations of heavy gas dispersion the basis is a pool of propane at atmospheric boiling point evaporating from a free pool. This is a very conservative estimate of the evaporation rate. For a more accurate evaporation rate calculation other models are available.

2

Dispersion and mixing in confined spaces with equipment, such as an offshore module, will follow more complex mechanisms. In general turbulence round equipment would accelerate mixing. However, pockets of air may also be formed where air movement is limited and mixing will be slow. These effects can be studied in a wind tunnel or using computer models.

3

In the table, 5D and 2F refer to the windspeed (metres per second) and Pasquill stability class (A through F)

13/06/2003

PROCSREL.DOC

Page 18



Rev 0

Table 4.4

Release and dispersion Effect of stability on dispersion/dilution of methane Distance to LFL with different stabilities.

Reference

FRED 2.2 software package (AEROPLUME: Jet dispersion model from Shell HGSYSTEM)

The calculations include several assumptions and parameters: Ambient Temperature Gas Temperature 20 °C

-42 °C

Humidity

70 %

Reservoir Pressure

1.2 bar

Wind Speed

2 m/s

Reservoir Temperature

20 °C

Surface Roughness

0.3 m

Reference Height

10 m

LFL conc.

53,000 ppm

Sample Time

18.75 seconds

Release Height

10 m

Note: Release is oriented downwind for worse case Hole size is minimum for required mass flow rate Do not use the values given in this table for design! Pasquill stability

[kg/s] 1

5

class

10

50

Distance to LFL [m]]

A B

8 9

17 18

23 25

45 50

C

9

20

27

56

D

9

21

28

57

E

10

21

28

57

F

10

21

30

62

Notes 1

Table 4.4 shows the magnitude of stability effects on dispersion distance for methane. Class D is by far the most common condition outdoors in the UK. Other conditions can always occur but they generally (but not in all cases) have only a slight effect on predicted dispersion distances.

13/06/2003

PROCSREL.DOC

Page 19


Table 4.5 Reference


Rev 0

Typical flame sizes for ignited releases of process hydrocarbon FRED 2.2 software package (Shell Research model for gas flare radiation)

The calculations include several assumptions and parameters: Gas Composition 80% Methane

10% Ethane

6% Propane

4% Nitrogen

Ambient Temperature

20 °C

Humidity

70%

Fuel Temperature

20 °C

Release Height

10 m

Note: Release is oriented downwind for worse case Do not use the values given in this table for design! 2 inch diameter hole Mass Flow Rate No Wind [kg/s] Length 1 15.1 5 28.0 10 37.4 20 50.2 100 100.2

Vertical Wind=5m/s Length Width 8.4 2.6 15.7 4.7 20.9 6.2 28.0 8.2 56.0 16.6

No Wind Length 11.9 22.3 29.6 39.5 77.8

Horizontal Wind=5m/s Length Width 12.9 1.6 23.3 3.0 31.0 4.1 41.5 5.9 82.2 13.5

6 inch diameter hole Mass Flow Rate No Wind [kg/s] Length 1 20.7 5 33.2 10 41.2 20 53.4 100 103.1

Vertical Wind=5m/s Length Width 11.1 5.1 18.4 6.2 22.9 7.1 29.8 9.0 57.7 16.9

No Wind Length 14.8 24.0 31.6 41.2 79.3

Horizontal Wind=5m/s Length Width 20.7 2.1 28.3 4.7 35.2 5.7 44.9 7.3 85.0 14.9

13/06/2003

PROCSREL.DOC

Page 20



Rev 0

Figure 4.1 Thermal radiation from an ignited 2 inch release

2 inch diameter hole 200 180

Dist to 1.5kW/m2

160 140 Vertical/No Wind

120

Vertical/5m/s Wind

100

Horizontal/No Wind

80

Horizontal/5m/s Wind

60 40 20 0 0

20

40

60

80

100

Mass Flow Rate

Figure 4.2 Thermal radiation from an ignited 6 inch release

6 inch diameter hole 200 180

Dist to 1.5kW/m2

160 140 Vertical/No Wind

120

Vertical/5m/s Wind

100

Horizontal/No Wind

80

Horizontal/5m/s Wind

60 40 20 0 0

20

40

60

80

100

Mass Flow Rate

Notes 1

Distances to 1.5kW/m2 are downwind distances (where applicable) and are at release height (10m)

13/06/2003

PROCSREL.DOC

Page 21



Rev 0

Table 4.6

Pool Fire and BLEVE Typical sizes and effects of ignited releases of process hydrocarbon

Reference

FRED 2.2 software package (Shell Research model pool fire radiation model and Shell Research BLEVE model)

The calculations include several assumptions and parameters: Pool fire Fuel

Kerosine

Ambient Temperature

20 °C

Humidity

70%

Windspeed

2 m/s

Radiometers are at ground level, oriented to maximum and downwind BLEVE Fuel

40% Propane, 60% Butane

Fill ratio

80%

Humidity

70%

Instruments are at ground level

Fuel Temperature

20 °C

Ambient Temperature

20 °C

Bold for interpolated results

Do not use the values given in this table for design! Table A

Pool fire typical dimensions and effects Pool Distance [m] from pool to given radiation level [kW/m2]

Diameter

Area

1.5

5

12.5

25 7.4 9.2

5 10

20 80

31 46

19 27

12 16

25

500

66

36

19

11

50

2000

98

51

21

12

Table B

BLEVE Fireball: typical dimension, duration and effects

Mass

Diameter

Duration

Distance [m] to given % fatality (Lees)

[tonnes]

[m]

[s]

50

10

1

1 5

43.8 74.9

11.1 15.0

20 36

20 37

20 40

10

94.4

16.4

47

47

52

25

128.8

19.2

69

70

78

50

161.4

21.1

89

91

100

100

203.3

24.8

117

121

139

250

275.9

30.0

166

178

206

500

347.7

35.2

218

243

280

Notes 1 The tabulation of typical fire sizes and effects is given for those who are not familiar with the scale and severity of such events. The data in the Tables are for guidance only. Calculations should be made appropriate to a given engineering situation.

13/06/2003

PROCSREL.DOC

Page 22


4.2


Rev 0

Research

There are several ongoing research and development projects within the area of release, dispersion, ignition and fires/explosions. It is expected that these projects will influence the models used, and substitute for lack of historical or relevant data; focus the attention of the industry on the need for quality historical data. Release frequencies: • E&P forum leak and ignition database • UK HSE release data for UK sector Ignition models: • Joint Industry Project: Ignition Modelling (1995-96) with DNV Industry, Scandpower, AEA Technology and COWIconsult. Fire and Explosion modelling • Joint industry project on Blast and Fire engineering with The Steel Construction Institute. • Gas safety Programme 1993-96. CMR, Bergen. • Fire on Sea (1993-96), SINTEF/NBL. It is expected that the historical data for release frequencies will improve when the E&P Forum project on HC (hydrocarbon) leak and ignition data collection has been established. The work was started in 1990-92 as a feasibility study whereby a database was established, and the structure and procedures for a more comprehensive database were decided as a follow-up. Ref. [10] [11] [12]. A similar database to the one being developed by E&P Forum is established by UK HSE (Health and Safety Executive). The data input are provided by all UK operators, however, HSE will only make summary reports available for the public and potential users. No intention or possibilities are at present made to integrate the HSE database with similar data from other regions/areas. A major problem with historical data on releases is associated with the leak rate and leak volume. It is acknowledged (ref. [11]) that hole sizes are one of the most difficult parameters to collect, and various methods are offered.

13/06/2003

PROCSREL.DOC

Page 23



Rev 0

5.

REFERENCES

5.1

E&P Forum member

5.2

DNV, 1990: Worldwide Offshore Accident Data, Statistical Report 1990, Det Norske Veritas

5.3

DNV, 1994: Worldwide Offshore Accident Data, (WOAD) Det Norske Veritas, 1994

5.4

E&P Forum member

5.5

Sofyanos, T., 1981: Causes and Consequences of Fires and Explosions on Offshore Platforms: Statistical Survey of Gulf of Mexico Data, DNV Rep 81-0057

5.6

Ashmore, F.S., 1989: The Design and Integrity of Deluge Systems, Proceeding of conference on Contingency Planning for the Offshore Industry, Aberdeen, January 1989

5.7

Technica (UK), 1990: Riser Safety Evaluation Routine, Report issued by an E&P Forum member, 90-1045, April, 1990

5.8

Veritec, 1988; Reassessment of Fatal Accident Frequency Rates for Troll Gas only Topsides, Report 88-3101

5.9

DNV Technica; ARF Technical Note T5, 1996.

5.10

Hydrocarbon Leak and Ignition Data Base Prepared for E&P Forum by DNV Technica Project No. N658, 20. February 1992 Issued as EP report EP 92-0503.

5.11

Guidelines for HC Leak and Ignition Data Collection Prepared for E&P Forum by DNV Technica Project No. N658, 20. February 1992 Issued as EP report EP 92-0577.

5.12

Calibration of HC Leak Frequency and Ignition Probability Data Prepared for E&P Forum by DNV Technica Project No. N658, 20. February 1992 Issued as EP report EP 92-0504.

5.13 Loss Prevention in the Process Industies F. P. Lees Butterworth, 1980, ISBN 0-408-10604-2. 5.14 The Offshore Hydrocarbon Release (HCR) Database R. A. P. Bruce (HSE Offshore Safety Division) ICHEME Symposium Series No. 139.

13/06/2003

PROCSREL.DOC

Page 24


13/06/2003


PROCSREL.DOC

Rev 0

Page 25

Riser and Pipeline Leaks

E&P Forum QRA Data Directory

Rev 0

RISER AND PIPELINES LEAKS

13/06/2003

RISER.DOC

Page 1



Rev 0

TABLE OF CONTENTS

1. 1.1 1.2

SUMMARY ..............................................................................................................3 Scope ........................................................................................................................3 Application ...............................................................................................................3

2. 2.1

2.2 2.3 2.4

KEY DATA .............................................................................................................. 3 Offshore Pipelines ................................................................................................... 3 2.1.1 Population Data ..............................................................................................3 2.1.2 Incident Data ..................................................................................................4 2.1.3 Frequency Estimates ......................................................................................5 2.1.4 Discussion ......................................................................................................8 Onshore Pipelines .................................................................................................. 10 Ignition Probability ............................................................................................... 11 Umbilicals .............................................................................................................. 12

3.

ONGOING RESEARCH ...................................................................................... 13

4.

REFERENCES ...................................................................................................... 14

13/06/2003

RISER.DOC

Page 2


1.

SUMMARY

1.1

Scope


Rev 0

This data sheet covers loss of containment from pipelines and risers. Data are presented for both steel pipes and flexibles, and detailed for a number of factors influencing the frequency of loss of containment. Only incidents involving loss of containment are included in this data sheet. However, Ref. [1] also contains data on riser and pipeline incidents which did not result in leaks, but possibly caused repair activities and production down time. Hence, assessment of risk to personnel and to the environment is prioritised, while risk of loss of production is not. Estimates of ignition probabilities of a release from pipelines and risers are also given. A section on reliability data of umbilicals is also included. This comprises umbilicals used for production and injection well control as well as pipeline safety valve control. 1.2

Application

Emphasis is put on offshore installations in the North Sea. However, data from the Gulf of Mexico and from onshore pipelines are presented for reference. The data sheet gives details on a number of factors that can influence the failure rate for pipelines and risers. However, it should be noted that individual pipelines may have very different properties, characteristics and functions, many of which may not have been considered to the required detail here. Therefore, it is recommended that in hazard and risk analysis each pipeline should be assessed on its own merits. 2.

KEY DATA

2.1

Offshore Pipelines

The data presented in this data sheet is taken from the PARLOC 92 report by AME [1], if not otherwise stated. Reference [1] describes a comprehensive database analysis performed on behalf of the Health and Safety Executive (HSE). The study covers the various sectors of the North Sea. Incidents included are sourced from information held by Regulatory Authorities and Pipeline Operators. Each incident has been subject to thorough investigation. A correlation of the data also included follow-up clarification of incident details. The HSE report is generally recognised as the best source of North Sea data, and supersedes previous work by consultants and companies for this area. The number of incidents in [1] is 295 with 201 involving operating pipelines and risers (incl. fittings), the remainder occurring during construction, hydrotest etc. Of the 201 incidents, 94 caused loss of containment. At the date of the report (by end of 1991) there were 794 pipelines in the North Sea with a total length of about 15770 km, representing almost 130000 km-years of operation. In addition, data on 902 risers with a total of approx. 7700 years of operational experience is included.

13/06/2003

RISER.DOC

Page 3



Rev 0

2.1.1 Population Data Population data for the North Sea is given in Table 1. Tables 2 and 3 present the corresponding operating experience that is used as a basis for the frequency estimates. Table 1: Number of North Sea Pipelines in the AME Database Line Type Contents of Pipeline Diameter (in) Oil Gas Other Flexible lines 77 25 27 Steel lines 227 300 138 2" to 8" 115 80 121 10" to 16" 54 101 16 18" to 24" 33 72 1 26" to 36" 25 47 0 Total 304 325 165 Note 1.1: Flexible lines are mainly in the range of 2"-8" diameter.

Total 129 665 316 171 106 72 794

Table 2: North Sea Pipeline operating experience in km-years to end of 1991 Line Type Diameter (in) Flexible lines Steel lines 2" to 8" 10" to 16" 18" to 24" 26" to 36"

Oil 862.4 36,961.9 3,239 6,146.6 7,743.3 19,833

Contents of Pipeline Gas Other 129.9 255.9 80,287.4 10,600 1,731.9 10,184.2 9,902.8 400.1 14,536.1 15.7 54,116.6 0

Total 1,248.2 127,849.3 15,155.1 16,449.5 22,295.1 73,949.6

Table 3: North Sea riser operating experience in riser-years to end of 1991 Line Type Diameter (in) Diameter (in) Flexible lines Steel lines 2" to 8" 10" to 16" 18" to 24" 26" to 36"

Oil 2,095.8 446.5 622.1 721.2 306

Contents of Pipeline Gas Other 3,798.1 310.9 1,270.7 1,316.3 900.2

1,411 1,318.5 83 9.5 0

Total 404.1 7,304.9 2,075.9 1,975.8 2,047 1,206.2

2.1.2 Incident data The database contains incident data as given in table 4 and 5 below. Only data related to loss of containment from operating pipelines and risers (48 incidents) is analysed in the following chapters.

13/06/2003

RISER.DOC

Page 4



Rev 0

Table 4: Incidents involving pipelines and risers Consequence of incident Status of pipeline at No of incid. No hole Hole in 0-20mm 20-80mm > 80mm incident pipeline hole hole hole Operating 138 90 48 27 7 13 Shut down 9 8 1 1 Under construction 55 39 15 2 13 Before 11 10 1 1 commissioning Hydrotest 12 4 8 2 1 5 Commissioning 2 1 1 1 Total 227 152 74 32 9 32 Note 4.1:"Shut down" denotes pipelines no longer in operation at the time of the incident. Table 5: Incidents involving fittings

Status of pipeline at incident Operating Shut down Under construction Before commissioning Hydrotest Commissioning Total

Number of incidents 63 0 0 1 3 1 68

Consequence of incident No leak Leak 0-20 mm 20-80 hole mm hole 17 46 37 8

> 80 mm hole 1

1 1 19

2 1 49

2 39

8

1 2

2.1.3 Frequency estimates The following tables give frequency estimates for loss of containment from risers and pipelines. The estimates are sorted, based on the governing factors affecting the frequency, as analysed in [1]. These are: • • • • •

Location of the leak (riser, platform safety zone, subsea well safety zone or mid-line) Incident cause Diameter of pipeline Length of pipeline Contents of pipeline

In addition, the possible effect of a number of other factors are discussed in relation to the frequency estimates (see notes). It must be noted, however, that the assessment of the effect of the factors are based on a very small number of incidents, and should consequently be interpreted with care. In the calculation of frequencies in Tables 6-8, it is assumed that the number of incidents follows a Poisson distribution. Based on this assumption, the upper 95% and lower 5% confidence limits for each estimate have been calculated. For all categories where no incidents are recorded, a best estimate of 0.7 incidents and an upper bound of 3 incidents are assumed. 13/06/2003

RISER.DOC

Page 5



Table 6: Frequency (per 104 years) of loss of containment for risers [1] 5.4 Diameter Experience Number of Lower Best (riser-years) incidents bound estimate Steel lines 2" to 8" 2083 1 0.24 4.8 > 10" 5249.2 5 3.75 9.53 10" to 16" 1995.9 4 6.86 20 6 .2 ) 0.244 4.88 18" to 24" 2047.1 1 26" to 36" 1206.2 0 5.8 Flexibles All 404.1 2 8.91 49.5

Rev 0

Upper bound 22.8 20 45.8 23.2 24.9 156

Note 6.1: [1] assesses that statistically the following factors have no significant effect on the recorded frequency of loss of containment from steel risers; length of pipeline that the riser is attached to, riser diameter, riser contents, location of riser internal or external steel jacket. However, see section 2.1.4 for discussion of effects for different parameters. Note 6.2: This 18" riser failure is due to the escalation of a major platform fire. 4

Table 7a: Frequency (per 10 pipe-years) of loss of containment caused by anchoring and impact incidents in the platform safety zone (within 500 m of the platform) [1] 5.5a Diameter Experience Number of Lower Best Upper bound (pipe-years) incidents bound estimat e Steel lines 2" to 8" 2334 2 1.54 8.57 27 > 10" 5323.3 4 2.57 7.51 17.2 10" to 16" 2069.4 4 6.62 19.3 44.2 18" to 24" 2047.7 0 3.42 14.7 26" to 36" 1206.2 0 5.8 24.9 Flexibles All 550.8 0 12.7 54.5 Table 7b: Frequency (per 104 pipe-years) of loss of containment caused by anchoring and impact incidents in the subsea well safety zone (within 500 m of the subsea facility) [1] 5.5b Diameter Experience Number of Lower Best Upper (pipe-years) incidents bound estimate bound Steel lines 2" to 8" 841.6 0 8.32 35.6 > 10" 89.3 0 78.4 336 10" to 16" 87 0 80.5 345 18" to 24" 2.3 0 3040 13000 26" to 36" 0 0 Flexibles All 657 3 12.5 45.7 118

13/06/2003

RISER.DOC

Page 6



Rev 0

Table 7c: Frequency (per 104 pipe-km-years) of loss of containment caused by anchoring and impact incidents in the mid-line of pipelines [1] 5.5c Diameter Experience Number of Lower Best Upper (pipe-km-years) incidents bound estimate bound Steel lines 2" to 8" 13669.1 3 0.6 2.19 5.67 > 10" 110084.1 1 0.005 0.091 0.431 10" to 16" 15423.4 0 0.454 1.95 18" to 24" 21289.4 1 0.024 0.47 2.23 26" to 36" 73371.3 0 0.095 0.409 Flexibles All 808.8 1 0.618 12.4 58.6 Note 7.1: Frequency of loss of containment caused by anchoring and impact incidents is significantly larger for safety zones than for mid-line. In addition, diameter of pipeline is a significant parameter for incidents in the mid-line. Note 7.2: Protection of lines (unprotected, trenched, buried) and age of pipeline appears to have minor effect on the recorded frequency data. Table 8a: Frequency (per 104 pipe-km-years) of loss of containment caused by corrosion and material defects for pipelines less than 2 km in length Contents Steel lines All Oil Gas Other Flexibles All

Experience (pipe-km-years) 680.6 280.6 254.9 145.1 298.5

Number of incidents 7 6 1 0 5

Lower bound 48.3 93 1.96 66

Best estimate 103 214 39.2 48.2 168

Upper bound 193 422 186 207 352

Table 8b: Frequency (per 104 pipe-km-years) of loss of containment caused by corrosion and material defects for pipelines 2 to 5 km in length Contents Steel lines All Oil Gas Other Flexibles All

13/06/2003



RISER.DOC

Lower bound 1.63 7.46 5.91

Best estimate 5.96 4.23 3.07 27.3 32.8

Upper bound 15.4 18.1 13.2 70.5 103

Page 7



Rev 0

Table 8c: Frequency (per 104 pipe-km-years) of loss of containment caused by corrosion and material defects for pipelines greater than 5 km in length Contents Steel lines All Oil Gas Other Flexibles All



Lower bound 0.067 0.234 -

Best estimate 0.245 0.856 0.09 0.748 20.6

Upper bound 0.632 2.21 0.384 3.21 88.1

Note 8.1: There is a strong dependency between pipeline length and frequency of loss of containment caused by corrosion and material defects. For longer pipelines a very significant decrease in frequency is observed. For comparison, data on offshore pipelines from the Gulf of Mexico are given in Table 9. Table 9: Frequency (per 104 pipeline-km-years) of pipeline leakage outside platform safety zone (more than 1000 m away from the platform) in Gulf of Mexico [2] ,

Failure mode Anchor/impact Material defect/corrosion Other Total

< 8" 0.21 0.65 0.21 1.1

Pipeline Diameter (inches) 8" to 18" 0.1 0.45 0.09 0.27

> 20" 0.009 0.084 0.014 0.11

Note 9.1: The pipeline population in GoM appears to contain a large proportion of small diameter pipelines, and a substantial part of the pipeline population is old. This factor will tend to make the failure rates rather high compared to the North Sea. 2.1.4 Discussion Failure mechanisms and failure rates of pipelines and risers will depend on a number of technical, operational and environmental parameters. The experience data presented in the previous sections do, to some extent, justify these dependencies with statistical significance. However, a quantification of the influence and importance of all these inherent parameters is not statistically possible due to scarce data samples and limited experience. In order to provide some guidance on these parameters, a qualitative assessment of the effects is given in Table 10. The effects of these parameters may not only relate to the failure rate, but also to other aspects of the failure mechanisms, like the leak hole size distribution, the progression of an initially minor leak etc. Normally, engineering judgement will be applied in order to quantify the effects of specific parameters on failure rate etc.

13/06/2003

RISER.DOC

Page 8



Rev 0

Table 10: Indicative effects of different parameters on failure rate and failure mechanisms Failure mode Corrosion (external coating

Effect on failure rate Parameters tending to

Parameter Wet CO2 in carbon steel pipe Riser inside water filled concrete leg

and cathodic

increase

Warm sea

protection

failure rate

Riser clamps in splash zone

Parameters

Sleeving External Inconel 625 overlay

tending

Duplex stainless steel

to decrease

Monel sleeve

failure rate

Inspection

assumed)

Intelligent pigging Age 4 - 20 years ("bathtub" effect) Design (utilisation) factor 0.3 instead of 0.6 Inside dry concrete leg External impact

Parameters

Monel cladding Riser position outside jacket

tending to increase failure rate

Pipelines exposed or trenched Landing position of supply boats on same side as riser

Parameters tending

Riser within crane reach Shipping lane within 5 km of platform Riser position inside jacket/concrete leg

to decrease failure rate

Burial of pipeline Diameter/wall thickness No significant merchant shipping in area Operational restricions in bad weather, defined vessel no-go areas, Agreed approach procedures Fenders/sleeving of risers outside jacket

Failure mode Effect on failure rate Mechanical defects Parameters tending to increase failure rate Parameters tending to decrease failure rate

Natural hazards

13/06/2003

Parameters tending to increase failure rate

Parameter Duplex stainless steel Wall thickness > 25 mm Seamless riser Comprehensive inspection (NDT, etc) Manual inspection Design (utilisation) factor 0,3 instead of 0.6 Riser clamps; redundancy in design, regular inspection, monitoring of riser motion etc. Severe local conditions (earthquakes, hurricanes etc.)

RISER.DOC

Page 9


2.2


Rev 0

Onshore Pipelines

Table 11 presents estimated leakage frequencies for onshore gas and oil pipelines in Western Europe. The references give more detailed information on leak frequency as a function of pipeline diameters, hole sizes, age, wall thickness etc. Table 11: Freq.(per 104 km-years) of leakage from onshore pipelines in Western Europe Failure mode External interference Construction/material defects Corrosion Ground movement (incl. flooding) Other (incl. operator error) Total

Gas pipeline [4] 1970-92 1988-92 0.3 0.22 0.11 0.07 0.08 0.05 0.03 0.02 0.06 0.02 0.58 0.38

Oil pipeline [3] 1984-88 0.17 0.14 0.17 0.02 0.08 0.58

Note 11.1: The data on oil pipeline leaks [3] includes 51 incidents from a total of 17700 km of pipelines operated or owned by the 63 members of CONCAWE. The population includes pipelines of all sizes carrying both crude oil and products. Of the 51 incidents, 37 caused spill of less than 10 m3 net volume, 5 leaks from 11-100 m3, 8 leaks from 101-1000 m3 and 1 spill of more than 1000 m3. Net volume is the estimated or measured gross spillage minus the volume of oil recovered. Note 11.2: The total length of the gas pipeline system of the eight major gas transmission system operators comprising EGIG is 92853 km. The exposure in the period 1970-92 is 1.47 million km-years. Almost 50% of the exposed pipeline system is in the 5"-16" range and 20% has a diameter of more than 30". Note 11.3: The discussion on effect of different parameters in section 2.1.4 is also valid for onshore pipelines. Reference [6] presents data on leaks from onshore pipelines in the US. Accident statistics is compiled by the US Department of Transportation (DoT) for all pipelines that involve explosion or fire, the loss of 50 bbl or more of liquid, the loss of 5 or more bbl of highly volatile liquid, the death or bodily harm to any person or estimated property damage exceeding $5000. During the studied period from 1982 to 1991, the DoT regulated an average of 344575 km (214155 miles) of liquid pipeline per year. Table 12 gives the failure rate by the various causes. Table 12: Pipeline failure rates by cause for onshore US pipelines (1982-1991) [6] Accident cause Number of accidents Failure rate (per 104 km-years) Outside force 581 1.69 Corrosion 523 1.52 Other 496 1.44 Operator error 107 0.31 Pipe defect 98 0.28 Weld defect 54 0.16 Relief equipment 42 0.12 Total 1,901 5.52 Table 13: Pipeline failure rates by cause for subcategories of the outside force category1 [6] 13/06/2003

RISER.DOC

Page 10



Outside Force Breakdown 10 yr accident total Damage by others 265 Damage by operator 43 Natural forces 20 Other outside force 18 Ship anchor 4 Washout 3 Landslide 2 Subsidence 2 Frostheave 2 Fishing operation 2 Earthquake 0 Mudslide 0 1 For accidents that occurred between 1986 to 1991

Rev 0

Failure rate (per 104 km-years) 1.28 0.21 0.1 0.09 0.02 0.01 0.01 0.01 0.01 0.01 0 0

Note 12.1: Figures in italics denote accidents that occured between 1986 to 1991. 2.3

Ignition Probability

There will be a large number of parameters that influence the probability of ignition of a release from a riser or pipeline leakage. The data in Table 14 splits the estimates on leakage size and location of release. Table 14: Probability of ignition of a hydrocarbon release from a riser leakage [5] Typical probability of ignition (integrated platform) Location of release Massive gas Major gas Minor gas release (<2 kg/s) release (>20 kg/s) release (2-20 kg/s) Riser above sea 0.168 0.026 0.005 Subsea 0.443 0.13 0.043 Typical probability of ignition (bridge linked complex) Location of release Massive gas Major gas Minor gas release (<2 kg/s) release (>20 kg/s) release (2-20 kg/s) Riser above sea 0.078 0.013 0.002 Subsea 0.14 0.051 0.002 Typical probability of oil releases (calculate flash gas and treat as gas release) Location of release Massive oil Major oil release Minor oil release (<2 kg/s) release (>20 kg/s) (2-20 kg/s) Riser above sea 0.051 0.009 0.003 Subsea 0.005 0.001 Note 14.1: The ignition probabilities quoted in Table 14 are from a study that included development of a model relating probability of ignition to the size of release, its location and other relevant factors. Table 15: Historical ignition probability for onshore gas pipelines (1970-92) [4] 13/06/2003

RISER.DOC

Page 11


Damage classification Pinhole/crack Hole Rupture (<= 16") Rupture (> 16")


Rev 0

Ignition probability (%) 2.7 1.9 9.9 23.5

The average ignition probability was 3.4%. 2.4

Umbilicals

All data given in this section is retrieved from a comprehensive study [7] on reliability of umbilicals offshore in the UK and Norwegian sectors of the North Sea up to 1990. Data has been collected from 45 fields and 17 operators and includes data on 180 umbilicals2 with a total length of approx. 800 km. 78% of the umbilicals are used for production and injection well control while 9% are connected to pipeline safety valves and 5% used for chemical injection. Types of umbilicals comprise electrical (E), electrohydraulic (EH), hydraulic (H), chemical (C) as well as combinations hereof (some also with fibre optic - F). In addition to the operational experience and reliability aspects presented in this data dossier, the study also includes a review on design and installation. The study was concerned not only with failures of umbilicals but also with problems that did not necessarily result in a total loss of umbilical functions. The 180 umbilicals have experienced a total of 85 problems during service (totally 187 problems), of which 67 were related to the well control umbilicals. Problems of umbilicals in service were mainly categorised as power conductor failure (short or open circut), hydraulic leakage or hydraulic blockage and mechanical damage. For the purpose of the analysis a Mean Time To Problem (MTTP) was calculated, similarly to a mean time to failure (MTTF). However, this value should not be used as a mean time to failure in other reliability analysis. Table 16:

Calculated Mean Time to Problem by Type of Umbilical [7]

Type E, EF EH, EHC, EHF H, HC C Table 17:

Number of Umbilicals 24 66 73 17

Service MTTP (days)

Problem Rate (/year)

4682 5869 2159 1075

0.078 0.062 0.169 0.34

Calculated Mean Time to Problem by Application of Umbilical [7]

Primary Application No of Umbilicals Well control 140 Pipeline valve 17 Power transfer 2 Chemical inj./gas lift 17 Misc. 4 (TFS = too few samples) 3. ONGOING RESEARCH

Service MTTP (days) 2856 14745 TFS 1053 TFS

Problem Rate (/year) 0.128 0.025 TFS 0.347 TFS

2

only umbilicals with a length of more than 100m have been included in the analysis. 13/06/2003 RISER.DOC

Page 12



Rev 0

A number of research programmes are in progress on testing of flexible risers/hoses. These include testing performed by Coflexip, Wellstream and SINTEF. A JIP project on development of an analysis model for prediction of ignition probability has been initiated in 1995 and will continue through 1996. The project is supported by 6 major oil companies and undertaken by DNV Technica, AEA and Scandpower. The analysis model should also be applicable to major releases in open air (from risers and pipelines).

13/06/2003

RISER.DOC

Page 13



Rev 0

REFERENCES [1]

Advanced Mechanics & Engineering Ltd: PARLOC 92 The update of loss of containment data for offshore pipelines. Final report for UKOOA and HSE. February 1993.

[2]

E&P Forum Source

[3]

Performance of oil industry pipelines in Western Europe 1988. CONCAWE (the oil companies' European Organisation for Environment, Health and Safety), December 1989.

[4]

European Gas Pipeline Incident Data Group (EGIG) Gas pipeline incidents. Report 1970-1992. October 1993.

[5]

E&P Forum Source

[6]

Diane J Hovey et al. Pipeline Accidents, Failure Probability determined from Historical Data, Oil and Gas Journal, July 12 1993.

[7]

Study of the performance and reliability of hydraulic, electrohydraulic and multifunctional umbilicals. Engineering Research centre, July 1990.

13/06/2003

RISER.DOC

Page 14


13/06/2003


RISER.DOC

Rev 0

Page 15

Storage Tanks


Rev 0

STORAGE TANK INCIDENTS

13/06/2003

STORTANK.DOC

Page 1

Storage Tanks


Rev 0

TABLE OF CONTENTS

1. SUMMARY--------------------------------------------------------------------------------------------- 3 2. STORAGE TANK POPULATION---------------------------------------------------------------- 3 3. STORAGE TANK LEAK FREQUENCY ------------------------------------------------------- 5 4. STORAGE TANK LEAK CAUSES-------------------------------------------------------------- 8 5. STORAGE TANK FIRES -------------------------------------------------------------------------- 9 6. REFERENCES ------------------------------------------------------------------------------------- 12

13/06/2003

STORTANK.DOC

Page 2

Storage Tanks

1.


Rev 0

SUMMARY

This datasheet provides information on above ground storage tank (AST) failure frequencies for leaks and major releases. The data was obtained from several sources. The contribution of the various causes, for AST leak and major releases, is also identified. The datasheet also provides frequency information for the causes of AST fires. The relative effect of various prevention measures against storage tank failures are also discussed. Storage Tank - A stationary container (tank) that operates at pressures below 5 psig (0.34 barg)

and is constructed primarily of non-earthen materials. Above Ground Tank - A storage tank whereby more than 90% of the tank volume is not buried

below the ground surface. Elevated Tank - A storage tank not in contact with the ground, on a concrete, steel, or other solid

support. Incident - Any leak, rupture, explosion, failure, ignition, etc., of an upstream storage tank

containing any form of oil and gas.

2.

STORAGE TANK POPULATION

A number of references were found that describe above ground storage tank failures, their typical causes, and the number of failures that occurred within a surveyed time frame. AST age and type of service have some influence on a tank's leak/rupture frequency. One would expect that older tanks or tanks in more corrosive service would have a higher than average leak frequency. Reference [1], an above ground storage tank survey, provides age and service data on U.S. tank storage. Tables 2.1, 2.2 and 2.3 summarize key population data and service data from this reference for above ground storage tanks. The industry segment with the largest number of tanks is production. However, the industry segment with the largest storage capacity is refining. By implication, the production segment has a large number of small capacity tanks.

13/06/2003

STORTANK.DOC

Page 3

Storage Tanks


Rev 0

Table 2.1 Above Ground Storage Tank (AST) Population and Age (U.S., 1989) [1] API Industry Segment Marketing Refining Transportation Production Total * **

Estimated Total Shell National Capacity(MBBLs) Total

Surveyed Above Ground Tanks

Average*Age (Yrs)

5,831

88,529

486,925

29.4

11,440

29,727

945,092

34.6

5,341

9,197

556,183

31.4

54,046

572,620**

280,595

15.1

76,708

700,073

2,268,795

17.9

Calculated using the tank age distribution given in [1]. Reference 1 states that the number of storage tanks may be as high as 900,000 if tanks at low production operations in Texas and lease counts are included.

Table 2.2: Type of Service for Production ASTs (Ref. 1) Type of Service

% of Production AST Population

Crude Oil (>16 °API)

55

Heavy Crude Oil (<16 °API)

1.7

Condensate

9

Lube Oils (not viscous)

<1

Non-Potable/Production Water

31

Non-Operational Tanks

2

Other

1.5

Table 2.3: Number of ASTs by Capacity Range (U.S., 1989) (Ref.1) Capacity Range (bbls) 25 to 500 1000 to 10,000 to 100,000 to 500 to 1000 10,000 100,000 500,000 API Industry Number of Segment Tanks Marketing 64,793 4417 7434 11469 416 Refining 3913 2460 9665 11629 2028 Transportation 694 307 1468 5048 1674 Production 510,045 37,628 17977 5969 974

13/06/2003

STORTANK.DOC

+500,000 Total 0 32 6 27

88,529 29727 9,197 572,620

Page 4

Storage Tanks

3.


Rev 0

STORAGE TANK LEAK FREQUENCY

Several references provided failure data on the frequency of AST leakage. However, most of the references did not indicate the type of service for the above ground storage tanks or describe design or operational factors which influence a tank's failure frequency. Table 3.1 summarizes AST leak frequencies collected from a variety of references. Some of the data contained in this table were calculated using information from multiple references. To estimate the failure frequency for an average AST, we simply divided the number of tank leaks or ruptures observed in a time period by the number of tank years for that same time period. For example, the first failure rate in Table 3.1 was calculated as follows: PRODUCTION TANK RELEASE FREQUENCY

=

(8389 LEAKS IN A YEAR [1]) (572, 620 TANK YEARS [1]) 1.5 x 102/YR

=

When data was lacking in one reference, we used data from other references to supplement the calculation. For example, [7] states that 92 major tank releases had occurred since 1970 and 1989, the time this article was published. Using these data (92 major releases, 19 year period) in combination with the tank population data from reference 1, the calculated AST major release frequency is as follows: MAJOR TANK RELEASE FREQUENCY

= =

(92 MAJOR TANK RELEASES [7]) (19 YRS [7]) x (700, 073 TANKS [1]) 6.9 x 10-6/YR

While [7] does not specify a tank population, it can be conservatively assumed that the 92 major tank failures mentioned in this reference all occurred within the oil industry tankage including both upstream and downstream operations and all capacities. Further, these 92 releases represent a range of causes, e.g., valve failure, vandalism and overfilling. Such conservative assumptions were made whenever a tank failure rate was calculated based on limited raw data in a reference.

13/06/2003

STORTANK.DOC

Page 5

Storage Tanks


Rev 0

Table 3.1: Above Ground Storage Tank Failure Data Equipment Type

Failure Mode

Failure Rate (yr1)

References and Remarks

Above Ground Storage Tank (Production Facility)

External leakage

1.5 x 10-2

EL, pg. 26 (Ref. 1)

Atmospheric storage tank

Serious leakage

9.6 x 10-5

Rijnmond, Table IX.I (Ref. 2)

Atmospheric storage tank

Catastrophic rupture

6 x 10-6

Rijnmond, Table IX.I (Ref. 2)

Cryogenic LNG storage tank _ double-walled (steel outer shell; aluminum or 9% nickel-steel inner shell)

Major failure (external leak)

9.6 x 10-3

GRI, pg. 9 (Ref. 3)

Atmospheric storage tank _ mild steel

All modes (specific failure modes were not listed)

3.9 x 10-2

GENDATA (Ref. 4)

Storage tank

Leaks

1.1 x 10-2

NPRD-91/FMD-91 (Ref. 5 and 6) Failure rates calculated using failure data from NPRD-91 and failure mode distributions from FMD-91. NPRD-91 data selected for tanks that store oil

Storage tank

Rupture/Puncture

8.8 x 10-4

NPRD-91/FMD-91 (Ref. 5 and 6) Failure rates calculated using failure data from NPRD-91 and failure mode distributions from FMD-91. NPRD-91 data selected for tanks that store oil

Above Ground Storage Tank

External leakage

2.5 x 10-2

HSB, pg. 127 (Ref. 7)

Major Release

6.9 x 10-6

HSB, pg. 122 (Ref. 7)

External leakage

7.2 x 10-3

Oil & Gas, pg. 31 (Ref. 8)

Above Ground Storage Tank

13/06/2003

STORTANK.DOC

Page 6

Storage Tanks


Rev 0

Reference [1], EL's API Tank Survey, contains mostly population data on tanks used in the U.S. oil industry. The study does provide a limited amount of failure data on the number of tank leak events that occur in an average year in the production segment of the oil industry. The failure rate listed in the table is the average number of tank leaks in a year divided by the tank population. Reference [2], the Rijnmond Study, was one of the first QRAs ever performed for chemical process facilities. The data base in this study is based on other publicly available data sources and includes pumps, piping, valves, measuring devices, instrumentation and controls, electrical equipment, and vessels. Reference [3], the Gas Research Institute, provides a set of failure rates and failure mechanisms for various types of equipment in LNG base load and satellite facilities. Equipment failure data, including data for storage tanks, were collected from 27 separate LNG facilities and covered approximately 1.6 million hours of service time. Point estimates of equipment failure rates were derived from these failure data. Reference [4], GENDATA, provides failures rates for a variety of components used in both the nuclear and the chemical process industries. The reported failure rates, with confidence intervals, are derived from failure histories provided by subscribers to this data base. References [5] and [6], NPRD-91 and FMD-91, contain a large amount of failure data on a variety of components. Raw information for this data base is primarily obtained from component failure histories provided by the U.S. military. The NPRD data base provides "total" failure rates for numerous types of nonelectric equipment operating in different types of environments. Failure rates are provided for both military grade and commercial grade equipment. The FMD data base supplements the NPRD data base and contains a percentage breakdown of component failure rates listed in NPRD by failure mode. (This breakdown is needed to calculate, for example, a storage tank rupture failure rate from the total failure rate.) Reference [7], a Hartford Steam Boiler paper, describes the results of testing the integrity of above ground storage tanks (ASTs) using acoustic emissions. The paper indicated that about 16,000 tank leaks occurred in 1988 and that 92 major release incidents have occurred since 1970. Conservatively assuming all of these leaks/releases were from ASTs, a tank leak and major release frequency can be estimated by dividing the number of failures by the product of the U.S. oil industry AST population (Ref. 1) and reporting period (1 year or 19 years). (Note: Using the total U.S. AST population in this calculation, would yield a lower failure frequency estimate.) This paper also provides a slightly higher AST leak frequency of 2.5 x 10-2/yr (versus the 2.3 x 10-2/yr leak frequency calculated) based on a small sample of tank inspections (835 tanks). The higher leak frequency in Table 3.1 is reported. Reference [8], an article on above ground storage tank leaks, states that more than 6,000 spills were reported in a two year period. Assuming all the spills were from ASTs, using the AST 13/06/2003

STORTANK.DOC

Page 7

Storage Tanks


Rev 0

population data from [1], and using the same calculation method described previously, the estimated AST leak frequency is 4.3 x 10-3/yr. The article also states, based on an API member survey, that less than 3.6% of tanks had bottom failures during a 5-year period. This translates into a tank leak frequency of 7.2 x 10-3/yr, which is reported in Table 3.1. While not listed in Table 3.1, [9] and [10] provide some useful descriptions of storage tank failures/fires in the hydrocarbon processing industry. Reference [9] provides an analysis of 170 large property damage losses that occurred in the hydrocarbon-chemical industries over the last 30 years. These studies provide statistics on the dollar loss per accident, cause of accident, equipment involved in an accident, source of ignition, and type of loss by complex. Reference [10] provides a brief synopsis (~100 to 200 words) of the top 100 major accidents that have occurred in industry over the past 30 years. Fourteen of the 100 accidents described in this reference involve storage tank failures. Reference [11], also not listed in Table 3.1, provides information on accidents involving storage tanks used in the oil industry. This reference summarizes numerous accidents that have occurred with atmospheric tanks, floating-roof tanks, refrigerated and cryogenic storage facilities, and spheres, spheroids, and bullets. This reference also identifies typical causes of storage tank accidents and the lessons learned from these accidents.

4.

STORAGE TANK LEAK CAUSES

Two of the references reviewed ([7] and [11]) provided some information on the causes of storage failures. Table 4.1, taken from [7], provides a breakdown on the causes of above ground storage tank leaks. Vandalism was excluded from the causes listed. Table 4.1: Causes of Above Ground Storage Tank Leaks Cause Corrosion Improper installation and tank failure Loose fittings Over fills and spills

Percent of Total 60 18 12 10

Table 4.2, based on data from [11], provides another breakdown on the causes of storage tank failures. In [11], the author reviewed 63 papers on storage tank incidents and categorized the causes of these incidents. Also, the incidents described in [11] usually involved major tank failures. The data in Table 4.2 on failure causes is most applicable to major tank failures (e.g., fires, large product losses, structural damage of equipment).

13/06/2003

STORTANK.DOC

Page 8

Storage Tanks


Rev 0

Table 4.2: Causes of Major Failures of Storage Tanks Cause Improper Operations (operating and maintenance errors)* Improper Procedures** Equipment Failure** Weather** Improper Design Other * **

Percent of Total 21 19 18 17 3 22

Operating errors were about three times as numerous as maintenance errors. More than half the incidents in this category involved floating-roof tanks.

5.0

STORAGE TANK FIRES [12]

Tank Fire Frequency Although published literature contains considerable information on tank fires, there is little reliable data on the number of tank-years required to calculate the tank fire frequency. Therefore, in order to obtain complete and accurate (as far as possible) data to determine tank fire frequency, [12] approached selective sources that would maintain not only the number of fires but would also have data required to calculate the tank-years. The table below identifies these data sources and the resulting floating roof tank fire frequency. Table 5.1 Floating Roof Tank Fire Frequency [12] Country

Data Source

Netherlands

Saval-Kronenburg (manufacture of fire extinguishers) Large single Company data N.Sea oil terminals

USA Scotland Total

No. of Fires 1

Total TankYears 673

Fire Freq. (per tank yr.) 1.5 x 10 -3

10 1 12

3883 461 5017

2.6 x 10-3 2.2 x 10-3 2.4 x 10-3

The average fire frequency for a floating roof tank is therefore 2.4 x 10-3 per tank-year. All the above 12 fires started as rim fires. Of these only one escalated into a full surface fire.

13/06/2003

STORTANK.DOC

Page 9

Storage Tanks


Rev 0

Table 5.2 Cone (Fixed) Roof Tank Fire Frequency [12] Country

Data Source

USA

API Risk Analysis Tank Force (1969-1977) OPITSC Members (since 1945)

Singapore Total

No. of Fires 270

Total TankYears 900,000

Fire Freq. (per tank yr.) 3.0 x 10-4

2 272

11125 911125

1.8 x 10-4 3.0 x 10-4

The average fire frequency for a cone roof tank is therefore 3.0 x 10-4 per tank-year. The above two tables show that the fire frequency for floating roof tanks is higher than that for fixed roof tanks. Not only does the type of tank affect the fire frequency, but also the type of product stored. The fire frequency for products with flash points under 1000F is about 11 times more than that for products with flash point above 2000F based on the total API tank population (i.e., including fixed and floating roof tanks) [12]. Cause of Tank Fires In order to determine the percentage contribution of each cause of tank fire, [12] examined the detailed records of 122 serious pool fires (worldwide) in its tank fire database. The resulting causal contributions are shown in the table below. Table 5.3 Cause of Tank Fires [12] Cause Lightning Sabotage Maintenance Vapor Ignition Spill/leak ignition Overfill External Fire Corrosion Explosion Overheat Reaction Design Total

Percent 39 15 12 8 8 6 3 3 2 2 1 1 100

Fatalities from Tank Fires Using the 122 incidents in the tank fire database, [12] categorized the fatalities associated with the various tank fires.

13/06/2003

STORTANK.DOC

Page 10

Storage Tanks


Rev 0

5.4 Summary of Fatality Statistics for Atmospheric Storage Tanks [12] Fatalities Zero Fatalities 1-3 Fatalities 4-10 Fatalities 11+ Fatalities

Percent of Tank Fires 77% 16% 5% 2%

Escalation The 122 tank fire incidents in the database in [12] are primarily more serious fires. Consequently, an examination of these fires provides information on escalation of tank fires to other tanks or to boilover.

Table 5.5 Escalation of Single to Multiple Tank Fires Type of Incident Total number of tank fires in Ref. 12 database Number involving 1 tank Number involving two or more tanks

Number 122 68 54

Percentage 100 56% 44%

Number of tanks suffering boilover

9

7%

13/06/2003

STORTANK.DOC

Page 11

Storage Tanks


Rev 0

6.

REFERENCES

1.

R. A. Christensen and R. F. Eilbert, Aboveground Storage Tank Survey, EL RN-623, Entropy Limited, Lincoln, MA, 1989. Cremer and Warner, Ltd., Risk Analysis of Six Potentially Hazardous Industrial Objects in the Rijnmond Area _ A Pilot Study for the Covo Steering Committee, D. Reide Publishing Company, Dordrecht, Holland, 1982. D. W. Johnson and J. R. Welker, Development of an Improved LNG Plant Failure Rate Data Base, Gas Research Institute, Chicago, IL, 1981. GENDATA, Issue 1, Systems Reliability Service, United Kingdom Atomic Energy Authority, Culcheth, Warrington, ENGLAND WA3 4NE. W. Denson, et al., Nonelectric Parts Reliability Data, Reliability Analysis Center, Rome, NY, 1991. G. Chandler, et al., Failure Mode/Mechanisms Distributions, Reliability Analysis Center, Rome, NY, 1991. R. W. Lauben and D. L. Robinson, "Acoustic Emission Integrity of Above Ground Storage Tanks," PWR-Vol. 5, Proceedings of the Industrial Power Conference, ASME, 1989. P. Crow, "Limiting tank leaks," Oil & Gas Journal, September 19, 1994. D. G. Mahoney, Large Property Damage Losses in the Hydrocarbon-Chemical Industries, A Thirty Year Review, Fourteenth Edition, M&M Protection Consultants, New York, NY, 1992. D. G. Mahoney, Large Property Damage Losses in the Hydrocarbon-Chemical Industries, A Thirty Year Review, Fifteenth Edition, M&M Protection Consultants, New York, NY, 1993. API, Safety Digest of Lessons Learned, Section 6, Safe Operation of Storage Facilities, American Petroleum Institute, 1982. “Atmospheric Storage Tank Study for Oil and Petrochemical Industries Technical and Safety Committee Singapore”, by Technica Ltd, London, April 1990.

2.

3. 4. 5. 6. 7.

8. 9.

10.

11. 12.

13/06/2003

STORTANK.DOC

Page 12

Storage Tanks

13/06/2003


STORTANK.DOC

Rev 0

Page 13

Blowouts

E&P Forum QRA Directory

Rev 0

BLOWOUTS

13/06/2003

BLOWOUTS.DOC

Page 1

Blowouts


Rev 0

TABLE OF CONTENTS

1. DEFINITIONS----------------------------------------------------------------------------------------- 3 2.1 Offshore-----------------------------------------------------------------------------------------------------------------4 2.2 Onshore -----------------------------------------------------------------------------------------------------------------6 2.3 Regulatory Bodies-----------------------------------------------------------------------------------------------------6 3. BLOWOUT FREQUENCY ESTIMATION ----------------------------------------------------------------------7 3.1 Offshore - Joint Industry Project (Scandpower) [1] -----------------------------------------------------------7 3.2 Offshore - US Studies-------------------------------------------------------------------------------------------------1 3.3 E&P Forum - Hydrocarbon Leak and Ignition Database [9]---------------------------------------------- 17 3.4 Onshore - US Studies ----------------------------------------------------------------------------------------------- 22 3.5 Onshore - ERCB Database ---------------------------------------------------------------------------------------- 23

REFERENCES----------------------------------------------------------------------------------------- 24

13/06/2003

BLOWOUTS.DOC

Page 2

Blowouts

1.


Rev 0

DEFINITIONS

Barrier

During drilling and well activities the following barriers will normally exist: a)

A barrier consisting of a homogenous mud column in hydrostatic overbalance in relation to the reservoir pore pressure.

b)

A barrier consisting of a cemented casing, wellhead, pipe ram/annular preventer and drill string with kelly valve/check valve.

Blowout

Any uncontrolled flow of formation fluids to the surface, due to formation pressure exceeding the hydrostatic pressure of the mud or fluid column and failure of second barrier.

Shallow Gas Blowout

Any uncontrolled flow of gas from gas pockets located above the intended reservoir prior to the Blowout Preventer being fitted.

Completion

Covers any installation of production tubing, packers and other equipment, as well as perforation and stimulation in production and injection wells.

Development Drilling

Covers all operations related to production, injection and observation wells between spudding and cementing the production casing.

Exploration drilling

Covers all operations related to wildcat and appraisal wells between spudding the well and plugging and abandonment.

High Pressure High Temperature (HPHT) well

The term HPHT well is typically defined as a well that is deeper than 4000m (TVD) and/or that has an expected shut-in wellhead pressure greater than or equal to 690 bar (10,000psi), and/or temperatures in excess of 150oC.

Kick

Entry of formation fluid into the well bore.

Production

Covers all offshore wells which produce oil and/or gas but excludes well intervention, start-up and close-in operations.

Workover

Covers all intervention operation other than operations carried out with wireline.

Wireline

Covers only those intervention operations where wireline is used.

13/06/2003

BLOWOUTS.DOC

Page 3

Blowouts


2.

BLOWOUT EVENT DATA SOURCES

2.1

Offshore

Rev 0

To estimate from historical data the risk of a blowout, it is necessary to have information on both the blowouts that have occurred and the number of well operations over a specified period. For offshore exploration and production the two main areas where both sets of data are readily available and accessible are the Gulf of Mexico and the North Sea. For these areas the two main databases are: -

SINTEF - Offshore Blowout Database; DNVT - World Offshore Accident Database (WOAD).

2.1.1

SINTEF Offshore Blowout Database [8]

This database is sponsored by several operating companies. The database is programmed in Paradox for Windows, and the raw database file is in Paradox format. As of November 1994, the SINTEF Offshore Blowout Database contains information on 382 blowouts worldwide since 1957. Background information related to each blowout has been collected from open sources and through international contacts, feeding information back to the database. In the total of 382 blowouts recorded since 1957 are: -

63 recorded in the period before 1970 114 in the period from 1970 to 1980, and 205 in the period after 1 January 1980.

The number of blowouts experienced in different activities worldwide since 1 January 1980 are listed in Table 1. Table 1: Number of blowouts experienced in different activities worldwide since 1/1/80 [8] Expl. Drillin g 81

Completion Dev. Drilling Activities 51

10

Workover Activities

Wireline Prod.

25

5

23(13)*

Unknown Unknown Drilling 1

9

* Figures in brackets denote the number of blowouts excluding those caused by external loads (storm, military activity, ship collision, fire and earthquake).

Most blowouts occur when working in the well. Blowouts seldom occur during normal production. Table 2 gives a breakdown of blowouts during different operational phases. Overall drilling and production exposure data for the North Sea (UK and Norway) and the US GoM Outer Continental Shelf (OCS) is included.

13/06/2003

BLOWOUTS.DOC

Page 4

Blowouts


Rev 0

Table 2: Overview of number of blowouts experienced during different operational phases, January 1980 - January 1993. [8]

Completion

AREA

Dev. Drlg

Expl Drlg

North Sea (UK & Norway) US GoM OCS

7

4 30

16 29

Total

7

34

45

Prod

Work- Wireover line

2(1)* 10(5) * 12(6) *

Unknown Total

1 18

1 3

1

24 (23)* 98 (93)*

19

4

1

(122(183)*

* Figures in brackets denote number of blowouts if excluding blowouts caused by external loads (storm, military activity, ship collision, fire and earthquake).

The information fed into the database has various origins. The best descriptions are from blowout investigation reports (public, company or insurance) while the "worst" are based on small notices in magazines. It should be noted that even from investigation reports several crucial facts may be missing, including cause of kick, ignition source, and human errors involved. This has led to several of the fields in the database being filled in with information not specifically stated in the source, but as a result of an evaluation of the complete blowout description. Table 3: Quality of reference data in the blowout database. [8] US GoM OCS Norway and UK Data Quality * Very good

Rest of the World

TOTAL

1970-1979 8

1980-1994 29

1970-1979 3

1980-1994 4

1970-1994 44

Good

7

22

3

4

36

Fair Low Very Low TOTAL

17 26 4 62

36 31 10 128

3 15 28 52

14 21 34 77

70 93 76 319

The database is believed to cover most blowouts in the North Sea and US GoM OCS, but from other parts of the world several blowouts are believed to be missing. Other than those from the North Sea and the US GoM OCS, blowouts are typically only reported in company internal files. From Table 3 it can also be seen that in general the quality of data is better for the GOM and the North Sea compared with the Rest of the World and that data quality has improved since about 1980.

13/06/2003

BLOWOUTS.DOC

Page 5

Blowouts


Rev 0

2.1.2 DNVT World Offshore Accident Databank [7] Veritas Offshore Technology and Services A/S started to collect data about accidents on offshore installations in 1975. This led to the development of WOAD, revision 1.0 in 1983. Data are collected by DNV (Det Norske Veritas) from official documents such as periodicals and manuals, published databank material, newspapers, information given from oil companies or other open information. A PC database program is available together with a handbook that is updated every two years. 2.2

Onshore

For onshore oil and gas production two databases available are: -

Energy Resources Conservation Board (ERCB), Alberta, Canada;

-

Neal Adams Firefighters Inc (NAF), Houston, Texas.

The ERCB database contains information on 593 onshore blowouts over the period 1947 to 1994. Information on the number of wells drilled and the number of service operations is also collated. The ERCB database is programmed in dBase IV format and is freely available. The NAF database includes 340 onshore blowouts. Most of the information originates from the ERCB though it is supplemented with additional information, particularly from Texas and Louisiana. Some of the ERCB data is not included because NAF did not consider the events recorded to be blowouts, but leakages (leakages in valves, etc). 2.3

Regulatory Bodies

In most countries there is a requirement to report to a regulatory body incidents and accidents, including blowouts, that occur during Exploration and Production activities. Examples of such bodies are: -

US Minerals Management Service; UK Health and Safety Executive; Norwegian Petroleum Directorate.

This information is being made increasingly available to the industry, usually through joint industry studies, to assist operators and contractors in the management of this inherent risk.

13/06/2003

BLOWOUTS.DOC

Page 6

Blowouts


3.

BLOWOUT FREQUENCY ESTIMATION

3.1

Offshore - Joint Industry Project (Scandpower) [1]

Rev 0

From the information collated in the databases referenced in Section 2.1 it is possible to obtain a coarse estimate of historical blowout frequencies. In 1993 Scandpower A/S were sponsored by a group of operators to undertake a rigorous assessment of blowout frequencies with the following objectives: -

identify and document changes in the technology and operational procedures used over the last 10-15 years during the different drilling and well intervention activities;

-

identify and describe the parameters which are significant contributors to the probability of a blowout;

-

to develop a differentiated PC-model for estimating site specific blowout frequencies.

Two phases of the work programme have been completed with a third phase in 1995. 3.1.1

Blowout Frequency

Scandpower carried out a comparison of the SINTEF and WOAD databases. A number of discrepancies were identified which have largely been resolved. The SINTEF database was selected for the work for exploration drilling, development drilling, completions, production, workover and wireline. Tables 4 - 9 give the estimated blowout frequencies. Figures 1 and 2 give a predicted regression line for exploration and development drilling. For exploration and development drilling the blowout frequencies are divided into shallow gas and deep hole blowout frequency .

13/06/2003

BLOWOUTS.DOC

Page 7

Blowouts


Rev 0

EXPLORATION DRILLING 140

Blowour Frequency (*10^4)

120 100 80 Blowout Freq

60

Regression Freq

40 20 0 1980

1982

1984

1986

1988

1990

1992

Year

FIGURE 1:

Blowout Frequencies per 10 000 Exploration Wells drilled in the US GoM OCS and the North Sea together with the associated Linear Regression Line

DEVELOPMENT DRILLING 100

Blowout Frequency (*10^4)

90 80 70 60 Blowout Freq

50

Regression Freq

40 30 20 10 0 1980

1982

1984

1986

1988

1990

1992

Year

FIGURE 1:

13/06/2003

Blowout Frequencies per 10 000 Development Wells drilled in the US GoM OCS and the North Sea together with the associated Linear Regression Line

BLOWOUTS.DOC

Page 8

Blowouts


Rev 0

EXPLORATION Table 4:

Number of Blowouts, Wells Drilled and Blowout Frequencies per 10,000 Exploration Wells Drilled [1]

Year

Exploration Drilling No. of Blowout Frequency (per 104 wells drilled) Wells Shallow Deep Deep Drilled Gas

No. of Blowouts

Shallow Gas 1980

2

2

360

56

56

1981

2

1

422

47

24

1982

1

-

480

21

-

1983

4

1

413

197

24

1984

4

2

549

73

36

1985

4

1

561

71

18

1986

-

-

400

-

-

1987

1

2

401

25

50

1988

-

2

528

-

38

1989

4

1

444

90

23

1990

4

1

527

76

19

1991

1

3

431

23

70

1992 Total

27

16

265 5,781

47

28

13/06/2003

BLOWOUTS.DOC

Page 9

Blowouts


Rev 0

DEVELOPMENT Table 5: Number of Blowouts, Wells Drilled and Blowout Frequencies per 10,000 Development Wells. [1]

Year

Development Drilling No. of Blowout Frequency (per 104 wells drilled) Wells Shallow Deep Deep Drilled Gas

No. of Blowouts

Shallow Gas 1980

1

-

800

13

-

1981

-

1

830

-

12

1982

4

2

785

51

25

1983

5

3

853

59

35

1984

1

-

874

11

-

1985

1

1

755

13

13

1986

-

1

556

-

18

1987

-

1

613

-

16

1988

-

1

816

-

12

1989

3

1

657

46

15

1990

2

1

806

25

12

1991

2

1

617

32

16

1992 Total

19

1 14

551 9,513

20

18 15

COMPLETION Table 6: Number of Blowouts, Wells Completed and Blowout Frequencies per 10,000 Wells Completed. [1]

Period No. of Blowouts 1980-84 1985-89 1990-92 Total

13/06/2003

6 1 7

Completion No. of wells completed 3,046 2,464 1,531 7,041

BLOWOUTS.DOC

Blowout frequency (per 104 wells) 20 4 10

Page 10

Blowouts


Rev 0

PRODUCTION Table 7: Number of Blowouts, Well Production Years and Blowout Frequencies per 10,000 Production Well Years. [1]

Period No. of Blowouts

1980-84 1985-89 1990-92 Total

2 4 6

Completion No. of wells Blowout frequency completed (per 104 production well years) 43,113 42,136 27,471 112,720

0.5 0.9 0.5

WORKOVER The workover blowout frequency (Table 8) has an additional column that presents the frequencies of blowouts per 10,000 workovers by using an estimate of five years between each workover operation on a single well. Table 8: Number of Blowouts, Well Years and Blowout Frequencies during Workover. [1]

Year No. of Blowouts 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 Total

13/06/2003

2 3 1 1 2 1 1 1 3 3 1 19

Workover No. of Well Blowout Freq. Years per 10,000 well years 7,746 2.24 8,909 9,690 3.10 9,061 1.10 1.20 8,468 8,676 2.31 8,841 1.13 8,801 1.14 8,999 1.11 8,253 3.63 9,419 3.19 9,627 1.00 9,730 116,220 1.63

BLOWOUTS.DOC

Blowout freq. per 10,000 workovers 11 15 6 6 12 6 6 6 18 16 5 8

Page 11

Blowouts


Rev 0

WIRELINE The wireline blowout frequency (Table 9) also has an additional column that presents the frequency as blowouts per 10,000 wireline operations by using an estimate of 0.6 years between each wireline operation. Each wireline operation may involve a number of wireline entries. Table 9: Number of Blowouts, Well Years and Blowout Frequencies during Wire Line. [1]

Period No. of Blowouts 1980 - 84 1985 - 89 1990 - 92

3 1

Total

4

Workover No. of well Blowout freq. years per 10,000 well years 43,874 0.68 43,570 28,776 0.35 116,220

0.34

Blowout freq. per 10,000 wireline ops. 0.4 0.2 0.2

Figures 1 and 2 (regression lines for exploration and development drilling respectively) do indicate some improvement over the last 10 years. However the main conclusion drawn from the study is that in general technological and managerial developments have been counterbalanced by the tendency to operate in more demanding areas of harsh environment, deeper water and unknown geology. The study also identified that during the period three of the 13 exploration blowouts recorded in the UK and Norwegian Sectors originated from HPHT wells. Given that the corresponding total number of HPHT wells is only 82 it was concluded that HPHT wells should be considered separately. Excluding HPHT wells means that the regression frequency for exploration drilling in the year 1992 can be reduced by 20%. Only a very few HPHT development wells have been drilled in the UK and Norwegian sector with no blowout from such wells recorded. 3.1.2

Causes of Blowout

Drilling operations are complex. The experience of the participating companies in the Scandpower study was that a detailed breakdown of the causes of a blowout using conventional fault trees was not satisfactory. In the Scandpower study a very simple fault tree was developed as illustrated in Fig. 3. A series of "Adjustment Factors" were identified during interviews with drilling representatives from the participating companies. In total nearly 200 are used. These factors are given a weighting in terms of their criticality with respect to preventing a blowout and then a rating for a standard well was established. Adjusting this rating to reflect the site specific circumstances of a particular well forms the basis of a "Blowout Model". Further information is available in Ref. 1.

13/06/2003

BLOWOUTS.DOC

Page 12

Blowouts


Rev 0

3.1.3 Release Size and Duration Only a few of the records in the SINTEF database have any information on the blowout release rate and for those that do often a wide range of values are given. Any attempt to derive some sort of average flowrate would be misleading as the number calculated would almost certainly be dominated by a very few large releases. It is therefore concluded that at present a statistical approach to estimating blowout release rates using historical data is not appropriate. A deterministic approach therefore has to be employed which takes account of: -

the reservoir; the flowpath to the surface; the properties of the release fluids; the release orifice.

Blowout durations tend to be more accurately recorded, a summary of some of the results of the Scandpower work is as follows: Blowout Duration < 1 hr 1 hr - 1 day > 1 day 3.1.4

Approx % 25% 15% 60%

Release Location

Formation fluids can reach the surface via a number of routes which will vary depending on the well activity and whether the activity is taking place on a fixed jacket or a floater. For example, on floaters a significant percentage (approximately 50%) of blowouts have been subsea. In drilling from a fixed position the release point has been roughly equally likely to occur subsea, in the wellhead (+BOP) area, the diverter or the drill floor. During completion all releases have been through the drill floor. During production the majority of releases are in the wellhead and xmas tree area whilst for workovers the release is primarily through or above the drill floor. 3.1.5

Ignition Probability

The Scandpower study concluded that the overall probability of ignition is 0.17 with approximately 35% of ignitions occurring immediately (within 5 mins).

13/06/2003

BLOWOUTS.DOC

Page 13

Blowouts


Rev 0

Blowout Risk due to Offshore Operations

Blowout Model - Principles Blowout

Barrier

Kick

Human Error

Unavailability

Equipment Failure

Human Error

Adjustment Factors

13/06/2003

BLOWOUTS.DOC

Page 14

Human Error

Blowouts

3.2


Rev 0

Offshore - US Studies

In 1992 the US Department of the Interior Minerals Management Service published a report on accidents associated with oil and gas operations on the US Outer Continental Shelf (OCS) [2]. The OCS may be broadly defined as the submerged lands beyond three miles of the US coastline (including the Atlantic Ocean, Pacific Ocean, Artic Ocean and the Gulf of Mexico). From 1971 to 1990, 74 blowouts were identified: 40 during exploration drilling and 34 during development drilling. During the same period, 6610 exploration wells and 14,815 production wells were drilled Table 10 shows the fatalities associated with blowouts in the Gulf of Mexico from 1956 through 1986. Table 10: Gulf of Mexico Fatality Data [3] No. of Blowouts No. of Blowouts with Fatality Fraction of Blowouts with Fatality Total Number of Fatalities No. of Fatalities per Blowout

146 12 0.082 61 0.4

Table 11 [2] indicates the number of blowouts that occurred each year together with the number of wells drilled. Table 12 gives the corresponding average probability of a blowout during exploration drilling. The predicted values compare closely with those presented in 3.1. An earlier study [4] used several data sources to analyse blowout frequencies. These included blowout specialists, trade journals, Kuparuk field history, published technical reports and insurance companies. The blowout frequencies for workover and wireline operations were estimated as follows: -

Workover risk was based on Gulf of Mexico statistics that indicate that the blowout frequency was 2-4 x 10-4/operation

Wireline-related blowout frequency was based on the number of wireline-related blowouts and an estimate of the hours of wireline work performed. Three wireline-related blowouts occurred during a 3.5 year survey period that included 275,000 wells in the non-communist world. Assuming 40 hours of wireline work per well-year a wireline-related blowout frequency range of 0.2 - 1 x 10-7/wireline-hour is estimated.

13/06/2003

BLOWOUTS.DOC

Page

15

Blowouts


Rev 0

Table 11: Offshore US Blowout Data [2] (1971-1990)

Year

Offshore Wells

1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 TOTAL

884 993 888 830 1028 1028 1217 1197 1260 1272 1476 1464 1270 1421 1247 898 709 866 746 704 21425

Offshore Blowouts 2 3 3 1 4 5 4 9 5 4 3 4 7 5 2 1 4 1 5 2 74

Wells per Blowout 442 331 296 830 257 206 304 133 252 318 492 366 181 284 637 898 177 866 149 152 290 (avg.)

Table 12: Historical Offshore US Blowout Probability [2] (1971-1990)

No. of Wells No. of Blowouts Wells/Blowout Probability

13/06/2003

Total

Exploration

Production

21425 74 290 (avg.)

6610 40 165

14815 34 436

0,0035 (avg)

0.0061

0.0023

BLOWOUTS.DOC

Page

16

Blowouts

3.3


Rev 0

E&P Forum - Hydrocarbon Leak and Ignition Database [9]

3.3.1 Introduction Technica hold a large database of blowout incidents in-house. The database covers mainly the North Sea and the Gulf of Mexico and comprises some 176 (mostly exploration drilling) incidents and over 140,000 well years of exposure. This database has been used in this project to predict blowout frequencies. 3.3.2 Production Blowouts 3.3.2.1 Definitions A production blowout in this database is defined as a blowout occurring with the Xmas tree connected to the wellhead. This comprises the following operations: -

regular production (a normal producing well, no intervention); maintenance/repair; coiled tubing operations; snubbing operations; wireline operations; well killed or otherwise shut in.

The events in the database are divided into sub-categories according to their consequences and well control success. Two frequencies are defined here: -

frequency of well control problems (ALL); frequency of uncontrolled blowouts (UBO).

All events in the database fall under the category of well control problems, while events in which the release was minor or the release was quickly controlled (ie. well shut in eg. by the normal safety equipment) are excluded from the category of uncontrolled blowouts. Events in this last category are the ones normally associated with the term blowout. 3.3.2.2 Population The majority of wells in the database are located in the Gulf of Mexico (approx. 90%). The remainder of the wells are located in UK, Norway, the Netherlands and Denmark. In total 86,606 oil wells years and 57,796 gas well years have been registered. The period covered in the database is 1970 through 1989. 3.3.2.3 Events A total of 21 well control problems were registered in the period. Five of these have been excluded because: -

3 events were caused directly by hurricanes and should be modelled as extreme weather consequences; 1 event was caused by a ship collision (single well jacket) and should be modelled as a ship collision consequence; 1 event was a knock-on event from an explosion in the wellhead area and should be modelled as consequences (escalation) of other hydrocarbon leaks.

Fourteen of the well control events have been recognised as uncontrolled blowouts. 13/06/2003

BLOWOUTS.DOC

Page

17

Blowouts


Rev 0

Table 13: Distribution by Well Medium and Blowout Category [9] MEDIUM

Cat. ALL

Cat. UBO

Gas Oil Gas and Oil Other/Unknown

10 1 3 2

8 1 3 2

TOTAL

16

14

3.3.2.4 Frequencies The following adjustments were made before estimation of frequencies: -

other/unknown blowouts are discarded (could be sulphur, water, etc); gas and oil blowouts are counted as oil blowouts.

Table 14 presents the resulting frequencies from the above analysis. Table 14: Frequency of Blowouts During Production (1/producing well year) [9] WELL TYPE

Cat. ALL

Cat. UBO

OIL GAS

4.6 x 10-5 1.7 x 10-4

4.6 x 10-5 1.4 x 10-4

3.3.2.5 Release Location The release location is important for modelling of consequences in QRA. Table 15 shows the relative split by location. Three categories of release locations are defined and used here: -

subsea: gas/oil flows outside casing and emerges on the seabed; Xmas tree/wellhead: gas/oil blowouts in the wellhead area; skid deck: gas/oil blowouts on deck where wireline etc. operations are performed (usually one level above the wellhead area).

Table 15: Release Location for Production Blowouts [9] RELEASE LOCATION Subsea Xmas tree/wellhead Skid deck

13/06/2003

Cat. ALL

Cat. UBO

20% 60% 20%

22% 61% 16%

BLOWOUTS.DOC

Page

18

Blowouts

3.3.3


Rev 0

Blowouts During Workover

3.3.3.1 Definitions In this database a Workover is defined as a well intervention where the Xmas tree has been removed. The events in the database are divided into subcategories according to their consequences and well control success. Two frequencies are defined here: -

frequency of well control problems (ALL); frequency of uncontrolled blowouts (UBO).

All events in the database fall under the category of well control problems, while events in which the release was minor or the release was quickly controlled (ie. well shut-in eg. by the normal safety equipment) are excluded from the category of uncontrolled blowouts. Events in this last category are those normally associated with the term blowout. 3.3.3.2 Population The same well population as for production blowouts is used. The preferred way to express the frequency of a blowout during workovers is per workover. To achieve this we need to estimate the number of workovers done on the wells in the population. We have assumed that a major well intervention (workover) has been performed every 7th well year. This gives a total of 12,372 workovers on oil wells and 8,267 workovers on gas wells. 3.3.3.3 Events A total of sixteen well control problems have been identified during workovers. Twelve of these are uncontrolled blowouts. Table 16 shows the split by medium for the 16 events. Table 16: Distribution by Well Medium and Blowout Category [9] MEDIUM Gas Oil Gas and Oil Other/unknown TOTAL

Cat. ALL 10 1 4 1 16

Cat. UBO 6 1 4 1 12

3.3.3.4 Frequencies The following adjustments were made before estimation of frequencies: -

other/unknown blowouts are discarded (could be sulphur, water, etc); gas and oil blowouts are counted as oil blowouts.

Table 17 presents the frequencies.

13/06/2003

BLOWOUTS.DOC

Page

19

Blowouts


Rev 0

Table 17: Frequency of Blowouts during Workover (per workover) [9] WELL TYPE

Cat. ALL

Cat. UBO

OIL GAS

4.0 x 10-4 1.2 x 10-3

4.0 x 10-4 7.3 x 10-4


subsea: gas/oil flows outside casing and emerges on the seabed;

-

Xmas tree/wellhead: gas/oil blowouts in the wellhead area;

-

drill floor: gas/oil blowouts on drill floor.

Table 18: Release Location for Blowouts During Workover [9] RELEASE LOCATION

Cat. ALL

Cat. UBO

Subsea

5%

7%

Xmas tree/wellhead

26%

29%

Drill floor

69%

64%

3.3.4

Blowouts During Development Drilling

3.3.4.1 Definitions Development drilling starts when the well is spudded is set and ends when production casing is set. The events in the database are divided into sub-categories according to their consequences and well control success. Two frequencies are defined here: -

frequency of well control problems (ALL) frequency of uncontrolled blowouts (UBO).

All events in the database fall under the category of well control problems, while events in which the release was minor or the release was quickly controlled (ie well shut in eg. by the normal safety equipment) are excluded from the category of uncontrolled blowouts. Events in this last category are those normally associated with the term blowout.

13/06/2003

BLOWOUTS.DOC

Page

20

Blowouts


Rev 0

3.3.4.2 Population The population consists of 17,271 wells drilled in US (OCS) and the North Sea. The majority of the wells are from the US (85%). 3.3.4.3 Events A total of 39 well control problems have been identified during workovers. Of these, only 28 are considered uncontrolled blowouts. 3.3.4.4 Frequencies The blowout frequencies during development drilling are as follows: -

2.3 x 10-3 per well drilled; 1.6 x 10-3 per well drilled.

all well control problems: uncontrolled blowouts:


subsea: gas/oil flows outside casing and emerges on the seabed; wellhead: gas/oil blowouts in the wellhead area; drill floor: gas/oil blowouts on drill floor (including BOP, diverter, shale shaker etc.).

Table 19: Release Location for Blowouts During Development Drilling [9] RELEASE LOCATION Subsea Wellhead Drill floor 3.3.5

Cat. ALL 23% 9% 68%

Cat. UBO 22% 9% 69%

Blowouts During Completion

3.3.5.1 Definition The completion phase includes the final phases of a development well. For the purpose of this database it is defined as starting with running the tubing and ending with well hook-up and commissioning. 3.3.5.2 Population The well experience consists of 17,271 wells drilled in US (OCS) and the North Sea. The majority of the wells are from the US (85%). 3.3.5.3 Events A total of twelve well control problems have been identified during completion. Of these, only nine are considered uncontrolled blowouts.

13/06/2003

BLOWOUTS.DOC

Page

21

Blowouts


Rev 0

3.3.5.4 Frequencies The blowout frequencies during completion are as follows: -

all well control problems: uncontrolled blowouts:

7.0 x 10-4 per completion 5.4 x 10-4 per completion

3.3.5.5 Release Location The release location is important for modelling of consequences in QRA. Table 20 shows the relative split by location. Three categories of release locations is defined and used here: -

wellhead: gas/oil blowouts in the wellhead area; Xmas tree: gas/oil blowouts in the Xmas tree area; drill floor: gas/oil blowouts on drill floor (including shale shaker etc).

Table 20: Release Location for Blowout During Completion [9] RELEASE LOCATION

Cat. ALL

Cat. UBO

Wellhead Xmas tree Drill floor

74% 13% 13%

80% 10% 10%

3.4

Onshore - US Studies

Tables 21 and 22 [5] list the blowouts per year from 1970 to 1992 for the State of Texas. As can be seen, onshore blowout probability is less than offshore blowout probability. The predicted frequencies are significantly less than those predicted for offshore. [4] also provides frequencies for some other potential causes of blowouts onshore. Airplane crash: A blowout resulting from an aircraft crash was considered possible at Kuparuk because of the proximity of the wells to a busy airstrip that serves large jet aircraft. Although no blowout has occurred due to an air crash, a failure rate was determined from studies performed at Sandia National Laboratories. >5 miles from airport < 5 miles from airport

3 x 10-9/well-year -6 6.6 x 10 /well year

Derrick collapse: Because of the relatively close spacing (60 to 120ft) of wellheads on the pads in the Kuparuk field, a blowout frequency due to derrick collapse was determined. The derrick collapse failure rate (one rig collapse per 4,000 rig years) was determined based on historical data from rigs companies. Derrick collapse

13/06/2003

-5

1 x 10 /well year

BLOWOUTS.DOC

Page

22

Blowouts


Rev 0

The reader should note that the ‘Mechanical Lifting Failures - Dropped Objects’ datasheet, indicates that the failure rate for an offshore derrick structure is 3.4 x 10-5, an order of magnitude difference on the above. 3.5

Onshore - ERCB Database

Whilst all the information needed to derive blowout frequencies is available, the authors are not aware of any publicly available analysis. Table 21: Onshore Texas Blowout Data [5] (1970-1992) Year 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 TOTAL

Wells 7802 7487 8073 8380 9888 12874 12286 14451 15145 14994 19173 25465 24615 23181 26417 23029 12830 10887 9383 7970 7086 8690 7462 317568

Blowouts 7 3 3 7 12 9 8 12 27 27 38 33 24 18 23 25 15 11 7 4 13 6 4 336

Table 22: Historical Onshore Texas Blowout Probability [5] (1970-1992) Total Onshore Texas Year No. of Wells No. of Blowouts Wells/Blowout Probability

13/06/2003

70-92 317568 336 945 0.0011

70-79 111380 115 969 0.001

BLOWOUTS.DOC

80-92 206188 221 933 0.0011

Page

23

Blowouts


Rev 0

REFERENCES [1]

"Blowout Risk Modelling", ASME Paper No. OMAE-95-1332, December 1994.

[2]

"Accidents Associated with Oil and Gas Operations, Outer Continental Shelf 19561990" MM5 92-0058, US Department of the Interior, Minerals Management Service, October 1992.

[3]

Minerals Management Service, OCS Report MMS 88-001

[4]

"Subsurface Safety Valves: Safety Liability", J M Busch, et al, Journal of Petroleum Technology, pp1813 - 1818, October 1985.

[5]

Texas Railroad Commission Reports

[6]

API Petroleum Data Book (1993)

[7]

"World Offshore Accident Database". DNV Technica Norge, PO Box 300, N-1322 Hovek, Norway.

[8]

"SINTEF Offshore Blowout Database". Trondheim, Norway.

[9]

“Hydrocarbon Leak and Ignition Database”, E&P Forum, 1992.

13/06/2003

BLOWOUTS.DOC

SINTEF Safety and Reliability, 7034

Page

24

Blowouts


13/06/2003

BLOWOUTS.DOC

Rev 0

Page

15

Dropped Objects


Rev 0

MECHANICAL LIFTING FAILURES DROPPED OBJECTS

13/06/2003

DROPPOBJ.DOC

Page 1

Dropped Objects


Rev 0

TABLE OF CONTENTS

1.

SUMMARY -------------------------------------------------------------------------------------------- 3 1.1 Scope--------------------------------------------------------------------------------------------------------------------------3 1.2 Application ------------------------------------------------------------------------------------------------------------------3

2.

KEY DATA---------------------------------------------------------------------------------------------- 3

REFERENCES-------------------------------------------------------------------------------------------- 12

13/06/2003

DROPPOBJ.DOC

Page 2

Dropped Objects

1. 1.1


Rev 0

SUMMARY Scope

This data sheet gives information about incidents resulting from the unsafe use or failure of cranes and other lifting devices. Specifically, it focuses on dropped object and swinging load accidents that could lead to the release of hydrocarbon, the damage of assets, or the physical harm of personnel. 1.2

Application

The datasheet provides dropped load frequencies. In practice, risk assessments also consider other numerical inputs apart from purely dropped load frequency. For example, probabilities are often applied to account for other case-specific factors even though there may be no published data available. Some examples of these factors are: • • • •

Crane loading distribution including consideration of number of lifts per week and the time duration of the lifts Probability of hydrocarbon release and ignition upon impact Probability of target impact: pipework, structure, equipment Probability of deck penetration

2. KEY DATA Serious Incidents Due to Dropped Objects and Swinging Loads (UK North Sea) Table 1 is the result of a study performed by the Health & Safety Executive on incidents surrounding lifting and rigging operations. The values in Table 1 were obtained from the Department of Energy/HSE ‘Safety’ database (Reference 1) on all recorded incidents involving cranes over the period 1981 to the end of September 1992. Records are based on incidents reported under the OIR9A reporting scheme. The database contained details of some 1160 incidents. Many of the incidents were of a relatively minor nature. Consequently the data was analyzed by the HSE to identify more “serious” incidents where it was believed that the potential existed for escalation into a significant event involving death or serious injury. Therefore, the analysis inevitably involved a degree of subjectivity as to which incidents had the potential to escalate to a “serious” incident. In many cases this issue was fairly clear-cut. In order to calculate incident frequencies on a per installation year basis, details of the number of installations (fixed and mobile) operating in each of the years was also required. Information for the years 1981 to 1990 were taken from the Department of Energy ‘Brown Book’. However, due to a change in format, the ‘Brown Book’ does not give equivalent figures for 1991 and 1992 and estimates had to be made for those years. The frequencies are calculated on a ‘per installation year’ basis.

13/06/2003

DROPPOBJ.DOC

Page 3

Dropped Objects


Rev 0

Incidents classed as “serious” were further sub-divided into incidents where: a. b. c.

impact was on the installation itself the dropped object fell into the sea (and hence could have impacted subsea equipment) the impact occured on a supply vessel

Incidents were further sub-divided by the type of lifting device involved. The types considered were: a. installation main cranes (pedestal cranes) b. derrick cranes (It is believed this category included crane barges working at or near an installation. An accident on a crane barge in transit is not believed to be included.) c. other fixed lifting devices e.g., lifting beams (including trolley cranes/hoists) d. portable lifting devices (e.g., chain blocks/slings etc.)

13/06/2003

DROPPOBJ.DOC

Page 4

Dropped Objects


Rev 0

Table 1: Serious Dropped Objects and Swinging Load Incidents (UK North Sea) [1] (Includes Fixed Installations, Jackups, Semi-subs) Year

Inst’n Year

Main Cranes

Derrick Cranes

Other Fixed Cranes

Impact

Freq

Fall

Freq

Impact

Freq

Impact

Freq

Fall

Freq

on

per

to

per

on

per

on

per

to

per

on

Inst’n

Year

Sea

Year

Vessel

Year

Inst’n

Year

Sea

Year

1

0.011

81

89

6

0.067

6

0.067

4

0.045

82

97

6

0.061

9

0.093

4

0.041

83

108

7

0.065

3

0.028

2

0.018

84

133

11

0.082

4

0.030

10

0.075

85

140

5

0.036

3

0.021

3

0.021

86

145

4

0.027

5

0.034

3

0.020

2

0.014

87

138

9

0.065

2

0.014

3

0.022

2

0.013

88

182

6

0.033

3

0.016

2

0.011

4

0.022

89

191

6

0.031

3

0.016

3

0.016

1

0.005

90

200

4

0.019

1

0.005

3

0.015

3

0.015

91

200(a)

10

0.050

2

0.010

1

0.005

2

0.010

92

150(a)

5

0.033

3

0.020

3

0.020

SUM

1777

79

0.044

44

0.025

41

0.023

2

0.018

5

0.051

1

0.009

1

17

0.010

1

Impact Freq

Total

Avg. Freq.

Fall

Freq

Impact

Freq

Fall

Freq

No.

per

per

to

per

on

per

to

per

of

installation

Inst’n

Year

Sea

Year

Inst’n

Year

Sea

Year

Inc.

year

3

0.034

1

0.011

21

0.236

3

0.031

28

0.289

22

0.204

29

0.218

12

0.086

1

0.010

1

0.009

5

0.046

1

0.007

3

0.022

1

0.009

0.007

0.007 3

1

Portable Devices

0.016

0.005

1

0.005

1

0.007

3

0.020

10

0.006

12

0.007

1

n/a

1

0.007

15

0.103

1

0.007

18

0.130

5

0.027

23

0.280

1

0.005

15

0.078

1

0.005

12

0.059

16

0.080

16

0.107

227

0.128

1

0.007

22

0.012

1

n/a

Notes: (a) Estimates. INCIDENTS:

13/06/2003

TOTAL TO INSTALLATION = 130 TOTAL TO SEA = 56 TOTAL TO VESSEL = 41 AVERAGE INCIDENTS PER YEAR, ‘81 - ‘86 = 21 AVERAGE INCIDENTS PER YEAR, ‘87 - ‘92 = 17

DROPPOBJ.DOC

AVG. FREQ. = 0.073 per installation year AVG. FREQ. = 0.031 per installation year AVG. FREQ. = 0.023 per installation year AVG. FREQ. = 0.19 per installation year AVG. FREQ. = 0.10 per installation year

Page 5

Dropped Objects


Rev 0

Frequency of Major Mechanical Failures of Secondary Structures (Worldwide, ‘70-’94) The data provided in Tables 2-4 are from WOAD (Reference 2) and an E&P Forum member source [3]. The types of failures which are considered in Table 2 are catastrophic failures which could be the top events in a risk assessment. Blowouts and fires in drilling facilities that lead to derrick collapse are not included. For the frequency of derrick failures presented in Table 2, no specific data were found on structural failures. However, since both crane towers and derricks are tall structures supporting irregular loads, it is proposed that the failure frequency for crane towers could be applied to derrick structures. Reference [3] indicates that the failure rate of a crane tower is 18% of the total failure rate for cranes. Applying this proportion to the WOAD historical rate for severe plus significant damage on a fixed platform of 0.187 x 10-3 /Unit yr, a failure rate for the tower would be 0.034 x 10-3 /Unit yr. Therefore, rate proposed for failure of a derrick is 0.034 x 10-3 /Unit yr. Table 2: Frequency of Major Mechanical Failures of Secondary Struct. (Worldwide,’70-’94) Secondary Structure Crane

Derrick

Frequency of Failure (x10-3/Unit yr) 0.187 [2]

0.034 [3]

Included Tower or jib collapse. Total failure of lifting devices during lifting

Collapse of derrick structure

Not Included Noncatastrophic failure of mechanical component Blowout or fire in drilling facilities

Freq. of Structural Damage per Unit Year Due to Crane Accidents (Worldwide, ‘70-’94) Data presented in Table 3 comes from the WOAD databank [2] which provides information on crane accidents as a separate category. The frequencies of severe and significant structural damage due to crane accidents are given. It is not clear whether or not the data in Table 3 includes crane barges. The definition of Severe and Significant Structural Damage as given in WOAD is: • •

Severe structural damage implies serious damage to several modules of the unit. In the case of mobile units this damage can hardly be repaired on site. The cost of damage is typically above 2 million USD. Significant structural damage implies serious damage to module, local area of unit, or minor structural damage to the unit itself. The cost of the damage is typically in the range of 0.9-2 million USD.

13/06/2003

DROPPOBJ.DOC

Page 6

Dropped Objects


Rev 0

Table 3: Number of Accidents and Frequency of Structural Damage per Unit Year due to Crane Accidents (Worldwide, ‘70 - ‘94) [2] Type of Unit Accident Severity

No. of Accidents Installation Years Frequency (10-3/Unit yr)

Severe

Fixed Units Significant

1 0.01

17 96,255 0.177

Total

Severe

18

2

0.187

0.186

Mobile Units Significant

22 10,781 2.04

Total

24 2.23

All (Fixed + Mobile) 42 107,136 0.39

Types of Crane Accidents and Estimated Frequencies (Worldwide, ‘70-’94) Reference [3] provides annual rates for crane accidents (including crane falls, boom falls, and load falls) on a floating production platform. However, these frequencies are high compared to those derived from WOAD in Table 3. Nevertheless, the distribution (i.e., percentages) between different types of crane accident may be helpful in risk analysis. Therefore, the suggested distribution in Reference 3 has been applied to the WOAD figures given in Table 3 to produce the breakdown in Table 4. Table 4: Types of Crane Accidents and Estimated Frequencies (Worldwide, ‘70-’94) Type of Accident Crane Fall Boom Fall Load Fall All (Ref. 2)

13/06/2003

% Distribution (Reference 3) 19% 54% 27% 100%

Frequencies (x10-3/ Unit yr) Fixed Units Mobile Units 0.036 0.42 0.101 1.21 0.050 0.60 0.187 2.23

DROPPOBJ.DOC

All 0.07 0.21 0.11 0.39

Page 7

Dropped Objects


Rev 0

Reported Failures Rates for Cranes on Fixed Platforms in the UK Sector of the North Sea Information found in Tables 5 and 7 comes from two sources. The first by DEn [4] is a compilation of descriptions of accidents in the UK sector of the North Sea. The second by Noble Denton [5] provides recommendations for potential developments in the North Sea. The values in Table 5 are from DEn accident reports for the UK sector of the North Sea. They include a large number of non-injury incidents, described as DIs. The data is entered in two ways; classified by type of incident (DI, SA, or FA) and by cause (EF, LH, FI, or OT). The population of cranes in the UK sector of the North Sea [5] was obtained and converted to crane years using the year when production started for each installation. Crane years for installations starting production in a year are included in the exposure for that year, assuming that platform cranes will be extensively used during commissioning and drilling. Table 5a Base Data for the Dervication of Frequencies [5]: Year 1980 1981 1982 1983 1984

Platform Population 116 122 126 138 156

Year

Platform Population

1985 1986 1987 1988 Total Platform Years

167 172 180 192 1369

Table 5b: Reported Failure Rates for Cranes on Fixed Platforms in the UK North Sea [4,5] Failure Code

Description

Number of Incidents

Failure Rate 1 (x10-6/hr)

Equipment Failure Lifting/handling Fire Other Failures

121 40 3 8

11.1 3.7 0.3 0.7

Dangerous Incidents Serious Accidents Fatal Accidents

157 14 1

14.3 1.3 0.1

Cause EF LH FI OT Incident Type DI SA FA 1

The Failure Rate (or frequency) was determined as shown below using the crane population data from [6].

For example: Failure Rate for EF Total Crane Years = 1369 x 2 = 2738 (Assuming 2 cranes/platform) Assuming 4000 hr/year of crane operation, Time in service = 2738 x 4000 = 10.95 x 106 hours of crane operation. Failure Rate for EF = 121/(10.95x106) = 11 x 10-6 /hr of crane operation. The UK Department of Energy defines a Serious Accident as one that involves injury to person(s), whereas, a Dangerous Incident is a “near-miss” incident.

13/06/2003

DROPPOBJ.DOC

Page 8

Dropped Objects


Rev 0

Failure Rate of Diesel Hydraulic Driven Cranes Table 6 gives the failure rate for dropped loads for diesel hydraulic driven cranes used on offshore platforms. The majority of offshore cranes are of this type. The data in Table 6 was obtained from [6] which only covers a small proportion of the total population, yet is the only data source known. Table 6: Failure Rate for Diesel Hydraulic Driven Cranes Failure Mode Load Droppage

Failure Rate (per 106 hours) 11

The data in Table 6 were based on a population of 21 cranes on 20 different installations. UK North Sea Crane Accident Data by Severity and Cause The values in Table 7 are provided by the UK DEn [4] and summarize the accidents in the UK sector of the North Sea. These are available for the period 1981-mid 1985. An analysis has been done of all reports involving cranes, differentiating between fatal accidents, serious accidents and dangerous incidents. Table 7: UK North Sea Crane Accident Data by Severity and Cause [4] Installation Year Type 1981 Fixed Mobile 1982 Fixed Mobile 1983 Fixed Mobile 1984 Fixed Mobile 1985 Fixed (part) Mobile Total Fixed Mobile All

13/06/2003

Number of Incidents (Severity) TOT DI SA FA 22 21 1 0 7 7 0 0 50 48 2 0 3 3 0 0 22 18 3 1 17 12 5 0 55 50 5 0 11 10 1 0 23 20 3 0 3 3 0 0 172 157 14 1 41 35 6 0 213 192 20 1

Number of Incidents (Causes) EF LH OT FI 15 4 3 0 6 1 0 0 39 6 3 2 3 0 0 0 15 7 0 0 10 7 0 0 32 20 2 1 6 5 0 0 20 3 0 0 3 0 0 0 121 40 8 3 28 13 0 0 149 53 8 3

DROPPOBJ.DOC

Page 9

Dropped Objects


Rev 0

Relative Breakdown of Crane Accidents by Severity (UK North Sea) Table 8 below gives a relative breakdown of crane accidents by severity for the UK North Sea for the period from 1980 to 1990. These crane accidents include both fixed and mobile installations. This information was obtained from the UK Department of Energy “Brown Book” [7], and differs only slightly from that in Table 7 for the years 1981 through 1984. However, no breakdown of the incidents by cause is available from this reference. Table 8: UK North Sea Crane Accident Data by Severity 1980 - 1990 [7] Number of Incidents (Severity)

Total

Year

FA

SA

DI

Incidents

1980

1

4

32

37

1981

0

1

29

30

1982

0

3

50

53

1983

1

6

32

39

1984

0

6

62

68

1985

0

8

52

60

1986

2

6

48

56

1987

0

0

20

20

1988

3

1

25

29

1989

0

2

49

51

1990

0

4

37

41

Total

7

41

436

484

Avg ‘80-’90

0.7

4

44

48

Platform Crane and Drilling Rig Derrick Accident Data by Cause (US Gulf of Mexico) The incidents found in Table 9 were taken from the MMS (Reference 8) and summarize offshore oil and gas operation incidents in the Gulf of Mexico between 1956 and 1990. The incidents include structural failures of the crane that resulted in dropped loads (e.g., failure of a chord, crane cab connection, slings) up to total collapse. Populations were taken from reports by the Offshore Oil Scouts Association [9]. However, where data for a given year was not available, the population was determined by interpolating between those years where data was available. Table 9:US Gulf of Mexico Platform Crane & Drilling Rig Accident Data by Cause (1956-‘90) Total Period

‘56-90

Platform Incidents

Totals

Average

Inst’n

No. of

Freq. of

No. of

Freq. of

No. of

Freq. of

No. of

Freq. per

Years

Crane

Crane

Rigging

Rigging

Human

Human

Incidents

Installation

Failures

Failures

Failures

Failures

Errors

Errors

12

4.9E-04

19

7.7E-04

5

2.0E-04

24741

13/06/2003

DROPPOBJ.DOC

Year 36

1.5E-03 Page 10

Dropped Objects


Total Period

‘56-90 Note:

Rev 0

Drilling Rig Incidents

Totals

Average

Inst’n

No. of

Freq. of

No. of

Freq. of

No. of

Freq. of

No. of

Freq. per

Years

Derrick

Derrick

Rigging

Rigging

Human

Human

Incidents

Installation

Failures

Failures

Failures

Failures

Errors

Errors

2

5.9E-04

18

5.3E-03

1

3.0E-04

3368

Year 21

6.2E-03

All frequencies are on a per installation year basis. Number of failures was determined from Reference 8. The platform population and installation years was determined from [9]

13/06/2003

DROPPOBJ.DOC

Page 11

Dropped Objects


Rev 0

REFERENCES 1.

J. N. Edmondson and T. Norman, “An Examination of the Number and Frequency of Serious Dropped Object and Swing Load Incidents Involving Cranes and Lifting Devices on Offshore Installations for the Period 1981-1992,” Offshore Technology Report - OTN 93 222, Health & Safety Executive, Sept. 1993.

2.

WOAD - World Offshore Accident Databank, Statistical Report, 1994, Veritec, Norway.

3.

E&P Forum Member, 1985.

4.

UK Department of Energy Accident Summaries, 1981-1985.

5.

Noble Denton North Sea Field Development Guide, through 1988.

6.

OREDA-92 - Offshore Reliability Data, 2nd Edition, DNV Technica.

7.

UK Department of Energy “Brown Book”, 1981-1985.

8. Lloyd M. Tracy, “Accidents Associated with Oil and Gas Operations: Outer Continental Shelf 1956-1990”, US. Department of the Interior, Minerals Management Service, Oct. 1992. 9.

Offshore Oil Scouts Association, “Status of the Offshore Oil Industry & Statistical Review of Events”, Multiple Issues, through 1995.

13/06/2003

DROPPOBJ.DOC

Page 12

Dropped Objects

13/06/2003


DROPPOBJ.DOC

Rev 0

Page 13

Ship/Installation Collision


Rev 0

SHIP/INSTALLATION COLLISIONS

13/06/2003

Collisions.doc

Page 1



Rev 0

Table of Contents

1 INTRODUCTION-------------------------------------------------------------------------------------- 4 2 CATEGORIES OF COLLIDING VESSELS --------------------------------------------------- 5 2.1 Merchant Vessels ------------------------------------------------------------------------------------------------------ 7 2.2 Naval Traffic ----------------------------------------------------------------------------------------------------------- 7 2.2.1 Surface Traffic---------------------------------------------------------------------------------------------------------7 2.2.2 Submerged Submarine Traffic --------------------------------------------------------------------------------------7 2.3 Fishing Vessels --------------------------------------------------------------------------------------------------------- 8 2.4 Offshore Traffic ------------------------------------------------------------------------------------------------------- 8 2.4.1 External Offshore Traffic --------------------------------------------------------------------------------------------8 2.4.2 Field Related Offshore Traffic --------------------------------------------------------------------------------------8

3 HISTORICAL COLLISIONS --------------------------------------------------------------------- 10 3.1 Introduction ---------------------------------------------------------------------------------------------------------- 10 3.2 Passing Vessels ------------------------------------------------------------------------------------------------------- 10 3.2.1 Passing Vessel Collisions UK Continental Shelf -------------------------------------------------------------- 10 3.2.2 Passing Vessel Collisions Norwegian Continental Shelf ----------------------------------------------------- 11 3.2.3 Passing Vessel Collisions Dutch Continental Shelf ----------------------------------------------------------- 12 3.2.4 Passing Vessel Collisions German Sector----------------------------------------------------------------------- 12 3.2.5 Passing Vessel Collisions World Wide-------------------------------------------------------------------------- 12 3.2.6 Evaluation of Data - Passing Vessel Collisions ---------------------------------------------------------------- 13 3.3 Visiting Vessels------------------------------------------------------------------------------------------------------- 14 3.3.1 Introduction ---------------------------------------------------------------------------------------------------------- 14 3.3.2 Operational Exposure - UK Sector ------------------------------------------------------------------------------- 14 3.3.3 Reported Collision Incidents - UK Sector ---------------------------------------------------------------------- 14 3.3.4 Collision Frequency Per Installation-Year - UK Sector ------------------------------------------------------ 15 3.3.5 Collision Frequency Per Vessel Visit ---------------------------------------------------------------------------- 18 3.3.6 Collision Frequency Per Vessel Orientation -------------------------------------------------------------------- 19 3.3.7 Collision Causation Factors - Visiting Vessels----------------------------------------------------------------- 19 3.3.8 Evaluation of Data - Visiting Vessel Collisions---------------------------------------------------------------- 21

4 COLLISION FREQUENCY MODELLING --------------------------------------------------- 23 4.1 Introduction ---------------------------------------------------------------------------------------------------------- 23 4.2 Ship/Installation Collision Frequency Modelling ------------------------------------------------------------- 23 4.2.1 Important Factors Affecting Collision Frequency ------------------------------------------------------------- 23 4.2.2 Collision Frequency Models--------------------------------------------------------------------------------------- 25 4.3 Vessel Traffic Pattern and Volume ------------------------------------------------------------------------------ 25 4.3.1 General---------------------------------------------------------------------------------------------------------------- 25 4.3.2 Factors Affecting the Traffic Volume---------------------------------------------------------------------------- 25 4.3.3 How to get Traffic Data -------------------------------------------------------------------------------------------- 26

5 COLLISION CONSEQUENCES---------------------------------------------------------------- 27 5.1 General ---------------------------------------------------------------------------------------------------------------- 27

6 RISK REDUCING MEASURES----------------------------------------------------------------- 28 13/06/2003

Collisions.doc

Page 2



Rev 0

6.1 Use of Risk Reducing Measures ---------------------------------------------------------------------------------- 28 6.2 Overview of Risk Reducing Measures--------------------------------------------------------------------------- 28

7 RESEARCH AND DEVELOPMENT PROJECTS ----------------------------------------- 29 7.1 Introduction ---------------------------------------------------------------------------------------------------------- 29 7.2 UK Continental Shelf Shipping Traffic Database------------------------------------------------------------- 29 7.3 The Effectiveness of Collision Control & Avoidance Systems ---------------------------------------------- 29 7.4 Comparison of ship-platform collision frequency models. -------------------------------------------------- 30

8 REFERENCES -------------------------------------------------------------------------------------- 31

13/06/2003

Collisions.doc

Page 3


1


Rev 0

INTRODUCTION

This data sheet provides data on ship/installation collision risk in relation to activities within the offshore oil & gas Exploration and Production Industry. The risk related to icebergs are not considered. During the last decade, considerable attention has been given to the risk related to collisions between offshore oil and gas platforms and ships in the North Sea. Several research programs have looked into this problem and considerable steps have been taken to improve the modelling of these problems. Collision risk is highly location dependent due to variation in ship traffic from one location to another. The ship traffic volume and pattern at the specific location should hence be considered with considerable care. This dependency on location also means that use of historical data which are averaged over a large number of different locations, is not possible. Field related offshore traffic involve those vessels which are specifically visiting the unit, and are therefore considered to be less dependent of the location of the platform. This means that there will be smaller variation in the collision frequency from one platform to another, and it is possible to use historical data to a much greater extent than for the other collision types.

13/06/2003

Collisions.doc

Page 4


2


Rev 0

CATEGORIES OF COLLIDING VESSELS

Ship traffic may for this purpose be divided into two groups: •

EXTERNAL: Ship traffic which is not related to the installation being considered, including merchant vessels, fishing vessels, naval vessels etc.

•

FIELD RELATED: Offshore-related traffic which is there to serve the installation being considered, e.g. supply vessels, oil tankers, work vessels etc.

Collisions can be divided into two groups: •

Powered collisions ( Vessel steaming towards the installation )

•

Drifting collisions ( Vessel drifting towards the installation )

Powered collisions will cover situations like navigational/manoeuvring errors (human/technical failures), watch keeping failure, bad visibility/ineffective radar use, etc. A drifting vessel is a vessel which has lost its propulsion or has experienced a progressive failure of anchor lines or towline and is drifting only under the influence of environmental forces. In Table 2.1 the different types of vessels that may collide with the platform are shown.

13/06/2003

Collisions.doc

Page 5


Table 2.1


Rev 0

Categories of Colliding Vessels VESSEL CATEGORIES

TYPE OF TRAFFIC

TRAFFIC CATEGORY

VESSEL CATEGORY

REMARKS

EXTERNAL

Merchant

Merchant ships Cargo, ferries etc.

Commercial traffic passing the area

Naval traffic

Surface vessels

Both war ships and submarines

Submerged vessels

Submerged submarines

Fishing vessels

Fishing vessels

Sub-categorised into vessels in transit and vessels operating in the area

Pleasure

Pleasure vessels

Traffic passing the area

Offshore traffic

Standby boats

Vessels going to and from other fields

Supply vessels


Offshore tankers


Tow

Towing of drilling rigs, flotels, etc.

Standby boats

Dedicated standby boats

Supply vessels

Visiting supply vessels

Working vessels

Special services/support as diving vessels, etc.

Offshore tankers

Shuttle tankers visiting the field

FIELD RELATED

Offshore traffic

Each of the traffic categories are presented in the following sections, with an evaluation of relevant traffic patterns and vessel behaviour. Each traffic type behaves in one of several distinct ways in relation to a platform. This must be considered both when reviewing traffic data and when estimating collision frequency.

13/06/2003

Collisions.doc

Page 6


2.1


Rev 0

Merchant Vessels

Merchant vessels are frequently found to represent the greatest platform collision hazard, since: • • •

Merchant vessels are often large and may thus represent considerable impact energy. The traffic may be very dense in some areas. No prevailing influence by oil and gas operators.

In addition there is a problem of the uncertainties in the risk estimates which are higher than for many of the other vessel groups as merchant vessel operating standards vary in quality. 2.2

Naval Traffic

Estimating risk associated with naval vessels is a problem because information about movements and volume is restricted and hence difficult to obtain. Estimation very often has to be based on surveys or subjective evaluation. Further, the volume is difficult to assess since possible routes and areas where naval vessels operate/exercise can vary each year. The variation in traffic routes and density can also be dependent on the political situation. Naval traffic may be divided into two main categories, surface traffic (submarines included) and submerged traffic. 2.2.1 Surface Traffic As already mentioned, collisions are either due to drifting of the vessel or may occur while the vessel is under power (errant vessels). Drifting is less likely to happen with a naval vessel than with a merchant vessel because it is designed to operate under difficult conditions and thus with a high degree of reliability. A reduced probability of drifting combined with a relatively low number of vessels usually makes this scenario negligible, at least in relation to the overall collision risk. As regards collisions under power, this scenario can probably also be disregarded. These vessels have a large crew compared to merchant vessels. They will always have at least two persons on the bridge (large vessels like frigates, destroyers, carriers etc. will have more personnel on the bridge). Normally the operation room is also manned. Considering the number of personnel "on watch" it seems very unlikely that a naval surface vessel should not know of/detect the platform and avoid it compared to a merchant vessel. In addition, naval vessels are more likely to operate in groups, something which also will reduce the collision probability. Submarines operating on the surface are not considered to represent any higher threat to the platform than any other surface vessel. All in all, it is considered that the contribution to overall collision risk from such vessels is likely to be very low. 2.2.2 Submerged Submarine Traffic As for naval surface vessels, due to a reduced probability of drifting combined with a relatively low number of vessels, the contribution from drifting submarines to the overall collision risk is neglected. Submerged submarines are in a special situation because they do not have a look-out. Navigation is therefore completely dependent on electronic navigational aids and sonar. 13/06/2003

Collisions.doc

Page 7



Rev 0

A 550 ton, West German submarine collided with Norsk Hydro’s Oseberg B platform in March 1988 causing damage estimated at up to NOK 200 million. In connection with this accident, it was stated that it was often very difficult for submarines to detect platforms which do not emit much sound in the water. In principle submarines are officially restricted from operating in the immediate vicinity of offshore installation in times of peace. Nevertheless the Norsk Hydro incident shows a deviation from this principle. Some data on the submarine traffic have been collected [1]. An appropriate number of submarines in activity in the entire North Sea, at all times, seems to be in the region of 15 25. 2.3

Fishing Vessels

Fishing vessels are divided into two groups, depending on the operational pattern : • •

Fishing vessels can be in transit from the coast to and from different fishing areas. Secondly, the vessels may be fishing in an area. The vessel’s operation and behaviour during fishing ( primarily trawling) will be complex and varied, but usually at low speed and with no preferred heading.

Fishing vessels vary in size from large factory/freezer ships to smaller vessels operating near the coast. Typically, a large fishing vessel will have a displacement around 1000 tons. This implies that the collision energy will be less than 20 MJ. For a typical North Sea installation neither drifting vessels nor vessels under power will normally be able to threaten the integrity of the platform. However, the risers and other relevant equipment will have considerably less impact resistance. Powered as well as drifting fishing vessels will hence be considered and models for these scenarios have been developed. 2.4

Offshore Traffic

2.4.1 External Offshore Traffic Passing offshore vessels, tankers as well as supply, standby and work vessels are in many respects similar to passing merchant vessels, except that such vessel operations tend to be more aware of the offshore installations and also may benefit from EP Operator influence (procedure, training competency, communication etc.). Vessels or installations under tow pose particular problems which should be considered separately [1]. 2.4.2 Field Related Offshore Traffic The most frequent collisions/contacts occur between offshore supply vessels and the platform to which they are delivering supplies. Those impacts generally cause only minor damage, although significant impacts have been reported [2]. It is worth noting that e.g. the Norwegian and the UK criteria for design against vessel impacts have been derived from a probabilistic evaluation of supply vessel impacts [3, 4]. These collisions are therefore to a large degree taken care of in the platform design.

13/06/2003

Collisions.doc

Page 8



Rev 0

Generally, collisions with any sort of offshore-related traffic can be more easily controlled because the vessels are operated by the oil companies themselves, and they can impose restrictions on this traffic if it is deemed necessary.

13/06/2003

Collisions.doc

Page 9



3

HISTORICAL COLLISIONS

3.1

Introduction

Rev 0

The history of collision incidents can provide useful information concerning the nature of collision risk. The historical perspective is reviewed in the following sections. The following sources have been available: 1)

Lloyds’ List Casualty Reports entries - World-wide for offshore structures.

2)

Det Norske Veritas World Offshore Accident Database (WOAD) - World-wide.

3)

UK Health and Safety Executive Incident Reports - UK Sector.

4)

US Coastguard Platform Collision Incident Reports.

5)

Norwegian Petroleum Directorate Accident Database.

While historical reports can provide useful insight into collision data, the figures have to be used with great care. There is no obvious or clear threshold of incident severity for the reporting of collisions and no well defined data source population. The way in which the information is reported and the original purpose can substantially affect the end result. Sources used in this report are No. 2, 3 and 5 listed above. Updated reports from No. 1 and 4 have not been available for this study. 3.2

Passing Vessels

3.2.1 Passing Vessel Collisions UK Continental Shelf A report by the UK Health and Safety Executive (HSE) [5] identifies the following major collision incidents during the period from 1973 through 1993. Table 3.1 Year 1988 1985 1983 1967*

Passing Vessel Collisions UK Continental Shelf [5] Installation type Jack Up Fixed installation Fixed installation Semi-submersible

Vessel type Merchant Vessel Supply Vessel Merchant Vessel Merchant Vessel

Damage Severe Severe Severe Severe

* This incident is taken from the same reference as the other three incidents, even though it is not part of the time span from 1973 through 1993. It has to be noted that none of these incidents have resulted in major structural collapse or fatalities. Appendix 1 gives a description of the collisions occurred. In addition to these 4 collisions the UK-HSE has recorded in the order of 7 collisions in the same period with minor or moderate damage. The UK-HSE is in the process of updating their internal database. 13/06/2003

Collisions.doc

Page 10



Rev 0

From the same report the following frequencies for severe collisions for the period from 1965 through 1988 are given: Table 3.2

Passing Vessel Collision Frequencies - UK Continental Shelf [5]

Category

Period No. of considered incidents

Fixed (severe incidents) 1965-1988 Mobile (severe 1965-1988 incidents)

2 2

No. of Collision Frequency installation- per installation-year years 1180 1.7 10-3 530 3.8 10-3

The following incidents have been identified with use of WOAD [6], covering the period from 1970 to 1995: Table 3.3

Passing Vessel Collisions - UK Continental Shelf [6]

Year 1995

Installation type Jacket

Vessel type Fishing

1995

Semi-submersible

Merchant

1990

Semi-submersible

Semi-subm.

1988 1984 1983 1976

Jack-up Jack-up Jacket Semi-submersible

Merchant Merchant Merchant Fishing

Damage No collision - evacuation due to drifting vessel No collision - evacuation due to drifting vessel No collision - evacuation due to drifting vessel Severely damaged Insignificant damage (only damage to vessel) Minor damage Damaged (columns)

3 of these incidents have been reported by the UK-HSE (Ref. Table 3.1) as severe incidents (1976, 1983 and 1988). Based on the number of platforms years given for the period 1970-1992 in [8] the following average annual collision frequencies are estimated. Table 3.4 Passing Vessel Collision Frequencies - UK Continental Shelf [6,8] Category

Period considered

Fixed (severe incidents) Mobile (severe incidents)

1970-1992 1970-1992

No. of No. of incidents installation -years 1700 [8] 1 [6] 704 [8] 2 [6]

Collision Frequency per installation-year 5.9 10-4 2.8 10-3

3.2.2 Passing Vessel Collisions Norwegian Continental Shelf Only one collision has occurred on the Norwegian Continental Shelf with external traffic [7]. This was a submarine colliding with the Oseberg platform in 1988 (See Appendix 1). Based on the number of installations years given from [7] for the period 1982 to 1994 are the following historical collision frequency for the Norwegian Continental Shelf estimated. Table 3.5 Category 13/06/2003

Passing Vessel Collision Frequencies - Norwegian Continental Shelf Period No. of No. of Collision Frequency considered incidents installation- per installation-year Collisions.doc

Page 11


Fixed


1982-1994

1 [7]

Rev 0

years 880 [7]

1.1 10-3

3.2.3 Passing Vessel Collisions Dutch Continental Shelf One ship/platform collision has occurred on the Dutch Continental Shelf since 1970. A jacket was in 1988 hit by a drifting ship. This caused however only minor damage [6]. From the on-going research project presented in Section 7.4 the number of installations years is estimated at 1200 for the period 1976 to 1995. Based in this, the following historical collision frequencies are estimated for the Dutch Continental Shelf. Table 3.6

Passing Vessel Collision Frequencies - Dutch Continental Shelf

Category


Fixed

1976-1995

1 [6]

No. of installationyears 1200

Collision Frequency per installation-year 8.3 10-4

3.2.4 Passing Vessel Collisions German Sector In September 1995 a German coaster hit the platform H-7. Only limited damage was observed on the platform (minor dents, paint damage). The German vessel, was undamaged except for a broken mast (Ref. Appendix 1). From the on-going research project presented in Section 7.4 is the number of installations years estimated to 70 up to 1995. Based in this, the following historical collision frequency are estimated for the German Sector. Table 3.7

Passing Vessel Collision Frequencies - German Sector

Category


Fixed

- 1995

1

No. of Collision Frequency installation- per installation-year years 70 1.4 10-2

3.2.5 Passing Vessel Collisions World Wide A report by the UK-HSE [5] gives the following number of severe collisions for the period from 1965 through 1988: Table 3.8

Passing Vessel Collisions - World wide [5]

Category



1965-1988 1965-1988

26 6

No. of Collision Frequency installation- per installation-year years 61000 4.3 10-4 8000 7.5 10-4

The following comparable collision frequencies are presented in [8]. Table 3.9 Category

13/06/2003

Passing Vessel Collisions - World wide [8] Period No. of No. of considered incidents installation -years Collisions.doc

Collision Frequency per installation-year

Page 12




1970-1992 1970-1992

34 5

Rev 0

89000 9000

3.8 10-4 5.6 10-4

3.2.6 Evaluation of Data - Passing Vessel Collisions The following table summarises the frequencies for severe incidents presented in the earlier sections. Table 3.10

Passing Vessel Collisions -Summary

Area considered

Category

UK Sector UK Sector UK Sector UK Sector Worldwide Worldwide Worldwide Worldwide

Fixed (severe incidents) Mobile (severe incidents) Fixed (severe incidents) Mobile (severe incidents) Fixed (severe incidents) Mobile (severe incidents) Fixed (severe incidents) Mobile (severe incidents)

Collision Frequency per install.year 1.7 10-3 3.8 10-3 5.9 10-4 2.8 10-3 4.3 10-4 7.5 10-4 3.8 10-4 5.6 10-4

References

HSE [5] HSE [5] WOAD [6]/MTD[8] WOAD [6]/MTD[8] HSE [5] HSE [5] MTD [8] MTD [8]

The frequencies presented for passing vessel collisions are in general questionable and sensitive due to the limited statistical data available. For fixed installations the frequencies of severe incidents vary between 3.8 10-4 and 1.7 10-3 per year. For mobile installations the range is 5.6 10-4 to 3.8 10-3 per year. The reporting threshold is seen to be very important. The Lloyds’ List reports and to some extent WOAD, originate primarily for insurance purposes. The damage threshold for a report to occur is therefore likely to be a level of damage sufficient to call in a surveyor. This is indicated by Section 3.2.1 which shows that WOAD compared to the UK-HSE Incident Reports has not recorded collisions with minor or negligible consequences. A certain under estimation of the collision frequencies is also expected on basis of WOAD for severe incidents in the UK Sector. It should however be noted that one minor incident in WOAD seems not to be included in the UK-HSE database. These figures are of course only indicative of the average risk level and cannot be used directly in estimation of risk to one particular installation because there will be very large variations in traffic density. Nevertheless, the relatively high historical risk level indicates that collision risk is a concern that must be taken seriously.

13/06/2003

Collisions.doc

Page 13


3.3


Rev 0

Visiting Vessels

3.3.1 Introduction Collisions between visiting vessels and offshore installations are relatively frequent occurrences, since these vessels, by definition, must come close to the installation. The most common type of vessel, visiting an offshore installation, is a supply vessel and as a result of this, and the fact that they must maintain close proximity to the installation during on/offloading, the number of supply vessel collisions is higher than for any other type of visiting vessel. Although visiting vessel collisions are relatively frequent, the vast majority of the collisions are of low energy (i.e. bumps against the installations) and cause little more than damaged paintwork and minor denting. This section reviews and discusses the extensive amount of visiting vessel collision data which has been collected for the UK and the Norwegian sectors of the North Sea, and then goes on to estimate the frequency of collision and the likely level of energy which the installation will absorb. An extensive amount of visiting vessel collision data have been collected for the UK and the Norwegian Continental Shelf. Statistics from other parts of the world are considered to be too unreliable when it comes to minor damage and are hence not presented. 3.3.2 Operational Exposure - UK Sector The J.P.Kenny report detailed the operating exposure, measured in installation-years, for installations in the UK sector of the North Sea. During the period from 1975 to 1985, a total installation exposure of 1024 installation-years was estimated. A breakdown of this total is presented in Figure 3-1. 800 Installation-Years

606 600 400

257

200

65

96

Fixed Concrete

Jack-up

0 Fixed Steel

Semisubmersible

Installation Type

Figure 3-1 Operational Exposure in UK Sector of North Sea (1975 - 1985) 3.3.3 Reported Collision Incidents - UK Sector A total of 145 collisions between installations and other vessels were reported to the UK Department of Energy (D.En.) during the period 1975-1985. Not included in this total is one collision which occurred between a tanker and a loading buoy. A breakdown of reported collisions, by type of installation impacted, is presented in Figure 32. From this figure it can be seen that the majority of reported collisions occurred with fixed steel installations and semi-submersible units. 13/06/2003

Collisions.doc

Page 14



Rev 0

No. Of Collisions

100 80

74 54

60 40 7

10

Fixed Concrete

Jack-up

20 0 Fixed Steel

Semisubmersible

Installation Type

Figure 3-2 Number of Reported Collisions by Installation Type in UK (1975 - 1985) The reported collisions were also broken down by type of vessel involved in the collision. This breakdown is presented in Figure 3-3. From this figure, it can be seen that the majority of collisions occurred with supply boats (67% of total). 97

No. Of Collisions

100 80 60 40 20

21

14

5

8

Passing Vessels

Others

0 Standby Vessel

Supply Vessel

DSV Colliding Ve sse l

Figure 3-3 1985)

Number of Reported Collisions by Colliding Vessel Type in UK (1975 -

3.3.4 Collision Frequency Per Installation-Year - UK Sector Based on the data presented in the previous two sections, the frequency of collisions can be determined for an average installation-year of exposure. This is presented in Figure 3-4. It should be noted that, as this section assesses the risks associated with visiting vessels, the five reported collisions from passing vessels (see Figure 3-3) have been excluded from the visiting vessel frequency assessment.

13/06/2003

Collisions.doc

Page 15



Rev 0

Collision Frequency per Installation Year

0.25 0.21 0.20 0.15

0.14 0.12

0.11

0.09

0.10 0.05 0.00

Fixed Steel

Fixed Concrete

Jack-up

Semisubmersible

Average

Figure 3-4 Visiting Vessel Collision Frequency by Installation Type (1975-1985) (UK) From Figure 3-4 it can be determined that the visiting vessel collision frequency for semisubmersibles (i.e. 0.21 per installation-year or a collision return period of 4.8 years) is approximately 76% higher than that for a fixed steel installation (i.e. 0.12 per installation-year or a collision return period of 8.5 years). The most probable reason for the variation in visiting vessel collision frequency between semi-submersibles and fixed steel installations is due to the installation exposure values used for the different types on installation. For the fixed steel jackets, the operating experience is in the region of 606 installation-years, with 406 of these being associated with platforms in the Southern North Sea. In the Southern North Sea, there are a number of complexes which have 3-5 bridge linked platforms. Some of these platforms are very rarely, if at all, visited by surface vessels, and in addition there are a large number of Normally Unattended Installations (NUIs) where very few vessel visits are made per year. The exposure for fixed steel jackets, relevant for visiting vessel collision frequency assessment, will therefore be significantly less than the 606 installation-years used, however, without performing a very detailed study of all installations in the North Sea a more appropriate value cannot be obtained. Semi-submersible units, on the other hand, are always manned and visited. The installationyears of semi-submersible exposure are therefore directly relevant for visiting vessel collision frequency assessment. The fact that a semi-submersible moves, due to environmental loads and flexible moorings, is unlikely to have a significant effect on the likelihood of a collision with a vessel in close proximity (e.g. an unloading supply vessel). This is because weather operating criteria during normal operations, when a vessel may be in close proximity, should ensure that environmental loads are not high (i.e. no close proximity work in bad weather). The movement of the semi-submersible is therefore likely to be small and predictable. Any collision, as a result of semi-submersible movement, is likely to be of low energy, with damage to paint-work being the likely consequence. Such minor bumps against the installation may not even have been reported. To obtain a reliable breakdown of collision frequency by type of colliding vessel, the collision frequencies associated with vessels visiting semi-submersible units was assessed. By restricting the installation type to semi-submersibles, the complication associated with multiple platform complexes and NUIs can be avoided. In addition, due to the limited operating exposure of fixed concrete platforms and jack-up mobile units, these types of installation have also been excluded as there would be large uncertainties regarding the calculation of collision frequencies. 13/06/2003

Collisions.doc

Page 16



Rev 0

Of the 54 collisions with semi-submersibles documented in the J.P.Kenny report, 53 were associated with visiting vessels. The remaining 1 was associated with a passing vessel and has therefore been excluded from this assessment. It was also noted in the J.P.Kenny report, that out of the 53 collisions which were associated with visiting vessels, 49 were with supply vessels, 1 with a Diving Support Vessel (DSV), 2 with standby vessels and 1 with an anchor handling tug (AHT). This breakdown of semisubmersible collisions is presented graphically in Figure 3-5.

DSV 2% Standby Vessel 4% AHT 2% Supply Vessel 92%

Figure 3-5 Percentage Breakdown of Semi-Submersible Collisions in UK (1975-1985) Based on the semi-submersible exposure of 257 installation-years, the collision frequency by type of visiting vessel can be determined. This is presented in Figure 3-6.


0.20

1.9E-01

0.15

0.10

0.05 3.9E-03

7.8E-03

3.9E-03

DSV

Standby Vessel

AHT

0.00

Supply Vessel

Figure 3-6 Visiting Vessel Collision Frequency for Semi-submersible Units by Colliding Vessel type per Installation-year. From Figure 3-6 it can be seen that the risk of a collision with a semi-submersible, during a year of operation, from a visiting supply vessel is over 12 times higher than the sum of the other vessel types. A frequency of 0.19 per installation-year is equivalent to a collision return period of 5.2 years.

13/06/2003

Collisions.doc

Page 17



Rev 0

3.3.5 Collision Frequency Per Vessel Visit During the time that the J.P.Kenny analysis was carried out, a detailed evaluation of the number of vessels visiting a MODU was carried out in the Risk Assessment of Buoyancy Loss (RABL) studies [9]. In this study it was determined that on average the number of visits made to a semi-submersible was approximately 5 per week (based on exploration and appraisal drilling in the Norwegian sector). This number of visits per week includes supply vessels, anchor handling at the beginning of the semi's work and standby vessel changeout once every 28 days. Figure 3-7 presents the average number of vessel visits to a semi-submersible unit for an installation-year.

No. Of Visits (per Installation-Year)

180

176.5

150 120 90

59

60 30 0 Supply Vessel

Unknown (not listed)

22.5

DSV

Standby Vessel

AHT

Colliding Vessel Type

Figure 3-7 Average Number of Visits to a Semi-Submersible Unit per Installation-Year The RABL study did not quantify the average number of DSV visits to an installation, however, it is considered reasonable to assume that on average a DSV would visit a fixed installation once every two years to perform inspection and/or repairs. Based on the collision frequency per semi-submersible installation-year and the average annual number of vessel visits, the collision frequency per vessel visit can be determined and is presented in Figure 3-8.


1.0E-02 7.8E-03 7.5E-03

5.0E-03

2.5E-03

1.1E-03

8.0E-04

3.5E-04

6.6E-05

Standby Vessel

AHT

0.0E+00

Supply Vessel

Figure 3-8

13/06/2003

DSV

Average

Visiting Vessel Collision Frequency for Semi-Submersible Units by Colliding Vessel Type per Vessel Visit (1975-1985) (UK Sector) Collisions.doc

Page 18



Rev 0

Figure 3-8 it can be seen that the likelihood of collision between a DSV and an installation is 7.8x10-3 per visit which is equivalent to one collision every 128 vessel visits. This is approximately one order of magnitude higher than the average. A likely reason for this relatively high collision frequency is that for every visit to an installation, the DSV has a much higher “at risk” exposure due to it remaining alongside the installation for a considerable number of hours whereas the other vessel types would remain close to an installation for a much more limited period. It should also be remembered that none of the 21 reported DSV collisions resulted in moderate or severe damage to the installation. The likelihood of a supply vessel colliding with a semi-submersible unit is 1.1x10-3 per visit which is equivalent to one collision every 926 vessel visits. 3.3.6 Collision Frequency Per Vessel Orientation Of the 49 reported collisions of supply vessels with semi-submersible units (Ref. Section 3.3.4) 27 had the orientation of the vessel recorded. A breakdown of the colliding vessel orientation is presented in Figure 3-9. Unknown 45%

Bow 4%

Stern 39%

Sideways 12%

Figure 3-9 Breakdown of Supply Vessel Collision Orientation From Figure 3-9 it can be seen that the majority of collisions, where the orientation of the colliding vessel was known, were stern-on, with sideways collision contributing a large proportion of the remainder. It is impossible, however, to determine the frequency of collision for each of the colliding vessel orientations since there is insufficient historical data on the exposure of each orientation (i.e. the annual number of visits stern-on, sideways, etc.). 3.3.7

Collision Causation Factors - Visiting Vessels

3.3.7.1 Operating Circumstances A distribution of the incidents involving moderate and severe damages is presented in Table 3.11, which gives an illustration of the ratio of collisions involving higher energies. The table gives a breakdown of the incidents according to the operational mode of the vessel when it collided with the installation. Incidents leading to complete failure of the structure have been reported in the period assessed in the J.P.Kenny report. Although the collision incidents reported in the J.P.Kenny work are related to vessels visiting semi-submersibles, the conclusions which can be drawn from the work are considered relevant to all attendant vessel visits to the types of installations considered in this study.

13/06/2003

Collisions.doc

Page 19


Table 3.11


Rev 0

Operating Circumstances Whilst Collision Occurred (Semi-Subs)

Operation

Total No of Reported Incidents

Percentage Contribution

Approach

13

23.6%

9

27.3%

Mooring

8

14.5%

4

12.1%

Cargo Transfer

25

45.5%

14

42.4%

Personnel Transfer

2

3.6%

2

6.1%

Diving Operations

1

1.8%

1

3.0%

Standby Duties

0

0%

0

0

Other/Not Specified

6

10.9%

3

9.1%

55

100%

33

100%

Total 1) 2)

No. of Incidents Resulting in Moderate1) or Severe2) Damage

Percentage Contribution to Moderate/Severe Incidents

Moderate: Incidents involving denting of stiffeners in Semi-Submersibles and incidents where repair was required. Severe: Those incidents where it was possible to calculate the energy absorbed by the struck installation and where the energy was greater than 0.5 MJ.

3.3.7.2 Main Causes of Visiting Vessel Collisions The J.P.Kenny report summarises the following with respect to the causes of visiting vessel collisions: • • • •

Misjudgement and equipment failure were seen to be the primary causes of visiting vessel collisions. Cranes with short reach do not allow supply vessels to stand sufficiently far off the platforms when off-loading, and this could be a contributory cause in some collisions. Fatigue of the vessels crew could have been a contributory cause of some collisions. In many cases marine operations with the supply boat on the windward side of the platform is required, either because the other crane is out of service or the item being brought to the platform is bound for a location that is practical to reach only from the windward side.

13/06/2003

Collisions.doc

Page 20



Rev 0

Table 3.12 shows the causes of the collisions between visiting vessels and offshore installations. Table 3.12

Prime Causes of Collision Accidents, Moderate/Severe Damage

Failure Mode

Supply Vessel Approach

Supply Vessel Loading

Standby Vessel Duties

Misjudgement

40 %

34 %

25 %

Equipment Failure

40 %

16 %

50 %

Weather

16 %

24 %

25 %

Mooring Problems

4%

16 %

0%

Other

0%

5%

0%

Not Specified

0%

5%

0%

100 %

100 %

100 %

Total

As the data in the J.P.Kenny report is from 1975-85, one would expect that increasing standards in both the vessels utilised and the marine procedures applied may have resulted in a decrease in the collision frequency (Ref. Section 3.3.8). 3.3.8 Evaluation of Data - Visiting Vessel Collisions For comparative purposes, the results of the assessment presented in Section 3.3.2 to 3.3.6, which are predominantly based on the extensive work performed by J.P.Kenny, were compared with a similar study conducted by Advanced Mechanics and Engineering Ltd. (AME) covering the period 1975 to 1990. The results of the AME study were presented (in part) in a lecture by Charles Ellinas [10]. During the period under consideration AME concluded there was a total of 138 collision incidents on fixed steel platforms. The platform exposure during this period was estimated from the OPL document titled “Subsea Guide and 3rd Edition Field Development Guide” as 908 installation-years. This gives a collision frequency of 0.152 per installation-year. The same reference presented an average risk estimate of 0.028 per installation-year for severe incidents (energy absorbed by the platform exceeding 0.5 MJ). The difference between the estimate of a visiting vessel collision frequency for fixed steel platforms in the UKCS, (based on the J.P.Kenny report) of 0.117 (Ref. Figure 3-4) with that estimated by Ellinas of 0.152 is considered relatively small and would probably be due to random fluctuation in the number of events per year. To compare the frequency of collision for attendant vessels in the UKCS with that of the corresponding sector of the Norwegian North Sea, the results of a report from The Norwegian Petroleum Directorate (NPD) [7] can be used. In the NPD report, a total of 29 attendant vessel collisions were reported on the Norwegian Continental Shelf during the period from 1982 to 1994. Of these, 4 were collisions by shuttle tankers against loading buoys, and the remaining 25 collisions from other vessels, (i.e. attendant vessels of different kinds). With a platform exposure during this period of 880 installation-years, 25 collisions gives a collision frequency of 0.028 per installation-year. This frequency reflects collisions by diving vessels, supply vessels, standby vessels, rescue vessels and pipe laying vessels. 13/06/2003

Collisions.doc

Page 21



Rev 0

The structural damage to the platforms has in general been small or insignificant, with the exception of six collisions causing expensive structural repair work. The reason for the considerable difference between the collisions frequencies found for the UK and Norwegian Sectors (0.117 and 0.028 per annum respectively) is unclear. However, following a review of incident reports carried out by the NPD [7], the reason for the difference in frequency is not due to lack of reporting of Norwegian offshore collisions. Some of the difference may be accounted to different attendant vessel operation procedures, mooring techniques, allowable weather criteria, etc. It should be noted that the statistics from the Norwegian Sector are from the period 19821994 and for the UK Sector 1975-1985 and 1975-1990. The difference in periods, 10 years versus 25 years and the improved incident reporting and operating standards over time could account for the difference. A major development of the supply and standby vessels has taken place from the first generation to the present, modern vessels. Aspects which may be mentioned, are: •

improved man/machine system

•

improved manoeuvring characteristics

•

machinery/electrical back-up systems

•

more reliable components

•

thruster power available

•

introduction of cranes with wider operating ranges

•

the size of the supply vessel's working area

Platform type (jacket, Con-deep, Semi-Sub., etc.), distances to structural elements, alternative working areas related to different wind directions, etc. will also influence the risk of collision. These factors have to be considered case by case. However, no obvious trend in the annual risk estimates for incidents to platforms is seen from AME [10] which presents the annual incident risk for each year over the period considered. It is however worth noting that the NPD collision frequency of 0.028 per installation-year is identical to that presented by Ellinas for collisions with a platform absorbed energy in excess of 0.5 MJ. This indicates that there may be a possible inconsistency in the reporting criteria (e.g. terminology) between the two reporting systems.

13/06/2003

Collisions.doc

Page 22


4


Rev 0

COLLISION FREQUENCY MODELLING

4.1 Introduction This Section gives an overview over which factors which should be considered for collision frequency assessment. The basis for collision risk assessment will be ship traffic data. This could be based on site specific traffic surveys or available traffic databases. 4.2

Ship/Installation Collision Frequency Modelling

4.2.1 Important Factors Affecting Collision Frequency The modelling of collision risk is based on the factors that will influence the collision process, i.e. those factors which will affect the probability of a collision as well as the consequences. Generally, these can be described as : • • •

Location specific factors. Rig/platform specific features. Traffic behaviour.

The collision risk will be more or less proportional to the traffic density. It is therefore important to model the actual traffic pattern(s) in the area studied. The main factors in each of these groups and their influence on the collision frequency are summarised in Table 4.1.

13/06/2003

Collisions.doc

Page 23


Table 4.1


Rev 0

Summary of Factors Affecting Collision Frequency Platform/Rig Location

Characteristics Traffic:

of

Vessel Passing Traffic - Independent of presence of installation varies considerably with location both in terms of number and type of vessels. Dedicated or Attendant Vessels - only present because installation is on that location.

Environmental Conditions: Visibility - fog - snow/driving rain - length of night Wind, current and waves Type of Location

Open water/coastal Few/many platforms in area.

Time at Location

Passing Traffic - affects the probability of being known as well as the proportion of vessels taking precautionary actions. Platform/Rig Features

Type - Fixed or Mobile:

Affects likelihood that ship will know in advance that the platform or rig is at a given location.

Size and design:

Collision frequency is proportional to the effective width/target presented by the platform.

Anchoring System:

Affects number of AHT/supply vessels needed to weigh and lay anchors.

Drilling Activity:

The type of activity being undertaken (e.g. exploration drilling, production drilling, well workover, etc.) will affect both the numbers of supply vessels needed and the duration on location. Logistic For example, size of supply vessel, affecting number of vessels visiting and also potential collision consequences.

Transport Decisions: Collision Measures:

Avoidance Measures taken by installation or its' standby vessel can reduce the risk of collisions. Traffic Behaviour

Vessel's Purpose:

E.g. if it is a visiting vessel it will head for it on a collision course.

Bridge Watch keeping Standards and Reliability:

Will determine probability of errors on the bridge. Varies with type of vessel.

Propulsion/Steering Performance and Reliability:

Affects speed of vessel, and ability to recover to avoid collision. Can be related to size of vessel.

For visiting vessels in particular, references are as well given to the discussion in Section 3.3.7 and 3.3.8.

13/06/2003

Collisions.doc

Page 24



Rev 0

4.2.2 Collision Frequency Models According to MaTSU(Marine Technology Support Unit) [11] three models are currently available for predicting the collision frequency of a ship with an offshore platform located in either the North Sea or the Irish Sea. Two are commercially available. The third model is the property of the DGSM (Directorate General of Shipping and Maritime Affairs - the Netherlands). The models have been used extensively within the UK, Norway and the Netherlands to help quantify the risk to an offshore platform from the ship collision hazard. Comparative studies performed for the UK-HSE (OSD) in the UK revealed significant variations in the collision frequencies predicted by the 2 commercial models [11]. 4.3

Vessel Traffic Pattern and Volume

4.3.1 General The traffic volume is probably the parameter which most directly can be based on observations and which can be treated statistically without having to apply analytical considerations or engineering judgement. This is therefore also the parameter which requires the least engineering effort in terms of modelling but will require considerable data gathering effort if the information is not already available. Any database also needs to be updated regularly. Seagoing traffic patterns invariably change with time. To some extent, such changes can be foreseen, but a certain element of unpredictability will always be present. For this reason, it may be wise to perform spot checks whenever a detailed risk analysis is performed or updated. In Section 4.3.2, some factors which are likely to affect the traffic volume have been identified and are discussed briefly. There is no general rule as to how large the influence of each factor will be, this will depend on the platform location and will vary. Nevertheless, these factors may be used as a check list when performing a risk analysis. The discussion gives an indication of influence each factor may have on traffic volume. 4.3.2 Factors Affecting the Traffic Volume The most important factor which will affect the traffic volume are changes in the activity level in the ports which generate traffic into the area in question. In particular for small routes, such changes may have a significant effect on the traffic volume. Many routes in the North Sea have traffic volumes of less than 1000 vessels annually and even if the traffic increases with only one passage per day, the increase in the traffic volume will still be about one third of a route with such a traffic volume. Such changes should therefore be taken into consideration. In most cases, the risk is calculated on an annual basis, and seasonal variations are thus of little importance. However, if one is interested in the risk level during only a limited period, e.g. in order to assess the risk for an installation period or another operation, variations over the year should be assumed.These variations may have several reasons: • • •

13/06/2003

Some routes may be operated during only a part of the year. Typical of these are ferry routes. Due to generally worse weather conditions during the winter there may be differences in choice of route. In some specific cases certain ship traffic may be reduced during parts of the year.

Collisions.doc

Page 25



Rev 0

These aspects should be taken into consideration when the traffic volumes for different routes or areas are estimated. In some cases, such seasonal variations are defined in the routes presented. An effect which is similar to the weather routing effect is the effect of the vessel size. Larger vessels may tend to choose different courses from smaller vessels, either because the water depth is limited or because larger vessels are less affected by bad weather and thus do not have to take such considerations into account. A particular weather related effect is the possibility that routes may be constantly deviated due to prevailing winds and current. This has not been taken into account when the route pattern was established, but may be considered. However, this effect is likely to be marginal because the vessels will correct their courses regularly. If a route passes very close to a platform, the effect may be of some importance because a larger proportion of the vessels than otherwise would be expected may choose to pass the platform on the leeward side. 4.3.3 How to get Traffic Data The three collision frequency models considered by MaTSU in [11] (Ref. Section 4.2.2) have as well integrated traffic databases. Other traffic databases do exist and are also commercially available. A traffic database (traffic volume, traffic pattern, ship sizes, ship speeds, etc.) could be established for a certain project based on the following sources (this could be necessary if traffic databases for the specific area are considered not to be of adequate quality, not updated or not existing): • • • • •

Data from Lloyds Maritime Information Services (or similar) to determine the number of merchant vessel movements as well as the types and sizes. Information on the movements of ferries, shuttle tankers and offshore vessels (supply and standby vessels) as provided by ferry and offshore operators respectively. Traffic surveys carried out by standby vessels, dedicated survey vessels and platform and shore based radar systems, to determine the positions of the different routes as they pass through survey locations. Information provided by the Coastguard, the defence and/or harbour authorities. Information provided by mariners and vessel passage plans

Several data sources should be combined in order to determine the route patterns.

13/06/2003

Collisions.doc

Page 26


5


Rev 0

COLLISION CONSEQUENCES

5.1 General This datasheet puts emphasis on the determination of the likelihood of various types of collision for a range of vessel and installation combinations. The consequences in the event of a collision are not covered in detail here. Consequence analysis would be on a case specific basis and take into account: • • • • •

Installation type: 1) Fixed: steel, concrete, tension leg etc, 2) Jack-up, 3) Semisubmersible Impact duration compared with the natural period of the installation motion Mass, velocity, impact direction and energy absorbtion characteristics of the colliding vessel and impacted installation Structural response of the vessel and installation Potential escalation events following initial impact (eg loss of containment, fire, explosion, evacuation, escape and rescue) covered in other datasheets.

13/06/2003

Collisions.doc

Page 27


6


Rev 0

RISK REDUCING MEASURES

Risk reducing measures and their effect has been considered in many research projects, among them [12] and an ongoing UK HSE project (Ref. Section 7.3). 6.1

Use of Risk Reducing Measures

Risk reducing measures comprise probability reducing as well as consequence reducing measures, including contingency measures. Priority should be given to risk reducing measures which can detect the potential for collision as early as possible and which can contribute to avoiding the collision. (For example, a warning of a potential collision as early as possible via a collision warning system on the platform and/or standby.) This is often also the most effective way to reduce the collision risk. Reducing the consequences of a collision, primarily by increasing the impact resistance of the platform will, in many cases, require significant effort and investment to be effective. 6.2

Overview of Risk Reducing Measures

The effect of different risk reducing measures can most readily be identified by looking at the modelling which has been used for the different vessel groups. • • • •

Powered passing Drifting passing and drifting nearby Powered nearby Floating Unit in Drift

A systematic approach to identification of risk reducing measures will be to look at the different parameters modelled and see whether it is possible to affect the parameters to reduce the risk.

13/06/2003

Collisions.doc

Page 28



7

RESEARCH AND DEVELOPMENT PROJECTS

7.1

Introduction

Rev 0

Currently there are three known ongoing research and development projects related to collision risk in the North Sea.

7.2 UK Continental Shelf Shipping Traffic Database A joint industry project started early 1995 to create a database of shipping patterns on the UK Continental Shelf (UKCS). It is sponsored by the UK Department of Transport, UK Offshore Operators Association (UKOOA) and the UK Health and Safety Executive (HSE). Vessel traffic data is being collected by standby vessels, platform and onshore based radar systems throughout the UKCS, supported by information from Lloyds’ port logs of vessel movements across Europe. The first and main phase of the project, which was to establish a traffic database, was completed in January 1996 [13]. There were several objectives for establishing the database. First of all it is desirable to know where the major shipping routes are concentrated around UK waters allowing for assessments of environmental risks associated with shipping. This way the determination of the best locations for rescue, salvage and counter pollution resources around the UK can be done. Another objective is to establish the location of major shipping routes in relation to future oil and gas developments. The HSE wishes to establish a reliable database that can be used to predict the risks associated with collisions between passing vessels and offshore installations. This will provide some standardisation to the industry and encourage operators to obtain an understanding of the traffic patterns around their offshore installations and use this to evaluate risk and develop emergency plans and resources to manage the risk. The database which is commercially available, will be updated annually to ensure that it remains reliable and up to date. The work planned for next phase includes establishment of chart plots, further traffic surveys to be carried out and analysed, and collections of further information on offshore field related traffic. 7.3

The Effectiveness of Collision Control & Avoidance Systems

This project is carried out for the HSE. Several topics are considered. The first task is identification and review of systems currently utilised by duty holders on the UKCS to identify and control the threat posed by shipping, and identification of any other systems in use world-wide or other transport sectors where a collision threat exists. The prime accident causation factors in collision scenarios are determined, and it is identified how a general collision avoidance system may intervene. A qualitative review of the effectiveness of these systems upon the causation factors is done, followed by a quantification of the effectiveness. Finally an evaluation of the systems identified is performed, to see how they could improve or complement any of the systems currently in use.

13/06/2003

Collisions.doc

Page 29


7.4


Rev 0

Comparison of ship-platform collision frequency models.

The background for this study is that regulatory bodies covering the different international sectors of the North Sea would like to develop a standardised risk assessment method to guarantee consistency in the safety management. This is based on the fact that ship collision risk is one of the major external factors contributing to the risk to an offshore installation, and that a critical review of the existing collision models has revealed large differences between the models. The project, which is sponsored by several authorities around the North Sea.

13/06/2003

Collisions.doc

Page 30


8


Rev 0

REFERENCES

13/06/2003

Collisions.doc

Page 31



Rev 0

9 1)

Dovre Safetec AS; SAFETOW Reference Manual - Risk Assessment of Towing Operations, Draft Report No. ST-95-CR-015-00, December 1995.

2)

J. P. Kenny; Protection of Offshore Installations Against Impact, Report No. OTI 88535, 1988.

3)

NPD: Regulation of Structural Design of Loadbearing Structures..., 29. Oct. 1984

4)

Department of Energy, Offshore Installations, Guidance on design, Construction and Certification, Fourth Edition, January 1990

5)

Health and Safety Executive, Update of UKCS Risk Overview, Offshore Technology Report, Report No. OTH 94 458.

6)

Det Norske Veritas, World Offshore Accident Data base.

7)

The Norwegian Petroleum Directorate, Båtkollisjoner - Fase 1, OD-94-50

8)

Marine Technology Directorate Ltd, Guide to Offshore QRA Collision Risk - draft, July 1995

9)

Technica Ltd., Risk Assessment of Buoyancy loss, Ship-MODU Collision Frequency, Report No. 3, July 1987

10 )

Charles Ellinas (Advanced Mechanics & Engineering Ltd), Ship/Installation Collision Data, International Workshop on Data for Oil & Gas QRAS, E&P Forum - London 15.12.93.

11)

MaTSU(Marine Technology Support Unit); A Critical Review of Ship-Platform Collision Frequency Models; MaTR/1020, 19.06.95.

12)

Dovre Safetec AS (earlier SikteC), Collide II - Reference Manual, Report No. ST-91-RF-032-01, November 1991

13 )

Dovre Safetec Ltd, UKCS Vessel Traffic Database - Project Report, Report No. DST-95-CR-110-01, January 1996

13/06/2003

Collisions.doc

Page 1

Extreme Weather Risk


Rev 0

EXTREME WEATHER RISK

21/03/97

Extweath.doc

Page1



Rev 0

SUMMARY Extreme Weather Risk for Fixed Units For fixed steel platforms the extreme weather risk may be estimated using a validated reliability model. results using this model are summarized in Table A for the Gulf of Mexico and for the North Sea areas, for both existing and new structures. These results are based on generic assumptions about each sub-population with respect to the design basis and the resulting strength. The values in Table A may be used in lieu of more detailed studies for the specific installation, but it should be recognized that they are necessarily approximate and generally would tend to overpredict the failure rate. Where installation specific data is available the estimate of the probability of failure may be further improved as discussed in Section 2.5 of this Note. Table A: Calculated failure rate per annum:

Geographical Area Gulf of Mexico North Sea

Installation Pd. pre- 1971 0.02 <1*10-5

1972-1981 0.003 <1*10-5

1982-1994 0.001 <1*10-5

1995-onwards 0.0001 <1*10-5

Extreme Weather Risk for Jack-Up Units The probability of failure of a jack up which just satisfies the Industry Recommended Practice (RP) for Location Assessments is given in Table B for the GoM and for the Central North Sea environments. It should be noted that jack ups are often used well within the capability envelopes defined by the RP. In such cases the probability of failure dues to extreme weather, will be lower than the values given in table B. In other instances however, a jack up may be deployed outwith the capability envelope defined by the RP (without a site specific assessment). In such a case the Pf may be considerably higher than the values given in table B. Guidance on how the values of Table B may be adjusted following an assessment is given in Section 3 of this Note. Table B: Probability of failure of jack up which satisfies Jackup RP Geographical Area Gulf of Mexico Central North Sea

Annual Pf 6*10-4 per year. 1.3*10-4 per year.

Extreme Weather Risk for Semi-submersible units The observed failure rate of semisubmersible units due to extreme weather is 0.00075/yr. This is based on two failures over an exposure of 2655 rig-years. This historical failure rate may not be indicative of the present or future failure rate, due to design modifications following these two disasters. However, there is no rigorous way of quantifying the effect of these improvements.

21/03/97

Extweath.doc

Page2


1.


Rev 0

SCOPE

This data sheet is concerned with the quantification of the probability of failure of offshore installations due to extreme weather. The installation types covered are classified as Fixed Units, Jack-Ups and Semi-submersibles. Fixed Units refers primarily to fixed steel, space frame structures. The great majority of offshore installations fall in this category. Concrete installations are not explicitly addressed. For jack up units the emphasis is on quantifying the probability of failure nits which satisfy the current Industry Recommended Practice for location assessment of jack-ups. For semi-subs the failure rate is primarily based on the historical performance of drilling and accommodation units.

21/03/97

Extweath.doc

Page3



Rev 0

2.

EXTREME WEATHER RISK FOR FIXED UNITS

2.1

Fixed Platform Exposure and Accident Statistics

This section presents data on the expected failure rate of fixed offshore installations due to extreme weather. The failure rate for a given installation depends, among other factors, on the design standard used, the metocean design conditions, fabrication practices and the geographical area. The design standards and practices have changed significantly over time and hence the existing population of fixed offshore platforms is not a homogeneous one. Historical statistics on failure rates (derived from existing databases such as WOAD, ref. 1) can be useful provided the data relates to a population which is reasonably homogeneous, that the exposure period is significant and the data source is reliable. Moreover, if for a given homogeneous population the number of failures is zero, it means that a historical failure rate can not be estimated with any degree of confidence. for such populations a calibrated/validated predictive model provides the only sound basis for predicting failure rates. Such a model is available (see ref.2) and is used here after a review of the historical performance. Exposure statistics for the Gulf of Mexico (GoM) and the North Sea areas have been extracted from WOAD and are summarized in Table 1. It is seen that the experience base in the GoM (72272 platform-years over the period 1970-1993) is considerably larger than in the North Sea. Table 1: Fixed Platform exposure statistics Geographical Area Gulf of Mexico North Sea Worldwide

Platform-Years (1970-1979) 21531 389 23304

Platform Years (1980-1993) 50741 3087 73051

Platform Years (1970-1993) 72272 3476 96255

No. of Platforms (1993) 3955 356 6349

Information on platform failures can also be obtained from WOAD for failures which occurred after 1970. A more complete record of platform failures over the entire period of offshore activity, (19741993) is available in the Final Report on the Hurricane Andrew JIP (ref. 3) and is summarized in Table 2 below. Table 2: Fixed Platform Failure statistics (excluding caissons) Geographical Area Gulf of Mexico Gulf of Mexico North Sea

Installation Period 1947-1973 1974-1993 1965-1993

No. of failures 61 0 0

A total of 61 platforms have collapsed due to severe weather over the entire period of offshore activity (1947-1993). It is important to note that all these platforms were installed in the GoM before 1973. The majority of collapses occurred in 4 hurricanes, namely, hurricane Hilda (1964, 14 failure), Betsy (1965, 8 failures), Camille (1969, 3 failures) and hurricane Andrew (1992, 25 failures). In addition to these there have been about as many caisson failures; however, caissons have been excluded from the failure statistics because they have not, generally, been designed to the same standard as space frame structures. For consistency caissons should also be excluded from the exposure statistics given in Table 1; Information to do this accurately is not readily available but it is estimated that doing so would reduce the exposure in the GoM from 72272 pl.-yrs. to about 55000 pl.-years over the period 1970-1993.

21/03/97

Extweath.doc

Page4


2.2


Rev 0

Historical failure rates

Fig. 1 taken from ref. 2 shows how the design load level has changed over time in the GoM and the N Sea. It is seen that the population of GoM platforms is far from homogeneous from the point of view of design load level. the entire GoM population may be conveniently subdivided into four subpopulations each of which can be regarded as homogeneous. It should be pointed out that this is an idealization because there exist some differences among US operators. However, these differences are not very significant. A notable difference between GoM and North Sea is that all design load levels (relative to the 100-year load) in the North Sea are considerably higher than in the GoM. Inevitably, there will exist some variability in the reliability level within a single population, for instance an 8-legged structure has different reserve strength characteristics to a 4-legged structure. Also the UK provisions (SHE Guidance, ref. 4) are somewhat different from the Norwegian provisions (NOD Regulations, ref. 5). The most significant change in the design load level took place in the GoM around 1970-72 with the introduction of API RP (ref. 6). As a result of these changes the design load level increased by a factor of about 2 (see Fig. 1) and the deck elevation was raised by about aft. This led to a profound improvement in structural reliability as evidenced by the failure statistics. Out of the 61 structures which collapsed over the period 1947-1993, 60 are known to have installed before 1971. For the remaining one structure the situation is not clear. This is platform (Ship Shoal 119) which was installed in 1973 and was found leaning by 10 de after hurricane Andrew (see ref. 3). The design basis of this structure is not known. It could have been designed using the pre-1971 practice or the post -1972 practice or something in-between. Using the above data the failure rate for each population is indicated in Table 3, in terms of the number of recorded failures within each population and the approximate number of platform-years of exposure. It is stressed that the platform-years of exposure, given in Table 3, is necessarily approximate because (I) caissons were excluded from the original WOAD exposure statistics in an approximate manner and (II) because the WOAD data is given in terms of platform-years of exposure over a given period, whereas we need to partition the data as a function of installation periods rather than exposure period. However, this approximation is not very important, because it will be seen below that the historical rates are not directly usable. Table 3: Fixed Platform historical performance and exposure statistics Geographical Area Gulf of Mexico North Sea

Installation Period 1947-1971 60/2000 (*) 0/300

1972-1981 1/30000 (?) 0/2500

1982-1994 0/10000 0/1000

1995 onwards 0/60 0/20

(*) = in the notation x/y, x represents the number of failures of structures installed over this period and y represents the approximate number of pl. -yr. of exposure of this population up to 1993. (?) = there is a question mark regarding the design basis of this structure (Ship Shoal 119) which was installed in 1973 and was found leaning by 10 de after hurricane Andrew. If it was designed using the pre-1971 design recipe it should, strictly, be in the first class rather than the second.

21/03/97

Extweath.doc

Page5



Rev 0

From Table 3 it becomes evident that for six out of the eight sub-populations it is NOT possible to estimate a historical failure rate because the number of failures within these populations was zero. A historical failure rate can be calculated for the early (pre-1971) GoM structures. Within this population there have been about 60 structural collapses over an exposure period of about 20000 platform-years. This leads to a historical failure rate of 60/20000 = 0.3% or 1 in 333 platform-yr.. The above failure rate is based on a large number of failures and hence may be considered rather reliable. However, one should bear in mind that the majority of failures have occurred in 4 hurricanes and hence the intensity of these hurricanes, their path and the density of platforms in this path influence the failure rate. The only other population for which a historical failure rate can be estimated is the GoM structures installed over the period 1972-1981. It is estimated that this population experienced an exposure of about 30000 platform-years with only one failure. On the basis of the above evidence the observed failure rate for this population is 3*10-5/yr. Because there was only one failure the estimate is unreliable, being very much dependent on the intensity of this single hurricane. Thus the observed failure rate of 3*10-5/yr calculated above cannot be relied upon. A more rigorous approach is to use the experience in severe hurricanes, such as hurricane Andrew, to validate(or calibrate) a predictive model. Such a predictive model is described in ref. 2 and used below. 2.3

Key elements of predictive model for failure rate of fixed platforms

Research and development work carried out over the last 5 years in the area of structural reliability of fixed platforms has resulted in a technological breakthrough. The main contributors to this breakthrough are: • • • •

availability of reliable, long records of metocean conditions at an offshore location, derived from hindcast models. This enables accurate determination of the joint occurrence of waves, currents and winds and the probability of exceedance of such combinations. improved models for a probabilistic description of wave loading have been derived and validated by comparing predictions with measurements from the Tern Monitoring System. The ultimate Strength of an offshore structure can now be evaluated accurately using non-linear finite element programs such as USFOS. The uncertainty in system strength is better understood and accounted for. integration of the above models within a reliability framework enables estimation of the annual probability of failure of the structure due to extreme storms.

The reliability model described in ref. 2 incorporates all of the above features and has been shown to give realistic predictions. However, reliability analysis remains a difficult subject and models with inadequacies in one or more of the above areas can give very misleading results. This is why it is quite important to use a consistent and validated model such as that given in ref. 2. 2.4

Failure rate of fixed platforms based on reliability models

The reliability model whose key features have been described above can provide rather accurate predictions of the reliability of a given installation. Results of generic reliability analyses are presented in Table 4A below, for each of the eight populations discussed above. These may be used in lieu of more detailed studies for the specific installation, but it should be recognized that they are necessarily approximate and generally would tend to overpredict the failure rate. The underlying generic assumptions with respect to platform loading are given in Fig. 1. The generic model with respect to platform ultimate strength has been revised slightly from that given in ref. 2 as follows: RSR = Reseve Strength Ratio =Ultimate Strength/Design Environmental Load

21/03/97

Extweath.doc

Page6



Rev 0

mean RSR = 2.4 for early GoM structures (installed before 1971) on the basis of pushover analyses of structures from this population (see for example ref. 8 which shows a mean RSR in excess of 2.4). This level of RSR appears to be somewhat on the high side, given the factors of safety inherent in API WSD, allowing for a contribution from system redundancy. It is possible that the early GoM structures have, on average, a somewhat higher RSR, because the majority of these are in shallow water where it is cost effective to standardize on member thicknesses for ease of fabrication. This was rather common practice for these early GoM structures and may be the main reason for the higher . mean RSR = 2.0 fro all other existing structures on the basis that for structures designed to API WSD and expected levels of system redundancy the resulting RSR will be close to 2. mean RSR = 2.0 for new structures if designed to API LRFD using an environmental load factor, , of 1.35. It is noted that in ref. 2 an RSR of 1.85 is used for new structures designed to API LRFD which is 8% lower than the value of 2.0 used above. As noted in ref. 2 the value of 1.85 is expected to be on the low side. This was rather deliberate for the purpose of Standard development where, in the absence of pushover analyses, it is not recommended to rely on system redundancy. However, for use in QRA studies which is the main purpose here, the intent is generally to obtain unbiased results rather than conservative results. Comparison of the model prediction for the pre-1971 GoM structures (0.02/yr) with the corresponding historical failure rate (0.003/yr) suggests that the model may overpredict the failure rate by a factor of about 6-7. However, more detailed validation exercises using evidence from hurricane Andrew (see ref. 2,3) suggest that the model overpredicts by about 15% on load or resistance which corresponds, approximately, to an overprediction of the failure rate by a factor of 23 on average. Thus part of the overprediction is known and has been discussed before [see ref. 2], while the remaining apparent overprediction is unclear. It may not, in fact, be an overprediction of the model but an underprediction by the historical statistics, for reasons discussed earlier. The failure rate for future GoM structures (i.e. 1995-onwards is based on design in accordance with API RP 2A LRFD and an environmental load factor of 1.35 as currently recommended in API LRFD.

21/03/97

Extweath.doc

Page7



Rev 0

Table 4A: Calculated failure rate per annum:


Installation Period pre-1971 0.02 < 1*10-5

1972-1981 0.003 < 1*10-5

1982-1994 0.001 < 1*10-5

1995-onwards 0.0001 < 1*10-5

For the North Sea area the conventional design loads (especially over the period 1982-1994) have been considerably higher than the 100-year loads. This is because: • •

the practice of superimposing extreme combinations of waves, currents and winds (without addressing their joint probability of occurrence) leads to an event with a return period longer than 100 years; and there has been a tendency to overpredict the individual extreme values of wave height, current and wind.

due to the first effect loads have been overpredicted by about 25% (see de Jong et. al. (1996), ref. 9) and by a similar magnitude due to the second. Obviously, the degree of overprediction varies somewhat from one operator to another. Because of the above elements of conservatism and because the long term distribution of load in the North Sea is milder than in the Gulf of Mexico (see ref. 2) the expected failure rate of fixed North Sea platforms is significantly less than in the GoM as seen in Table 4. In fact for the period 19821994 then calculated probability of failure due to extreme weather is 2-3 orders of magnitude less than 10-5/yr, suggesting that failure of the intact structure is negligibly small. Failure in extreme weather is still possible but realistically it can only happen in combination with a lower system strength, resulting from undetected deterioration in strength (due to fatigue or corrosion), i.e. a failure in the integrity management system. The integrity management systems currently in place would normally capture such damage before it influences the overall integrity significantly. Some brace severances have occurred (generally caused by fatigue) but they have been discovered and repaired within 1-2 years. The track record of fixed offshore platforms in this respect is excellent, in the sense that over a total exposure of about 96,000 pl.-years there have not been any known structural collapses attributable to fatigue or corrosion. Thus if the calculated failure rate of the intact structure is less than 10-6/yr we can state that the combined failure rate due to extreme weather plus failure due to deterioration in strength is less than 1*10-5/year. This is reflected in Table 4 for the North Sea area where the calculated failure rate is indeed less than 10-6/yr. The failure rate for future North Sea structures (i.e. 1995-onwards) is based on design in accordance with API RP 2A-LRFD and environmental load factors as recommended in ref. 2. 2.5

Adjusting the generic failure rates of fixed platforms

The failure rates given in table 4A are based on generic assumptions about each sub-population with respect to the design basis and the resulting strength. It should be recognized that they are necessarily approximate and generally would tend to overpredict the failure rate. Where installation specific data is available the estimate of the probability of failure may be further improved using directly the models presented in ref. 2. Some further guidance is provided below for two additional cases, namely (i) table 4B provides results for the case where the strength of the structure is 20% greater than assumed in Table 4A; The values of Pf are obviously lower. (ii) table 4C provides results for the case where the strength of the structure is 20% lower than assumed in Table 4A; The values of Pf are obviously increased.

21/03/97

Extweath.doc

Page8



Rev 0

Table 4B : Failure rate per annum when strength is 20% higher than assumed in Table 4A.


Installation Period pre-1971 0.01 < 1*10-5

1972-1981 0.001 < 1*10-5

1982-1994 0.00014 < 1*10-5

1995-onwards 0.00001 < 1*10-6

Table 4C : Failure rate per annum when strength is 20% lower than assumed in Table 4A


21/03/97

Installation Period pre-1971 0.05 <1*10-5

1972-1981 0.008 <1*10-5

Extweath.doc

1982-1994 0.003 <1*10-5

1995-onwards 0.0004 <1*10-4

Page9


3.


Rev 0

EXTREME WEATHER RISK FOR JACK-UP UNITS

The exposure statistics for jack ups in the GoM and the North Sea over the period 1970-1993 have been extracted from the WOAD Database and are given in table 5. From the WOAD database it is seen that there have been 71 jack ups declared as “Total Loss” (due to all causes) worldwide over the period 1970-1993 with a total exposure of 6111 rig years. This leads to an overall loss rate due to all causes, worldwide of 71/6111 = 1.2% per annum. Table 5 : Jackup exposure statistics Geographical Area Gulf of Mexico North Sea Other Areas Worldwide working

1970-1993 2129 616 3366 6111

Of these about one third have been lost while under tow from one location to another. While in the elevated condition about 20 units have been lost due to Wellhead Blowout or other ignited hydrocarbon events (fires, explosions). About 15 units have been lost in the elevated condition due to extreme weather. All of these units were located in the GoM and were lost during hurricanes. In all cases except one (Penrod 61) the units had been evacuated prior to the hurricane and hence there were no fatalities. In the case of Penrod 61 the unit was not evacuated because the path of hurricane Juan had been incorrectly predicted. Emergency evacuation took place later, during the hurricane, after the unit started listing. The remaining jack up losses were caused by (I) mechanical failure in the jacking system or other machinery failure, (ii) punch through during pre-loading of the unit (iii) mudslides, (iv)collision with a passing vessel, etc. In the North Sea are there was no failure of a jack up in the elevated condition caused by extreme weather over an exposure of 616 rig years (1970-1993). The observed failure rate of jack ups in the elevated condition in the GoM due to extreme weather over the period (1970-1993) is given by = 15/2129 = 7*10-3 per unit year. One important change in the deployment of jack ups is a joint industry effort aimed at rationalizing the acceptance criteria, y developing a Recommended Practice (RP) for the location assessment of jack up units (see ref. 10). Since this is now becoming widely used the question of most relevance with respect to the extreme weather risk for future jack-up deployments is: what is the expected probability of failure of a jack up which just satisfies the provision of the RP ? This question is answered approximately by undertaking a brief reliability evaluation of the RP. Some reliability annuluses have been carried out during the development of the RP which were re-visited. The outcome of this brief re-evaluation may be summarized as follows: A unit which just satisfies the RP achieves an RSR of 1.62, i.e. it can withstand a lateral load aprox. 1.62*100-yr load. This estimate of RSR has been primarily based on the checking equations for scantling strength and the general assessment intent that the jack up resistance checks for each failure mode (strength, overturning, foundation failure) should be reasonably well balanced. The above basis and the reliability framework discussed in ref. 2 have been used to estimate the probability of failure of a jack up which just satisfies the jack up RP. The results are given in Table 6A for the GoM and for the Central North Sea environments. It should be noted that jack ups are often used well within the capability envelopes defined by the RP. In such cases the probability of failure due to extreme weather, Pf, will be lower than the values given in Table 6A. For instance, 21/03/97

Extweath.doc

Page10



Rev 0

Table 6B gives values of Pf for a jack up which satisfies the RP with a spare capacity of 20%, i.e. it can withstand a load of 1.2 times the assessment load without exceeding any of the checks. In other instances however, a jack up may be deployed outwith the capability envelope defined by the RP (without a site specific assessment). In such a case the Pf may be considerably higher than the values given in Table 6A. Table 6C gives values of Pf for a jack up which fails the RP by 20%. Table 6A : Probability of failure of jack up which satisfies Jack up RP Geographical Area Gulf of Mexico Central North Sea

Annual Pf 6*10-4 per year. 1.3*10-4 per year.

Table 6B : Probability of failure of jack up which satisfies RP with 20% spare capacity Geographical Area Gulf of Mexico Central North Sea

Annual Pf 1*10-4 per year. 1*10-5 per year.

Table 6C : Probability of failure of jack up which fails RP by 20% Geographical Area Gulf of Mexico Central North Sea

21/03/97

Annual Pf 20*10-4 per year. 14*10-4 per year.

Extweath.doc

Page11


4.


Rev 0

EXTREME WEATHER RISK FOR SEMI-SUBMERSIBLE UNITS

The exposure statistics for semi-submersible units (SS) in the GoM and the North Sea over the period 1970-1993 have been extracted from the WOAD Database and are given in Table 7. From the WOAD database it is seen that there have been a total of 8 Sss lost (due to all causes) worldwide, over the period 19970-1993 with a combined exposure of 2655 rig-years. This leads to an overall loss rate due to all causes of 8/2655 = 0.003 per annum. Table 7 : Semi-submersible exposure statistics Geographical Area Gulf of Mexico North Sea Other Areas Worldwide working

1970-1993 436 436 1213 2655

The causes and consequences of these eight failures are given in table 8. The most serious accidents in terms of loss of life (Alexander Kielland and Ocean Ranger) occurred in relatively harsh weather. However, the loss of Alexander Kielland was initiated not by the harsh weather but by fatigue cracking around a welded attachment, which led to loss of one of the main columns and capsizing of the unit with the loss of 123 lives. On the basis of these two failures the observed failure rate due to extreme weather is 2/2655 = 0.00075 /yr. This historical failure rate may not be indicative of the present or future failure rate, due to improvements following these two disasters. However, there is no rigorous way of quantifying the effect of these improvements. Table 8 : Semi-submersible Total Loss Accidents Name of Unit Transocean 3 Deep Sea Driller SEDCO 135A SEDCO 135C Alexander Kielland Ocean Ranger Ocean Odyssey SEDCO

21/03/97

Geographical Area North Sea North Sea Gulf of Mexico Africa West Coast North Sea Canada NE Coast North Sea Africa South

Accident Cause Capsized in bad weather Blown aground Blowout Blowout Fatigue/Weather Extreme Weather Blowout Capsized

Extweath.doc

Fatalities 0 6 0 0 123 84 1 0

Page12



Rev 0

REFERENCES 1.WOAD (1994) “Worldwide Offshore Accident Databank”, Statistical Report, 1994, Det Norske Veritas, Hovic, Norway. 2. Efthymiou, M., van de Graaf J.W., Tromans, P.S. and Hines, I.M.,(1996), Reliability Based Criteria for Fixed Steel Offshore Platforms, OMAE 96-462, Florence, Italy, June 1996. 3. PMB Engineering Inc., (1993), “Hurricane Andrew - Effects on Offshore Platforms”, Joint Industry Project, Phase I Final Report, October 1993. 4. HSE (1990), “Offshore Installations: Guidance on Design, Construction and Certification”, HMSO, 4th Edition, London, 1990 5. NPD (1992), “Regulations concerning Load-bearing Structures in the Petroleum Activity”, Norwegian Petroleum Directorate, Stravanger, Norway. 6. API RP2A WSD, “Recommended Practice for Planning Designind and constructing fixed Offshore Platforms - WSD”, APIRP2A-WSD, 1st - 20th Edition, American Petroleum Institute, Washington D.C. 7. API EP2A LRFD (1993), “Recommended Practice for Planning Designing and Constructing Fixed Iffshore Platforms - LRFFD”, API RP 2A-LRFD, First Edition, July 1993, American Petroleum Institute, Washington D.C. 8. van de Graaf J.W., Efthymiou, M. and Tromans, P.S. (1993) “Implied reliability levels for RP 2A LRFD from studies of North Sea Platforms “, Conference on API RP 2A -LRFD, Society for Underwater Technology, December 1993, London. 9. de Jong, P.R., Vugts, J.H. and Gudmestad, O.T. (1996), “Extreme Hydrodynamic Load Calculations for Fixed Steel Structures”, OMAE (96-420), Florence, Italy, June 1996. 10. SNAME, (2994), “Recommended Practice for Site Assessment of Mobile Jack up Units”, SNAME Technical and Research Bulletin, First Edition, May 1994, New Jersey, USA.

21/03/97

Extweath.doc

Page13


21/03/97


Extweath.doc

Rev 0

Page14

HF in the Calculation of Loss of Containment Frequencies

E&P Forum Qra Datasheet Directory

Rev 0

HUMAN FACTORS IN THE CALCULATION OF LOSS OF CONTAINMENT FREQUENCIES

13/06/03

HFINLCF2.DOC

Page 1



Rev 0

TABLE OF CONTENTS

GLOSSARY OF TERMS & ABBREVIATIONS ------------------------------------------------- 3 1 INTRODUCTION-------------------------------------------------------------------------------------- 4 2 SCOPE -------------------------------------------------------------------------------------------------- 5 3 APPLICATION ---------------------------------------------------------------------------------------- 5 4 CALCULATING RELEASE FREQUENCIES USING FAULT TREE ANALYSIS --- 6 Description---------------------------------------------------------------------------------------------------------------------6 Data Sources-------------------------------------------------------------------------------------------------------------------9

5 MODIFYING GENERIC LOSS OF CONTAINMENT FREQUENCIES --------------- 14 Description------------------------------------------------------------------------------------------------------------------- 14 Data Sources----------------------------------------------------------------------------------------------------------------- 15 Framework for Understanding How Management Exerts An Influence on LOC Frequencies--------------------------------------------------------------------------- 19 Reviewing a Safety Management System for Calculating a Modification of Risk Factor -------------------------------------------------------------------------- 19

6 ONGOING RESEARCH -------------------------------------------------------------------------- 19 7 REFERENCES -------------------------------------------------------------------------------------- 20

13/06/03

HFINLCF2.DOC

Page 2



Rev 0

GLOSSARY OF TERMS & ABBREVIATIONS Term Absolute Probability Judgement European Community

Abbreviation APJ

Definition A method for estimating Human Error Probabilities

EC

-

Error Factor

EF

Event Tree Analysis

ETA

Fault Tree Analysis

FTA

Hazard and Operability Analysis Human Error Assessment and Reduction Technique Human Error Probability

HAZOP

The nominal human error probability (HEP) is multiplied/divided by the error factor to determine the upper/lower bounds of the HEP. An analysis technique used to evaluate the model for the development of an accidental event and determine the relative likelihood of possible outcomes. A technique to determine the frequency of an accidental event by organising the logical relationship between contributing causes and contingent conditions Structured approach to identifying hazards in complex systems, especially in process systems A human reliability analysis technique

HEART

Human Reliability Analysis Loss of Containment

LOC

Management Factor

MF

Monte Carlo Analysis

-

The nominal probability of a person making an error when performing a task. It is normally on a per opportunity basis. The HEP range is from 10-5 per opportunity to 1 per opportunity. For a given task there can be different error modes, each with a nominal HEP. The HEP is dependent on the characteristics of the task and the attributes of the person (e.g. trained or untrained). Human reliability techniques are used to estimate a HEP. A generic term covering all techniques which are used to assess the human component of a system An accidental release of hazardous material from pipework/vessels etc.. A factor derived from an evaluation of the quality of safety management and used to adjust the release rates within a quantified risk assessment A time-based method of modelling system behaviour

Nuclear Power Plant

NPP

-

Performance Shaping Factor Personal Protective Equipment Quantified Risk Assessment Task Analysis

PSF PPE

A factor which can influence human performance and human error probability -

QRA

-

SMS

A series of techniques used to analyse and assess the activities performed by people within a system -

MOR

-

PTW

-

Safety Management System Management Oversight & Risk Tree Permit To Work

13/06/03

HEP

HRA

HFINLCF2.DOC

Page 3


1.


Rev 0

INTRODUCTION

The purpose of this datasheet is to describe Human Factors methods and associated sources of data which are available for incorporation into quantified risk assessment (QRA). The scope of this datasheet relates to calculating loss of containment frequencies. Other datasheets within the directory addressing methods and data related to other aspects of Human Factors in QRA are: -

Human Factors in determining event outcomes (Safety Systems) Human Factors in determining fatalities during escape and sheltering (Vulnerability) Human Factors in determining fatalities during evacuation and rescue (Vulnerability)

The figure below indicates how the datasheets integrate into the overall framework for risk analysis. Figure 1: Overall Framework for Integration of Human Factors into QRA

Platform data

Failure case definition

HAZID study

Scenario development HFin LOC Frequencies & Event Outcome Probabilities

Frequency analysis

Event Outcome Probabilities

Consequence analysis Impact assessment

Fatalities During Escape & Sheltering, Fatalities During Evacuation & Rescue

Risk summation

Assessment of Results

Criteria

Each of the four datasheets describes the scope and application of approaches to human factors used in practice to support the safe design and operation of installations. Selected examples are provided to enable the analyst to follow through approaches in detail. Considerations, like the strengths and weaknesses of an approach, its maturity, and references to information sources are given where appropriate. The four datasheets are not intended as a definitive guide to or manual on Human Factors methods, nor to provide all possible sources of data. They should be used to gain an understanding of the important components of carrying out assessments and an appreciation of the approaches to incorporating Human Factors into quantified risk assessment.

13/06/03

HFINLCF2.DOC

Page 4


2.


Rev 0

SCOPE

This datasheet describes how Human Factors methods can be used to estimate the human error component of loss of containment (LOC) frequencies. Generic LOC data used in QRA include all causes of releases, including human errors. LOC accident analysis enables an estimation of the relative contribution of human and equipment failure, at around 40%:60% [1]. For crane accidents (dropped object events), four sources of data enable the classification of the direct causes of crane accident in terms of human error and mechanical failure [2,3,4,5]. The ratio for distributing the failure frequency between human error and mechanical failure is 55%:45%. These data which identify the relative contribution of human and hardware failures are useful for benchmarking in fault tree analysis. It helps as a check on whether the analysis is giving results consistent with the historical data, which is particularly important when human failure probabilities in fault trees are derived primarily from expert judgement. There is a tendency to overestimate human error probabilities relative to the hardware failure estimates. One reason is that human error recovery mechanisms are often forgotten. For example, a maintenance error could be recovered by checking by the supervisor. This means that in FTA, many human errors should have an AND gate with error recovery failure. The latter would be 1 if there is no opportunity for error recovery. For a well designed error management system, the practice is to use an error recovery failure probability of 10-2. Identification of management mechanisms which could have prevented or recovered unsafe conditions leading to Loss of Containment accidents, indicates that some 90% of LOC accidents are preventable. Prevention mechanisms are: identifying unsafe conditions through hazard review, task checking, routine testing and inspection, and Human Factors review, including associated follow-up actions. The data provide a statistical model which has been used as a basis for factoring Generic LOC data using a Modification of Risk Factor derived from an assessment of the quality of Safety Management. The modification factor for generic failure rates ranges between 0.1 and 100 for good and poor management respectively [6], but more typically between 0.5 and 10 in practice. In a study of 402 offshore LOC incidents, 47% originated in maintenance, 30% originated in design, 15% in operations, and 8% in construction. Of the maintenance failures, 65% were due to errors in performing maintenance and 35% failure to carry out the required activity. 3.

APPLICATION

In cases where the part played by the operator can be fairly well defined, unwanted events can be analysed by decomposition of human and technical failure causes using Fault Tree Analysis (FTA), particularly in cases where: 1. There is a new or modified system which has a significant role for operators; 2. First pass risk assessment indicates dominant risks which could have a significant human error component; 3. Human Factors risk reduction measures are required; 4. Historical failure data do not exist or are not applicable to the initiating event(s) of interest. 13/06/03

HFINLCF2.DOC

Page 5



Rev 0

Review of the quality of Safety Management Systems (SMS) through audit and application of a modification factor to all generic failure rates may be used in the QRA where: 1. The quality of the management system is considered to be either very good or very poor and it is desired that the QRA take account of this; 2. Risk reduction measures which target SMS improvements are required.

4.

CALCULATING RELEASE FREQUENCIES USING FAULT TREE ANALYSIS

4.1

Description

Operator error is incorporated through identification of opportunities for error which could lead to the initiation of an accident. The opportunities for error could include: • directly causing an initiating event (eg. leaving a valve open and starting a pump) • failing to recover (identify and correct) a mechanical failure or operator error which directly or indirectly could cause an initiating event (eg. failure to identify a stuck valve, fail to check procedure completed) • indirectly causing an initiating event (eg. a calculation error, installing the wrong piece of equipment) Figure 2 shows the overall structure of incorporating human error into FTA, and an example FTA, replicated from [8], is shown in Figure 3. Figure 2: Overall structure of incorporating Human Error into FTA

Initiating Event

Unrecoverable equipment failure

Unrecovered equipment failure

Recoverable equipment failure

Fail to recover (i.e. operator error)

Unrecovered operator error

Operator error

Fail to recover (i.e. operator error)

The example in Figure 3 estimates the probability of opening a pig launcher having failed to drain it beforehand. This could occur by either: • • •

the operators omitting to drain the vessel, or mechanical failure of the automatic drains tank discharge system, or a blockage in the drains system.

13/06/03

HFINLCF2.DOC

Page 6



Rev 0

The fault tree was constructed and the errors quantified with the assistance of a task analysis. The task analysis established that the procedure did not require inspection of the drains tank or drains pump during the operation, therefore removing a possible method of detecting a draining failure (error nos. 2, 7, 12 & 17 equal 1.0). The task analysis also identified that the pig vessel had no level gauge, therefore errors nos. 3, 13 & 18 equal 1.0. Note that the term "operator error" is frequently used to cover all cases of front line human error such as in maintenance, operations, task supervision, and start-stop decisions. The opportunities for operator error have to be identified by an analysis of the tasks performed. A full task analysis can involve a complete breakdown of all the task components to a very detailed level. However, many of the opportunities for error will not be directly relevant to the initiating events identified. Therefore, the task analysis process should be iterative, carried out in parallel with the fault tree development. When identifying opportunities for error, it is usual to express each error as an external (observable) mode of failure, such as an action error (eg. doing something incorrectly). This is preferable to using internal modes of failure (eg. short term memory failure). Swain and Guttmann [9] have identified a global set of action errors which are developed in numerous sources on error identification. The following list from [10] can be used: • • • • •

Error of omission: omission of required behaviour Error of commission: operation performed incorrectly (eg. too much, too little), wrong action, action out of sequence. Action not in time: failure to complete an action in time or performing it too late/too early. Extraneous act: performing an action when there is no task demand. Error recovery failure: many errors can be recovered before they have a significant consequence; failure to do this can itself be an error.

13/06/03

HFINLCF2.DOC

Page 7



Rev 0

Figure 3: Example Fault Tree Analysis (pig vessel not drained before opening) Pig vessel not drained before opening 1.51E-04

OR Omit to drain vessel and liquid in vessel not detected 6.00E-07

Undetected incomplete draining due to blockage in drain line 1.50E-04

In complete draining due to undetected mechanical failure 7.62E-08

AND

AND

AND Omit draining of pig vessel

Fail to detect liquid in pig vessel before opening

1.00E-04

1

Undetected mechanical failure causes draining failure 1.27E-06

6.00E-03

AND Check of door valve fails to detect liquid 6.00E-03 1.00E+00

4

AND Check of level in drains tank fails 1.00E+00

Failure of drain system to increase ullage

5.00E--01

2.54E-06

Liquid in pig not detected from vessel or drain tanks 1.00E+00

AND

5 OR Undetected pump failure

Check of level in Pig vessel fails 1.00E+00

2

Insufficient ullage at start of draining

5.18E-07

AND 3

Pump failure

Pump failure not detected

2.25E-03

Level sensor fails 8.80E-03

2.30E-04

9

Pump failure not detected locally 1.00E+00

Pump failure not detected from DCMS 2.30E-04

7

14

AND

Blockage in drain line 1.00E-02

15

Blockage not detected from no-change in drain tank level 2.50E-01

16

Liquid in pig not detected from vessel or drain tanks 1.00E+00

AND Check of level in drains tank fails 1.00E+00

13

17

Check of door valve fails to detect liquid 6.00E-02

19 Check of level in Pig vessel fails 1.00E+00

18

12

6 AND

13/06/2003

1.00E+00

AND

Check of door valve fails to detect liquid 6.00E-02

Check of level in Pig vessel fails 1.00E+00

Check of level in drains tank fails

Undetected High level sensor failure 2.02E-06

Fail to detect liquid in pig vessel before opening 6.00E-02

AND

AND

AND

Liquid in pig not detected from vessel or drain tanks

Undetected blockage in drain line 2.50E-03

Fail to detect liquid in pig vessel before opening 6.00E-02

8

Level sensor failure not detected 2.30E-04

AND Level sensor failure not detected locally 1.00E+00

HFINLCF2.DOC

10

Level sensor failure not detected from DCMS 2.30E-04

11

Page 8


4.2


Rev 0

Data Sources

The quantification of error, per demand, has been the subject of much debate. This is because historical data on human error frequencies are virtually non-existent. Human reliability assessment (HRA) methods have therefore been developed. A general text book on HRA is presented in [11]. One source which provides a comparison of HRA methods is the "Human Reliability Assessors Guide" [12]. This study identified Absolute Probability Judgement (APJ) as one of the most effective methods of Human Reliability Assessment. The APJ method uses informed (e.g. from experimental data) or expert judgement (eg. human reliability specialists and operations experts supported by judgement aids or data benchmarks) to assign a generic error probability to identified opportunities for error. The judgement must be supported by assumptions which can later be used as a basis for making recommendations as to how the error probabilities can be reduced. Generic error probabilities from [13] have been used in Absolute Probability Judgement (see Table 1). These probabilities were derived from expert judgement supported by a psychological scaling technique. Uninformed guessing of human error probabilities should not be equated with APJ. Relevant expertise, accepted sources of data, and appropriate documentation of the method of arriving at the data point are required. The quantification process must take account of important features in the task context, such as situation novelty, or time on task, which may increase or decrease the likelihood of error. These identified 'Performance Shaping Factors' can be used to modify nominal error probabilities. The PSFs of interest in the petrochemical industry can be grouped into a small number of areas. These are illustrated in Figure 4. Generic data on performance shaping factors are available [9,14].

13/06/2003

HFINLCF2.DOC

Page 9



Rev 0

Figure 4: Summary of Performance Shaping Factors

HUMAN-MACHINE INTERFACE CHARACTERISTICS (DISPLAYS AND CONTROLS) Sufficiency Location Readability Distinguishablity Identification Compatibility Ease of operation Reliability Meaning Feedback

TASK DEMANDS Perceptual Physical Memory Attention TASK CHARACTERISTICS Vigilance Frequency Repetitiveness Workload Criticality Continuity Duration Interaction with other tasks INSTRUCTIONS & PROCEDURES Accuracy Sufficiency Clarity Meaning Readability Ease of Use Applicability Format Level of detail Selection and location Revision

INDIVIDUAL FACTORS Capacities Training Experience Skills Knowledge Personality Physical condition Attitudes Motivation ENVIRONMENT Temperature Humidity Noise Vibration Lighting Workspace

13/06/2003

SOCIOTECHNICAL FACTORS Manning Work hours/breaks Resource availability Actions of others Social pressures Organizatiom structure Team structure Communication Authority Responsibility Group practices Rewards and benefits

HFINLCF2.DOC

STRESSES Time Pressure Workload High risk environment Monotony Fatigue, pain, discomfort Conflicts Isolation Distractions Vobration Noise Lighting Temperature Movement constriction Shiftwork Incentives

Page 10



Rev 0

Table 1: Example Generic Human Error Rates [13] Error type

Type of behaviour

1

Extraordinary errors of the type difficult to conceive how they could occur: stress free, powerful cues initiating for success. Error in regularly performed commonplace simple tasks with minimum stress.

2

Nominal human error probability (per demand) 10-5 10-4

3

Errors of commission such as operating the wrong button or reading the wrong display. More complex task, less time available, some cues necessary.

10-3

4

Errors of omission where dependence is placed on situation cues and memory. Complex, unfamiliar task with little feedback and some distractions.

10-2

5

Highly complex task, considerable stress, little time to perform it. Process involving creative thinking, unfamiliar complex operation where time is short, stress is high.

10-1

6

10-1 to 1

Although a great deal is known about the effects of different conditions on human performance, their quantification in terms of the extent to which error likelihood is affected is poorly researched. Human Reliability Assessment techniques often provide a database of the effects of PSFs, and these are generally based on judgement. The PSFs with the biggest influence, such as high stress or lack of training, are broadly estimated to result in an order of magnitude increase in error likelihood. Other effects relate to performance over time such as a decrease in the ability to remain vigilant over long periods and hence detect changes in the environment. Some data on the factors influencing the performance of an individual when carrying out a task are shown in Table 2.

13/06/2003

HFINLCF2.DOC

Page 11



Rev 0

Table 2: Multipliers for Performance Shaping Factors [14,12] (Maximum predicted value by which unreliability might change going from "good" conditions to "bad") Error-Producing condition

Multiplier

Unfamiliarity with a situation which is potentially important but which only occurs infrequently or which is novel.

17

A shortage of time available for error detection and correction.

11

A low signal-noise ratio.

10

A means of suppressing or over-riding information or features which is too easily accessible.

9

No means of conveying spatial and functional information to operators in a form which they can readily assimilate.

8

A mismatch between an operator's model of the world and that imagined by a designer.

8

No obvious means of reversing an unintended action.

8

A channel capacity overload particularly one caused by simultaneous presentation of nonredundant information. A need to unlearn a technique and apply one which requires the application of an opposing philosophy.

6

The need to transfer specific knowledge from task to task without loss. Ambiguity in the required performance standards. A mismatch between perceived and real risk.

5.5 5 4

Poor, ambiguous or ill-matched system feedback. No clear direct and timely confirmation of an intended action from the portion of the systems over which control is to be exerted.

4 4

Operator inexperience (eg. newly-qualified tradesman vs "expert").

3

An impoverished quality of information conveyed by procedures and person/person interaction.

3

Little or no independent checking or testing of output

3

A conflict between immediate and long-term objectives.

2.5

No diversity of information input for veracity checks.

2.5

A mismatch between the educational achievement level of an individual and the requirements of the task.

2

An incentive to use more dangerous procedures.

2

Little opportunity to exercise mind and body outside the immediate confines of a job.

1.8

Unreliable instrumentation (enough that it is noticed).

1.6

A need for absolute judgements which are beyond the capabilities or experience of an operator.

1.6

Unclear allocation of function and responsibility.

1.6

No obvious way to keep track of progress during an activity.

1.4

A danger that finite physical capabilities will be exceeded.

1.4

Little or no intrinsic meaning in a task.

1.4

High-level emotional stress

1.3

Evidence of ill-health amongst operatives, especially fever.

1.2

Low workforce morale.

1.2

Inconsistency in meaning of displays and procedures.

1.2

13/06/2003

HFINLCF2.DOC

6

Page 12



Error-Producing condition

Rev 0

Multiplier

A poor or hostile environment (below 75% of health or life-threatening severity).

1.15

Prolonged inactivity or high repetitious cycling of low mental workload tasks

Disruption of normal work-sleep cycles.

1.1 for 1st half hour 1.05 for each hour thereafter 1.1

Task Pacing caused by the intervention of others.

1.06

Additional team members over and above those necessary to perform task normally and satisfactorily.

1.03 per additional man. 1.02

Age of personnel performing perceptual task.

This is a mature and commonly used approach. It is relatively simple to follow and there are plenty of generic data sources for HEPs. However, it is very dependent upon the skill of the analyst in identifying opportunities for error. It usually requires at least a two person specialist team, one for the equipment and one for the human reliability identification, with some mutual understanding of the operation of the human-technical system.

13/06/2003

HFINLCF2.DOC

Page 13



5.

MODIFYING GENERIC LOSS OF CONTAINMENT FREQUENCIES

5.1

Description

Rev 0

Examination of major accidents shows management failures to be prevalent in the following organisational areas [18]: •

Poor control of communication and coordination: - between shifts; - upward from front line personnel to higher management in the organisational hierarchy and downward in terms of implementing safety policy and standards throughout the line of management (particularly in a many-tiered organisation); - between different functional groups (eg. between operations and maintenance, between mechanical and electrical); - between geographically separated groups; - in inter-organisational grouping (particularly where roles and responsibilities overlap) such as in the use of sub-contractors, or in an operation which requires the coordination of multiple groups within the same operational "space"; - in heeding warnings (which is one of the important manifestations of the above where the indicators of latent failures within an organisation become lost or buried).

•

Inadequate control of pressures: - in minimising group or social pressures - in controlling the influence of workload and time pressures - of production - of conflicting objectives (eg. causing diversion of effort away from safety considerations)

•

Inadequacies in control of human and equipment resources: - where there is sharing of resources (where different groups operate on the same equipment), coupled with communication problems. Eg. Lack of a permit-to-work (PTW) system. - where personnel competencies are inadequate for the job or there is a shortage of staff - particularly where means of communication are inadequate - where equipment and information (eg. at the man-machine or in support documentation) are inadequate to do the job

•

Rigidity in system norms such that systems do not exist to: - adequately assess the effects and requirements of change (eg. a novel situation arises, new equipment is introduced) - upgrade and implement procedures in the event of change - ensure that the correct procedures are being implemented and followed - intervene when assumptions made by front line personnel are at odds with the status of the system - control the informal learning processes which maintain organisational rigidity

These are types of failure which can be addressed in a Safety Management System (SMS) audit to derive a rating of the management system.

13/06/2003

HFINLCF2.DOC

Page 14


5.2


Rev 0

Data Sources

In a study of accidents in the chemical processing industry sponsored by the UK Health and Safety Executive, around 1000 loss of containment accidents from pipework and vessels on onshore chemical and petrochemical plants were analysed, and the direct and underlying causes of failure were assessed [19, 20]. The underlying causes were defined in terms of a matrix which expressed (a) the activity in which the key failure occurred, and (b) the preventive mechanism failure (i.e. what management did not do to prevent or rectify the error). The preventive mechanisms are described below. Hazard study (of design or as-built) Hazard studies of design, such as hazard and operability studies (HAZOP), should recover design errors and potential operational or maintenance errors to the extent they fall within the scope of the review. Some underlying causes of failure will be recoverable at the as-built stage such as certain layout aspects or wrong locations of equipment. Hazard study covers: -

inadequacies or failures in conducting an appropriate hazard study of design; failure to follow-up recommendations of the HAZOP or other hazard study.

Human factors review This category specifically refers to cases of failure to recover those underlying causes of unsafe conditions which resulted in human errors within the operator or fitter - hardware system, including interfaces and procedures. These errors are of the type that can be addressed with a Human Factors oriented review. The unrecovered errors will be information processing or action errors in the following categories: - failure to follow procedures due to poor procedural design, poor communication, lack of detail in PTW, inadequate resources, inadequate training, etc.; - recognition failures due to inadequate plant or equipment identification, or lack of training, etc.; - inability or difficulty in carrying out actions due to poor location or design of controls. Task Checking Checks, inspections and tests after tasks have been completed should identify errors such as installing equipment at the wrong location or failure to check that a system has been properly isolated as part of maintenance. Routine Checking The above are all routine activities in the sense that they are part of a vigilance system on regular look-out for recoverable unsafe conditions in plant / process. These activities may be similar to the task checking category activities but they are not task driven. This category also includes failure to follow-up , given identification of an unsafe condition as part of routine test or inspection. Evidence for events that would be included in this category would be: -

equipment in a state of disrepair; inadequate routine inspection and testing

13/06/2003

HFINLCF2.DOC

Page 15



Rev 0

The distribution of failures is shown in Table 3 and 4 and graphically in Figure 5. Human factors aspects of maintenance and normal operations account for around 30% of LOC accidents (a similar proportion could have been prevented by a hazard study of the design (by HAZOP, QRA etc.). A study of 402 North Sea offshore industry release incidents, from a single operator, indicates results consistent with those obtained for the onshore plant pipework study [7].

13/06/2003

HFINLCF2.DOC

Page 16



Rev 0

Figure 5: Contributions to Pipework Failures According to Underlying Causes and Preventive Mechanisms [19]

25%

20% 15% 10% 5% Not recoverable Hazard Study Human Factors Review Preventive Task Checking

Mechanism

Routine Checking Unknown Recovery

Maintenance Natural Causes Design Manufacture Construction Underlying Operation

Cause

Sabotage Domino

Table 3: Distribution of direct causes of pipework and vessel failures [19,20]

CAUSE OF FAILURE

% OF KNOWN CAUSES PIPEWORK

VESSELS

20.5 30.9 15.6 6.4 8.1 5.0 6.7 2.5 1.3 2.5

45.2 24.5 6.3 11.2 5.6 2.6 1.9 0 0.2 2.6

Overpressure Operator Error (direct) Corrosion Temperature Impact External Loading Wrong Equipment/Location Vibration Erosion Other

13/06/2003

HFINLCF2.DOC

Page 17



Rev 0

Table 4: % Contribution of underlying causes to pipework (n=492) and vessel failures (n=193) (all unknown origins and unknown recovery failures removed) [19,20] Recovery Mechanism

Not Recoverable

Hazards study

Human Factors

Origin

Pipes

Vessels

Pipes

Vessels

Pipes

Vessels

Natural Causes Design Manufacture Construction Operations Maintenance Sabotage Domino

1.8 0 0 0.1 0 0 1.2 4.6

0.5 0 0 0 0 0 1 11.9

0 25 0 0.2 0.1 0.4 0 0.2

0 29 0 0.3 5.4 2.1 0 0.3

0 2 0 2 11.3 14.8 0 0

0 0 0 0 24.5 5.7 0 0

TOTAL

7.7

13.4

25.9

37.1

30.1

30.2

Recovery Mechanism Origin

Pipes

Vessels

Pipes

Vessels

Pipes

Vessels

Natural Causes Design Manufacture Construction Operations Maintenance Sabotage Domino

0.2 0 2.5 7.6 1.6 13 0 0

0 0 0 1.8 2.1 3.6 0 0

0 0.2 0 0.2 0.2 10.5 0 0.3

0 0.5 0 0 0 10.8 0 0.5

2 27.2 2.5 10.1 13.2 38.7 1.2 5.1

0.5 29.5 0 2.1 32 22.2 1.0 12.7

TOTAL

24.9

7.5

11.4

11.8

100

100

13/06/2003

Task Checking

Routine Checking

HFINLCF2.DOC

Total

Page 18



Rev 0

5.3 How Management Exerts An Influence on LOC Frequencies The key areas already mentioned for the control of loss of containment accidents, can be listed as follows (in order of importance for preventing pipework failures): • • • • • • • •

Hazard review of design Human factors review of maintenance activities Supervision and checking of maintenance tasks Routine inspection and testing for maintenance Human factors review of operations Supervision and checking of construction/installation work Hazard review (audit) of operations Supervision and checking of operations

5.4

Reviewing a SMS to Calculate a Modification of Risk Factor

The complexity of safety management systems makes it necessary to have a structured and systematic approach to assessing their quality and adequacy. Any attempt to adjust or modify risk factors based on the outcome of an assessment of the Safety Management System must be approached with caution and should not be driven solely by the need to reduce calculated absolute risk levels (the QRA process will already take it into account many of the factors relating to safety management of the facility or activity). Notwithstanding, the assessment of whether risk factors may be adjusted up or down must be objective and impartial. This implies that such adjustments are only valid if based on wholly independent assessments of the relevant Safety Management System and Safety Case

6.

ONGOING RESEARCH

There is a continuing search for human error data, and there has been some sponsorship of this from the EC. Human Reliability Assessment techniques, and associated task analysis methods, are relatively mature and new developments here will not have a significant impact on current methodologies, simply offer refinements. Modification of risk is still state-of-the-art in terms of application. Techniques which are consistent in deriving objective MOR factors are under development. New ways of calculating top event frequencies using organisation and management influence pathways are being considered, but this is currently at the research stage.

13/06/2003

HFINLCF2.DOC

Page 19


7.


Rev 0

REFERENCES

[1]

Hurst, N.W., Bellamy, L.J. and Geyer, T.A.W. (1991) A classification scheme for pipework failures to include human and sociotechnical errors and their contribution to pipework failure frequencies. J. Hazardous Materials, 26 (1991) 159-186.

[2]

Danos W., and Bennett L.E., Risk Analysis of Crane Accidents, U.S. Department of the Interior/Minerals Management Service, OCS Report MMS 84-0056, 1984

[3]

Butler A.J., An investigation into crane accidents, their causes and repair costs. Building Research Establishment Report CP75/78, Department of the Environment, 1978

[4]

Sutton R., and Towill D.R., A model of the crane operator as a man-machine element, pp. 25-42 in Proceedings of the second European annual conference on human decision making and manual control, June 2-4, 1982, University of Bonn, poppelsdorfer Schloss. Forschungsinstitut fur Anthropotechnik (FGAN/FAT). Wachtberg - Werhoven, Federal Republic of Germany, 1982

[5]

Wiken H., Offshore Crane Operations, Progress report no 1, Study of offshore crane casualties in the North Sea. Det Norske Veritas Technical Report 78-633, 1978

[6]

Muyselaar, A.J. and Bellamy, L.J. (1993). An audit technique for the evaluation and management of risks. Paper presented at the CEC DGXI workshop on "Safety Management in the Process Industry", October 7-8 1993, Ravello, Italy.

[7]

Four Elements (1993) report 2258

[8]

Brabazon P.G., Gibson W.H., Tinline G., Leathley B.A., Practical Applications of Human Factors Methods in Offshore Installation Design. Offshore South East Asia, 6-9 December, 1994

[9]

Swain, A.D. and Guttmann, H.E. (1983), A Handbook of Human Reliability Analyses with Emphasis on Nuclear Power Plant Applications, NUREG/CR-1298, Nuclear Regulatory Commission, Washington DC 20555.

[10]

Bellamy, L.J. (1986) The Safety Management Factor: An Analysis of the Human Error Aspects of the Bhopal Disaster. Safety and Reliability Society Symposium, 25 September 1986, Southport, UK.

[11]

Kirwan B., A guide to practical human reliability assessment, Taylor & Francis, 1994, ISBN 07484-0111-3

[12]

SRD/Humphreys, P. (ed.) (1988) Human Reliability Assessors Guide. Safety and Reliability Directorate Publication RTS 88/95Q. Warrington: UK Atomic Energy Authority

13/06/2003

HFINLCF2.DOC

Page 20



Rev 0

[13]

Hunns, D.M. and Daniels, B.K., The Method of Paired Comparisons, Proceedings 6th Symposium on Advances in Reliability Technology, Report NCSR R23 and R24, UK Atomic Energy Authority, 1980.

[14]

Williams, J.C. (1988), A data-based method for assessing and reducing human error to improve operational experience, In Proceedings of IEEE 4th Conference on Human Factors in Power Plants, Monterey, Calif., 6-9 June 1988.

[15]

Whittingham, B. (1993) Human Factors in QRA - Data and Methodology. pp. 93118 in proceedings of the E&P Forum Workshop on Data in Oil and Gas Quantitative Risk Assessments, December 1993, Report no. 11.7/205 Jan 1994.

[16]

Brown W et al., The qualification of human variability and its effect on nuclear power plant risk, Brookhaven National Laboratory, Upton, NY, 1990

[17]

Wong S et al., Risk sensitivity to human error in the LaSalle PRA, NUREG CR/5527, U.S. Nuclear Regulatory Commission, Washington, DC., 1990

[18]

Bellamy, L.J., Wright, M.S. and Hurst, N.W. (1993) History and development of a safety management system audit for incorporation into quantitative risk assessment. International process Safety Management Workshop, San Francisco, 22-24 September, AIChemE/CCPS.

[19]

Bellamy, L.J., Geyer, T.A.W., and Astley, J.A.A. (1989) Evaluation of the human contribution to pipework and in-line equipment failure frequencies. HSE Contract Research Report No. 89/15.

[20]

Bellamy, L.J. and Geyer, T.A.W. (1991) Organisational, Management and Human Factors in Quantified Risk Assessment. HSE Contract Research Report 33/1991.

13/06/2003

HFINLCF2.DOC

Page 21


13/06/2003


HFINLCF2.DOC

Rev 0

Page 22

Fire & Gas Detection

E&P Forum Datasheet Directory

Rev 0

FIRE AND GAS DETECTION

13/06/2003

FIRE&G~1.DOC

Page 1



Rev 0

TABLE OF CONTENTS

LIST OF ABBREVIATIONS -------------------------------------------------------------------------- 3 1. INTRODUCTION------------------------------------------------------------------------------------- 4 2. RELIABILITY DATA -------------------------------------------------------------------------------- 5 2.1 Summary Reliability Data -------------------------------------------------------------------------------------------5 2.2 Reliability Parameter Definitions-----------------------------------------------------------------------------------5

3. DATA SOURCES FOR FIRE AND GAS DETECTION SYSTEM----------------------- 8 3.1 Data Sources ------------------------------------------------------------------------------------------------------------8 3.2 Literature Survey---------------------------------------------------------------------------------------------------- 10 3.2.1 Compendex ----------------------------------------------------------------------------------------------------------- 11 3.2.2 CARL UnCover ------------------------------------------------------------------------------------------------------ 11 3.2.3 BIBSYS --------------------------------------------------------------------------------------------------------------- 11

4. ON-GOING RESEARCH------------------------------------------------------------------------- 11 5. REFERENCES ------------------------------------------------------------------------------------- 12 APPENDIX A - RELIABILITY DATA SHEETS ------------------------------------------------ A1

13/06/2003

FIRE&G~1.DOC

Page 2



Rev 0

LIST OF ABBREVIATIONS

CPU

Central Processing Unit

CSU

Critical Safety Unavailability

ESD

Emergency Shut Down

FGD

Fire and Gas Detection

FTIR

Fourier Transform Infrared

FTO

Fail To Operate

IR

InfraRed

LCC

Life Cycle Cost

NC

Non-Critical

NORSOK

The Norwegian initiative to reduce development and operation cost for the offshore oil and gas industry. NORSOK have issued a number of technical standards. Offshore Reliability Data

OREDA PDS-method

PLC

Method for quantification of the safety and reliability performance of computer-based process safety systems, developed by SINTEF in the PDSproject. SINTEF-project “Reliability and Availability of Computer-Based Process Safety Systems” (Norwegian abbreviation) Programmable Logic Controller

SO

Spurious Operation

STR

Spurious Trip Rate

TÜV

Technische Überwachungs Verein (Germany)

TIF

Test Independent Failure

UV

Ultraviolet

PDS-project

13/06/2003

FIRE&G~1.DOC

Page 3


1.


Rev 0

INTRODUCTION

The objective of this datasheet is to identify data sources for fire and gas detection system components, and further to provide illustrative reliability data for such components. The report presents reliability data for fire and gas detection system components (Chapter 2 and Appendix B). Further, data sources for these type of components are identified and discussed (Chapter 3).

13/06/2003

FIRE&G~1.DOC

Page 4


2.


Rev 0

RELIABILITY DATA

In Section 2.1 the reliability data for the fire and gas detection systems are summarised. Section 2.2 gives the definitions of the reliability data parameters presented in Section 2.1. Datasheets for the components are given in Appendix B. 2.1

Summary Reliability Data

Table 1 summarizes reliability input data for quantification of the reliability of fire and gas detection systems. Table 1:

Failure rates, coverage of automatic self-tests and TIF probabilities for fire and gas detection system components.

Component

crit per106 hrs

Coverage c

Failure rate per 106 hrs

det

SO

TIF (Test Independent Failures)

FTO

Gas detector, conventional catalytic Gas detector, conventional IR Gas detector, beam Smoke detector

5.5

50%

3.0

1.0

1.5

3x10-4 - 0.1 1)

4.0

70%

2.9

0.1

1.0

3x10-4 - 0.1 1)

7

70%

5

1

1

3x10-4 - 0.1 1)

4.0

40%

1.5

2.0

0.5

10-3 - 0.05 2)

Heat detector

2.5

40%

1.0

1.0

0.5

0.05 - 0.5 3)

Flame detector

7.0

40%

2.5

3.0

1.5

3x10-4 - 0.5 4)

ESD push button

1.0

20%

0.2

0.6

0.2

10-5

FGD node (single PLC system)

80.0

90%

72.0

6.0

2.0

5x10-5-5x10-4

Field bus coupler

0.2

90%

0.18

0.02

0.001

10-5

Field bus CPU/ Communic. unit

0.2

90%

0.18

0.02

0.001

10-5

1) 2) 3) 4) 5)

2.2

5)

The range gives values for large (lower value) to small gas leaks. For smoke and flame fires, respectively. The range represents the occurrence of different types of fires (different locations). For flame and smoke fires, respectively. For TÜV certified and standard system, respectively.

Reliability Parameter Definitions

13/06/2003

FIRE&G~1.DOC

Page 5



Rev 0

The following parameters are presented in Table 1: crit

=

Total critical failure rate of the component. Rate of failures that will cause either trip or unavailability of safety function (unless detected and prevented from causing such failure)

det

=

Rate of critical failure which will be detected by automatic self-test or by control room monitoring. The effect of these failures on the Spurious Trip Rate (STR) depends on the operational philosophy of the system.

=

det / crit = Coverage of the automatic self-test + control room operator.

=

Rate of Spurious Operation (SO) failures, undetectable by automatic self-test. The rate of Spurious Operation (SO) failures of a component contributes to the STR of the system (independent of operation philosophy).

FTO =

Rate of failures causing Fail-To-Operate (FTO) failures, undetectable by automatic self-test. The FTO failures contribute to the Critical Safety Unavailability (CSU) of the component/system.

c SO

TIF

=

Observe that

Test Independent Failures. The probability that a component which has just been functionally tested will fail on demand (applies for FTO failures only). crit =

det +

FTO +

SO.

An essential element is to clarify precisely which failures contribute to TIF and crit, respectively. Figure 1 is an aid to clarify this. In particular the following is stressed concerning the interpretation of these concepts as used in the present report. TIF probability The TIFprobability is the probability that a component which has just been tested will fail on demand. This will include failures caused by for example improper location or inadequate design (software error or inadequate detection principle). An imperfect functional testing procedure will also contribute. Finally, the possibility that the maintenance crew perform an erroneous functional test or fail to return the component to a working state (which is usually not detected before the next test) also contributes to the TIF probability.

13/06/2003

FIRE&G~1.DOC

Page 6



Rev 0

Detected by automatic self-test. det

Detected by operator/maintenance personnel (independent of functional test)

crit SO

Spurious trip failure; immediately revealed. Not prevented by any test.

FTO

Loss of safety failure. Detected by demands only.

Coverage: c =

det

- design errors

crit

TIF prob.

Possible contributors

* software * degree of discrimination - wrong location - insufficient functional test procedure

(Test demand different from true demand)

- human error during test (insufficient/ erroneous test) * forget to test * wrong calibration * damaged detector * bypass not removed

13/06/2003

FIRE&G~1.DOC

Page 7



Rev 0

Thus, note that if an imperfect testing principle is adopted for the functional testing, this will contribute to the TIF probability. For instance, if a gas detector is tested by introducing a dedicated test gas to the housing via a special port, the test will not reveal a blockage of the main ports. Furthermore, use of a dedicated test gas is a contribution to the uncertainty, as testing with process gas has not been done. The contribution of the TIF probability and FTO to the Critical Safety Unavailability (CSU) is illustrated in Figure A.1 in Appendix A. The two main contributions to TIF are also indicated in the figure. Coverage The coverage is the fraction of the critical failures which is detected by the automatic self-test or by an operator. Thus, we include as part of the coverage any failure that in some way is detected in between functional tests. An analog sensor (e.g. transmitter) that is “stuck” will have a critical failure, but this failure is assumed to be detected by the panel operator and thus contribute to det. Any trip failure of a detector, giving a pre-alarm, which in principle allows the operator to prevent an automatic activation (trip) to occur is also part of det, and contributes to the coverage, c. In short, we include in det failures for which a trip could be prevented by specifying so in the operation philosophy. This means that both det and SO can contribute to the spurious trip rate.

3.

DATA SOURCES FOR FIRE AND GAS DETECTION SYSTEM

3.1

Data Sources

Failure rate data is mainly based on the OREDA Phase III database. Where this source does not contain data, or data are scarce, the failure rate estimate is based on other relevant sources. The individual data sheets give information on the data sources for the various components. A brief overview of all the failure rate data sources are given below. Estimates of the failure mode distribution and the coverage is based on a combination of expert judgement and data from the OREDA Phase III database. For the TIF probabilities, the estimates are based upon expert judgements.

13/06/2003

FIRE&G~1.DOC

Page 8



Rev 0

OREDA - Offshore Reliability Data,.[6, 7, 8] Authors: Publisher: OREDA Participants, distributed by DNV Technica, Høvik, Norway Publ. year: 1984, 1992 and 1993 Data based on: Field experience Description: The Offshore Reliability Data (OREDA) handbooks and databases contain experience data from a wide range of components and systems used on offshore installations, collected from installations in the North Sea and in the Adriatic Sea. OREDA has published two handbooks; 1st edition from 1984 [3] and 2nd edition from 1992 [2]. Further, there are two versions of the OREDA database, of which the latest version is the main data source in this report, denoted the OREDA Phase III database [1]. The data in the OREDA Phase III database were collected in 199293. Oseberg C - Experience Data on Fire and Gas Detectors, [9] Author: Jon Arne Grammeltvedt Publisher: Norsk Hydro, Research Centre, Porsgrunn, Norway Publ. year: 1994 Data based on: Field experience Description: The report presents field experience data on catalytic gas detectors, IR flame detectors and smoke detectors from the Oseberg C platform in the North Sea. VULCAN - A Vulnerability Calculation Method for Process Safety Systems, [10]/ Author: Lars Bodsberg Publisher: Norwegian Institute of Technology, Trondheim, Norway Publ. year: 1993 Data based on: Field experience Description: This doctoral dissertation includes experience failure data on fire and gas detectors from one offshore petroleum production installation. The data presented here are very comprehensive with respect to failure types, including functional failures. Note that the same data are also included in the OREDA Phase III data. NPRD-91: Nonelectronic Parts Reliability Data 1991, [14]/ Authors: William Denson, Greg Chandler, William Crowell and Rick Wanner Publisher: Reliability Analysis Centre, Rome, New York, USA Publ. year: 1991 Data based on: Field experience Description: The handbook provides failure rate data for a wide variety of component types including mechanical, electromechanical, and discrete electronic parts and assemblies. Data represent a compilation of field experience in military and industrial applications, and concentrates on items not covered by MIL-HDBK 217, "Reliability Prediction of Electronic Equipment". Data tables include part descriptions, quality levels, application environments, point estimates of failure rate, data sources, number of failures, total operating hours, and detailed part characteristics.

13/06/2003

FIRE&G~1.DOC

Page 9



Rev 0

Reliability Data for Computer-Based Process Safety Systems, [13]/ Author: Lars Bodsberg Publisher: SINTEF Safety and Reliability, Trondheim, Norway Publ. year: 1989 Data based on: Field experience/expert judgement Description: The report presents field data and guide figures for prediction of reliability of computer-based process safety systems. Data is based on review of oil company data files, workshop with technical experts, interviews with technical experts and questionnaires. T-boken: Reliability Data of Components in Nordic Nuclear Power Plants, [11]/ Authors: ATV-kansliet and Studsvik AB Publisher: Vattenfall, Sweden Publ. year: Version 3, 1992 Data based on: Field experience Description: The handbook (in Swedish) provides failure rate estimates for pumps, valves, instruments and electro power components in Nordic nuclear power plants. The data are presented as constant failure rates, with respect to the most significant failure modes. Mean active repair times are also recorded. FARADIP.THREE, [12]/ Author: David J. Smith Publisher: Butterworth-Heinemann Ltd., Oxford, England Publ. year: Fourth edition, 1993 Data based on: Mixture of field experience and expert judgement Description: The textbook "Reliability, Maintainability and Risk - Practical Methods for Engineers" [7] has a specific chapter and an appendix on failure rate data. The data presented are mainly compiled from various sources, such as MIL-HDBK-217, NPRD-1985 (i.e. the '85 version of NPRD-91) and OREDA Handbook 1984. The failure rate data presented in the textbook is an extract from the database FARADIP.THREE. 3.2

Literature Survey

A search has been done through the following literature data bases: • • •

Compendex (1990 - 1995) CARL UnCover BIBSYS (“PUBSØK”).

The search did not result in identification of new data sources compared to data sources already known and used by SINTEF (and as described in Section 3.1 above). A brief summary of the searches are given below. The search did, however, result in identification of some articles with respect to ongoing research in the area of fire and gas detection systems.

13/06/2003

FIRE&G~1.DOC

Page 10


3.2.1


Rev 0

Compendex

Compendex is a comprehensive interdisciplinary engineering information database, which includes journal articles, reports and conference proceedings, and 220,000 new additions every year. The search was done on the CD ROM version of Compendex. The search resulted in identification of 11 potentially relevant articles/conference papers. 3.2.2

CARL UnCover

CARL is a computerized network of library services developed by the Colorado Alliance of Research Libraries. CARL UnCover is the Alliance's index to periodicals. UnCover provides keyword access to information from the tables of contents of over 12 000 journals, listing over 1 million articles which have appeared since 1988. UnCover includes periodicals from all subject areas. Keywords used in the search was “reliability” * “detector”. No relevant articles were found. 3.2.3

BIBSYS

BIBSYS is a shared library system for all Norwegian University Libraries, the National Library and a number of research libraries. The BIBSYS database includes 1.8 million bibliographic records (books, periodicals, journals, handbooks, etc). A search for Reliability Data Handbooks (time period: 1989 - 1995) was done. Keywords used in the search was “reliability” * “handb?”. The search resulted in identification of 8 potentially relevant handbooks.

4.

ON-GOING RESEARCH

On offshore oil and gas platforms the catalytic point gas detector has so far been the most used gas detector type. In the last few years, several optical point and open path detectors have been installed on offshore installations. However, most of the research on gas detectors deals with volume detectors. Appendix D discusses three different volume gas detectors. Volume fire detectors have been used on shore for several years and little research has recently been done on this topic.

13/06/2003

FIRE&G~1.DOC

Page 11



Rev 0

5.

REFERENCES

1.

Ragnar Aarø, Lars Bodsberg and Per Hokstad, Reliability Prediction Handbook. Computer-Based Process Safety Systems. SINTEF Report STF75 A89023.

2.

Lars Bodsberg and Per Hokstad, A System Approach to Reliability and Life-CycleCost for Process Safety Systems. To appear in IEEE Transactions on Reliability 1995.

3.

Lars Bodsberg et al, Reliability and Quantification of Control and Safety Systems. The PDS-II method. SINTEF Report STF75 A93064.

4.

Common Requirements, SAFETY AND AUTOMATION SYSTEMS (SAS), Norsok Standard, I-CR-002, Rev.1, December 1994. Distributed by NORSOK Standards Information Centre, OLF, P.O. box 547, N-4001 Stavanger.

5.

Draft IEC 1508 - Functional Safety : Safety-Related Systems, International Electrotechnical Commission, 1995.

6.

OREDA Phase III, computer based database on topside equipment, OREDA Participants (multiclient project on collection of offshore reliability data).

7.

OREDA Handbook; Offshore Reliability Data Handbook, 2nd edition, OREDA Participants (multiclient project on collection of offshore reliability data), 1992

8.

OREDA Handbook; Offshore Reliability Data Handbook, 1st edition, OREDA Participants (multiclient project on collection of offshore reliability data), 1984

9.

Jon Arne Grammeltvedt, U&P; Oseberg C - Gjennomgang av erfaringsdata for brann- og gassdetektorer på Oseberg C. Forslag til testintervaller for detektorene, report from Norsk Hydro, Research Centre Porsgrunn, 1994-07-28 (internal Norsk Hydro report in Norwegian).

10.

Lars Bodsberg, VULCAN - A Vulnerability Calculation Method for Process Safety Systems, Doctoral dissertation, Norwegian Institute of Technology, Dep. of Mathematical Sciences, Trondheim, 1993.

11.

T-boken, Version 3: Tilförlitlighetsdata för komponenter i nordiska kraftreaktorer, ATV-kansliet and Studsvik AB, publisehd by Vattenfall, Sweden, 1992 (in Swedish).

12.

David J. Smith, Reliability, Maintainability and Risk - Practical Methods for Engineers, Butterworth-Heinemann Ltd., Oxford, England, Fourth edition, 1993.

13.

Lars Bodsberg, Reliability Data for Computer-Based Process Safety Systems, SINTEF Report STF75 F89025, 1989.

14.

William Denson et al., NPRD-91: Nonelectronic Parts Reliability Data 1991, Reliability Analysis Center, Rome, New York, USA, 1991.

15.

D. C. Strachan et al., Imaging of hydrocarbon vapours ad gases by infrared thermography, J. Phys. E: Sci. instrum., No 18, 1985.

13/06/2003

FIRE&G~1.DOC

Page 12



Rev 0

16.

T. G. McRae and T. J. Kulp, Backscatter absorption gas imaging: a new technique for gas visualization, Applied Optics, Vol. 32, No. 21, 1993.

17.

G. Thomas, OTIM - Passive Remote Gas Detector, Sensor Review, Vol. 14, No. 3, 1994.

18.

S. M. Skippon and R. T. Short, Suitability of Flame Detectors for Offshore Applications, Fire Safety Journal, No 21, 1993.

13/06/2003

FIRE&G~1.DOC

Page 13



Rev 0

Appendix A:

RELIABILITY DATA SHEETS

13/06/2003

FIRE&G~1.DOC

A1



Rev 0

Data Sheet Contents Page Component

Page Number

Gas Detector, Conventional Catalytic A - 3 Gas Detector, Conventional IR Gas Detector, Beam

A-4 A-5

Smoke Detector, Conventional

A-6

Heat Detector, Conventional

A-7

Flame Detector, Conventional

A-8

ESD Push Button

A-9

FGD Node (single PLC system)

A - 10

Field Bus Coupler

A - 11

Field Bus CPU/Communication Unit A - 12

13/06/2003

FIRE&G~1.DOC

A2



Rev 0

Fire and Gas Detection System Data Sheets Component: Gas Detector, Conventional Catalytic Description Date of Revision The detector includes the sensor and local electronics 1996-02-14 such as the address/interface unit. Values for Calculation

FTO= SO =

6

det =

1.5 per 10 hrs 6 1.0 per 10 hrs 6 3.0 per 10 hrs

crit =

5.5 per 10 hrs

Coverage = 50% -4 1 TIF-probability = 3x10 - 0.1 ) 1) Large to small gas leaks

6

Failure Rate Assessment Failure rate estimate is based on OREDA Phase III, ref. /6/. The overall coverage given above is estimated as the average for both failure modes based on OREDA Phase III. TIF-probability Assessment The TIF-probability is entirely based on expert judgement. Location is the essential factor for the TIF of gas detectors, and it is not expected that conventional catalytic and conventional IR detectors are significatly different in this respect. It is expected that on the average 1 out of 10 small gas leaks are not detected (even if the detector is physically sound). For large gas leaks, where the gas is allmost certain to reach the detector, it is essentially human operations (erroneous by-pass) that contribute to TIF. Comments The location of possible leakage sources, heat sources and ventilation compared to the location of the detector has to be considered when determining values for calculation. However, as these parameters vary with time (e.g. due to climatic variation, process variation), it may be difficult to determine the correct values for calculation. The number of detectors in an area may also influence the TIF probability. Further, the TIF probability may be different for different applications. For instance, gas detectors located in an air intake may have a lower TIF than gas detectors located in a naturally ventilated process area.

13/06/2003

FIRE&G~1.DOC

A3



Rev 0

Fire and Gas Detection System Data Sheets Component: Gas Detector, Conventional IR Description Date of Revision The detector includes the sensor and local electronics 1996-02-14 such as the address/interface unit. Values for Calculation

FTO SO =

6

det =

= 1.0 per 10 hrs 6 0.1 per 10 hrs 6 2.9 per 10 hrs

crit =

4.0 per 10 hrs

Coverage = 70% -4 1 TIF-probability = 3x10 - 0.1 ) 1) Large to small gas leaks

6

Failure Rate Assessment The failure rate estimates are essentially based the Oseberg C data, ref. /9/. TIF-probability Assessment The TIF-probability is entirely based on expert judgement. Location is the essential factor for the TIF of gas detectors, and it is not expected that conventional catalytic and conventional IR detectors are significatly different in this respect. It is expected that on the average 1 out of 10 small gas leaks are not detected (even if the detector is physically sound). For large gas leaks, where the gas is certain to reach the detector, it is essentially human operations (erroneous by-pass) that contribute to TIF. A conventional gas detector detects the gas concentration in essentially a point in space. Since the gas detector location is the major source for the TIF for a conventional catalytic gas detector, the TIF is almost unchanged if this conventional catalytic detector is interchanged with a conventional IR detector. Comments The following aspects should be assessed when determining values for calculation: IR detectors are used in critical applications, as ventilation air intakes, where response time and reliability is most important. On new installations, they are typically used in order to reduce maintenance costs. IR detectors are influenced by high humidities. IR detctors are pressure dependent, that is their output varies linearly with pressure when a constant gas concentration applied. In application, where substantial pressure variation may be expected, pressure compensation has to be used.

13/06/2003

FIRE&G~1.DOC

A4



Rev 0

Fire and Gas Detection System Data Sheets Component: Gas Detector, Beam Description Date of Revision The detector includes the sensor and local electronics 1996-02-14 such as the address/interface unit. Values for Calculation

FTO=

1. per 10 hrs

SO =

1. per 10 hrs

det =

5. per 10 hrs

crit =

7. per 10 hrs

6

6

Coverage

= 70% -4

-2 1)

TIF-probability = 10 - 10

6

1) Large to small gas leaks

6

Failure Rate Assessment Failure rate estimate is an expert judgement based on the failure rate data for the corresponding conventional IR gas detector. TIF-probability Assessment The TIF-probability is entirely based on expert judgement. Location is the essential factor for the TIF of gas detectors, and it is not expected that conventional catalytic and conventional IR detectors are significatly different in this respect. It is expected that on the average 1 out of 100 small gas leaks are not detected (even if the detector is physically sound). For large gas leaks, where the gas is certain to reach the detector, it is essentially human operations (erroneous by-pass) that contribute to TIF. Comments Most of problems that have been reported for this type of detector, are due to environmental conditions: Humidity (fog, deluge, etc.) and vibrations (e.g. caused by wind). It is also important to note that so far IR beam detectors have not been hooked up to the ESD-logic.

13/06/2003

FIRE&G~1.DOC

A5



Rev 0

Fire and Gas Detection System Data Sheets Component: Smoke Detector, Conventional Description Date of Revision The detector includes the sensor and local electronics 1996-02-14 such as the address/interface unit. Values for Calculation

FTO= SO =

6

det =


crit =

4.0 per 10 hrs

Coverage = 40% -3 1) TIF-probability = 10 - 0.05 1) For smoke and flame fires, respectively

6

Failure Rate Assessment Failure rate estimate is based on OREDA Phase III, ref. /6/. The overall coverage given above is estimated as the average for both failure modes based on OREDA Phase III. TIF-probability Assessment The TIF-probability is entirely based on expert judgement. Comments The following aspects should be assessed when determining values for calculation: There are two types of smoke detectors in use: Optical and ionizing smoke detectors. Since optical smoke detectors have shown better performance when the fire is smouldering (and earlier detection is obtained), this type of detector is usually prefered. Smoke detectors are not recommended to be used in naturally ventilated areas. Detector location is critical, and because heat sources and ventilation (air flow) is critical parameters in determining optimal location of smoke detectors, detector location should always be based on measurements during full scale smoke tests. Smoke detectors should not be used in applications where smoke may be a natural part of the environment (e.g. workshops). In electrical rooms, high sensitivity optical detectors are suggested.

13/06/2003

FIRE&G~1.DOC

A6



Rev 0

Fire and Gas Detection System Data Sheets Component: Heat Detector, Conventional Description Date of Revision The detector includes the sensor and local electronics 1996-02-14 such as the address/interface unit. Values for Calculation

FTO= SO =

6

det =


crit =

2.5 per 10 hrs

6

Coverage = 40% TIF-probability = 0.05 - 0.5 1) The range repr. the occurrence of different types of fires (different locations)

Failure Rate Assessment Failure rate estimate is based on OREDA Phase III, ref. /6/. The overall coverage given above is estimated as the average for both failure modes based on OREDA Phase III. TIF-probability Assessment The TIF-probability is entirely based on expert judgement. Comments The following aspect should be assessed when determining values for calculation: Heat detectors should not be the only means of fire detection in an area. There are, however, a few exceptions to this rule, e.g. workshops, where any other method may cause a number of false alarms.

13/06/2003

FIRE&G~1.DOC

A7



Rev 0

Fire and Gas Detection System Data Sheets Component: Flame Detector, Conventional Description Date of Revision The detector includes the sensor and local electronics 1996-02-14 such as the address/interface unit. Values for Calculation

FTO= SO =

6

det =


crit =

7.0 per 10 hrs

Coverage = 40% -4 1) TIF-probability = 3x10 - 0.5 1) For flame and smoke fires, respectively

6

Failure Rate Assessment Failure rate estimate is based on OREDA Phase III, ref. /6/. The overall coverage given above is estimated as the average for both failure modes based on OREDA Phase III. It is probable that the trip rate for UV detectors and IR detectors differs, since UV detctors have more false alarm sources than IR detectors. However, the data on alarms from IR detectors are too sparse to make a distinction between the two. TIF-probability Assessment The TIF-probability is entirely based on expert judgement. The TIF is different for UV detectors and IR detectors, mainly because IR detectors perform better than UV detectors when smoke is present before a flame is visible. Comments The following aspects should be assessed when determining values for calculation: There are two major problems related to flame detectors: One is that detectors may unintentionally be repositioned during maintenance and/or construction work, and the second is poor ability to detect flames through smoke. Generally, IR detectors perform better than UV detectors when smoke is present before a flame is visible. Moreover, UV detectors have more false alarm sources than IR detectors. Therefore a trend towards IR detectors has been seen. Note that UV and IR radiation may be absorbed by deposits on the detector lens.

13/06/2003

FIRE&G~1.DOC

A8



Rev 0

Fire and Gas Detection System Data Sheets Component: ESD Push Button Description Pushbutton including wiring.

Date of Revision 1996-02-14

Values for Calculation

FTO=

0.2 per 10 hrs

SO =

0.6 per 10 hrs

det =

0.2 per 10 hrs

crit =

1.0 per 10 hrs

6

6

Coverage

= 20% -5

TIF-probability = 10

6

6

Failure Rate Assessment The failure rate is estimated based on FARADIP.THREE (ref. /12/) and NPRD-91 (ref. /14/), taking into account expert judgements. The overall coverage given above is estimated as the average for both failure modes. TIF-probability Assessment The TIF-probability is entirely based on expert judgement. Comments

13/06/2003

FIRE&G~1.DOC

A9



Rev 0

Fire and Gas Detection System Data Sheets Component: FGD Node (single PLC system) Description PLC system includes input/output cards, CPU incl. memory and watchdog, controllers (int. bus, comm. etc.), system bus and power supply. Values for Calculation

FTO=

2.0 per 10 hrs

SO =

6.0 per 10 hrs

det =

72.0 per 10 hrs

crit =

80.0 per 10 hrs

6

6

6

Coverage


= 90% -5

-4 1)

TIF-probability = 5x10 - 5x10

1) For TÜV certified and standard safety

6

system, respectively.

Failure Rate Assessment The failure rates have been estimated mainly based on the OREDA Phase III data (ref. /6/), taking into account the following aspects: It is assumed that some of the observed FTOfailures in OREDA III is included in the TIF-probability. Further, for FTO-failures, only the current loop (i.e. one I-card, etc.), not the entire PLC system, is required for activation. Thus, the estimated rate of FTO-failures is somewhat reduced compared to the OREDA III data. The overall coverage is set mainly based on expert judgement. TIF-probability Assessment The TIF-probability is entirely based on expert judgement.

Comments

13/06/2003

FIRE&G~1.DOC

A 10



Rev 0

Fire and Gas Detection System Data Sheets

Component: Field Bus Coupler Description



FTO=

0.001 per 10 hrs

SO =

0.02 per 10 hrs

det =

0.18 per 10 hrs

crit =

0.2 per 10 hrs

6

6

Coverage

= 90% -5


6

6

Failure Rate Assessment No sources of failure rate data are identified. The failure rates are estimated based on expert judgement and failure rate data found for FGD node (single PLC system). TIF-probability Assessment The TIF-probability is entirely based on expert judgement.

Comments

13/06/2003

FIRE&G~1.DOC

A 11



Rev 0

Fire and Gas Detection System Data Sheets

Component: Field Bus CPU/Communication Unit Description



FTO=

0.001 per 10 hrs

SO =

0.02 per 10 hrs

det =

0.18 per 10 hrs

crit =

0.2 per 10 hrs

6

6

Coverage

= 90% -5


6

6

Failure Rate Assessment No sources of failure rate data are identified. The failure rates are estimated based on expert judgement and failure rate data found for FGD node (single PLC system). TIF-probability Assessment The TIF-probability is entirely based on expert judgement.

Comments

13/06/2003

FIRE&G~1.DOC

A 12


13/06/2003


FIRE&G~1.DOC

Rev 0

A1

ESD and Blowdown


Rev 0

ESD AND BLOWDOWN SYSTEMS

13/06/2003

ESDBLOWD.DOC

Page 1

ESD and Blowdown


Rev 0

TABLE OF CONTENTS

1. INTRODUCTION-------------------------------------------------------------------------------------3 1.1 Background -------------------------------------------------------------------------------------------------------------3 1.2 Reliability Analysis ---------------------------------------------------------------------------------------------------4

2. CONTROL AND SHUTDOWN SYSTEMS ---------------------------------------------------6 3. RISER ESD VALVE---------------------------------------------------------------------------------8 3.1 Reliability ---------------------------------------------------------------------------------------------------------------8 3.2 Vulnerability to Damage ------------------------------------------------------------------------------------------- 11 3.3 Speed of Response --------------------------------------------------------------------------------------------------- 11

4. SUBSEA ISOLATION VALVE ----------------------------------------------------------------- 12 4.1 Reliability ------------------------------------------------------------------------------------------------------------- 12 4.2 Vulnerability to Damage ------------------------------------------------------------------------------------------- 12 4.3 Speed of Response --------------------------------------------------------------------------------------------------- 12

5. TOPSIDES EMERGENCY SHUTDOWN (ESD) AND BLOWDOWN (BD) VALVES ------------------------------------------------------------------------------------------------- 13 5.1 Reliability ------------------------------------------------------------------------------------------------------------- 13 5.2 Vulnerability to Damage ------------------------------------------------------------------------------------------- 13 5.3 Speed of Response --------------------------------------------------------------------------------------------------- 13

6. SURFACE CONTROLLED SUBSURFACE SAFETY VALVES (SCSSV) --------- 14 6.1 Reliability ------------------------------------------------------------------------------------------------------------- 14

REFERENCES----------------------------------------------------------------------------------------- 15 Attachment 1 2 3

Handbooks Databases Textbooks

13/06/2003

ESDBLOWD.DOC

Page 2

ESD and Blowdown


Rev 0

ESD AND BLOWDOWN

1.

INTRODUCTION

1.1

Background

The Emergency Shutdown (ESD) and Blowdown (BD) systems on a hydrocarbon production facility provide a means for isolating and safely disposing of process inventories. These actions may be initiated as a precautionary or preventive measure, or in response to a hazardous situation. The latter would typically be a hydrocarbon release that has either been detected by plant personnel or a fire and gas detection system. Closure of ESD valves and opening blowdown valves limits the hydrocarbon inventory available to feed a hazardous release. This reduces to some extent the: • • •

likelihood of ignition; the severity of a fire if the release is ignited; likelihood of catastrophic failure of plant.

The effectiveness, or the performance, of these systems is defined by a number of factors: • • •

Reliability Vulnerability Speed of response

For an existing design these factors can be estimated and used as input for a QRA. For a new design a QRA might be carried out to determine what standard of performance is required by these valves in order to meet some higher level goals. An integrated approach to the management of hazards tends to go against the grain of the traditional prescriptive specification of shutdown systems. The draft IEC SC65A WG10 standard [4] and the draft prevention of Fire and Explosion and Emergency Response Regulations (UK) [5] together with a number of international and national standards are starting to promote a clear link between overall risk levels as predicted by QRA and the reliability required of safety systems. The required performance of these systems may vary between facilities and between different valves on the same facility. For example a very high performance may be required of the riser ESD valve due to the large inventory of hydrocarbons in the connecting pipelines. In some circumstances a subsea isolation valve may be installed to back-up the riser ESDV and provide a means of isolating the riser itself. This data sheet provides information on control and shutdown systems including three specific valve duties: • • •

Riser ESD Valve Subsea Isolation Valve Process ESD and BD valves.

13/06/2003

ESDBLOWD.DOC

Page 3

ESD and Blowdown


Rev 0

Illustrative data are provided and the effectiveness, or performance, of these systems is discussed relative to reliability, vulnerability to damage and speed of response. This datasheet also includes in Attachment I a list of data sources where additional data on these systems can be found. The list also applies to data sources for general reliability studies on other components. 1.2

Reliability Analysis

The best way to obtain reliability data is through statistical analysis of historical failure data (eg. from maintenance records) from the plant or process. However, the main difficulty is that such data may not be readily available, or may provide too small a sample to be statistically valid. If this is the case then generic data from published sources or databanks will have to be used. It is important to note that such data needs to be interpreted with care. The figures quoted are often aggregated averages of many failure modes; and the environmental conditions under which the data was collected may be different to the problem in hand. Another point to note is that the quality of the data varies from source to source and not all sources give specific failure modes and confidence bounds. Commonly used terms in Reliability Analysis are: Failure Rate - The ratio of the number of failures divided by the product of the item population and the average operating or calendar time. Failure rates may be quoted in failures per hour, failures per million hours or failures per year. ‘Operating time’ is the time in which the item is in its working state. ‘Calendar time’ generally represents the time interval between the start and the end of item monitoring period. Some sources give both failure rates for operating time and for calendar time. In this case, it is generally best to use the operating time failure rate if the component to be assessed will be operating continuously. If operation is intermittent, as with ESD and blowdown systems, the failure rate for calendar time may be more appropriate. Test Interval - the time between tests that will reveal a specified failure. Failure on demand - The probability that a given item will not perform the required function when called upon to do so. This quantity is dimensionless, unlike the failure rate which has dimensions of the number of events per unit time. It is important to distinguish between failure rates and failure on demand probability. The first is essentially the average number of failures over a period of time; the latter the probability of a specific failure event To a first approximation the probability of ‘failure on demand’ can be related to the ‘failure rate’ as follows: “failure on demand” = “failure rate” x “test interval” 2 For components which exhibit unrevealed failure states (e.g. pressure safety valves), the above equation determines the Fractional Dead Time (FDT). 13/06/2003

ESDBLOWD.DOC

Page 4

ESD and Blowdown


Rev 0

Failure modes - The description of the failed state of an item. The definition of failure must be related to the task which the component is expected to perform. In some cases, only total failure of a component will be of interest. In other cases, degraded performance will need to be counted as a failure. The percentage of failures which has occurred in a specific failure mode is usually given. The failure rate for a given mode can then be calculated from the total failure rate multiplied by the failure mode percentage. Mean time between failures - MTBF is defined as the total measured operating time of a population of items divided by the total number of failures. The MTBF is the reciprocal of the failure rate. Common cause failure mode - when a system being analysed is made up of two or more components it is important to identify any common causes that could give failure in more than one component. If this is not done then the calculations could significantly over-state the reliability of the system. Some practical advice on the interrogation of databases is as follows: a)

Care should be taken to use data of appropriate format (eg. do not confuse ‘failure on demand’ with ‘failure rates’).

b)

Failure data derived for continuously operating components should not be used for stand-by components if there are indications that conditions in the quiescent state are significantly different from those in the working state.

c)

The data used should be derived from items operating under similar conditions whenever possible.

d)

When only data derived from conditions different from those of the case studied are available, adjustments (stress factors) should be made to account for such differences.

e)

The sources of the data used should be traceable. They should be quoted in the document containing the qualitative analysis.

f)

The data used should be summarised in a table and their format clearly defined.

g)

The choice of a value within a given range should be justified with qualitative arguments.

h)

It is advisable to perform a sensitivity analysis to identify most significant components.

The potential for human error is present in all engineering systems, be it in the design, construction or operation phase. Therefore, human error needs to be considered when carrying out a quantitative reliability analysis. However, many data sources will have human error included as an implicit part of the causes of failure. If human error appears to form a significant component of the anlaysis, it should be assessed in more detail.

13/06/2003

ESDBLOWD.DOC

Page 5

ESD and Blowdown


Rev 0

The quantitative assessment of the likelihood of human error must be treated differently from that of a hardware and is a specialised field in its own right. 2. CONTROL AND SHUTDOWN SYSTEMS A list of data sources for control and shutdown system equipment failures is given in Attachment I. The main sources are handbooks and databanks. A key data source in the offshore hydrocarbon production industry is the "OREDA Handbook" [6]. A 2nd Edition of this handbook following Phases I and II of the OREDA project was published in 1992 and represents collated data of several oil companies operating in the Norwegian and UK sector of the North Sea as well as the Adriatic. Data collation is ongoing in Phase III of the project. This latest data can be accessed via the computerised database, [Offshore Reliability Data (OREDA); Joint Industry Project; AGIP, BP, Elf, Exxon, Norsk Hydro, PPCoN, Saga, Shell, Statoil, Total, SINTEF]. Two commonly used data sources used in conjunction with OREDA when addressing ESD/BD system reliability are: • •

"IEE Guide to the Collection and Presentation of Electrical, Electronic and Sensing Component Reliability Data for Nuclear Power Generating Stations" issued by the Institute of Electrical and Electronic Engineers Inc [7]; Non-Operating Reliability Databook issued by Reliability Analysis Centre [8].

Another prime data source is in-house records, which in some cases might be available for the specific system being analysed. For illustrative purposes, failure rates for common items in control and shutdown systems are given in Table 2.1.

13/06/2003

ESDBLOWD.DOC

Page 6

ESD and Blowdown


Rev 0

TABLE1:ILLUSTRATIVEFAILURERATES

13/06/2003

Failuretocloseondemand Fail tocloseondemand Plugged Failuretocloseondemand Fail tocloseondemand Fail tocloseondemand Fail tocloseondemand Failuretocloseondemand Fail tocloseondemand Fail tocloseondemand Fail tocloseondemand Fail tocloseondemand Fail totripat setpoint Fail toopenondemand Internal Leak

FAILURERATE (peryear) 2.1E-02 1.4E-02 2.4E-02 1.7E-01 3.8E-02 5.7E-02 1.14E-01 5.0E-02 3.9E-02 6.0E-03 2.6E-02 6.0E-01 4.4E-02 3.5E-03 8.9E-02

TESTINTERNAL (months) 3 3 3 3 3 3 3 3 12 12 12 12 12 12 12

Fail tocloseondemand Fail tocloseondemand

1.0E-03 1.0E-02

120 6

ITEM

FAILUREMODE

X-masTreeWingValve MasterValve BlowdownValve 6"ShutdownValve 10"ShutdownValve 12"ShutdownValve 16"ShutdownValve 20"ShutdownValve Level Sensor PressureSensor FlowSensor Control LogicUnit TemperatureSwitch 2"PressureRelief Valve SafetyRelief Valve CheckValve DownholeSafetyValve

ESDBLOWD.DOC

Page 7

FAILUREONDEMAND DATASOURCE 0.0026 0.0018 0.003 0.021 0.0048 0.0071 0.014 0.0063 0.020 0.003 0.013 0.30? 0.022 0.0018 0.045 0.05 0.025

OREDAPhaseIII OREDA92 OREDA92 OREDAPhaseIII OREDAPhaseIII OREDAPhaseIII OREDAPhaseIII OREDAPhaseIII OREDAPhaseIII OREDAPhaseIII OREDAPhaseIII OREDAPhaseIII OREDA92 OREDAPhaseIII OREDAPhaseIII OREDAPhaseIII HARIS OREDA92

ESD and Blowdown

3.


Rev 0

TOPSIDE RISER ESD VALVE

Within the UK the installation, location, operation, inspection and testing of riser ESD valves is addressed by Statutory Instrument No. 1029 "The Offshore Installations (Emergency Pipeline Valve) Regulations 1989" (Ref 1). This regulation has meant that priority attention has been given to these valves. In recent years many valves have been upgraded, relocated or replaced. 3.1

Reliability

At a detailed level, a riser ESD valve together with its actuator and associated control system can be subject to a Failure Modes Effects and Criticality Analysis coupled with a fault tree analysis to estimate the 'fractional deadtime' of the valve and hence the probability of the valve failing to close on demand. A variety of basic event data sources may be used depending on the specific design of the system. Some basic events may be human errors of one form or another which will require input from other relevant data sources. For illustration purposes, Table 3.1 contains a list of the reliability data used in the detailed analysis of a riser ESDV system consisting of a ball valve, a hydraulically operated double acting actuator and a piloted pneumatic control system to switch hydraulic power stored in three piston accumulators to the open and close parts of the actuator. From Table 3.1 it can be seen that a variety of data sources are used and that for a number of components no directly applicable data is available and expert judgement has to be used. It is important to emphasise that detailed reliability analysis is a specialised area and expert advice is required if a study is to be undertaken. From detailed reliability analyses that have been carried out on riser ESD systems, the indications are that for a well designed system the probability of the valve failing to close on demand of 0.01 may be achievable [10]. In reaching this result a large number of assumptions were made including: • • • • • •

proof test frequencies for covert failures (SI 1029 requires regular testing); equipment is not subjected to abnormal stresses and environments such that generic failure data taken from field history of similar components is invalidated; revealed failures are rectified within a reasonable time, say 12 hours; all equipment is taken into use in a correctly assembled manner and that all components are operating according to their specification; quality assurance procedures are fully implemented; design codes and standards stated in purchase requisitions and engineering specifications are adhered to by the manufacturers of all system equipment.

Given this list of assumptions and the level of reliability analysis required to produce this result it is clear that it would be prudent to be cautious about the reliability value used in a full QRA. For example at a coarse level, a failure to close on demand of around 0.05 might be appropriate. This value being refined down to say around 0.03 for more detailed QRA studies. 13/06/2003

ESDBLOWD.DOC

Page 8

ESD and Blowdown


Rev 0

A reliability as good as a demand failure of 0.01 would probably need to be justified using a detailed reliability analysis. SI 1029 also requires riser ESD valves to be regularly leak tested. The maximum acceptable leak threshold should ensure that leakage of the valve after it has been closed is not a significant issue.

13/06/2003

ESDBLOWD.DOC

Page 9

ESD and Blowdown

Table 3.1 -


Rev 0

Illustrative Data Used in a Detailed Reliability Analysis for a Riser ESD Valve System

Item

Description

Failure Rate

Data Source

(per year)

Pilot Valve Pilot Valve Pilot Valve PO Check Valve PO Check Valve PO Check Valve PO Check Valve PO Check Valve Check Valve ESD SOV ESD SOV ESD SOV ESD SOV ESDV ESDV Valve Actuator Actuator Actuator Ball Valve Ball Valve Valve Limit Switch Switch Switch Pilot Line Regulator Accumulator Accumulator Accumulator Annunciator Air Supply Air Supply Pump Filter Filter Filter Gauge Pipework

All Failures Fail energised Fail de-energised Fail energised fixed Fail d-energised fixed Fail de-energised dynamic Blocked or pilot signal lost Internal leakage Hydraulic; All failures All failures Fail energised Fail de-energised Reset pin failure Fail to close posn Fail to re-open Needle, Hydraulic Hydraulic,fail to close Hydraulic, fail to open Hydraulic, all failures + incipient Fail to close All failures Hyd. manually activated Failure, closed circuit Level; all failures inc. incipient Press; all failures inc. incipient Failure Spring induced failure Hydraulic Leaking Hydraulic no operation/piston fail Minor leakage Microprocessor based; fail to alarm Instrument air supply failure 3 x 50% Compressor system Hydraulic Air Fluid Blocked,(Pre filter low concentration level) Press; Faulty indication Instrument Connection Leakage

0.018 0.012 0.006 0.012 0.012 0.006 0.00804 0.0107 0.0268 0.0115 0.0077 0.0038 1.15E-4 0.0219 0.00817 0.0119

RAC [8] Estimated Estimated Estimated Estimated Estimated Estimated Estimated RAC [8] RAC[8] Estimated Estimated Estimated OREDA1 [6] OREDA1 [6] RAC [8]

0.0278 OREDA2 [6] 0.00692 OREDA2 [6] OREDA2 [6] 0.1458 OREDA2 [6] 0.00578 0.05589 OREDA2 [6] 0.0211 RAC [8] RAC [8] 0.0021 0.0841 OREDA1 [6] 0.1139 OREDA1[6] 0.0001 BPE 0.0230 RAC [8] 0.0912 RAC[8] 0.0120 RAC[8] 0.0026 E&P Forum*[10] 0.0860 E&P Forum*[10] 0.6220 OREDA1 [6] 0.0296 Estimated 0.0147 RAC [8] 0.0105 RAC [8] 0.0263 RAC [8] 0.03416 OREDA1 [6] 0.1752 Estimated 8.76E-5 E&P Forum* [10]

*E&P Forum member Note: PO = Pilot Operated; ESD - Emergency Shut Down; SOV Solenoid Valve

13/06/2003

ESDBLOWD.DOC

Page 10

ESD and Blowdown


Rev 0

Table 3.1 Notes: 1.

Repair time for overt failures = 12 hours

2.

Proof test frequencies for overt failures ESDV/Actuator full closure 6 monthly ESDV/Actuator part closure 6 monthly ESDV Control system 3 monthly Yellow Shutdowns 8 per year.

3.2

Vulnerability to Damage

There are two types of damage that can occur: 1. 2.

The valve actuator or associated control system is damaged in such a way that the valve fails to fully close in an emergency. Once the valve is closed the valve is damaged in such a way that there is significant internal leakage.

The vulnerability to either type of damage is dependent on the specific design and protection of the valve, actuator and control system together with the specific hazards to which it might be exposed. A report providing an overview of the methods used by operators in the UK sector of the North Sea to protect ESVs from severe accident conditions is given in Ref. 2. 3.3

Speed of Response

The speed of response is made up of a number of components: • • •

detection time; evaluation and decision to initiate time; response time of the control system and valve.

The two first components will depend largely on the degree of automation and the sequencing of ESD and BD actions. The third component will be driven largely by the size and type of valve and the size and type of the actuator. For liquid systems, surge consideration may also place limitations on the speed of closure. For an existing valve the time to close can be directly measured during proof testing. For a detailed design it should also be possible to make a reasonable estimate. A coarse rule of thumb is that it will take 1.5 seconds for every inch of pipeline diameter for a valve to close, e.g., a valve in a 10in line would take 15 seconds to close whilst a valve in a 36in line would take closer to one minute.

13/06/2003

ESDBLOWD.DOC

Page 11

ESD and Blowdown


4.

SUBSEA ISOLATION VALVE

4.1

Reliability

Rev 0

UKOOA/HSE sponsored a study on the reliability of subsea isolation systems (Ref. 3). This was an in-depth study and included actual experience with subsea isolation valves in the UK sector of the North Sea. For a single ball valve configuration the fractional deadtime was estimated at 1.2 x 10-2 which means the probability of the valve failure to close on demand is 0.012 provided that the product of Hazard Rate x Fractional Deadtime is much less than 1. This ties in closely with the values quoted earlier for riser ESDVs. The control system, actuators and valves should also be fairly similar. As noted for the riser ESDVs, there are a large number of assumptions that need to be made in calculating these figures and consideration should be given to using slightly more conservative values. Leak testing of subsea isolation valves is more difficult than for riser ESDVs and hence over a period of time there is a possibility that there will be some degradation of sealing performance. 4.2


Unlike the riser ESDV a subsea isolation valve is not vulnerable to any topside accidents. The key concern is that the valve and associated actuator and control system is damaged by some form of impact, e.g., anchor, trawl net etc, causing it not to operate on demand. 4.3

Speed of Response

Response time will be similar to riser ESDV though there may be a slight delay (e.g., a few seconds) in hydraulic control signals reaching the valve.

13/06/2003

ESDBLOWD.DOC

Page 12

ESD and Blowdown


Rev 0

5.

TOPSIDES EMERGENCY SHUTDOWN (ESD) AND BLOWDOWN (BD) VALVES

5.1

Reliability

OREDA is probably the best source of failure rate data on topsides emergency shutdown and blowdown valves. This data source can be used to estimate the reliability of valves of different size and service. An aggregate value across all sizes and service of hydraulically operated ESD valves is approximately 0.1 per year critical failures (fail to close or significant internal leakage when closed). Typically process ESDVs and their control system will be partially tested every three months and fully tested every six months. On this basis the probability of the valve failing to close on demand is again going to approach 0.01. Whilst there is not normally any form of internal leak testing for process ESD valves the reality will be that once blowdown has been initiated differential pressures across the ESD valves should not be particularly high. Again as with the riser ESDV and SSIV, if ESD or blowdown valve reliability is going to be included in a QRA it may be prudent to assume slightly more conservative values. For blowdown valves a lower failure rate is given in OREDA, but the population is very small. It may therefore be prudent to assume similar reliability as the ESDV. 5.2


Topside ESD valves and blowdown valves are subject to the same types of damage as described for riser ESD valve. However, unlike the riser ESD valve they are located in areas where they may be more vulnerable to damage and may have limited protection. A "fire-safe" valve is usually tested to API RP 6F. This confirms ability to reseal or stay tight after 15 or 30 minutes exposure to a pool fire. An ESDV may be required to withstand substantially longer exposure times or severities, or both. A detailed analysis should take these considerations into account. 5.3

Speed of Response

As discussed previously, it is worth noting that in order to achieve a controlled shutdown and blowdown of the plant it is necessary to carefully sequence the closure and opening of various valves. The whole response may take a number of minutes. American Petroleum Institute RP521 para 3.16.1 recommends for the blowdown systems to reduce pressures to half the design pressure within 15 minutes.

13/06/2003

ESDBLOWD.DOC

Page 13

ESD and Blowdown


Rev 0

6.

SURFACE CONTROLLED SUBSURFACE SAFETY VALVES (SCSSV)

6.1

Reliability

The SCSSV is primarily a backup to the Xmas tree master valve. There are several situations which would prevent the SCSSV from acting as a safety barrier: 1. 2. 3. 4.

The valve is in a failed state, ie. it fails to close, it leaks when closed, or it fails to hold in the nipple when closed. The valve is removed because it has failed a test and is to be replaced. The valve is removed because wireline work is going on beneath the valve. Wireline operations are performed through the valve and the wire will prevent the valve from closing properly.

There are two fundamentally different types of SCSSV, a wireline retrievable valve and a tubing retrievable valve. In [9] SINTEF carried out a detailed reliability analysis of SCSSVs using data from 13 North Sea Fields. For the critical failures described in 1. above the estimated failure rates were: -

Wireline Retrievable Valve Tubing Retrievable Valve

0.168 failures/year 0.06 failures/year.

It should be noted that these values are for the valves only and do not include the control systems. However, from the discussions on riser ESD valve reliability it is likely that the failure rate of the control systems will be significantly less than for the valve itself. The probability of failing to close on demand will be a function of the test interval. Assuming that each test includes fully closing the valve and carrying out a leak test the probability of critical failure is as follows: Type of Valves 3 months

Test Interval 6 months

1 year

Wireline Retrievable Valve

0.021

0.042

0.084

Tubing Retrievable Valve

0.0075

0.015

0.03

It is assumed that the above failure probabilities do not include the likelihood of human error. As there is always a possibility that the valve may be left in a failed state following testing, it is important to ensure that these modes of failure are taken into account during any analysis. For failures described in 2-4, the unavailability of the SCSSV has to be looked at on a case by case basis.

13/06/2003

ESDBLOWD.DOC

Page 14

ESD and Blowdown


Rev 0

REFERENCES

1.

Statutory Instrument 1989 No. 1029, The Offshore Installations (Emergency Pipeline Valve) Regulations 1989, HMSO (UK), June 1989.

2.

Topside Emergency Shutdown Valve (ESV) Survivability, A Joint HSEOSD/UKOOA study in response to Cullen Recommendation 48, RABA/16405206/94/ISSUE 1, January 1994.

3.

Subsea Isolation System Reliability and Cost Study, A joint HSE-OSD/UKOOA study in response to Cullen Recommendation 46ii, April 1994.

4.

International Electrotechnical Commission Standards Committee 65A Working Group 10, draft standard: Functional Safety, Part 2, Safety Related Systems, 1994.

5.

The Offshore Installations (Prevention of Fire and Explosion and Emergency Response) Regulations 199 , draft Regulations and Guidance, August 1994.

6.

"Offshore Reliability Data Handbook", OREDA Steering Committee, PO Box 300, N1322, Hovik, Norway.

7.

IEE Standard - 500 - 1984 "IEEE Guide to the Collection and Presentation of Electrical, Electronic and Sensing Component Reliability Data for Nuclear Power Generating Stations", Wiley 1983, ISBN 0471807850.

8.

"Non-operating Reliability Databook", Reliability Analysis Centre, PO Box 4700, Rome, NY, 13440-8200 USA.

9.

"Reliability of Surface Controlled Subsurface Safety Valves", SINTEF, 21/2/1983, STF18 A83002.

10.

E&P Forum members

13/06/2003

ESDBLOWD.DOC

Page 15

ESD and Blowdown


Rev 0

Attachment 1

1.

HANDBOOKS

1.1

Overview

A limited number of unrestricted data handbooks are available which provide specific information in a structured format on failure rate, failure on demand rate, failure mode, etc. These handbooks form a good ready reference for the data required for a preliminary reliability study. The data is presented in a format suitable for direct use without any need for manipulation. Information is usually well indexed, allowing easy access to the specific data required. An important feature incorporated in most handbooks is the reference source from which the data were obtained. Brief details of the main handbooks are presented in Section 1.4 of this attachment. Keywords are provided to assist in identifying the most relevant handbook for a particular application. Details of the keywords are in Section 1.2 below. The handbooks listed in Section 1.4 comprise: a)

d)

Publications containing mainly generic data on components of diverse nature (electrical, electronic, mechanical items). Publications giving data on a specific class of components (eg. electronic circuits only). Textbooks which treat reliability techniques and which also contain a substantial amount of data. Reports with sections containing a substantial amount of data.

1.2

Keywords

b) c)

The content of data sources is described using the keywords shown in Table 1. The keywords are divided into several groups. The first group describes the item type and comprises the following keywords: a) b) c)

d)

Electrical - This describes all items powered by electricity and ranges from simple switches and electrical motors to more complex systems such as electrical power systems or generators. Electronic - This keyword also covers a wide range of items. It applies to computer or microprocessor systems, and most instrumentation (see below). Mechanical - This keyword covers all equipment whose operation is based on mechanical and hydraulic principles. The items to which the keyword is applied range from relatively simple instrumentation (see below) such as pressure gauges to complex handling systems such as lifts or cranes. Machine tools, pipelines, conveyor belts and excavators are all examples of items to which this keyword is applicable. Instrumentation - This keyword was added because of the specific function that instrumentation has in control systems. It covers electronic, mechanical and electrical instrumentation and can be coupled with these keywords to reduce the field of search.

13/06/2003

ESDBLOWD.DOC

Page 16

ESD and Blowdown


Rev 0

Table 1 Keywords used to describe the content of the sources quoted: Electrical Electronic Mechanical Instrumentation Systems Components Failure Rates Failure on demand Repair times Failure modes Nuclear Chemical Offshore Military Process plant Manufacturing plant Stress (degree of) Human error In some cases, items could be equally described by two or more of the keywords above, for example, robots are both mechanical and electronic systems and could use electrical parts to generate the required motion. In this case all three keywords apply. The second group (Components and Systems) refers to the complexity of the item considered. As an example, food and packaging equipment could be described either as an Electrical or a Mechanical System or both, whilst a pipe is better described as a Mechanical Component. Other items could be described either as Components or as Systems depending on the detail required by the quantative analysis or on the data collection used in a given data source. A grab, for example, could qualify as either Component or System according to the complexity of its design. A third group of keywords describes the type of parametric data available in each source (Failure rates, Failure modes, Failure on demand, Repair times). The fourth group of keywords describes environmental conditions applicable to source data (Nuclear, Chemical, Offshore, Military, Process plant, Manufacturing plant, Mining). These describe not only the provenance of the data quoted in the sources, but also help to identify typical environmental constraints of such data. Less common environments should be related to the environments which resembles them more closely. For example, medical equipment is likely to be housed in conditions less severe than those encountered in the Offshore environment but could share some similarity with equipment in a Process Plant or a Nuclear environment (eg. radiation equipment). 13/06/2003

ESDBLOWD.DOC

Page 17

ESD and Blowdown


Rev 0

The keyword Stress (Degree of) refers to specific or generic operating conditions of the item; data-sources containing k-factors (see example below) are identified by this keyword. Finally, the keyword Human error indicates sources which can be used for human reliability assessment. An index listing the data sources to which each keyword is applicable is provided in Section 4 at the end of this document. 1.3

Example - How to use the keywords for a data search

The failure rate of a pressure transducer in a Process plant is required. The appropriate keywords are: 1. Electronic; 2. Instrumentation; 3. Failure rate; 4. Component; 5. Process plant. A quick scan of the indices reveals that most data sources contain items described by keywords 1 to 4. No handbook includes keyword 5. In this case, it is also appropriate to select handbooks which contain stress factors (keyword: Stress (degree of)) so that the Process environment can be taken into account applying stress factors to generic failure rates. The following handbooks include the keyword: Stress (degree of ): HD1 : Electronic Reliability Data - IEE INSPEC; HD6 : MOD 0041 Part 3; HD9 : Mechanical Design System Handbook, K A Rothbart; HD15: Reliability Technology, Green & Bourne. The following data banks also include 'Process plant' in their keywords: DB1 : The SRD Reliability data bank; DBS : The HARIS data bank. 1.4

List of handbooks

The following list includes handbooks available in the UK. Most handbooks can be ordered from publishing houses; the list quotes the original publisher whenever possible.

13/06/2003

ESDBLOWD.DOC

Page 18

ESD and Blowdown


HAND BOOKS REFERENCE

TITLE

ISSUED BY:

AVAILABLE FROM

HD1

Electronic Reliability Data - A Guide to Selected Components

Institution of Electrical Engineers

HD2

IEEE standard - 500 - 1984 Full title: IEEE Guide to the Collection and Presentation of Electrical, Electronic and Sensing Component Reliability Data for Nuclear Power generating Stations Mlitary Handbook - reliability prediction of electronic equipment MIL - HDBK - 217E Handbook of Reliability Data for components used in Telecommunication Systems. HRD 4 OREDA - Offshore reliability Data Handbook Practices and Procedures for Reliability and Maintainability. Issue 2 0041. Part 3 Reliability Prediction NONOP - 1 (Non-operating Reliability Databook)

The Institute of Electrical and Electronic Engineers, Inc.

INSPEC Marketing Department, Institution of electrical Engineers, Michael Faraday House, Six Hills Way, Stevenage, Herts, SGI 2AY Wiley - Interscience, John Wiley & Sons, Inc.

HD3 HD4 HD5 HD6

HD7

13/06/2003

Rev 0

ESDBLOWD.DOC

United States - Department of Defense BRITISH TELECOM OREDA Participants Directorate of Standardisation, MOD, Kentigern House, 65 Brown Street, Glasgow, G2 8EX Reliability Analysis Centre, PO box 4700, Rome, NY, 13440-8200 USA

Page 19

Page 1 of 3 YEAR

Infonorme London Information, Index House, ascot, Berkshire, SL5 7EU Infonorme London Information, Index House, ascot, Berkshire, SL5 7EU OREDA Steering Committee, PO Box 300, N - 1322, Hovik, Norway MOD

Infonorme London Information, Index House, ascot, Berkshire, SL5 7EU

1981

1983

1987 1984

1987

ESD and Blowdown


Rev 0

HANDBOOKS REFERENCE HD8

HD9

13/06/2003

Page 2 of 3

TITLE

ISSUED BY:

AVAILABLE FROM

YEAR

Component Reliability Databooks (several titles see below) Contents: Electronic Component Data Titles: DSR-4 Transistor/Diode Data 1988 MDR -21/22A Microcircuit Device Reliability 1985 MDR-22/22A Microcircuit Screening Analysis 1985 EERD-2 Military electronic equipment Data 1986 Mechanical Design systems Handbook 2nd Edition

Reliability Analysis Centre, PO Box 4700, Rome, NY, 13440-8200 USA

Infonorme London Information, Index House, Ascot, Berkshire, SL5 7EU

1980 to 1984

HD10

Non-Electronic Parts Reliability Data Printed Copy NPRD-91

McGraw Hill Book Company (UK) Ltd, Shoppenhangers Road, Maidenhead Berks SL6 2QL Reliabillity Anaysis Centre, PO Box 4700, Rome, NY, 13440-8200 USA

HD11

Receuil des Donnes de fiabilite RDF (in French)

CNET France

HD12

Reactor Safety Study - An Assessment of Accident Risks in US Commercial nuclear Power Plants

United States Regulatory Commission

HD13

Component Failure-rate Data with Potential Applicability to a nuclear fuel Reprocessing plant DP-1633

du Pont de Nemours, E 1 & Co, Savannah River Laboratory, Aiken, SC 29808

ESDBLOWD.DOC

Page 20

1985

Infonorme London Information, Index House, Ascot, Berkshire, SL5 7EU Centre National d’Etudes des Telecommunications, LAB IFE, 2 Rue de Tregastel, BP40, 22 301 Lannion, Cedex, france National Technical Information Service, Springfield Virginia 22161 USA

1991

1975 (2nd Printing) 1982 (July)

ESD and Blowdown


Rev 0

HAND BOOKS REFERENCE

HD14

13/06/2003

Page 3 of 3 TITLE

HD 15

Reliability and Maintainability in Perspective Subtitle: Practical, Contractual, Commercial and Software Reliability Technology

HD 16

Loss Prevention in the Process Industries (2 volumes)

ESDBLOWD.DOC

ISSUED BY:

Higher and Further Education Division, MacMillan Publishers Ltd, Basingstoke, Hampshire, RG21 2XS Wiley - Interscience John Wiley & Sons Butterworths ~ Co (Publishers) Ltd, 28 Kingsway London, WC2B 6AB

Page 21

AVAILABLE FROM

YEAR

1988 Third edition 1978

1980

ESD and Blowdown


Rev 0

Attachment 2

2.

DATABANKS

2.1

Overview

Most organisations concerned with quantitative reliability assessment studies maintain reliability data records in some form. Those described here are known to provide commercial data bank services to consultants and industry. For the purpose of this source book, a data bank is defined as a computerised set of parametric reliability data (ie failure rates, failure on demand rates, failure modes, etc) classified to permit systematic storage and retrieval of the information. Included here are data banks which are regularly updated. Also there are fixed data sets which may be provided with appropriate software to permit adjustment of the item failure rate for specific operational and environmental conditions. Brief details of the most important data banks are given below. As with the reliability data handbooks listed in the previous section, the keywords should help the user to identify the most relevant data bank for a specific application.

13/06/2003

ESDBLOWD.DOC

Page 22

ESD and Blowdown


Rev 0

DATABANKS

Page 1 of 4

REF DB1

NAME Component Reliability Databank

DB2

AEA Technology Reliability Technical Information Library

SIZE 4,000 separate component populations, around 30 different components classifications Over 300 separate components and system descriptions

DB3

HARIS (Hazard and Reliability Information Service)

650 abstracts generating approx, 3000 individual data entries

Literature references, Incidents, Maintainability and Reliability

DB4

FARADIP.3 (Failure Rate Data on Disk)

Data from over 20 sources

See Keywords. Also calculates Mean time Between Failures (MTBF). Gives advice on more common values and shows ranges of failure rates and modes

13/06/2003

ESDBLOWD.DOC

CONTENT From over 500 sources

CONTACT Databank Manager, AEA Technology Data Centre, Thomson House Risley, Warrington WA3 6AT

From over 200 sources including published sources, reports and individual computerised databases

Databank Manager, AEA Technology Data Centre, Thomson House Risley, Warrington WA3 6AT R M Consultants Ltd., Suite 7, Hitching Court, Abingdon Business Park, Abingdon, Oxfordshire, OX14 IDY or HARIS System Manager, RM Consultants LTD, Genesis Centre, Garrett Field, Birchwood Science Park, Warrington, Cheshire WA3 7BH Technis, 26 Orchard Drive, Tonbridge, Kent, TNIO 4LG

Page 23

ACCESS Available through SRD Association or direct. Held on “Database Manager”™, Windows based database shell software Available through SRD Association or direct

Menu-driven will run from hard disk or floppy disk on IBM PC or compatible machines Allows the creation of users’ own project data bank

Floppy disk Menu driven runs on IBM PC or compatible machines

ESD and Blowdown

DB5

13/06/2003


Non-Electronic parts Reliability Data 1991 Edition. NPRD-91P

Requires about 265k bytes of RAM

ESDBLOWD.DOC

Rev 0

Page 2 of 4 Generic and application-specific data Reliability Analysis Centre, Operating environment information PO Box 4700, Rome, NY, 13440-8200 USA

Page 24

From floppy disk on IBM PC, XT, AT or 100% compatible machines. Hardcopy available

ESD and Blowdown

REF DB6


NAME VZAP-9OP Electrostatic Discharge Susceptibility Data diskette

SIZE

Rev 0

CONTENT ESD susceptibility data for 4000 devices including integrated circuits, descrete semiconductors and resistors

DB7

RAMP (Reliability Availability Maintainability of Process Systems)

999 Elements

Monte Carlo Simulation

DB8

CODUS PLUS

120,000 component groups

Contains detailed characteristics and reliability model prameters for components approved to BS9000, CECC and IECQ approval systems. The ‘CODUS Reliability’ facility calculates failure rates for electronic components based on the methods of the American MIL Handbook 217 and British Telecoms Handbook of Reliability Data. The CODUS user is provided with a wide range of facilities enabling the construction and manipulation of complex systems, resulting in the calculation of the MtBF for the system

13/06/2003

ESDBLOWD.DOC

Page 25

CONTACT Reliability Analysis Centre, PO Box 4700, Rome, NY, 13440-8200 USA Marketing Dept, Rex Thompson L Psrtners Ltd. Newhams, West St, Farnham Surrey, GU9 7EQ Customer Support, CODUS Ltd, Institute for Information Technology, 196198 West Street, Sheffield S1 4ET

ACCESS IBM PC, XT, AT or 100Yo~ compatible machines with DOS 2.10 or later version Hardcopy available User builds up a model of process plant system using reliability block diagrams. Runs on PC or VAX/VMS. On-line (via PSS or direct-dial)

ESD and Blowdown


Rev 0

REF DB9

NAME Over 3.8 million documents covered from 1969 - present, growing at .25 million records/yr. More than 4000 journals, and 1000 conferences/yr now scanned from publishers worldwide

SIZE Information on wide-ranging publications Some entries may contain reliability data

CONTENT The Institution of Electrical Engineers

CONTACT INSPEC Marketing Department, IEE, Michael Farday House, Six Hills Way, Stevenage, herts, SGI 2AY

DB10

Predictor Reliability Suite of Programmers

Can give information up to 20 million parts starting from a common pool of data

Services Ltd, Quality and Reliability House, 82 Trent Boulevard, West Bridgford, Nottingham NG2 5BL

DB11

TNO COMPI

Two floppy disks

Software based on MILHDBK-217 and relying on data in this reference. The program gives reliability prediction calculation rather than parametric data Failure rates of mechanical components and instrumentation, conditions of use. Reference source given. Data and installation instructions in English, but manual is in Dutch

13/06/2003

ESDBLOWD.DOC

Page 26

TNO, Department of Industrial Safety, PO Box 342, 7300 AH Apeldoorn, The Netherlands

ACCESS On line from PC or teletype terminal. (BRS: CAN/OLE; CEDOCAR; DATASTAR; DIALOG; ESA-IRS; ORBIT; STN and STIC on-line host services). Customer Search Service also available from: IEE Technical Information Unit, Savoy Place, London, WC2R OBL. Various versions; can be run on PC, minicomputers and workstations as well as on a wide range of Main Frames IBM pc or compatible with 512k RAM and MS DOS 2.0 or later version

ESD and Blowdown


Rev 0

Attachment 3

3.

TEXTBOOKS

(a)

E J Henley and H Kumamoto - Reliability Engineering and Risk Prentice Hall 1981. ISBN 013 7722516

(b)

R Billington and R N Allan - Reliability Evaluation of engineering Systems: Concepts and Techniques, Pitman 1983. ISBN 0273084844

(c)

J Davidson editor - The Reliability of mechanical Systems. Institute of Mechanical Engineering Publications, Institute of Mechanical Engineers, London 1988. ISBN 0852986750

(d)

Barlow R E and Proschan, F Wiley - mathematical Theory of Reliability, 1965.

(e)

Human Reliability Assessor's Guide, Humphreys, P, UKAEA, Safety and Reliability Directorate, Culcheth, Warrington, Cheshire, UK 1988 (RTS 88/952)

(f)

Human error in Risk assessment. London ISBN 0853563322

(g)

Tolerability of risk from nuclear power stations HSE/HMSO London, 1988. ISBN 0118839829

(h)

Mann, N R; Schafer, R E, and Singpurwila, N D, John Wiley and Son methods for Statistical Analysis of Reliability and Life Data. 1974

(i)

Programmable electronic systems in safety-related applications General Technical Guidelines No 2. HMSO London ISBN 011 88 3906 3.

(j)

BS 4778: Parts 1: 1987 and 2: 1979 Quality Vocabulary. Institution

(k)

Reliability of constructed or manufactured products, systems, equipments and components. British Standards Institution BS 5760: Parts 1 : 1985, 2: 1981, 3: 1982 and 4: 1986

13/06/2003

Assessment,

Brazendale, J, editor SRD/HSE R510. HMSO

ESDBLOWD.DOC

British Standards

Page 27

ESD and Blowdown

13/06/2003


ESDBLOWD.DOC

Rev 0

Page 27

Emergency Systems

E&P Forum QRA Data Sheet Directory

Rev 0

EMERGENCY SYSTEMS

13/06/2003

EMERGSYS.DOC

Page 1

Emergency Systems


Rev 0

TABLE OF CONTENTS

1. INTRODUCTION ------------------------------------------------------------------------------------ 3 2. DATA AVAILABLE --------------------------------------------------------------------------------- 4 3. EMERGENCY SYSTEMS SURVIVABILITY ANALYSIS -------------------------------- 5 4. REFERENCES ---------------------------------------------------------------------------------------- 5 FIGURE 1 ------------------------------------------------------------------------------------------------- 6

13/06/2003

EMERGSYS.DOC

Page 2

Emergency Systems

1.


Rev 0

INTRODUCTION

Table 1 below, includes a listing of Emergency Systems for a typical offshore facility. The Emergency Systems of an installation may be defined as those, which under certain accident circumstances, could be critical to the safety of personnel on board. Emergency systems are utilised for the prevention, control and mitigation of hazardous events. Table 1: List of Emergency Systems • Fire and Gas Detection • Active Fire Protection • Passive Fire / Blast Protection • Emergency Shut Down, ESD (Process and Risers) • Blowout Prevention. • Blowdown • Evacuation, Escape & Rescue

• HVAC, Heating, Ventilation and Air Conditioning • Communications: Internal & External • Power Supplies: Emergency and Uninteruptable • Emergency Lighting • Instrument Air Supply • Control Room Interfaces • Navigational Aids

Typical of the criticality of each Emergency System for an offshore manned platform is the need for that system to protect Temporary Refuges from major hazard accident and related escalation effects. Adequate protection of a Temporary Refuge will include its emergency access and egress facilities. This data sheet principally includes an overview of the analysis of Emergency Systems against accident conditions. Such an analysis is commonly referred to as "Emergency Systems Survivability Analysis" or ESSA.

13/06/2003

EMERGSYS.DOC

Page 3

Emergency Systems

2.


Rev 0

DATA AVAILABLE

Table 2: Related Directory Data Sheets for Certain Emergency Systems Emergency System

Data Sheet #

Title

• Fire and Gas Detection • Active Fire Protection

3.1 3.5 3.6 3.7 5.2 3.3

Fire and Gas Detection Fire Water Supply Fire Water Distribution Foam & Gaseous Systems Vulnerability of Plant Emergency Shutdown & Blowdown

3.2 3.3 4

Blowout Prevention & SSSV Emergency Shutdown & Blowdown Evacuation, Escape & Rescue

• Passive Fire / Blast Protection • Emergency Shut Down, ESD (Process and Risers) • Blowout Prevention. • Blowdown • Evacuation, Escape & Rescue

A number of Emergency Systems, as listed and detailed in Table 1, are the subject of their own data sheets within this E&P Forum directory, see Table 2. Available data relating to Emergency Systems and their components are mainly confined to performance reliability of the type found in OREDA, Ref. 1. For those emergency systems not listed in Table 2, Ref. 1 contains data as follows: Section 4.3.6 General Alarm & Communication Systems Section 4.4.1 Electrical Systems: Power Generation Section 5.2.1 Utility Systems: Ventilation and Heating Systems In addition, the general reliability handbooks, databanks and textbooks listed under Attachment 1 of the ESD and Blowdown Systems Data sheet # 3.3, would be appropriate to the equipment of emergency systems. This type of data is appropriate for the assessment of the functional reliability and availability of such systems. The Vulnerability of Plant data sheet in this directory contains data for damage for certain equipment items under accident conditions. Such data could form a useful input to an assessment of emergency systems, as detailed below. A further aspect for analysis of the Emergency Systems is their performance and vulnerability under accident loading. No generic system level data is presently known of for this issue. This is hardly surprising considering the rare nature of real major hazard accidents. The implication is that for each installation, its Emergency Systems should be analysed on a case by case basis. See below. While Evacuation, Escape and Rescue (EER) Systems are included in the list it should be noted that they are usually covered by a specific safety and risk study.

13/06/2003

EMERGSYS.DOC

Page 4

Emergency Systems

3.


Rev 0

EMERGENCY SYSTEMS SURVIVABILITY ANALYSIS

Generally, the main objective of an Emergency Systems Survivability Analysis (ESSA) is to determine the vulnerability of emergency systems to severe accident events. This is usually achieved by systematically assessing the effects of accidental events on the ability of Emergency Systems to perform their intended function. A detailed analysis of all parts of the emergency system for vulnerability is made. If it is identified that an essential emergency system might be lost or damaged, such that the system is prevented from operating for a minimum required time, then that system would be considered as being unacceptably vulnerable. The period of time during which Emergency Systems must adequately function depends on the requirements of the Escape and Evacuation programme but could also, for instance, be the endurance time set for the Temporary Refuge. An initial ESSA for a facility would involve the assumption of major hazard accident scenarios and initially a qualitative approach can be adopted for the analysis. The safety criticality of each particular emergency system is reviewed with respect to each particular hazard scenario. Key to the analysis is assessment of the following system features: Criticality, Fail safety, Vulnerability, Redundancy/Diversity. The process is outlined in Figure 1. Where, following initial ESSA, systems have been assessed as being unacceptably vulnerable, further more detailed risk assessment would be necessary. Such assessment may involve quantification of the expected frequencies of occurrence of the initial hazardous event and resultant loss of the system. Thus, enhancements may be shown to be required to the survivability of certain systems Rigorous application of ESSA is more usually confined to manned or occasionally manned offshore facilities for which risk to life from plant or other hazards is predicted as being relatively high. Nevertheless the principles can be readily applied to other offshore or even onshore facilities where, for instance, the potential asset value is high or the facility is critical to field production. ESSA is but one of the numerous studies that may be made to achieve an overall assessment of risks associated with a facility or activity, others being for example, Fire Risk Assessment and Evacuation, Escape and Rescue Assessment. Overlaps and commonalties between ESSA and these other studies will inevitably exist. Input to the performance prediction of systems and their components in adverse conditions may also be available from studies such as Hazard and Operability (HAZOP) and Failure Mode and Effect Criticality Analysis.

4.

REFERENCES

1. OREDA. Offshore Reliability Data Handbook. DNV Technica. 2nd Edition. 1992. ISBN 82 515 0188 1.

13/06/2003

EMERGSYS.DOC

Page 5

Emergency Systems


Rev 0

FIGURE 1 EMERGENCY SYSTEMS SURVIVABILITY ANALYSIS (ESSA) PROCESS

Define system

Is the system critical?

No

Yes

Is the system fail safe?

Yes

No No

Is the system vulnerable? Yes

Does the system have redundancy?

Yes

No

Define scenarios where system fails

13/06/2003

No further analysis required

EMERGSYS.DOC

Page 6

Emergency Systems

13/06/2003


Rev 0

EMERGSYS.DOC

Page 7

Blowout Prevention


Rev 0

BLOWOUT PREVENTION EQUIPMENT

13/06/03

BLWOUTPR.DOC

Page 1

Blowout Prevention


Rev 0

TABLE OF CONTENTS

1.

SCOPE----------------------------------------------------------------------------------------------- 3

2.

APPLICATION ------------------------------------------------------------------------------------- 3

3.

DEFINITIONS -------------------------------------------------------------------------------------- 3

4.

KEY DATA ------------------------------------------------------------------------------------------ 3 4.1 Key data, Subsea BOP systems -------------------------------------------------------------------------------------3 Data Tables --------------------------------------------------------------------------------------------------------------------5 4.2 Key data, Surface BOP systems----------------------------------------------------------------------------------- 12 Data Tables ------------------------------------------------------------------------------------------------------------------ 12 4.3 Key Data, Downhole Safety Valves (DHSV/SCSSV) --------------------------------------------------------- 19 Data Tables ------------------------------------------------------------------------------------------------------------------ 20

5.

ONGOING RESEARCH ------------------------------------------------------------------------27

REFERENCES ------------------------------------------------------------------------------------------------------------- 28 APPENDIX 1

13/06/03

29

BLWOUTPR.DOC

Page 2

Blowout Prevention


Rev 0

BLOWOUT PREVENTION 1.

SCOPE

The purpose of this datasheet is to provide failure data for the following blow-out prevention equipment: • Subsea BOPs • Surface BOPs • SCSSV The report also includes selected information that could be used to better understand the causes leading to loss of the primary barriers during well drilling. 2.

APPLICATION

The data presented are applicable for quantitative risk assessments (QRA) related to well drilling and production. 3.

DEFINITIONS

BOP SCSSV

Blowout preventer. Used for the blowout prevention during the drilling phase. Surface Controlled Sub-surface Safety Valve. Used for downhole shut-in of production and/or injection wells to avoid blowouts.

4.

KEY DATA

4.1

Key data, Subsea BOP systems

There has, during the years 1982 - 1990, been carried out a comprehensive reliability study of Subsea Blow-out Preventer (BOP) systems on behalf of various oil companies operating in the Norwegian Sector of the North Sea and the Norwegian Petroleum Directorate (NPD). The project has been divided into five phases, with final reporting after each phase. Main activities within each phase have been: Phase I Phase II Phase III Phase IV Phase V

Analysis of failure data from 61 wells and BOP system analysis. Analysis of failure data from 99 wells and mechanical evaluation of BOP components. Separate report on control systems reliability. Evaluation of BOP test procedures and operational control. Analysis of failure data from 58 wells drilled by fairly new rigs. Evaluation of failure causes. Estimation of blow-out probabilities based on a fault tree model. Analysis of 47 exploration wells, drilled in the period 1987 - 1989. BOP failures and BOP tests were recorded and analysed.

The data presented here are mainly based on the results from Phase V (/1/) of the study because a significant BOP reliability improvement was observed in the period from 1979 to 1986. Results from Phase II, III and IV serve as a reference for comments made related to the specific equipment. 13/06/03

BLWOUTPR.DOC

Page 3

Blowout Prevention


Rev 0

Specific data background A total of 47 wells drilled in the Norwegian Sector of the North Sea have been reviewed. All wells were drilled in the period from 1987-01-01 to 1989-09-01. These 47 wells represent a total of 3023 rigdays or 2636 BOP-days. Included in rigdays is the time from the rig arrives the location and drops the anchors, until the last anchor is pulled prior to leaving the location. Included in BOP-days are all days from when the BOP is first landed on the wellhead, until it is pulled the last time. If the BOP is pulled anytime between first landing and last pulling, for any reason, these days are also included in the BOP-days. The data was collected from ten different subsea BOP stacks. All the stacks were 18 3/4 inch 10000 or 15000 psi stacks. For the failure recording period, the BOPs were function and pressure tested prior to running, after landing, after running casing and approximately once a week during drilling operation according to the NPD regulations that existed at that time. Current testing practice varies from the above due to changes in NPD testing regulations.

13/06/03

BLWOUTPR.DOC

Page 4

Blowout Prevention


Rev 0

Data Tables In Table 4.1 the number of failures and the total downtime associated with the Subsea BOP component or subsystems are listed. Table 4.1: Subsea BOP item specific average downtime BOP item

No of failures

Total time

Average downtime (hrs) per BOP-day1) per rig-day2)

Flexible joints

0

-

-

-

Annular preventers Ram preventers

8 4

534.5 146.5

0.203 0.056

0.177 0.048

6 2 19 28 7 74

111.5 67.0 627.0 521.5 134.0 2142.0

0.042 0.025 0.238 0.198 0.051 0.813

0.037 0.022 0.207 0.173 0.044 0.708

Hydraulic connectors Failsafe valves Choke and kill lines Hydraulic control system Acoustic control system Total

Notes: 1 BOP-days are all days from the time the BOP is first landed on the wellhead, until it is pulled the last time. 2 Rig-days is the time from when the rig arrives on location and drops the anchors, until the last anchor is pulled prior to leaving the location. As seen from Table 4.1 the annular preventers, the choke and kill lines and the hydraulic control system caused the majority of downtime with 79% of the total downtime caused by these three items. The most time consuming single failure lasted for 362 hours, which alone represents 17 % of the total downtime. Further, it is seen that the choke and kill lines and the hydraulic control system have experienced the majority of failures during the study. The failure rate for the various subsea BOP items is presented in Table 4.2. Table 4.2 is based on the same data as in Table 4.1.

13/06/03

BLWOUTPR.DOC

Page 5

Blowout Prevention


Rev 0

Table 4.2: Subsea BOP item specific failure rate with 90% confidence limits BOP item

Failure mode

Flexible joints Annular preventers Failed to open fully Hydraulic leakage Unknown Total Ram type Internal leakage (seal failures) Internal leakage (seal and blade failure) External leakage (door seal) Failed to fully open Total Hydraulic External leakage Failed to unlock Hydraulic failure in locking device Total Failsafe valves Internal leakage External leakage Unknown leakage Total Choke and kill lines Leakage to environment Plugged line (ice) Unknown Total riser related failures Total flex.jumper hose failures Total BOP flex. hose failures Total choke kill line system Hydraulic control Spurious activation of BOP function system Loss of all functions one pod Loss of several functions one pod Loss of one function both pods Loss of one function one pod Loss of one topside panel Loss of one function topside panel Topside minor failures Other Unknown Total Acoustic control Failed to operate BOP Spurious operation one BOP function One subsea transponder failed to Portable unit failed Function failure LMRP function Transducer arm failed Total Total subsea BOP system

13/06/03

BLWOUTPR.DOC

Failure rate per 10E6 hours Lower Estimate Upper 0.0 0.0 36.4 23.6 54.1 94.8 0.5 9.0 27.0 0.5 9.0 27.0 35.9 72.1 118.5 1.4 7.9 18.7 0.2 4.0 11.8 0.0 0.0 9.1 0.2 4.0 11.8 5.4 15.8 30.6 10.8 31.6 61.3 0.4 7.9 23.7 0.4 7.9 23.7 20.7 47.4 83.1 0.1 2.6 7.9 0.0 0.0 6.1 0.1 2.6 7.9 0.9 5.3 12.5 85.6 134.4 192.1 0.4 7.9 23.7 0.4 7.9 23.7 54.7 94.8 143.9 20.7 47.4 83.1 0.4 7.9 23.7 98.3 150.2 211.0 0.8 15.8 47.4 41.3 94.8 166.2 5.6 31.6 75.0 5.6 31.6 75.0 85.8 158.1 248.2 0.8 15.8 47.4 0.8 15.8 47.4 5.6 31.6 75.0 0.8 15.8 47.4 5.6 31.6 75.0 314.6 442.6 588.6 5.6 31.6 75.0 0.8 15.8 47.4 0.8 15.8 47.4 0.8 15.8 47.4 0.8 15.8 47.4 0.8 15.8 47.4 51.9 110.6 187.2 955.4 1169.7 1402.5

Page 6

Blowout Prevention


Rev 0

General comments to item specific trends in failure rates and down times Flexible joints Ball joints are no longer used as flexible joints in floating drilling in the Norwegian sector of the North Sea. In Phase V of the study no flexible joint failures were observed. Phase V study and the earlier BOP studies show that the flexible joint principle is superior to the ball joint principle in terms of reliability. The only likely flexible joint failures today are failures introduced by a not completely horizontal wellhead and/or a systematic poor rig positioning. Annular preventers The non-critical failure mode "could not be fully opened" is dominating the annular preventer failure rate. Normally, this failure mode causes only minor operational problems. This failure type used to create a lot of trouble for one specific make. The problems have, however, been reduced from Phase IV to Phase V data. Annular preventer average downtime is significantly higher during the Phase V data collection than earlier. This increase is caused by one failure, which caused 362 hours rig downtime because it was very difficult to find the failure cause. Ram-type preventers Ram preventer performance has improved significantly from Phase II to Phase IV and V. Ram preventer failures seem to be relatively low today. The critical failures "Leakage through a closed ram preventer," and "Leakage to sea in bonnet sealing areas", were the most frequent failure types during Phase II of the data collection. A significant reduction in failure rate from Phase II to phase IV and V has been observed. The main causes for this reduction are improved preventive maintenance and some minor design modifications. It should be noted that during the Phase IV and V data collection, no failures in either variable or normal packer elements were observed (variable packers are commonly used in the North Sea today). Hydraulic connectors External leakage and improper locking/unlocking function are the most typical failures. The hydraulic connectors have experienced approximately the same failure rate and downtime in Phase IV and V of the study, which is a significant reduction compared to Phase II. This improvement is likely to be caused by improved maintenance and the introduction of derrick mounted heave compensators that are claimed to give more accurate BOP wellhead landings. It should, however, be noted that during Phase V of the study an external leakage in a wellhead connector was observed during a regular BOP test. From a safety point of view this failure is one of the most critical of all failures. Approximately 75% of the connector failures were observed on the wellhead connectors and 25% on the Lower Marine Riser Package (LMRP) connectors in all the data collections.

Failsafe valves 13/06/03

BLWOUTPR.DOC

Page 7

Blowout Prevention


Rev 0

Failsafe valves have caused few problems during Phase V study compared to the earlier studies. During Phase IV, erosion in the sealing area causing the failure mode "Leakage in closed position" was the most frequent failure type. Valve design errors caused the majority of failures and downtime. During Phase IV this failure type also was observed on several valves simultaneously. In Phase II several external leakages were observed in the clamp connection between the inner valve and the BOP body. These failures seem now to be almost eliminated. Better designed line arrangement on the stack, and better valve to stack connections are believed to be the main reason for this improvement. Choke and kill lines Choke and kill line problems seem to cause more problems today than a few years ago. This may be caused by the fact that the average riser age was higher during Phase V of the study than Phase IV of the study. Another interesting fact is that during the earlier studies the failures were typically concentrated to some few rigs, while during Phase V of the study, no particular rig seems to have more riser problems than the other rigs. The majority of failures in the choke and kill lines are leakages to the environment in line connections. Plugged lines have also been observed. Hydraulic control systems Hydraulic control systems were producing rig downtime in the same order of magnitude during the Phase V study as both Phase II and IV. Pilot, shuttle and regulator valve failures in addition to hydraulic line leakages are the most typical failures. These failures are mostly affecting single BOP functions only. Other, more severe and relatively frequent, failures are burst or broken hydraulic control hose bundles. Frozen pilot lines were also observed during Phase II and Phase IV of the study. The failure rate has shown a decreasing tendency from Phase II to Phase IV and V. However, the average downtime is at the same level. Acoustic backup control systems Typical failures are failures in subsea or topside acoustic equipment preventing a proper acoustic communication between the rig and the BOP stack, in addition to failures in the subsea hydraulic equipment. No trend in acoustic control system reliability has been observed. Failure observation and criticality The BOP item specific failures from Table 4.1 have been observed as shown in Table 4.3 Table 4.3: Observation of Subsea BOP failures 13/06/03

BLWOUTPR.DOC

Page 8

Blowout Prevention


Subsea BOP item

Rev 0

NO. OF FAILURES Total

When observing BOP failures BOP on rig

Running BOP

Installation test

Regular tests/drilling

Flexible joints

0

-

-

-

-

Annular preventers

8

0

0

1

7

Ram preventers

4

1

0

3

0

Hydraulic connectors

6

3

0

1

2

Failsafe valves

2

1

0

1

0

Choke and kill lines

19

1

5

1

12

Hydr. cont. system

28

4

3

9

12

Acoustic contr. system

7

0

1

5

1

Total

74

10

9

21

34

As seen from Table 4.3, approximately one out of two failures are observed on regular BOP tests or during drilling/well testing activities. Included in the installation tests are also tests performed after landing the BOP after repair actions. A total of approximately 64 installation tests have been carried out on the 47 wells. From a safety point of view the most important failures are the failures observed during regular BOP tests or during drilling/testing operations. The failures observed when the BOPs were on the rig, during running of the BOPs and during installation testing are not discussed further. In the following a short discussion of failures observed during regular BOP tests or during drilling/testing operations is presented. The influence on BOP safety availability is discussed. Annular preventers Six out of seven annular preventer failures were observed as "failed to fully open" failures. These failures are not assumed to reduce the safety availability. The seventh failure was observed because rubber pieces were found in the mud return after severe problems pulling a parted seal assembly through the BOP stack. It is not known whether this failure caused the annular preventer to leak or not. The BOP was pulled because problems with the BOP stack were expected after the parted seal assembly operation. Ram preventers None of the ram preventer failures were observed during regular BOP tests.

13/06/03

BLWOUTPR.DOC

Page 9

Blowout Prevention


Rev 0

Hydraulic connectors The most critical of all failures observed during Phase V was a leakage in the wellhead connector during a regular BOP test. The other hydraulic connector failure was a failure in LMRP locking hydraulics. This was not a critical failure. The LMRP locking function could still be controlled. Failsafe valves None of the failsafe valve failures were observed during regular BOP tests. Choke and kill lines A total of twelve choke and kill line failures were observed during regular BOP tests or regular BOP operations. Seven of these failures were associated with riser attached line connections, and five in the moonpool flexible jumper hoses. All these failures will reduce the BOP safety availability. However, the most important factor is that these failures will cause extra problems if the well hydrostatic pressure has to be stabilized. Hydraulic control system A total of twelve control system failures was observed during regular BOP tests, or during normal drilling operations. Of these failures, three failures can be regarded as insignificant with respect to safety. Four failures caused “loss of BOP control on one pod”. These failures were all caused by leakage/rupture in pod main supply line. Two failures caused “loss of one BOP function on both pods”. These failures were caused by a failure in the shuttle valve or hydraulic line from the shuttle valve to the BOP function. Three failures caused “loss of one BOP function on one pod”. These problems were caused by pilot valve failures. Acoustic control system failures On the acoustic control system only one failure was observed during regular BOP tests. One out of two subsea transducers failed, the other remained in good condition. However, it seems that the acoustic control systems in general get a stepmotherly treatment. It is likely that more failures occur in these systems than reported in the daily drilling reports. 4.1.1.1 Data Source The data is from reference [1]: Holand, P.: “Subsea BOP Systems, Reliability and Testing Phase V, revision 1" SINTEF report STF 75 A89054, Trondheim, Norway 1995 4.1.1.2 Range Included in the subsea BOP system are the following components/subsystems: 1. 2. 3. 4. 5.

Flexible joint Upper and lower annular preventer Lower marine riser package (LMRP) connector, wellhead connector Shear, upper, middle and lower pipe ram Six failsafe choke and kill valves

13/06/03

BLWOUTPR.DOC

Page 10

Blowout Prevention


Rev 0

6. Choke and kill lines, which includes riser integral lines and flexible jumper hoses in the rig moon pool 7. Hydraulic control system including control lines and topside control panels 8. Acoustic control system including topside panels and transmitting/receiving equipment. A BOP failure is defined as a failure associated with one of the above components/subsystems. The failure specific downtime is the total time lost in conjunction with each failure. The downtime includes the time from the preparation for the restoration starts, until the failure is repaired and the drilling is at the same level as when starting the preparation. For instance if the BOP failure requires the BOP to be pulled, the time included to set and drill the cement plugs, are included in the downtime. 4.1.1.3 Availability Data about the subsea BOP failures is not easily available from any public or oil company sources. This type of information has to be collected one by one from the oil companies/drilling contractor files. 4.1.1.4 Strengths The data presented here is the newest available data. 4.1.1.5 Limitations The failure data has been collected during normal drilling operation, i.e., they have not been collected for situations were the BOPs have needed to act to close in a well kick. 4.1.1.6 Applicability The subsea BOP reliability data can be used as input for drilling risk analyses, or drilling regularity studies. 4.1.1.7 Estimating Frequencies When calculating BOP failure rates, it is assumed that the times between BOP failures are exponentially distributed. The standard estimate for the BOP failure rate ^ is:

=

Number of failures Number of operational hours

=

n

The uncertainty of the estimate ^ can be measured by a 90% confidence interval. When n denotes number of failures and t the exposure value the uncertainty of the estimate, is given by: If the number of failures n > 0, a 90% confidence interval is calculated by: 1 Lower limit: L = 2 0.95, 2n Upper limit:

H

=

1 2

0.05, 2(n+1)

If the number of failures n = 0, a 90% confidence interval is calculated by: Lower limit: L = 0 13/06/03

BLWOUTPR.DOC

Page 11

Blowout Prevention

Upper limit:


H

=

1 2

Rev 0

0.10, 2

where ce,z denotes the upper 100 % percentile of the Chi-squared distribution with z degrees of freedom. The meaning with the 90% confidence intervals is that the frequencies are a member of the interval with a probability of 90%, i.e., the probability that the frequency is lying outside the interval is 10%. 4.1.1.8 Comparative statistics When reviewing all the data from Phase I to Phase V of the study it is observed that subsea BOP reliability has improved during the 1980’s. Therefore Phase V of the study is more likely to represent the subsea BOP reliability today than the previous study. The OREDA Handbook, 2nd edition [5] does also include subsea BOP reliability data. These data were transferred from the first edition of the OREDA Handbook. The basis for the reliability data in this book is a subset of the subsea BOP reliability data collected during Phase II of the subsea BOP reliability project. Due to the above mentioned reliability improvement, these data are thereby not as relevant as the data presented here. 4.2

Key data, Surface BOP systems

4.2.1 Data Tables Two main types of failure data are presented: -

installation failure failure during operation

An installation failure is a failure observed during the installation test, i.e., the test after installing the BOP the first time or after subsequent installations. If pipe rams have been changed, the test of the changed ram is also regarded as an installation test. Installation failures will generally not represent a threat to safety. Failures during operation may represent a threat to safety, depending on the failure mode. These are failures observed during regular testing or during drilling operations. The surface BOP reliability data (/6/) has been collected by reviewing daily drilling reports for 53 development wells drilled from three different North Sea platforms in the period 1987 - 1991. When drilling a development well, normally a Low Pressure BOP is used for the shallow section of the well and a High Pressure (HP) BOP is used for the deeper sections of the well. The low pressure stacks were typically approximately 21 inches and rated to 2000 or 3000 psi of pressure. The high pressure stacks were typically 13 5/8 inches and rated to 5000 or 10 000 psi of pressure. In total three low pressure stacks and three high pressure stacks were included in the study. 13/06/03

BLWOUTPR.DOC

Page 12

Blowout Prevention


Rev 0

Table 4.4 presents an overview of surface BOP item specific no. of failures and down times.

13/06/03

BLWOUTPR.DOC

Page 13

Blowout Prevention


Rev 0

Table 4.4: Overview of surface BOP item specific no. of failures and down times Total Average Pressure class Days in Number of failures service Instal- Opera Total down down time lation -tion time (hrs) per day (hrs) Annular preventers Low pressure 473 1 5 6 6 0.013 High pressure 1891 6 9 15 50.5 0.027 Total 2364 7 14 21 56.5 0.024 Shear/blind rams Low pressure 473 1 0 1 0.5 0.001 High pressure 1891 1 7 8 62.5 0.033 Total 2364 2 7 9 63 0.027 Pipe rams Low pressure 401 0 0 0 0.000 High pressure 3782 2 1 3 10 0.003 Total 4183 2 1 3 10 0.002 Control system Low pressure 473 7 1 8 13 0.027 High pressure 1891 7 12 19 66.5 0.035 Total 2364 14 13 27 79.5 0.034 BOP to high pressure Low pressure 473 2 0 2 16.5 0.035 riser connection High pressure 1891 5 0 5 32.5 0.017 Total 2364 7 0 7 49 0.021 Riser connections Low pressure 473 1 0 1 1 0.002 and wellhead connections High pressure 1891 6 1 7 10.5 0.006 Total 2364 7 1 8 11.5 0.005 Failsafe valves Total 5994 5 3 8 20 0.003 BOP stack clamps Low pressure 473 2 0 2 5 0.011 High pressure 1891 0 0 0 0.000 Total 2364 2 0 2 5 0.002 Choke/kill lines Low pressure 473 1 0 1 3.5 0.007 High pressure 1891 1 0 1 0 0.000 Total 2364 2 0 2 3.5 0.001 Total BOP system Low pressure 473 17 6 23 49 0.104 High pressure 1891 31 33 64 249 0.132 Total 2364 48 39 87 298 0.126 BOP item

In Table 4.5 the surface BOP item specific failure modes and frequencies with 90% confidence limits for all failures (also installation failures) are included. Table 4.5 is based on the same data as Table 4.4.

13/06/03

BLWOUTPR.DOC

Page 14

Blowout Prevention


Rev 0

Table 4.5: Surface BOP item specific failure modes and frequencies with 90% confidence limits (all failures included) BOP ITEM

Failure mode

Annular preventers Failed to fully open Leakage in closed position Hydraulic leakage adapter ring (degraded) Shear/blind rams External leakage Leakage in closed position Premature partly closure shear ram Unknown Pipe rams Leakage in closed position Failed to fully open Hydraulic control Failed to operate BOP systems Failed to operate one BOP function Failed to operate BOP from remote panels Spurious activation of BOP functions Failed to operate rams from remote panels Failed to operate rams from remote panels Hydraulic leakage Unknown Incipient BOP to high External leakage pressure riser connections Riser & wellhead External leakage connections Failsafe valves External leakage External hydraulic leakage Failed to operate valve Leakage in closed position Failed to fully open Unknown BOP stack clamps External leakage Choke/kill lines External leakage Total BOP system

13/06/03

BLWOUTPR.DOC

Failure rate per 10E6 hours Lower Estimate Upper limit limit 149.18 246.76 364.29 46.06 105.75 185.30 0.90 17.63 52.80 0.90 46.06 0.90 0.90 3.54 0.51 34.72 70.16 0.90

17.63 105.75 17.63 17.63 19.92 9.96 88.13 141.00 17.63

52.80 185.30 52.80 52.80 47.25 29.84 161.34 231.74 52.80

0.90 0.90

17.63 17.63

52.80 52.80

0.90

17.63

52.80

34.72 14.41 6.26 57.91

88.13 52.88 35.25 123.38

161.34 110.97 83.61 208.73

70.16

141.00

231.74

0.36 0.36 0.36 5.68 0.36 0.36 6.26 6.26 1273.39

6.95 6.95 6.95 20.85 6.95 6.95 35.25 35.25 1533.42

20.82 20.82 20.82 43.76 20.82 20.82 83.61 83.61 1813.47

Page 15

Blowout Prevention


Rev 0

Overall Comments to the BOP Reliability Failure probability For surface BOPs, more than 50% of the BOP failures observed are installation failures. Installation failures have been observed for all the BOP component/subsystems. Nearly all failures observed on the HP riser and connections to BOP and wellhead are observed during installation testing. These failures are rare during normal operations. In addition, a relatively large percentage of the failures of the other components is observed during installation testing. If not taking failure criticality into consideration when comparing the overall Mean Time Between Failures (MTBFs) for surface BOPs with the overall MTBFs for subsea BOPs (including installation failures), it is observed that surface BOPs fail more often than subsea BOPs. If disregarding the installation failures for both subsea and surface BOPs, surface BOPs also fail more often. The annular preventers, the control system and the shear/blind rams are responsible for the majority of the BOP failures when disregarding the installation failures. Downtime caused by BOP failures The total downtime caused by BOP failures is nearly 300 hours. The installation failures caused approximately 50% of this downtime. Compared to subsea BOPs the average downtime per day in service is low. For subsea BOPs the average downtime caused by BOP failures were 0.81 hours per BOP day in service (/1/), and for surface BOPs it is 0.13 hours per BOP day in service. This difference is reasonable since maintenance actions on surface BOPs are significantly easier to carry out than on subsea BOPs. The shear/blind rams, the control system and the annular preventers are responsible for the majority of the downtime caused by BOP failures when disregarding the installation failures. Failure criticality Several failures of a BOP barrier were observed for the surface BOPs. Such failures seldom occur on subsea BOPs. These failures were: -

BOP control system failed to operate one or several BOP functions Shear/blind rams leaked in closed position (4 failures) Annular preventers leaked in closed position (5 failures)

13/06/03

BLWOUTPR.DOC

Page 16

Blowout Prevention


Rev 0

The main reasons for the relatively high frequency of the above failures are believed to be: -

One of the observed operators has a control system with very low reliability Surface BOP control systems have no redundancy (subsea BOP control has a lot of redundancy) Inadequate preventive maintenance or weak design of one of the shear/blind ram preventers Inadequate preventive maintenance of annular preventers

For surface BOPs, more than 50% of the BOP failures observed are installation failures. Installation failures have been observed for all the BOP component/subsystems. Nearly all failures observed on the HP riser and connections to BOP and wellhead are observed during installation testing. These failures are rare during normal operations. In addition, a relatively large percentage of the failures of the other components is observed during installation testing. 4.2.1.1 Data Source The reliability data included is from reference /6/ Holand, P. “Reliability of Surface Blowout preventers (BOPs)” STF75 A91037 In total 53 wells were included in the data collection study. 35 of these wells were new wells, while the remaining 18 wells were redrilled (side-tracking old well) . When collecting reliability data only the well "drilling" period has been included. The well "drilling" period for the two well types is defined in Figure 4.1. As seen from Figure 4.1, the period where completion activities are carried out is not included. Further, for redrilled wells the period where the tubing is pulled and the old casing is pulled or milled is not included (milling window in old casing is included). Note that for some redrilled wells also the 13 5/8" casing is pulled or milled out. For these redrilled wells the low pressure BOP (LP BOP) stacks are used when drilling the hole for the new 13 5/8" casing. This period is hence included in the data material (not included in Figure 4.1). The BOP operational periods refer to the periods where the HP BOPs and/or the LP BOPs have been used within the drilling period defined in Figure 4.1.

13/06/03

BLWOUTPR.DOC

Page 17

Blowout Prevention


Rev 0

Figure 4.1 Periods included in data collection. 4.2.1.2 Range Included in the BOP system are the following components/subsystems: -

Annular preventers Shear/blind ram preventers Pipe ram preventers Hydraulic control systems BOP to high pressure riser connection High pressure riser and wellhead connection Failsafe valves BOP stack clamps Choke and kill lines

A BOP failure is defined as a failure associated with one of the above components/subsystems. It should be noted that no components above the annular preventer are regarded as a part of the BOP system in this study. Failures of the low pressure riser and the diverter systems have consequently not been included. The failure specific downtime is the total time lost in conjunction with each failure. The downtime includes the time from the preparation for the restoration starts, until the failure is repaired and the drilling is at the same level as when starting the preparation. For instance if 13/06/03

BLWOUTPR.DOC

Page 18

Blowout Prevention


Rev 0

the BOP failure requires the BOP to be disconnected, the time included to set and drill the cement plugs, are included in the downtime. Downtime is the total drilling time lost in connection with restoring a BOP failure. To assess the failure criticality with respect to blow-out safety it has been recorded whether the failure was observed during "normal" BOP testing/operation or during the installation test. 4.2.1.3 Availability Data about the BOP failures is not easily available from any public or oil company sources. This type of information has to be collected one by one from the oil companies/drilling contractor files. 4.2.1.4 Strengths The data presented here is the only reliability data regarding surface BOP reliability. 4.2.1.5 Limitations The failure data has been collected during normal drilling operation, i.e., they have not been collected for situations were the BOPs have needed to act to close in a well kick. 4.2.1.6 Applicability The surface BOP reliability data can be used as input for drilling risk analyses. 4.2.1.7 Estimating frequencies See section 4.1.1.7. 4.2.1.8 Comparative Statistics Not relevant 4.3

Key Data, Downhole Safety Valves (DHSV/SCSSV)

The surface controlled subsurface safety valve (SCSSV) in a normal production well completion is considered the most important primary safety barrier. The SCSSV is frequently also called a downhole safety valve (DHSV). The objective of the SINTEF studies on SCSSVs has been to collect and analyse data with the view of obtaining reliability improvement and provide reliability data for risk and reliability analysis. The results include MTTF estimates for all major valve models from the different manufacturers, failure mode distributions and a discussion of valve failure mechanisms and failure causes. The SCSSV reliability study has been carried out in four phases since 1983 and is the most comprehensive database in its kind world-wide. Table 4.6 below shows some key historical parameters for these studies. 13/06/03

BLWOUTPR.DOC

Page 19

Blowout Prevention


Rev 0

Table 4.6: SINTEF joint industry SCSSV studies since 1983. Study

Data Collection

Phase I

Period 1981-1982

Phase II

1983-1986

2 143

435

Phase III

1987-1989

5 843

1 106

Phase IV

1990-1991

2 840

267

Amount of Data Service time Number of failures 1 223 544

Most SCSSV failures are observed during pressure testing. Normally the valves are tested every six months. They are normally tested more often just after installation. Some may also select to use a shorter test interval. For the purpose of analysis, it is recommended that Phase IV data are used. Therefore the data presented here are based on the Phase IV study. 4.3.1 Data Tables The table includes a breakdown of performance data by valve type and failure categories. Failure category indicates what caused the SCSSV malfunction. When SCSSV is stated, the valve itself failed mechanically. “Other” may typically be control line failure or scale in the well. For details concerning the failure categories, ref. Section 4.3.1.2. Table 4.7: Overall failure categories for valve main groups (production and injection wells). Valve type Wireline Retrievable Flapper

Years in No. of failures per category MTTF (years) service Total SCSSV Other Unknown Total SCSS 1189.7 124 39 54 31 9.6 30.5

Wireline Retrievable Ball

508.9

All Wireline Retrievables Tubing Retrievable Flapper Tubing Retrievable Ball

36

42

6

6.1

14.1

1698.6 208

75

96

37

8.2

22.6

1088.2 54

26

22

6

20.2

41.9

4

1

0

10.5

13.2

52.7

84

5

All Tubing Retrievables

1140.9 59

30

23

6

19.3

38.0

Total, all valves

2839.5 267

105

119

43

10.6

27.0

Table 4.8. is included to allow comparison of main results between study phases III and IV. This table underlines the significant improvement in valve reliability over the last few years. 13/06/03

BLWOUTPR.DOC

Page 20

Blowout Prevention


Rev 0

Table 4.8 Comparison of overall reliability results between Phases III and IV. Valve type

Years in service Total no. of failures Total MTTF (years) Phase Phase IV Phase III Phase IV Phase III Phase IV III

Wireline Retrievable Flapper

1986.7

1189.7

324

124

6.1

9.6

Wireline Retrievable Ball

2356.4

508.9

657

84

3.6

6.1

All Wireline Retrievables

4343.1

1698.6

981

208

4.4

8.2

Tubing Retrievable Flapper

1184.8

1088.2

67

54

17.7

20.2

Tubing Retrievable Ball

314.8

52.7

58

5

5.4

10.5

All Tubing Retrievables

1499.6

1140.9

125

59

12.0

19.3

Total. all valves

5842.7

2839.5

1106

267

5.3

10.6

The above conclusion still stands after considering the fact that fewer fields are represented in Phase IV, and that the total amount of field data is less. The main reason for the smaller amount of data represented in Phase IV is that the average reporting period is only 60 % of the average Phase III reporting period. A factor that historically has had a significant effect on valve reliability, is whether or not the valve has been equipped with a so-called equalizing mechanism. This is a valve internal mechanism that allows for pressure equalization across the valves closing mechanism during leak testing with a pressure differential. An overview of the effect of including/excluding the equalizing mechanism is given in Table 4.9 (tubing retrievable valves) and 4.10 (wireline retrievable valves) respectively. A breakdown by failure modes is given in this table. A description of SCSSV failure modes is given below.

13/06/03

BLWOUTPR.DOC

Page 21

Blowout Prevention


Rev 0

Table 4.9 Valve failure mode distribution tubing retrieveable (TR) valves (TR ball valves are not included). Valve Type TR Flapper,

Failure Mode* FTC

Equalizing

LCP

4

28.6

47.3

PCL

0

0

>189.1

FTO

6

42.8

31.5

CLW

0

0

>189.1

WCL

4

28.6

47.3

OTH

0

0

>189.1

All

14

100

189.1

13.5

FTC

14

35.0

899.1

64.2

Non-Equalizing LCP

9

22.5

99.9

PCL

2

5.0

449.6

FTO

0

0

>899.1

CLW

13

32.5

69.2

WCL

2

5

449.6

OTH

0

0

>899.1

All

40

100

TR Flapper,

Failure Mode Distribution No. of % of total 0 0

Years in service 189.1

899.1

MTTF (years) >189.1

22.5

* Failure mode abbreviations are defined below.

13/06/03

BLWOUTPR.DOC

Page 22

Blowout Prevention


Rev 0

Table 4.10: Valve failure mode distribution wireline retrieveable (WR) valves (WR ball valves are not included). Valve Type

Failure Mode* WR Flapper, FTC

Failure Mode Distribution No. of % of total 22 25.9

Years in service 908.8

MTTF (years) 41.3

LCP

9

10.6

101.0

FTH

3

3.5

302.9

PCL

4

4.7

227.2

FTO

6

7.1

151.5

CLW

17

20.0

53.5

WCL

24

28.2

37.8

FSN

0

0

>908.8

FTR

0

0

>908.8

OTH

0

0

>908.8

All

85

100

908.8

10.7

WR Flapper, FTC

3

7.7

280.9

93.6

LCP

9

23.1

31.2

FTH

0

0

>280.9

PCL

7

17.9

40.1

FTO

13

33.3

21.6

CLW

4

10.3

70.2

WCL

1

2.6

280.9

FSN

2

5.1

140.5

FTR

0

0

>280.9

OTH

0

0

>280.9

All

39

100

Equalizing

NonEqualizing

280.9

7.2

* Failure mode abbreviations are defined below. SCSSV functions and failure modes The SCSSV has the following primary functions: In open position; to shut in the well on command on it's intended setting depth and seal against flow of oil/gas/condensate in accordance with API RP 14B requirements. In closed condition, the valve is to maintain this seal until the open command is initiated. In this instance, the valve function is to open fully with no restriction of valve cross-sectional flow area. The sealing integrity requirement also applies to any associated control line(s).

13/06/03

BLWOUTPR.DOC

Page 23

Blowout Prevention


Rev 0

Also, secondary functions may be integrated into the valve. The objective of these secondary functions is to transfer the valve to a state where the primary functions are restored. Examples of such secondary functions are: • • •

Temporary lockout Permanent lockout Accommodating and establishing control fluid communication with insert valve

This defines the following failure modes relating to the primary and secondary valve functions: Primary function failure modes With the valve in open position, the following failure modes apply: • • • •

Failure to close on command (FTC) Premature closure of valve (PCL) Control line to well communication (CLW) Fail to set in nipple (FSN)

The following failure modes apply with the valve closed: • • • •

Leakage in closed position (LCP) Failure to open on command (FTO) Well to control line communication (WCL) Fail to hold in nipple (FTH)

Secondary function failure modes The following failure modes apply with the valve in open or closed position: • • • • • • • • • •

Failure to shift isolation sleeve Premature shifting of isolation sleeve Inadvertent activation of temporarily locked-out valve Inadvertent closure of permanently locked out valve Inadvertent permanent lockout Failure to activate the valve remotely Failure to activate the valve by wireline tools Failure to lockout the valve remotely Failure to lockout the valve by wireline tools Failure to release lock (FTR)

All SCSSV failures, where either the primary or secondary function of the valve is affected are registered in the SINTEF studies. In general, if multiple failures are experienced, e.g. a LCP failure followed by a FTO failure during testing, the most critical detected failure is quoted. This is justified from the primary function definition for the valve. However, it is 13/06/03

BLWOUTPR.DOC

Page 24

Blowout Prevention


Rev 0

suggested that all verified failures are reported in cases where multiple failures are observed. Note also that in cases of multiple failures on one valve, only one failure will be registered for calculations of failure rates/MTTF. The failure reporting format in SINTEFs SCSSV software uses primary function failure modes. Phase IV has identified a great number of failures that can be directly related to valve secondary functions, typically frequent failures of the communication feature for WR valves that is included in many TR valves. 4.3.1.1 Data source The reliability data included is from /9/ Molnes, E., Sundet, I., Vatn, J.: "Reliability of Surface Controlled Subsurface Safety Valves -Phase IV". SINTEF Report STF75 F91038. 4.3.1.2 Range Unless otherwise explicitly stated in result presentation tables, the SCSSV reliability data covers the entire SCSSV system, including: • • • • • •

Surface control system Control line(s) Valve including actuating mechanism Lock (wireline retrievable valves only) Lockout/insert valve mechanism and communication feature (when applicable) Equalizing mechanism (when applicable)

In some cases, result presentation tables are split into the following failure categories: • • •

SCSSV failures Other Unknown

The category SCSSV failures includes cases where the failure is directly attributable to the valve itself. The Other category includes the following cases: • Control line leak/blockage • Other control system failure • Wireline job/tool induced failure • Other operation induced failure • Scale • Other well deposits • Nipple/lock failure • Human failure SCSSV malfunctions where no information with respect to failure cause exist, have been classified as unknown. These may contain hidden information on any one of the other failure classes. 13/06/03

BLWOUTPR.DOC

Page 25

Blowout Prevention


Rev 0

When evaluating SCSSV system performance, e.g., in safety and reliability studies, it is important to base calculations on the total, observed failure rate - irrespective of failure class. When comparing valve specific performance, both total and SCSSV related MTTF should be considered. Detailed information for such comparisons can be found in /8/, or in the more recent /9/. 4.3.1.3 Availability The data has been collected directly from oil companies with subsequent input from SCSSV manufacturers through joint industry research projects. The processed reliability data are initially released on a limited availability basis to the funding oil companies and manufacturers involved. After a confidentiality period of three years, the data became publicly available. A similar publication philosophy is likely also for future SINTEF studies on SCSSV (and other well completion equipment) reliability. 4.3.1.4 Strengths The SCSSV data presented herein is the most comprehensive data source known for this item world-wide. The close interaction with the contributing oil companies and the manufacturers during data collection and analysis greatly adds to the quality of these results. 4.3.1.5 Limitations The data has been analysed assuming that the exponential distribution applies. This assumption holds considering the data as a whole, and for large samples of data. However, when looking at data layers in isolation, data subsets can be found where the Weibull distribution more accurately reflects the failure distribution. This is typically the case in situations where extreme corrosion is present, showing a distinct wear-out effect on the lifetime of the valves. 4.3.1.6 Applicability The SCSSV reliability data can be used as input to risk analysis for production installations, as well as for conceptual comparison of alternative SCSSV configurations. To allow for more detailed comparison between specific SCSSV models/makes, refer to /9/.

13/06/03

BLWOUTPR.DOC

Page 26

Blowout Prevention


Rev 0

4.3.1.7 Estimating frequencies The MTTF values given in Tables 4.7 - 4.10 can be transformed to Failure rate per 10E6 hours by the following expression: Failure rate per 10E6 hours = 10E6 / (MTTF * 24 * 365) 4.3.1.8 Comparative statistics None Relevant. 5.

ONGOING RESEARCH

The fall 1995 SINTEF will start a new project concerning reliability of deep-water subsea BOPs. The project “Reliability of Well Completion Equipment - Phase II” is currently ongoing, with funding from 13 oil companies. The report including the latest updated SCSSV reliability statistics is scheduled for release at the end of October 1995. A three year confidentiality clause applies for this report, causing the report to be available to the public from October 1998. This project will include reliability data also for other vital completion equipment, such as tubing hangers, annulus safety systems, production packers, seal assemblies, etc.

13/06/03

BLWOUTPR.DOC

Page 27

Blowout Prevention


Rev 0

REFERENCES

1. Holand, P.: “Subsea BOP Systems, Reliability and Testing Phase V, revision 1" SINTEF report STF 75 A89054, Trondheim, Norway 1995 2. Holand, P.: "Subsea Blow-out-Preventer Systems: Reliability and testing". SPE Drilling Engineering, SPE 17083, December 1991 3. Holand, P.: "Reliability of Subsea BOP Systems". IADC, European Well Conference, June 11 - 13 1991, Stavanger 4. Rausand, M., Engen, G.: "Reliability of Subsea BOP Systems". OTC 4444 Offshore Technology Conference, Houston 1983. 5. “OREDA, Offshore Reliability Data, 2nd edition", DNV Technica, Høvik, Norway 1992 6. Holand, P. “Reliability of Surface Blow-out preventers (BOPs)” STF75 A91037 7. Holand, P. "Offshore Blow-outs, Data for Riak Assessment" ASME paper no. OMAE - 95 - 133, presented at the OMAE conference in Copenhagen, June 18 - 24, 1995 8. Molnes, E., et.al.: "Reliability of Surface Controlled Subsurface Safety Valves - Phase III". SINTEF Report STF75 F89030. 9. Molnes, E., Sundet, I., Vatn, J.: "Reliability of Surface Controlled Subsurface Safety Valves -Phase IV". SINTEF Report STF75 F91038.

13/06/03

BLWOUTPR.DOC

Page 28

Blowout Prevention


Rev 0

APPENDIX 1

CAUSES FOR LOSS OF PRIMARY BARRIER DURING DRILLING, DIVERTER PERFORMANCE This Appendix is fully based on reference /7/ which again is based on the SINTEF Offshore Blow-out Database. Causes for loss of primary barrier during drilling The causes for losing the primary barrier during drilling are listed in Table A.1. Specific comments to the various reasons for losing the primary barrier is given after Table A.1. Table A.1: Primary barrier failure causes for drilling as listed in the database for the North Sea and the US GoM OCS blow-outs in the period 1980-01-01 - 1993-01-01. Primary barrier failure

Development drilling


too low mud weight

3

7

swabbing

12

7

Too low hydrostatic

unexpected high well pressure

3

9

head

gas cut mud

-

3

improper fill up

-

1

disconnected riser

-

1

annular losses

2

3

while cement setting

6

3

cement preflush weight too low

-

-

drilling into neighbour well

1

-

trapped gas

-

1

unknown why

6

6

Poor cement

1

2

Formation breakdown

-

1

Well test string barrier failure

1

-

Tubing plug failure

1

-

Unknown

-

2

36 (34)*

46 (45)*

Total *

Figures in parentheses denote number of blow-outs. For some blow-outs two primary barrier failures are reported.

13/06/03

BLWOUTPR.DOC

Page 29

Blowout Prevention


Rev 0

Too low hydrostatic head Table A.1 lists several possibilities for losing the hydrostatic head. It is important to note that the quality of the source information regarding this database field is variable. The actual reason for losing the primary barrier is often uncertain, and the sources do frequently not state any reason. Too low mud weight as cause of losing the primary barrier was reported for 10 of the blowouts. For all these blow-outs too low mud weight was stated as the cause in the source material. However, it is likely that many of these blow-outs were caused by unexpected high well pressure. Swabbing is listed as the cause of losing the primary barrier for 19 blow-outs. Swabbing has either been stated as a cause of barrier loss in the source, or the blow-out has started when tripping out of the hole. Unexpected high well pressure is listed as the cause of losing the primary barrier for twelve blow-outs. Unexpected high well pressure is either stated as a cause of barrier loss in the source, or the blow-out started when actually drilling. Gas cut mud has only been stated as cause three times, but it is believed that this may have been a contributing factor more often. Annular losses are listed as cause of losing the primary barrier five times. This is based on statements in the sources. As many as nine of the drilling blow-outs occurred when waiting on cement to harden. The cause is typically that when the cement is in the transition state, it will not impose necessary hydrostatic pressure on the formation at the same time as the cement is not gas tight. Well collisions causing blow-outs are frequently discussed in connection with development drilling. Only one such incident is reported in the US GoM OCS and the North Sea during the actual period. However, the database contains five other similar incidents. Three in the US GoM in the seventies, one in Dubai in 1982 and one in Trinidad in 1991. Trapped gas is listed as cause of losing the primary barrier one time. . Twelve incidents are listed with unknown reason for losing the hydrostatic head.

Other causes Poor cement is listed as cause of losing the primary barrier three times. Formation breakdown, well test string barrier failure and tubing plug have all been listed once. Two blow-outs were listed with unknown as cause of losing the primary barrier. Diverter performance 13/06/03

BLWOUTPR.DOC

Page 30

Blowout Prevention


Rev 0

Diverters are used when drilling the shallow part of the wells when the formation integrity may not allow the well pressure to be closed in. Diverters divert the gas at top side. In Table A.2 the experienced diverter performance is listed. Table A.2: Diverter performance as listed in the database for the North Sea and the US GoM OCS blow-outs in the period 1980-01-01 - 1993-01-01. Secondary barrier failure

Development drilling


Diverted, no problem

11

5

Failed to operate diverter

2

2

Diverter failed after closure

4

7

17 (*16)

14

Total *

Figures in parentheses denote number of blow-outs. For one blow-out two diverter outcomes were listed

The diverter was intended for use 30 times. For 16 of these incidents the diverter functioned as intended. Four times the diverter failed to close, and eleven times the diverter failed after a period of diverting. The diverter thus failed for nearly 50% of the blow-outs. It should, however, be noted that for the eight latest incidents the diverters have functioned as intended. Diverter systems have improved during the past years. Drilling without risers has become normal practice in the North Sea for semi submersible rigs in "deep water", due to the above diverter problems. Two such blow-out incidents are reported in the database. In addition the riser was disconnected to avoid bringing gas to the rig once.

13/06/03

BLWOUTPR.DOC

Page 31

Blowout Prevention

13/06/03


BLWOUTPR.DOC

Rev 0

Page 1

Active Fire Protection


Rev 0

ACTIVE FIRE PROTECTION SYSTEMS

13/06/2003

FIREPROT.DOC

Page 1



Rev 0

TABLE OF CONTENTS

1.

INTRODUCTION .............................................................................................3 1.1 Scope ............................................................................................................3 1.2 System and component reliability data limitations ...........................................3 1.3 System failure mechanisms .............................................................................3 1.4 Datasheet limitations ......................................................................................3 1.5 Terminology ..................................................................................................4 1.6 Cross-referencing with other datasheets .........................................................4

2. ACTIVE FIRE PROTECTION SYSTEMS ........................................................5 3.

FIREWATER SUPPLY ....................................................................................6 3.1 Pumps ...........................................................................................................6 3.2 Reservoirs .....................................................................................................7 3.3 Generators and motors ..................................................................................7 3.4 Design considerations ....................................................................................8 3.5 Vulnerability to fire/explosion ........................................................................8

4.

FIREWATER DISTRIBUTION .......................................................................10 4.1 Valves ..........................................................................................................10 4.2 Mains ...........................................................................................................10

5.

FIREWATER APPLICATION ........................................................................11 5.1 Sprinkler systems .........................................................................................11 5.2 Deluge systems ............................................................................................11 5.3 Design considerations .................................................................................11 5.4 Vulnerability to fire/explosion ......................................................................12

6.

FOAM SYSTEMS ..........................................................................................13 6.1 Design considerations ...................................................................................13 6.2 Vulnerability to fire/explosion .......................................................................13

7. GASEOUS SYSTEMS ...................................................................................14 7.1 Halon systems ..............................................................................................14 7.2 CO2 systems .................................................................................................14 7.3 Design considerations ...................................................................................14 7.4 Vulnerability to fire/explosion .......................................................................15 8.

REFERENCES and BIBLIOGRAPHY ...........................................................16 8.1 References ...................................................................................................16 8.2 Bibliography .................................................................................................16

13/06/2003

FIREPROT.DOC

Page 2


1.

INTRODUCTION

1.1

Scope


Rev 0

This datasheet provides information about failure rates of active fire protection systems and their component parts. These include water supply, distribution and application systems, foam mixing and supply systems, and gaseous systems. 1.2

System and component reliability data limitations

The reliability of active fire protection systems is difficult to determine: by their nature they are not routinely operated, and although function testing is likely in most cases to be frequent it will normally be restricted to specific components and not whole systems. In some cases, manufacturers may be a source of reliability data for their systems, although these must obviously be treated with caution. Many of the components used have a wider application than purely in fire protection systems, and consequently more data on reliability are available. However, most of the data presented here are based on limited datasets and the quoted rates have wide confidence limits. Failure rate data for components is generally quoted on a time basis, whereas for fire systems rates are required to be known on a demand basis. Building a picture of overall system reliability from limited data on component parts may introduce errors. 1.3

System failure mechanisms

The real test of system reliability is the success rate in extinguishing fires, and this is the information which a risk analyst will be trying to determine. There are several fault mechanisms which may lead to ultimate failure in this respect: •

system design. Fires may be outside the design capacity of the extinguishing system, either intentionally or not. Systems are generally designed to standard codes, not on an assessed risk basis

•

management system failure, for example if fire compartments are breached in modification work and not correctly reinstated

•

human error may lead to system failure, for example if fire doors are left open

•

failure caused by the event itself, for example fire impingement on control cables, or missile damage to pipework in an explosion

•

component failure. Any of the components of a system may fail and lead to the ultimate failure of the system.

1.4

Datasheet limitations

This datasheet only contains information on failure rates arising from this last failure mechanism. It follows that analysts using these data must exercise caution, and be aware that analyses performed solely on the basis of the figures presented here are unlikely to be complete. Qualitative information is provided for each system on design considerations and vulnerability to fire and explosion to assist the analyst in assessing overall reliability. 13/06/2003

FIREPROT.DOC

Page 3


1.5


Rev 0

Terminology

The terms used in this datasheet have the following meanings: • failure per demand - fail to start/operate when required • failure per 106 operating hours - fail whilst running/operating • failure per 106 (calendar) hours - all failures. 1.6

Cross-referencing with other datasheets

As noted in paragraph 1.2, many of the components of fire protection systems are used in other systems. The following datasheets may provide additional information for the particular system under assessment: • Storage tanks • Process releases • Vulnerability of plant.

13/06/2003

FIREPROT.DOC

Page 4


2.


Rev 0

ACTIVE FIRE PROTECTION SYSTEMS

Table 1 summarises the data for each of the systems considered separately in this document. These overall rates are given as a general guide; they should not be used in isolation to make engineering decisions. More specific data in the following sections and in source material should be consulted. Table 1: Typical failure rates for fire protection systems Equipment type Firewater system Water supply - diesel engine driven pumpset Water supply - electric motor driven pumpset Deluge system Sprinkler system Foam mixing system Foam supply system Halon system CO2 system

Failures (per 106hrs) 9.7(3)

87.0(2) 8.0(2)

Failures (per demand) 0.01(1) 0.025(1) 0.004(1) 0.015(1) 0.005(1) 0.01(1) 0.02(1) 0.02(1) 0.02(1)

Most of the data shown above are based on small populations and short timescales, and is therefore of suspect quality. There are few data on performance against real fires. Sources used in Reference 1 are given in the bibliography.

13/06/2003

FIREPROT.DOC

Page 5


3.


Rev 0

FIREWATER SUPPLY

Offshore firewater supply systems usually consist of seawater pumps, either diesel or electric motor driven via a gearbox or hydraulic drive. Standby or emergency generators are used to provide power for electric pumps. Typical onshore systems involve a reservoir of firewater connected to the firemain. This section provides failure data for each of these components of a firewater supply system. 3.1

Pumps

Table 2a: Pumps Pump type

Failure per 106 hrs operating 4719(2)

per demand 0.0033(2) 0.043 (3) 0.023(2) 0.019(3)

Electric motor Diesel engine

25808(2)

per 106hrs calendar 56(2) 185(2)

Table 2b: Pumps(5) Pump type

Failure mode

Positive displacement

All While running Fail to start All While running Fail to start

Centrifugal

Failures per 106 calendar hrs 22 1.9 1.9 99 7.1 7.1

Failures per demand 0.094 0.019 0.033 0.0047

Table 2c Pumps(6) Failure mode All pumps

Fail to start Fail to run

Failures per 106 calendar hrs

Failures per demand 0.001

30

There are limited systematic data on offshore fire pump packages. The data are based on limited samples of conditions and equipment, and consequently show wide variatins in failure rates. No data are available for hydraulic motors or pumps. However these are likely to be more reliable than the associated prime mover. No data have been given for dedicated fire pump controllers. However these are simple devices which can be expected to have high reliability, and alternative starting and control mechanisms are usually provided. 13/06/2003

FIREPROT.DOC

Page 6


3.2


Rev 0

Reservoirs

Table 3a: Pressure Vessels Vessel type Metal All

Failure mode Catastrophic Serious leakage Catastrophic rupture

Failure per 106hrs 0.011(3) 10(6) 1(6)

The calculation of failure rate for a pressurised vessel should include failures in the pressure maintenance system. Table 3b: Tanks and non-pressurised vessels Type Metal vessel Non-metal vessel Tank

Failure mode Catastrophic Catastrophic Serious leakage Catastrophic rupture

Failure per 106hrs 0.99(3) 1.2(3) 100(6) 6(6)

These figures have been produced from limited samples of equipment. The failure on demand rate for an elevated reservoir might be expected to be dominated by the reliability of the system. 3.3

Generators and motors

Table 4 Generators(2) Type Dual fuel Diesel

per demand 21.2 1.3

Failures/106hrs calendar 1300 180

per 106hrs operating 3400 8500

The calendar rate quoted is taken from OREDA(2), and includes all failure modes. Table 5: Motors Motor type

Failure mode

Failures per 106hrs

Electric

Failures per demand 0.0003(6)

Fail to start Fail to run 7(6) Composite Catastrophic 5(5) Fail to run 20(5) A.C. Catastrophic 15(3) 0.000025(3) These figures have been produced from limited samples of equipment.

13/06/2003

FIREPROT.DOC

Page 7


3.4


Rev 0

Design considerations

Pumps: • reliability of gear drive • alignment problems • maintenance and inspection • water availability and composition. • caisson vulnerability to collision damage (offshore) • diving (offshore) Centrifugal sets: • excessive pressure drop in suction • use of suction lift and foot valves • failure of priming system • size of supply tank. Diesel pumpset: • fuel supply adequacy for incident duration • fire detector types and logic. Electric pumpset: • power supply changeover system • reliability of power supply. Reservoir: • reliability and capacity of refilling system • detection of incipient problems • adequacy of size for foreseeable incidents • pressure maintenance system. 3.5

Vulnerability to fire/explosion

All components and their essential services should be protected from blast and fire or separated by sufficient distance from the fire zone, including: • • • • • • • •

pumps motors/engines generators control lines air supply lines fuel supply lines power cables reservoirs.

13/06/2003

FIREPROT.DOC

Page 8


4.


Rev 0

FIREWATER DISTRIBUTION

Firewater distribution systems comprise a pre-pressurised ring main and associated control valves. This section provides data on failure rates for such systems and their components. Failure rates will be sensitive to the standards of materials, design, maintenance and operation of such systems. They will also be sensitive to the composition and properties of the water used in the system, for example the use of seawater or hard water might lead to deposition of scale affecting operation of components. 4.1

Valves

Table 6 Valves(1) Type

Failures per demand

Air/hydraulic Motorised Solenoid Pressure regulating Pressure relief

4.2

0.0003 0.001 0.001

Failures per 106 operating hrs 10 10 10 50 2.3

Mains

Table 7 Mains(1) Equipment type Medium Fire main Joint (>2in ND) Joint (<2in ND) Valve (>2in ND) Valve (<2in ND) Pipe (>2in ND)

Leaks per106hrs Serious 0.04/m

0.014 0.0015 0.009 0.001 0.0015/100m

Large 0.0015 0.001 0.0002/100m

The data are gathered from a variety of different systems and are poorly supported. The data quoted are for steel pipe. Increasingly, glass re-inforced plastic/epoxy resin (GRP/GRE) pipes are being used in these applications. No useful quantitative data are yet available for such pipe. There is some anecdotal evidence that GRP/GRE pipes appear to suffer from ‘infant mortality’ failures because of unfamiliar installation techniques and design approaches, but subsequent to the initial commissioning phase, thereafter are proving as reliable as steel. Whilst GRP has a lower thermal consuctivity than steel, GRP pipes might be able to withstand a similar heat load under fire conditions to steel pipe (owing to the cooling effect of the flowing water), missile damage from explosions would be likely to be greater for GRP than steel.

13/06/2003

FIREPROT.DOC

Page 9


5.


Rev 0

FIREWATER APPLICATION

Firewater application systems are of two main types; sprinkler systems, and deluge systems. Data on both types of system and their components are given in this section. 5.1

Sprinkler systems

Table 8 Sprinkler systems(1)(2) Equipment type System Control valve Automatic head

Failure per 106hrs

Failure per demand 0.005 0.001 0.001

10

Data on sprinkler systems are based on Australian experience, where all incidents involving sprinklers are reported. The dataset is therefore relatively large. 5.2

Deluge systems

Table 9 Deluge systems(1)(2) Equipment type System Butterfly valve Swing type valve Pneumatic valve

Failure per demand 0.015 0.001 0.001 0.0099

Failure per 106hrs 10 10 21

Data are from a limited sample of deluge systems. The adequacy of a deluge system may suffer from plugged nozzles, poor siting of nozzles, or intrusion of other equipment between nozzles and the fire area, giving reduced water spray protection. Loss of protection over even small areas of an overheating vessel can lead to vessel failure. Deluge system codes may be inadequate for offshore operations. They are unable to cope with impinging jet fires for example. However, deluge systems may mitigate against further escalation in such circumstances. 5.3


Application systems: • design code does not include fire type/duration • water supply contains plugging materials • failure of control/supply isolation valves • degraded water supply • system maintenance and inspection • equipment in protected area insufficiently waterproof • drainage 13/06/2003

FIREPROT.DOC

Page 10



Rev 0

In most cases, problems are far less acute with sprinkler systems. Sprinkler systems: • inadequate flushing • mechanical damage to frangible element • pre-action valve fails to open Deluge systems: • nozzle positioning/orientation • simultaneous operation of other deluge systems • water hammer causing valve tripping 5.4


Pipework and nozzles are vulnerable to blast and missile damage, which may cause loss of system effectiveness. Control lines and power cables are also vulnerable, and may need protecting.

13/06/2003

FIREPROT.DOC

Page 11


6.


Rev 0

FOAM SYSTEMS

Two main types of foam system are considered; conventional low-expansion systems of the type used for protection of tanks, and foam mixing systems of the type used as attachments to deluge systems. Table 10: Foam compound and mixing systems(1) Equipment type Foam compound supply Centrifugal electric pump Pelton wheel motor Supply system Foam compound proportioning In-line proportioner Nozzle eductor Metered proportioner Pressure proportioning tank Around-the-pump proportioner Foam generation Low expansion foam maker High back-pressure foam maker

Failure per demand 0.007 0.007 0.02

Failure per 106 hrs 200 200 neg.

0.005 0.005 0.005 0.005 0.005

neg. neg. neg. neg. neg.

0.005 0.005

neg. neg.

6.1


• • • • • • • •

variable water flow leading to incorrect foam/water ratio selection of concentrate and specification of type condition of concentrate on demand (degradation) water quality, constituents and temperature compatibility of concentrate and system materials testing fire duration re-supply logistics

6.2


Pipework and mixing systems will be vulnerable to blast and missile damage. The mixing system and associated control lines and power supply will also be vulnerable to fire.

13/06/2003

FIREPROT.DOC

Page 12


7.


Rev 0

GASEOUS SYSTEMS

Gaseous systems comprise a battery of gas bottles, a release mechanism, and application nozzles. These systems are commonly applied to enclosed spaces where long or very intense fires are unlikely, and are often able to be backed up by manual intervention. These data are based on limited samples of equipment and systems, which may account for the wide variation in quoted failure rates. 7.1

Halon systems

Table 11: Halon systems Equipment type System

Failure per demand 0.0004(2) 0.02(1)

Discharge nozzle

Failure per 106hrs 87(2) 0.27(2)

Owing to its adverse environmental effects, halon is being phased out in existing applications, and is unlikely to be specified for new applications. These data are provided as an indication of failure rates which might be expected in systems provided with ‘halon-like’ replacement agents. 7.2

CO2 systems

Table 12: CO2 systems(2) System 7.3

Failure per 106hrs 8


Gaseous systems in general: • design volume • system capacity • make-up system • operating and valve logic • safeguards for personnel • reaction forces at nozzles Halon and halon-like agent systems: • applicability to fire type • back up protection • allowance for leakage • availability of top-up gas (halon phase-out) • ventilation/leakage in protected area • re-ignition from hot surfaces CO2 systems: • overpressure effects of discharge • cooling effects of discharge 13/06/2003

FIREPROT.DOC

Page 13


7.4


Rev 0


The situations in which gaseous systems are deployed should give rise to limited risks from blast. Detection, control signal and power lines are all vulnerable to fire damage.

13/06/2003

FIREPROT.DOC

Page 14



Rev 0

8.

REFERENCES AND BIBLIOGRAPHY

8.1

References

1.

E&P Forum member

2.

Offshore reliability data: OREDA-92 OREDA participants, 2nd edition 1992 Distributed by DNV Technica, Høvik, Norway

3.

Guideline for process equipment reliability data American Institute of Chemical Engineers, New York 1989

4.

DJ Campbell et al Reliability analysis of underground fire water piping at the Paducah gaseous diffusion plant JBF Associates, Knoxville,Tennessee 1990

5.

Guide to the collection and presentation of electrical, electronic, sensing component, and mechanical equipment reliability data for nuclear power generating stations Institution of Electrical and Electronic Engineers, London 1983

6.

Cremer and Warner Ltd Risk analysis of six potentially hazardous industrial objects in the Rijnmond area a pilot study for the Covo steering committee D. Reidel Publishing, Dordrecht, Holland 1982

8.2

Bibliography

KW Blything The fire hazards and counter measures for the protection of pressurized LPG storage on industrial sites SRD R 263, July 1983 HF Martz On broadening failure rate distributions in PRA uncertainty analyses Risk Analysis, Vol. 4, No. 1, 1984 M Finucane and D Pinkney Reliability of fire protection and detection systems Proceedings of 2nd international conference on fire engineering and loss prevention in offshore petrochemical and other hazardous applications BHRA, Brighton, 1989 FP Lees Loss prevention in the process industries Butterworth, 1980

13/06/2003

FIREPROT.DOC

Page 15



Rev 0

HW Marriott Automatic sprinkler performance in Australia and New Zealand 1886-1968 Australian Fire Protection Association, 1971 An assessment of the reliability of automatic sprinkler systems UKAEA, Report SRS/ASG/1015, 1972 FS Ashmore The design and integrity of deluge systems Conference on contingency planning for the offshore industry IBC Technical Services, 1989

13/06/2003

FIREPROT.DOC

Page 16


13/06/2003


FIREPROT.DOC

Rev 0

Page 1

HF in the Determination of Event Outcomes


Rev 0

HUMAN FACTORS IN THE DETERMINATION OF EVENT OUTCOMES

13/06/2003

HFINDEO2.DOC

Page 1



Rev 0

TABLE OF CONTENTS

GLOSSARY OF TERMS & ABBREVIATIONS ------------------------------------------------- 3 1 INTRODUCTION-------------------------------------------------------------------------------------- 4 2 SCOPE -------------------------------------------------------------------------------------------------- 5 3 APPLICATION ---------------------------------------------------------------------------------------- 5 4 INCORPORATING HUMAN ACTIONS IN EVENT TREE MODELLING -------------- 6 Description------------------------------------------------------------------------------------------------------------------- 6 Data Sources----------------------------------------------------------------------------------------------------------------- 6 Availability of Data --------------------------------------------------------------------------------------------------------9 Strengths of the Method --------------------------------------------------------------------------------------------------9

5 SIMULATING HUMAN CONTRIBUTION TO EVENT MITIGATION ------------------- 9 Description ------------------------------------------------------------------------------------------------------------------9

6 EXAMPLE OF EVENT MITIGATION INCLUDING OPERATOR TASKS ----------- 10 Scenario -------------------------------------------------------------------------------------------------------------------- 10 Task Analysis ------------------------------------------------------------------------------------------------------------- 10 Human Errors ------------------------------------------------------------------------------------------------------------ 10 Time to perform tasks --------------------------------------------------------------------------------------------------- 11 Results ---------------------------------------------------------------------------------------------------------------------- 14


13/06/2003

HFINDEO2.DOC

Page 2



Rev 0

GLOSSARY OF TERMS & ABBREVIATIONS Term

Abbreviation

Definition

Absolute Probability Judgement Error Factor

APJ

A method for estimating Human Error Probabilities.

EF

Event Tree Analysis

ETA

Fault Tree Analysis

FTA

Human Error Assessment and Reduction Technique Human Error Probability

HEART

The nominal Human Error Probability (HEP) is multiplied or divided by the error factor to determine the upper or lower bounds respectively of the HEP. An analysis technique used to evaluate and model the development of an accidental event and determine the relative likelihood of the possible outcomes. A technique to determine the frequency of an accidental event by organising the logical relationship between contributing causes and contingent conditions. A human reliability analysis technique.

Human Reliability Analysis Monte Carlo Analysis

HRA

Performance Shaping Factor Quantified Risk Assessment Task Analysis

PSF

13/06/2003

HEP

-

QRA -

The nominal probability of a person making an error when performing a task. It is normally on a per opportunity basis. The HEP range is from 10-5 per opportunity to 1 per opportunity. For a given task there can be different error modes, each with a nominal HEP. The HEP is dependent on the characteristics of the task and the attributes of the person (e.g. trained or untrained). Human reliability techniques are used to estimate a HEP. A generic term covering all techniques which are used to assess the human component of a system. A time based method of modelling system behaviour. A factor which can influence human performance and human error probability. A series of techniques used to analyse and assess the activities performed by people within a system.

HFINDEO2.DOC

Page 3


1.


Rev 0

INTRODUCTION

The purpose of this datasheet is to describe Human Factors methods and associated sources of data which are available for incorporation into quantified risk assessment (QRA). The scope of this datasheet relates to determining event outcome probabilities. Other datasheets within the directory address methods and data related to other aspects of Human Factors in QRA, these being: -

Human Factors in the calculation of loss of containment frequencies (Event Data) Human Factors in determining fatalities during escape and sheltering (Vulnerability) Human Factors in determining fatalities during evacuation and rescue (Vulnerability)

The figure below indicates how the datasheets integrate into the overall framework for risk analysis. Figure 1: Overall Framework for Integration of Human Factors into QRA Platform data


HAZID study


Frequency analysis




Risk summation


Criteria

In each of the four datasheets the scope and application of approaches to human factors which have been used in practice to support the safe design and operation of installations are described. Selected examples are provided to enable the analyst to follow through approaches in detail. Considerations, like the strengths and weaknesses of an approach, its maturity, and references to information sources are given where appropriate. Taken together, the four datasheets are not intended to be a definitive guide to or manual on Human Factors methods, nor to provide all possible sources of data. They should be used to gain an understanding of the important components of carrying out assessments and an appreciation of the approaches to incorporating Human Factors into quantified risk assessment.

13/06/2003

HFINDEO2.DOC

Page 4


2.


Rev 0

SCOPE

Event outcome modelling is normally concerned with mitigation and escalation of an initiating event. The outcome of events can be dependent on operator intervention, either because the operator is required to perform a primary role, or because the operator must rectify failures of automatic systems, e.g. if an automatic system fails or an operator is aware of the event prior to automatic detection. In outcome modelling of release related scenarios, the kinds of issues of concern are: • • •

whether and how quickly a release is isolated; whether a release is ignited or not; whether the impact of the release is minimised.

The type of events are not limited only to process hydrocarbon releases, but can include events such as rupture of a buoyancy tank, where the mitigation could involve ballasting actions. The methods described are predominantly concerned with control room activities (e.g. interpreting alarms, activating systems) rather than manual process interventions (e.g. operating valves). Since emergency situations tend to be unfamiliar to operators, requiring infrequently rehearsed actions to be performed as quickly as possible, operator reliability, typically, is less than in normal conditions. However, the superior ability of operators to adapt to unpredictable circumstances can result in them being given a key role in formulating and instigating emergency response. This section gives guidance on how to take account of an operator’s role within a quantified analysis.

3.

APPLICATION

Two approaches are presented in this part of the document. The first is concerned with standard event tree modelling of event escalation for which the factors to be taken into account in estimating the probabilities of operator success/failure are presented. The approach to quantifying human error event tree branches closely resembles the quantification of human error base events in fault trees. The principle difference being the method of taking account of the performance shaping factors in emergency and non-emergency scenarios. In the second approach the dimension of time is considered. The issues of time to respond to an incident and time taken to perform actions are introduced. Many human tasks are not characterised by simple success or failure criteria. Instead, they are characterised by varying time requirements for success. Hence, the majority of errors which may be made in the implementation of emergency procedures can be recovered given sufficient time, and so the critical question is when will certain actions be carried out (rather than will they be carried out). This approach is suitable for scenarios where the severity of consequence is sensitive to the elapsed time and a more detailed assessment is needed to determine the likelihood of different outcomes.

13/06/2003

HFINDEO2.DOC

Page 5



4.

INCORPORATING HUMAN ACTIONS IN EVENT TREE MODELLING

4.1

Description

Rev 0

Three general types of human actions are of relevance to event tree modelling: • • •

Human detection and recognition of the incident Operator activation of an emergency system (e.g. manual activation of blow-out preventer, manual activation of process shut down system) Operator application of a specific procedure (e.g. move installation using anchor winches)

Success in the first of these - the detection and recognition of the incident - is crucial to the effectiveness of operator involvement. Therefore it is beneficial for the modelling of event mitigation to treat this as a distinct step in the sequence. Figure 2 shows the generic Human Factors branches of an escalation event tree. Figure 2: An Event Tree with the Generic Human Factors Branches

Operator DETECTS the incident

Operator Initiates response action Yes

Yes No No

The performance shaping factors of particular concern in quantifying the likelihood of operator success or failure during event mitigation are: • • •

4.2

reliability of an operator recognising an emergency situation (clarity of the alerting signal and subsequent information) familiarity with the task increased stress due to perceived threat

Data Sources

The method of quantifying the probability of failure of event mitigation tasks is almost identical to the first method presented in the data sheet on Human Factors in the Calculation of Loss of Containment Frequencies (i.e. characterise the type of each task and apply modifiers as appropriate). Modifiers for the key performance shaping factors are suggested as follows:

13/06/2003

HFINDEO2.DOC

Page 6



Rev 0

Modifier for clarity of warning signal If the signal is clear, highly attention gaining, and very difficult to confuse with any other type of signal (including a false alarm) and the required action by an operator is do nothing more than acknowledge it, the likelihood of an operator error is small (in the region of 10-4 to 10-5 per demand). Increasing the complexity of warning signals, therefore requiring the operator to interpret a pattern of signals, raises the likelihood of error. From the HEART technique (see data sheet Human Factors in Calculation of Loss of Containment Frequencies) the effect of a "low signal to noise ratio" (i.e. signal masked by competing signals, or of low strength in terms of perceptibility) can increase the likelihood of misdiagnosis by up to a factor of 10. An additional performance shaping factor of concern is the false alarm frequency. Data on human behaviour in fires in buildings shows that 80% - 90% of people assume a fire alarm to be false in the first instance (see data sheet - Human Factors in Estimating Fatalities during Escape and Sheltering). Importantly, these data do not show that emergency procedures are not followed, rather they indicate that there is likely to be a delay in emergency response, most probably due to confirmation being sought. This aspect of emergency response is difficult to take account of within event tree modelling. If an event tree is constructed with multiple detection branches (e.g. immediate human detection, short delay human detection, long delay human detection) the relative weightings of the branches could and should take account of the false alarm rate. Data showing the effect of different false alarm rates is not available, requiring judgements to be made by the analyst. Modifiers for operator familiarity with the task and increased stress due to perceived threat Due to the low probability of emergency events operators can have little familiarity with the tasks that they have to perform. This results in increased likelihood of error. Stress also increases the likelihood of error. A table of modifiers is provided in Table 1 below [1]. In selecting an error probability, account can be taken of the type and quality of training of operators. For example, sufficiently frequent and realistic simulation of emergencies should increase the familiarity of operators with such situations and thereby reduce error rates. However, a definitive relationship between error rate in an actual incident and either frequency or quality of simulation training cannot be provided.

13/06/2003

HFINDEO2.DOC

Page 7


Table 1


Rev 0

Modifications of estimated human error probabilities (HEPs) for the effects of stress and experience levels. [1]

Stress Level

Modifiers (Multipliers) of Nominal HEPs Skilled

Novice

2

2

Step-by-step task†

1

1

Dynamic task†

1

2

Step-by-step task†

2

4

Dynamic task†

5

10

5

10

Very low (Very low task load) Optimum (Optimum task load):

Moderately high (Heavy task load):

Extremely High (Threat stress): Step-by-step task† Diagnosis task

Error probability = Error probability = 0.5 0.25 (EF = 5) (EF = 5) † Step-by-step tasks are routine procedural tasks. Dynamic tasks involve a higher degree of man-machine interaction such as monitoring and controlling several functions simultaneously. For comparison, the HEART techniques [2] suggests a factor of 17 as the maximum increase in error likelihood due to "unfamiliarity with a situation which is potentially important but which only occurs infrequently or which is novel". Where an operator is to perform a number of tasks as part of a predefined procedure the analyst must decide whether to apply the modifier to some or all of the errors which may be made in following the procedure. It can be argued that the modifier should be applied once (i.e. to the procedure as a whole) rather than to each error, since the tasks are inherently linked by the procedure rather than being independent actions. Table 2 provides error probabilities for critical steps in procedure based response by a control room team [1].

13/06/2003

HFINDEO2.DOC

Page 8


Table 2


Rev 0

Estimated human error probabilities (HEPs) for rule-based actions by control room personnel after diagnosis of an abnormal event†.[1]

Potential Errors

Human error probability Failure to perform rule-based actions correctly when written procedures are available and used:

Error factor

Errors per critical step with recovery factors‡

0.05

10

Errors per critical step without recovery factors‡

0.25

10

Failure to perform rule-based actions correctly when written procedures are not available or used: Errors per critical step with or without recovery factors

1.0

-

† this model pertains to the control room crew rather to one individual ‡ “recovery factors” relates to the ability to reverse the error so as to avoid its consequences 4.3

Availability of Data

In comparison to the databases of human error probabilities which have been produced for normal operational tasks (see data sheet on HF in Loss of Containment) there is less specific data for incident response activities. However, the approach described in the data sheet on HF in Loss of Containment (namely the APJ method with modification using performance shaping factors) can be used. 4.4

Strengths of the Method

A strength of the method is the distinction between detection and action. In human factors terms these two can be affected by different design and operational factors. Separating the two activities within the analysis gives an opportunity to reflect the perceived quality of the relevant factors, e.g. for the detection failure rate to take account of the false alarm history of the installation, or the action failure rate to reflect the emergency training given to the operators.

5.

SIMULATING HUMAN CONTRIBUTION TO EVENT MITIGATION

5.1

Description

Due to the possible relationship between severity of consequence and elapsed time, a more thorough investigation of the time taken to perform mitigation activities may be needed in order to determine the distribution of probability of successful mitigation against time. A model of the incident response activities is required with an estimate of the time to undertake each task successfully and the probability of so doing. In addition, how an operator can recover from errors or equipment failures is required, with estimates of the probability of recovering and the time required. Using the model a distribution for the total elapsed time from the start of the incident to mitigation can be calculated.

13/06/2003

HFINDEO2.DOC

Page 9


6.


Rev 0

EXAMPLE OF EVENT MITIGATION INCLUDING OPERATOR TASKS

This example demonstrates the method of analysing the human involvement in event mitigation. The data in this example and the results should not be transferred to other situations as case by case evaluation is required. 6.1

Scenario

A mobile installation is anchored in position with the ability to manoeuvre using winches. In the event of a sub-sea gas release the procedure is to use the winches to move the installation to a safe distance from gas plume. The consequence analysis will have calculated, for a number of release scenarios, the probability that the installation will need to move off station and the time available to do so. Therefore, to complete the analysis it is necessary to estimate the time taken to move the installation a safe distance. 6.2

Task Analysis

An analysis of the tasks would be performed to identify the key human tasks. For this event the key tasks are assumed to be: 6.3

recognise the event ensure sufficient power is available to operate the winches (it is assumed that sufficient power is not available initially) determine the direction to move the installation operate the winches so as to slacken and reel in opposing winches Human Errors

In conjunction with the task analysis the key human errors would be identified. For this example the following task errors are taken to be the dominant failures and corresponding probabilities per operation are shown (Table 3).

13/06/2003

HFINDEO2.DOC

Page 10



Rev 0

Table 3: Significant Human Errors Task

Error mode

Ensure that sufficient power is available to operate the winches

Omit to request power and attempt to operate winches

Determine the direction to move the installation Operate the winches so as to slacken and reel in opposing winches 6.4

Type of error Omission error (HEP = 0.01)

Modifiers

Significant error in selection of direction to move the installation

-

High threat, diagnosis task, novice staff, HEP = 0.5

0.5

Incorrect combination of winches selected

Commission error (HEP = 0.001)

High threat, Step-bystep task, novice staff x10

0.01

High threat, Step-bystep task, novice staff x10, No diversity of information input for voracity checks x 2.5

HEP/ operation 0.25

Time to perform tasks

The time taken to perform the key tasks is required to be known and the time to recover from the errors is also needed. The times for each task are presented in Table 4. Table 4: Time taken per task Task

Time taken

Recognise the incident

70 seconds

Request sufficient power to be available to operate the winches

10 seconds

Determine the direction to move the installation

20 seconds

Operate the winches so as to slacken and reel in opposing winches

30 seconds

Recognise the failure to request sufficient power

30 seconds

Recognise that the wrong direction has been selected

120 seconds

Recognise that the winches have been operated in the wrong combination

80 seconds

To advance the analysis a further stage the above point estimates of time would be replaced with time distributions, based on the best and worst times to complete each task. This kind of data could be estimated by operators or through observations of simulated incidents. Using the above information a simulation model can be developed, a schematic of which is presented in Figure 3.

13/06/2003

HFINDEO2.DOC

Page 11


6.5


Rev 0

Additional information

Estimates of the following are needed to compute the results: • •

Time taken for power to reach sufficient level to operate winches (assumed to be 45 seconds) Time taken for winches to move the installation to the safest position (assumed to be 200 seconds if no errors are made, 240 seconds if the winches were initially operated incorrectly, 300 seconds if the wrong direction was chosen initially)

13/06/2003

HFINDEO2.DOC

Page 12


Figure 3:


Rev 0

Schematic of Simulation Model

Event Begins

Recognize event

Omit to request sufficient power

Recognize need to request sufficient power

(p=0.75)

(p=0.25)

(30 secs)

Recognise error in direction

(120 secs)

Installation moves to position

(10 secs)

(45 secs)

Select correct direction to move

(p = 0.5)

Operate winches

Operate winches

Request sufficient power

(30 secs)

Power-up

Select incorrest direction to (p = 0.5) move

(70secs)

(30 secs)

(300 secs)

Select incorrect combination of (p=0.01 winches

p=0.99)

Select correct combination of winches

Operate winches

(30 secs)

Operate winches

Recognise error in operating winches

(80 secs)

Installation moves to position

Operate winches Installation moves to position

(30 secs)

(200 secs)

(30 secs)

(240 secs)

Event Ends

13/06/2003

HFINDEO2.DOC

Page 13


6.6


Rev 0

Results

The distribution of times to move the installation can be calculated using the above model by summing the task times along each path in accordance with the branch probabilities The results, presented in Table 5, indicate that the time taken falls into two bands - one band below 600 seconds, and the other at more than 800 seconds. Table 5: Results of the Simulation Example Time to move installation to safest position

Cumulative probability

575 seconds

0.371

595 seconds

0.495

765 seconds

0.499

785 seconds

0.500

865 seconds

0.875

885 seconds

1

Therefore, for a scenario in which the installation has 750 seconds to move to safety, the probability of it doing so would be taken to be assigned 0.495 (without interpolation of the results).

7.

ONGOING RESEARCH

A number of lines of research are being pursued to investigate the human role in event mitigation including the methods to improve decision making in emergencies and the key characteristics of offshore personnel, particularly the Offshore Installation Manager. Development of QRA support tools is ongoing, with a general objective to improve the modelling of event detection, including operator detection, and response reliability.

8.

REFERENCES

[1] Swain, A.D. and Guttmann, H.E., A Handbook of Human Reliability Analyses with Emphasis on Nuclear Power Plant Applications, NUREG/CR-1298, Nuclear Regulatory Commission, Washington DC 20555, 1983. [2] Williams, J.C., (1988) A data-based method for assessing and reducing human error to improve operational experience, In Proceedings of IEEE 4th Conference on Human Factors in Power Plants, Monterey, Calif., 6-9 June 1988.

13/06/2003

HFINDEO2.DOC

Page 14


13/06/2003


HFINDEO2.DOC

Rev 0

Page 15

Vulnerability of Humans


VULNERABILITY OF HUMANS

13/06/2003 VULNHUM.DOC

Page 1

Rev 0



Rev 0

TABLE OF CONTENTS

1. SUMMARY------------------------------------------------------------------------------------------------ 3 2. KEY DATA ------------------------------------------------------------------------------------------------ 4 Heat Radiation ------------------------------------------------------------------------------------------------------------------4 Overpressure---------------------------------------------------------------------------------------------------------------------6 Carbon Dioxide------------------------------------------------------------------------------------------------------------------7 Hydrogen Sulfide ---------------------------------------------------------------------------------------------------------------8 Protective Clothing for Human Survival in the North Sea--------------------------------------------------------- 11 Cause of Death in Survivable Helicopter Accidents------------------------------------------------------------------ 11 Probit Models------------------------------------------------------------------------------------------------------------------ 12

3. ONGOING RESEARCH ---------------------------------------------------------------------------- 16 REFERENCES-------------------------------------------------------------------------------------------- 17


Page 2


1.


Rev 0

SUMMARY

This data sheet gives information regarding conditions at which humans might be adversely impacted by the following: • • • •

Heat Radiation Blast Overpressure Increased concentrations of Carbon Dioxide Increased concentrations of Hydrogen Sulfide

The information includes the effect of heat radiation based on thermal radiation intensity and exposure time, effects of overpressure as a result of a vapor cloud explosion, and toxicity data for carbon dioxide and hydrogen sulfide. This data sheet also provides information pertaining to protective clothing in relation to offshore search and rescue operations and the cause of death in survivable helicopter accidents. Finally, probit models are provided as one method to estimate the severity of personnel injuries in some of the above mentioned events. The following are common abbreviations used to describe toxic or hazardous exposure: ACGIH NIOSH OSHA REL TLV TWA

PEL Pk hmn ihl mam pph/min ppm/min

American Conference of Governmental Industrial Hygienists National Institute for Occupational Safety and Health Occupational Safety and Health Administration Recommended Exposure Limit Threshold Limit Value Time-weighted Average concentration for a normal 8-hour workday and 40 hour workweek to which nearly all workers may be repeatedly exposed, day after day, without adverse effect Short Term Exposure Limit is the maximum concentration to which workers can be exposed for a period of up to 15 min continuously and which should not be repeated more than 4 times per day with at least 60 mins between successive exposures Ceiling is the concentration which should not be exceeded even instantaneously Lethal Concentration Low - lowest concentration of material reported to have caused death in humans Lethal Concentration - concentration of airborne material the inhalation of which results in death of 50% of the test group Immediately Dangerous to Life and Health is the maximum concentration from which one could escape within 30 min. without any escape-imparing symptoms or any irreversible effect Permissible Exposure Limit Peak Human Inhalation mammal Concentration in parts per hundred/minute of exposure Concentration in parts per million/minute of exposure

ERPG TLV REL EEGL CEGL

Emergency Response Planning Guidelines Threshold Limit Value Recommended Exposure Limit Emergency Exposure Guideline Level Continuous Exposure Guideline Level

STEL C LCLo LCL50 IDLH


Page 3


2.


Rev 0

KEY DATA

Heat Radiation The data found in Tables 1 and 2 come from two references. Reference [1], API RP 521, provides guidelines for examining the principle causes of overpressure; determining individual relieving rates; and selecting and designing disposal systems, including component parts such as vessels, flares, and vent stacks. Reference [2], by Federal Emergency Management Agency, provides information for explosive, flammable, reactive and otherwise dangerous chemicals. The handbook provides methodologies for assessing the impact of hazardous material releases and addresses hazard analysis. The information reported from FEMA is a compilation of data from various studies. Table 1 presents recommended permissible design levels for flare heat radiation conditional upon the anticipated operational activities and exposure levels. Tables 2 lists some of the effects of thermal radiation on bare skin as a function of exposure level and time. The apparrent differences between the tables can be accounted for by the intended application for the information. Table 1 is intended to assist in the design of operational facilities, whereas Table 2 is a mechanistic determination of the unmitigated effects of thermal radiation. Table 1: Thermal Radiation Exposure to Flares [1] [2] Permissible Design Level Btu/hr-ft2 kW/m2 5000 15.8 3000

9.5

2000

6.3

1500

4.7

500

1.6


Conditions On structures and in areas where operators are not likely to be performing duties and where shelter from radiant heat is available. At any location to which people have access. Exposure to personnel is limited to a few seconds, sufficient for escape only Where emergency actions lasting up to 1 minute may be required by personnel without shielding but with appropriate clothing Where emergency actions lasting several minutes may be required by personnel without shielding but with appropriate clothing At any location where personnel are continuously exposed.

Page 4



Rev 0

Table 2: Pain Threshold and Second Degree Burns [2] Time to Pain Threshold 1

Radiation Heat Flux

Btu/hr-ft2 300 600 1000 1300 1600 1900 2500 3200 3800

kW/m2 1 2 3 4 5 6 8 10 12

Sec

Time for Second-Degree Burns Sec

115 45 27 18 13 11 7 5 4

663 187 92 57 40 30 20 14 11

Note 1: Burns occur relatively quickly once the pain threshold is achieved. Factors involving reaction time and human mobility are not considered. For emergency releases, a reaction time of 3-5 seconds may be assumed. Perhaps 5 seconds more would elapse before the average individual could seek cover or depart from the area, which would result in a total exposure period ranging from 8 to 10 seconds. [1] As a basis of comparison, the intensity of solar radiation is in the range of 250 to 330 Btu per hour per square foot (0.79 to 1.04 kilowatts per square meter). Solar radiation may be a factor for some locations, but its effect added to flare radiation will generally have a minor impact on the tolerable exposure time. [1] Another factor to be considered regarding thermal radiation levels is that clothing provides shielding, allowing only a small part of the body to be exposed to full intensity. The extent and use of personal protective equipment may be considered as a practical way of extending the times of exposure beyond those listed, and accounts for some of the differences between tables 1 & 2. [2]


Page 5



Rev 0

Overpressure The data found in Table 3 comes from two references. Reference [2], by Federal Emergency Management Agency, provides information for explosive, flammable, reactive and otherwise dangerous chemicals. The handbook provides methodologies for assessing the impact of hazardous material releases and addresses hazard analysis. The information reported from Federal Emergency Management Agency is a compilation of data from various studies. Reference [4], by Lees, is a commonly used resource for assessing exposures thresholds in the process industries. Table 3: Personnel Injury Data for Explosion Effects [2] [4] Overpressure(a) mbar psi 70 1 70-560 1-8 168-854

2.4-12.2

1085-2030

15.5-29

Physiological Effect Knocks personnel down Range for slight to serious injuries due to skin lacerations from flying glass and other missiles Range for 1-90% eardrum rupture among exposed populations Range for 1-99% fatalities among exposed populations due to overpressure

Notes: (a) These are peak overpressures in excess of normal atmospheric pressure by blast and shock waves

Table 3 presents the injury data for direct and indirect blast effects. A large explosion can cause injury mostly through the following effects: heat radiation, blast and combustion products. The effects of heat radiation are addressed elsewhere in this data sheet. Injury from blast includes (1) direct blast injury and (2) indirect blast injury. The effect of blast overpressure depends on the peak overpressure, the rate of rise and the duration of the positive phase. The damaging effect of a given peak overpressure is greater if the rise is rapid. Damage also increases with duration up to a value of several hundred milliseconds after which the effect levels off. Besides personal injuries and property damage caused by direct exposure to peak overpressures, the blast or shock wave also has the potential to cause indirect impacts. The secondary effects of explosions include: [2] • •

Fatalities or injuries due to missiles, fragments, and environmental debris set in motion by the explosion or by the heat generated. Fatalities or injuries due to forcible movement of exposed people and their subsequent impact with ground surfaces, walls, or other stationary objects.


Page 6



Rev 0

Carbon Dioxide Gaseous carbon dioxide is an odorless, colorless, non-combustible gas that is also an asphyxiant. The greatest physiological effect of carbon dioxide is to stimulate the respiratory centre. It is able to cause dilation and constriction of blood vessels. Carbon dioxide acts as both a stimulant and depressant on the central nervous system. Increases in heart rate and blood pressure have been noted at 7.6% (i.e., 76,000 ppm concentration), and dyspnea (labored breathing), headache, dizziness, and sweating may occur if exposure at that level is prolonged. At 10% concentration and above, unconsciousness may result in one minute or less. Impairment in performance has been noted during prolonged exposure to 3% carbon dioxide even when the oxygen concentration was normal (21%). [5] The data found in Table 4 comes from three references. Reference [5], by Sax, provides hazard information for industrial materials. The reference provides clinical toxicological data, NIOSH numbers, and standards and regulations for substances regulated by an agency of the United States Government. Reference [6[, by the Compressed Gas Association, Inc., presents general information regarding the characteristics of carbon dioxide and its safe handling. The material is intended for shippers, carriers, distributors, consumers, equipment designers, or installers desiring introductory knowledge of the subject. Reference [7], the Chemical Hazards Response Information System (CHRIS), is designed to provide information needed by Coast Guard personnel during emergencies that occur during the water transport of hazardous chemicals. The chemical substances addressed in Reference [5] are assumed to exhibit the reported toxic effect in their pure state unless otherwise noted. However, even in the case of a supposedly "pure" substance, there is usually some degree of uncertainty as to its exact composition and the impurities that may be present. Generally, the data reported in the references are not from actual measurements on humans but generated from accident statistics or animal data. Therefore, the toxic effects reported could in some cases be caused by a contaminant. Reference [6] is an introductory source only and is an older source of data. Reference [7] addresses, in brief, information about chemicals for emergency response purposes. Detailed information is not addressed here. Table 4: Carbon Dioxide Exposure Limits [5] [6] [7] Lethal Concentration Low OSHA Permissible Exposure Limit ACGIH Threshold Limit Value NIOSH Recommended Exposure Limit Short-Term Inhalation Limits Immediately Dangerous to Life and Health


Page 7

9 pph/5 min, 10 pph/1 min Time-weighted Average (TWA) 5,000 ppm TWA 5,000 ppm; STEL 30,000 ppm TWA 10,000 ppm; C 30,000 ppm/10 min 30,000 ppm for 60 min. 50,000 ppm



Rev 0

Hydrogen Sulfide Hydrogen sulfide is a colorless gas that is a poison by inhalation and as an asphyxiant. It is a severe irritant to the eyes and mucous membranes. The symptoms depend on concentrations, exposure time, and individual variations. The human systemic effects by inhalation may include coma and chronic pulmonary edema. Low concentrations of 20 to 150 ppm may cause irritation of the eyes; slightly higher concentrations may cause irritation of the upper respiratory tract, and if exposure is prolonged, pulmonary edema may result. The irritant action has been explained on the basis that H2S combines with the alkali present in moist surface tissues to form sodium sulfide, a caustic. With higher concentrations, the action of the gas on the nervous system becomes more prominent. A 30-minute exposure to 500 ppm may result in headache, dizziness, excitement, staggering gait, diarrhea and dysuria, followed sometimes by bronchitis or bronchopneumonia. (Ref. 5, 8) The data summarized in Tables 5-8 come from five references. Reference 4, by Lees, is a commonly used resource for assessing exposures thresholds in the process industries. References 5 and 7 are discussed in the previous section on Carbon Dioxide. Reference 8, published by the National Fire Protection Association, is intended for those confronted with emergencies such as fires, accidental spills, and transportation accidents involving chemicals and is oriented to emergency preparedness information. It is oriented to emergency situations and information, particularly fire protection. Reference 9, by American Industrial Hygiene Association, is a publication containing emergency response guidelines.


Page 8



Rev 0

Table 5: Hydrogen Sulfide Exposure Limits (ppm, mg/m3) [5] [7] [8] Lethal Concentration Low Lethal Concentration that resulted in the death of 50% of the test group of rats Lethal Concentration that resulted in the death of 50% of the test group of mammals OSHA Permissible Exposure Limit ACGIH Threshold Limit Value NIOSH Recommended Exposure Limit Short-Term Inhalation Limits: Odour Threshold: Immediately Dangerous to Life and Health Value:

600 ppm/30 min 444 ppm 800 ppm/5 min C 20 ppm; Pk 50 ppm/10 min TWA 10 ppm; STEL 15 ppm C 15 ppm/10 min 200 ppm for 10 min.; 100 ppm for 30 min.; and 50 ppm for 60 min. 0.0047 ppm 300 ppm

Table 6: Effects of Hydrogen Sulfide on Humans [4] Effect Threshold Limit Value - Time Weighted Average Threshold Limit Value - Short Term Exposure Limit Concentration causing slight symptoms after exposure of several hours Maximum concentration inhalable for 1 hour without serious effects Concentration dangerous for exposure of 1/2 to 1 hours

Concentration, ppm 10 15 70-150 170-300 400-700

Table 7: Toxicity of Hydrogen Sulphide by Inhalation in Humans [9] Estimated Concentration (ppm) 1000-2000

Exposure Duration < 20 min

1000

< 25 min

230

20 min

200-300 10-50 10-40

1 hr 1 hr 4 - 7 hr


Effects on Humans Of 340 exposed, 320 hospitalized, 22 died, 4 had residual nerve damage Unconsciousness, low blood pressure, pulmonary edema, convulsions, and hematuria Unconsciousness, arm cramps, low blood pressure in one person Marked conjunctivitis and respiratory tract irritation Mild conjunctivitis and respiratory tract irritation Conjunctivitis (an analysis of 6500 cases)

Page 9



Rev 0

Table 8: Exposure Guidelines of Hydrogen Sulfide by Regulatory Bodies [9] Regulatory Body American Industrial Hygiene Association (AIHA)

Limit ERPG-1(a) : 0.1 ppm

TLV(b) : 10 ppm STEL(c) : 15 ppm

Discussion The maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to one hour without experiencing other than mild, transient adverse health effects or without perceiving a clearly defined objectionable odor. The maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to one hour without experiencing or developing irreversible or other serious health effects or symptoms which could impair an individual’s ability to take protective action. The maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to one hour without experiencing or developing lifethreatening health effects. For an 8-hr time-weighted average (TWA) For a 15-min short-term exposure limit.

PEL(d) : 10 ppm STEL(c) : 15 ppm

Permissible exposure limit for an 8-hr TWA For a 15-min short-term exposure limit.

ERPG-2(a) : 30 ppm

ERPG-3(a) : 100 ppm

American Conference of Governmental Industrial Hygienists (ACGIH) Occupational Safety and Health Administration (OSHA) National Institute for Occupational Safety and Health (NIOSH) National Academy of Sciences / National Council (NAS/NRC)

REL(e) : 10 ppm Evacuation Limit : 50 ppm EEGL(f)-10min : 50 ppm EEGL(f)-24hr : 10 ppm CEGL(g) : 1 ppm

Recommended exposure limit for a 10-min ceiling Limit at which evacuation is required. Recommended emergency exposure limit for 10 min. Recommended emergency exposure limit for 24 hr. Recommended emergency exposure limit for 24 hr/day, 90 day continuous exposure

The action of small amounts of hydrogen sulfide on the nervous system is one of depression; in larger amounts, it stimulates; and with very high amounts the respiratory center may be paralyzed. Exposures of 800 to 1000 ppm may be fatal in 30 minutes, and high concentrations can be instantly fatal. H2S does not combine with the hemoglobin of the blood; its asphyxiant action is due to paralysis of the respiratory center. With repeated exposures to low concentration, conjunctivitis, photophobia, corneal bullae, tearing, pain, and blurred vision are the most common finding. High concentration may cause rhinitis, bronchitis, and occasionally pulmonary edema. Chronic poisoning may result in headache, inflammation of the conjunctivae and eyelids, digestive disturbances, weight loss, and general debility. [5] Hydrogen sulfide is an insidious poison because sense of smell may be fatigued. The odor and irritating effects do not offer a dependable warning to workers who may be exposed to gradually increasing amounts and therefore become used to it. The sense of smell may be immediately lost at concentrations of greater than 200 ppm. [5] [8] Hydrogen sulfide is a fire hazard when exposed to heat, flame, or oxidizers. It is moderately explosive when exposed to heat or flame. [5]


Page 10



Rev 0

Protective Clothing for Human Survival in the North Sea Table 9 provides information pertaining to protective clothing for human survival in the North Sea as relates to search and rescue operations. The information was obtained from [10]. Table 9: Recommended Protective Clothing as Relates to Search and Rescue (SAR) Operations in the North Sea [10]

Max SAR Time 2-6 hr 1-2 hr <1 hr

-2 Note 1 Note 1 Note 1

Water Temperature Range (oC) 0-5 6-15 Note 1 S S S S J

16-20 J J O

21-25 J* O O

Note 1: Specialist advice needed for each case S J J* O

Immersion suit over warmest tolerable clothing Immersion jacket over warm clothing Immersion jacket over normal work clothing Normal work clothing only

The data in Table 9 also gives an idea of how long an individual can survive in the North Sea after helicopter ditching.

Cause of Death in Survivable Helicopter Accidents Table 10 gives estimates for the causes of death following helicopter “hard ditching”. The data were obtained from [10]. The reference also indicates that a broken wrist reduces the chance of survival in water by 75% and that drowning appears less significant as a cause of death. Table 10: Causes of Death in Survivable Helicopter Accidents [10] (See also datasheet XX, Air Transport (aircraft & helicopters)) Cause Burns and complications Multiple extremity trauma Head injuries Haemorrhage Heart trauma Haemopneumothorax Chemical pneumonia Drowning

% of Fatalities 30 18 15 9 9 8 8 3

Reference [10] also indicates an order of undesirability for upsets during helicopter evacuation, which is: 1) Injury, 2) Disorderly evacuation, 3) Underwater disorientation, and 4) Exposure.


Page 11



Rev 0

Probit Models Tables 12-18 present probit models for estimating the severity of personal injuries. Table 11 describes the relationship between probit values and probability. The probit method is a statistical method of assessing consequence. The probit (probability unit) method described by Finney (1971) reflects a generalized time-dependent relationship for any variable that has a probabilistic outcome that can be defined by a normal distribution. The probit method accounts for the idea that the consequence may not take the form of discrete functions but may instead conform to probability distribution functions. For example, Eisenberg et al (1975) use this method to assess toxic effects by establishing a statistical correlation between a ‘damage load’ (i.e., toxic dose that represents a concentration per unit time) and the percentage of people affected to a specific degree. The probit method can be applied to thermal and explosion effects as well as toxic effects. [12] Table 11: Probit Analysis [3] The probit value Pr is related to a probability by the following equation: 2 Pr 5 u 1 2 Pr obability = 1/ 2 e du (2 ) Pr is a Gaussian-distributed, random variable with a mean value of 5.0 and a standard deviation of 1.0 The following table gives the relationship between Pr and % (i.e., probability) % +0% +2% +4% +6% +8% 0

-

2.95

3.25

3.45

3.59

10

3.72

3.82*

3.92

4.01

4.08

20

4.16

4.23

4.29

4.36

4.42

30

4.48

4.53

4.59

4.64

4.69

40

4.75

4.80

4.85

4.90

4.95

50

5.00

5.05

5.10

5.15

5.20

60

5.25

5.31

5.36

5.41

5.47

70

5.52

5.58

5.64

5.71

5.77

80

5.84

5.92

5.99

6.08

6.18

90

6.28

6.41

6.55

6.75

7.05

99**

7.33

7.41

7.51

7.65

7.88

* For Pr = 3.82, % = 12% (or probability = 0.12) ** Values in the last row are for 99.0, 99.2, 99.4, 99.6, and 99.8%. The data summarized in Tables 12-18 come from two references. Reference [3], the TNO Green Book, presents damage to people and objects due to release of dangerous substances. Reference [12], the Vulnerability Model, is a computerized simulation system for assessing damage that results from marine spills of hazardous materials. In Table 12, TNO [3] presents probit models for estimating effects on personnel from exposure to pool and flash fires. 13/06/2003 VULNHUM.DOC

Page 12



Rev 0

Table 12: Probit Models for Estimating Effect on Personnel from Exposure to Pool and Flash Fires [3] Pr = -39.83 + 3.0186 loge( t e I th4/3 ) Pr = -43.13 + 3.0186 loge( t I

4/3 e th

Pr = -36.38 + 2.56 loge( t e I th4/3 )

)

, for first-degree burns , for second-degree burns , for burn fatalities I

Where: te = duration of exposure, (sec) Ith = thermal radiation intensity, (W/m2) Pr = probit value, (dimensionless)

The primary cause of lethality from direct blast effects is lung hemorrhage. Data on direct blast injury to personnel have been obtained by experimentally determining overpressure-duration relationships for animals, and extrapolating these to humans. The level of injury depends upon both peak overpressure level and the duration of the overpressure. For long-scale conventional explosions and most probably for all diffuse explosions, the duration of the blast wave may be considered "long." Eisenberg (1975) [12] uses the free field (side on) overpressure, associated with various levels of lethality at infinitely large durations to assess deaths from direct blast effects. The relationship between overpressure and lethality from direct blast effects was collected and used to derive the probit model, equation 1 of Table 13, probit models for personnel injury due to direct blast effects based on nuclear explosion data. [12] The main non-lethal injury resulting from direct blast effects is eardrum rupture. Unlike the lungs, for which overpressure and blast wave duration together determined damage, eardrums are damaged in response to overpressure alone because the characteristic period of the ear vibration is small compared to the duration of a blast wave from even low-yield explosions. The relationship between overpressure and eardrum rupture was collected and used to derive probit model, equation 2 of Table 13. [12] Table 13: Probit Models for Personnel Injury due to Direct Blast Effects [12] Pr = - 77 .1 + 6 .91 log

e

Ps

P r = - 1 5 .6 + 1 .9 3 l o g e P s

: for fatalities from lung hemorrhage : for ear drum ruptures

[1]

[2]

Where: Ps = peak overpressure, (N/m2)

Table 14 presents probit models for personnel injury due to direct blast effects. These effects were derived with the help of tests with animals and assuming the blast wave propagates undisturbed. [3]


Page 13



Rev 0

Table 14: Probit Models for Personnel Injury due to Direct Blast Effects [3] 4.2 1.3 + P I Pr = -12.6 +1.524 log e P s P Is P= and I = 1/2 1/3 9 Pa Pa mb Pr = 5.0 - 5.74 log e

, for fatalities from lung damage7 , for eardrum ruptures8

Where: P = actual pressure (N/m2) exerted on the body (dependent on the position of the person), Pa = atmospheric pressure, 1.013 × 105, (N/m2) Is = positive incident impulse, (N-sec/m2) mb = mass of human body, (kg)

Table 15 presents probit models for personnel injury due to indirect blast effects based on nuclear explosion data. The transfer of momentum by a blast wave to objects in its path can result in injury from secondary missiles (both penetrating and non-penetrating) or from displacement of the human body resulting in subsequent severe impact or decelerative tumbling; these are secondary and tertiary blast effects respectively. The injuries that may result include wounds, such as contusions and fractures, which result from being thrown against an object. In addition, crush injuries from falling debris, should they occur, would be particularly more common in populated areas and less common in the open. Certain kinds of indirect blast injuries, such as violent decelerations or sharp blows to the head from blunt debris, may produce lethality just as does direct blast injury to the lung. However, the magnitude and severity of indirect hazards are very much dependent on the conditions of exposure, range, and explosive yield. [12] [13] Table 15: Probit Models for Personnel Injury due to Indirect Blast Effects [12] Pr = -46.1+ 4.82 log e I s Pr = -39.1+ 4.45 log e I s Pr = -27.1+ 4.26 log e I s

, for fatalities from impact10 , for injuries from impact11 , for injuries from flying fragments12

Where: Is = impulse, (N-sec/m2)

Table 16 presents probit models for personnel fatalities due to indirect blast effects (Ps < 4 x 105 N/m2). In case of a collision due to a shock or pressure wave from an explosion, the skull is the most vulnerable part of the body. The probit models for a fatality due to impact of the head is given in equation A of Table 15. If the orientation of the person exposed is such that flow around him takes place, total body-impact by the explosion wind can occur. The probit model for a fatality due to collision of the body with a rigid obstacle is given in equation B of Table 16. [3] [13] Table 16: Probit Models for Personnel Injury due to Indirect Blast Effects [3] Pr = 5.0 -8.49 log e

2.43x 10 3 4 x 10 8 + Ps Ps Is

(A)

Pr = 5.0 - 2.44 log e

7.38 x 10 3 1.3x 10 9 + Ps Ps Is

(B)


Page 14



Rev 0

Table 17 presents probit models for personnel fatalities from flying fragments of mass mfrag and velocity vo. An explosion can give rise to fragments that are accelerated and that can be dangerous to people who are hit by them. These fragments can originate directly from the explosion source, but they can also come from objects in the surroundings of the explosion, when such objects are subjected to the blast wave. [3] [13] Table 17: Probit Models for Personnel Fatalities from Flying Fragments of mass mfrag and velocity vo [3] Pr = -13.19 +10.54 log e v o 1 Pr = -17.56 + 5.3 log e m frag v o2 2 Pr = -29.15+ 2.1log e ( m frag v5.115 ) o

, for 4.5 kg > mfrag , for 4.5 kg

mfrag > 0.1

, for 0.1 kg

mfrag > 0.001

Table 18 presents a probit model for estimating personnel injury resulting from exposure to H2S gas and SO2 gas [14]. This model involves first determining the toxic load which is subsequently related to the probit value. Table 18: Estimating Personnel Injury Resulting from Exposure to Toxic Material [11] te

Step 1:

First Calculate the Toxic Load

Toxic Load = [C(t )]n dt 0

C(t) = concentration of toxic material as a function of time t, (ppm) n = exponent that is a function of the specific toxic material, (dimensionless) te = total exposure time, (min) Step 2: For exposure to a constant concentration C(t) = C, the toxic load is given by the following: Toxic Load = Cnte Step 3: For exposure to a time-varying concentration, the toxic load can be approximated by the following: m

Toxic Load = i =1

Ci ntei

Ci = concentration of toxic material for exposure time tei , (ppm) tei = exposure time, (min) Step 4: The probit equation is often used to relate toxic loads to the probability of causing an effect among a population Pr = At + Bt loge [ Toxic Load ] Pr = probit, (dimensionless) At , Bt = coefficients associated with a specific toxic material, (ppm) The units for toxic load are ppmn - min For hydrogen sulfide, At = -31.42 Bt = 3.008 n = 1.43 13/06/2003 VULNHUM.DOC

For sulfur dioxide, At = -15.67 Bt = 2.10 n = 1.00

Page 15


3.


Rev 0

ONGOING RESEARCH

An E&P Forum member has initiated an effort to collate the current and relevant data on human vulnerability. The study intends to have leading consultants in the field search available sources for impairment and fatality thresholds for a variety of parameters. Such parameters will include: • • • • • • • • • • •

Blast Overpressure Heat Radiation Increased concentrations of Carbon Dioxide Increased concentrations of Carbon Monoxide Reduced concentrations of Oxygen Heat build-up (i.e., indoors as opposed to heat radiation such as within a temporary refuge) Hydrogen Sulfide Toxic Products of Combustion/Smoke Particles Hydrogen Fluoride Carbonyl Fluoride Phosgene

HSE / W.S. Atkins are currently undertaking additional research into the vulnerability of building occupants to explosion events.


Page 16



Rev 0

REFERENCES 1.

American Petroleum Institute (API), Guide for Pressure-Relieving and Depressuring Systems, Recommended Practice 521, Third Edition, API, Washington, D.C., November 1990. 2. Federal Emergency Management Agency, Handbook of Chemical Hazard Analysis Procedures, available from Federal Emergency Management Agency, Publications Office, 500 C Street, SW, Washington, D. C. 20472. 3. Methods for the Determination of Possible Damage to People and Objects Resulting From Releases of Hazardous Materials (TNO Green Book)," CPR 16E, The Netherlands Organization of Applied Scientific Research, Voorburg, December 1989. 4. F. P. Lees, Loss Prevention in the Process Industries, Volume 1, ISBN 0-0408010604-2, Butterworths, London and Boston, 1980. 5. N. Irving Sax and Richard J. Lewis, Sr., Dangerous Properties of Industrial Materials, Seventh Edition, 3 Volume, 1989, published by Van Nostrand Reinhold, New York, NY, ISBN 0-442-28020-3. 6. Carbon Dioxide, CGA G-6 - 1984, Compressed Gas Association, Inc., Fourth Edition, 1989. 7. CHRIS Hazardous Chemical Data, U.S. Department of Transportation, United States Coast Guard, Commandant Instruction M16465.12A. 8. Fire Protection Guide on Hazardous Materials, 10th Edition, page 49-101 NFPA, published by National Fire Protection Association, 1991. 9. Emergency Response Planning Guidelines, American Industrial Hygiene Association, November 1991. 10. E&P Forum Member Source. 11. Chemical Process Quantitative Risk Analysis, Center for Chemical Process Safety of the American Institute of Chemical Engineers, 1989. 12. N. A. Eisenberg, C.J. Lynch, and R. J. Breeding, Vulnerability Model - A Simulation System for Assessing Damage Resulting from Marine Spills, CG-D-136-75 (NTIS ADA-015-245), Prepared by Enviro Control, Inc., for the U.S. Coast Guard, Office of Research and Development, June 1975. 13. Hazard Evaluation Consequence Analysis Methods, training course, JBF Associates, Inc. 1994. 14. Guidelines for Chemical Process Quantitative Risk Analysis, ISBN 0-8169-0402-2, published by the Center for Chemical Process Safety of the American Institute of Chemical Engineers, 1989.


Page 17




Page 18

Rev 0

Vulnerability of Plant/Structures


Rev 0

VULNERABILITY OF PLANT/STRUCTURE

13/06/2003

VULNPLNT.DOC

Page 1



Rev 0

TABLE OF CONTENTS

1. SUMMARY -------------------------------------------------------------------------------------------- 3 1.1 Scope ---------------------------------------------------------------------------------------------------------------------3 1.2 Application--------------------------------------------------------------------------------------------------------------3

2. THERMAL RESPONSE OF STRUCTURES ------------------------------------------------- 4 2.1 Data ----------------------------------------------------------------------------------------------------------------------4 2.2 Discussion ---------------------------------------------------------------------------------------------------------------5

3. EXPLOSION RESPONSE OF STRUCTURES ---------------------------------------------- 6 3.1 Data ----------------------------------------------------------------------------------------------------------------------6 3.2 Effects Of Explosion Overpressure On Passive Fire Protection (PFP)-------------------------------------- 9 3.3 Discussion ---------------------------------------------------------------------------------------------------------------9

4. MISSILE LOADING ------------------------------------------------------------------------------- 10 4.1 Data -------------------------------------------------------------------------------------------------------------------- 10

5. ONGOING RESEARCH-------------------------------------------------------------------------- 12 6. REFERENCES ------------------------------------------------------------------------------------ 13

13/06/2003

VULNPLNT.DOC

Page 2


1.

SUMMARY

1.1

Scope


Rev 0

This data sheet provides information sources to assess the vulnerability of plant and structure exposed to fires, explosions and missiles generated by explosions. It addresses both loading and response aspects of the plant/structures. The vulnerability of safety critical systems such as Emergency Shutdown, Blowdown, Active fire Protection, Ventilation etc is not covered in the scope for this data sheet and reference should be made to the relevant data sheets within section 3 of this directory. The data sheets in this section are split-up to provide the following information: 2.0 3.0 4.0

Thermal Response of Structures Explosion Response of Structures/Plant Missile Loading

1.2

Application

The assessment of the vulnerability of plant and structure exposed to fires, explosions and missiles should be restricted to a specialist activity. The assessment should take into account the following aspects [1]: -

likely exposure of the plant, structure or equipment extent and intensity of the exposure duration of the exposure time to failure exposure of any critical elements which could cause an overall failure defined failure criteria of the plant or structure protection systems

13/06/2003

VULNPLNT.DOC

Page 3



2.

THERMAL RESPONSE OF STRUCTURES

2.1

Data

Rev 0

To predict structural response to fire loading, use may be made of fire tests in which the endurance of structural elements and sub-assembles are experimentally determined under a specific fire regime. The SOFIPP[ 2], British Gas [3] and Interim Jet Fire [4] tests have all made a valuable contribution in this area. Table 2.1 presents indicative failure times for steel members, firewalls and risers under hydrocarbon fire impact [5] conditions, where times to failure refer to burn through or loss of load-bearing capacity. The time to failure quoted are shown for illustrative purposes only. The risk analyst must determine the failure times on a case by case basis by modelling the thermal response for the appropriate fire conditions. To carry out this analysis the following information about the fire will have to be determined first: -

Type Size Severity Location

-

Duration

(hydrocarbon, jet, pool, spray and cellulosic) (diameter, flame length, spread, shape and volume) (emissive power, engulfment heat flux, remote heat flux levels) (the location and direction of the release, location and spread of pool fires, direction of flame spread, type of structure)

Table 2.1 - Steel Structures Indicative Failure Times [5] in Minutes (For Illustrative Purposes Only)

13/06/2003

VULNPLNT.DOC

Page 4



Structure

Rev 0

Jet Fire

Pool Fire

Unprotected structural steel beam (load bearing)

10

10

Unprotected steel plate (non-load-bearing)

5

10

A60 firewall

10

30

A60(H) firewall

15

60

H120 firewall

60

120

Protected structural steel beam

15

60

Riser

10

10

Jacket leg

15

30

2.2

Discussion

It is pessimistic to infer serious structural collapse from times to failure for individual structural members. The thermal response of the whole structure needs to be simulated, for the identified fire loading cases, in order to obtain predictions of the structural failure locations and time to failure. The requirements for specifying or selecting Passive Fire Protection (PFP) material should be based on an analysis of the structures' thermal response.

13/06/2003

VULNPLNT.DOC

Page 5



3.

EXPLOSION RESPONSE OF STRUCTURES

3.1

Data

Rev 0

The consequences of blast are tabulated in terms of explosion overpressure as shown in Tables 3.1, 3.2 and 3.3. The explosion overpressures quoted are shown for illustrative purposes only. The risk analyst must determine the explosion overpressure effects on plant and structures on a case by case basis by modelling the explosion loadings and response for the appropriate explosion conditions. To carry out this analysis the following information about the explosion may have to be determined first [1]: -

Type

-

Size Severity

-

Location

-

Duration

(confined explosions, high flame speed explosions, chemical explosions) ( extent and volume of gas cloud) (maximum overpressure,impulse pressure pulse rise time, both within and outside the gas cloud) (the location of flammable gas cloud and the extent of the overpressure and impulses both within the structure and beyond)

In addition to the above, the explosion analysis should also take into account the following parameters: •

Plant installation and process parameters: - inventory - type and composition of the fuel - type and rate of release - ventilation - obstacles and boundaries - ignition sources - wind direction and strength

•

Control and detection measures and their response time where appropriate: - emergency shut down - depressurisation/ blowdown - drainage and bunding - electrical isolation - fire and gas detection

13/06/2003

VULNPLNT.DOC

Page 6



Rev 0

Table 3.1 - Blast Damage [6] Pressure

Damage

psig

barg

0.02

0.0014

Loud noise (137 dB), if of low frequency (10-15 hertz).

0.03

0.0020

Occasional breaking of large glass windows already under strain.

0.04

0.0027

Loud noise (143 dB). Sonic boom glass failure.

0.1

0.0068

Breakage of windows, small, under strain.

0.15

0.0102

Typical pressure for glass failure.

0.3

0.0204

"Safe Distance" (probability 0.05 no serious damage beyond this value). Missile Limit. Some damage to house ceilings: 10% window glass broken.

0.4

0.0272

Limited minor structural damage.

0.5-1.0

0.0340

Large and small windows usually shattered occasional damage to window frames. Minor damage to house structure.

0.7

0.068-0.0476

1-2

0.068-0.136

1.3

0.088

2

0.136

2-3

0.136-0.204

2.3

0.1564

3

0.204

Heavy machines (wt 300lbs) in industrial building suffered little damage. Steel frame building distorted and pulled away from foundations.

3-4

0.204-0.272

Frameless, self-framing steel panel building demolished. Rupture of oil storage tanks.

4

0.272

5

0.340

5-7

0.340-0.476

7

0.476

7-8

0.476-0.544

9

0.612

10

0.68

300

20.4

Corrugated asbestos shattered. Corrugated steel or aluminium panels, fastenings, followed by buckling. Wood panel (standard housing) fastenings fail, panels blown in. Steel frame of clad building slightly distorted. Partial collapse of walls and roofs of houses. Concrete or cinder block walls, not reinforced, shattered. Lower limit of serious structural damage.

Cladding of light industrial buildings ruptured. Wooden utility poles (telegraph etc) snapped. Tall hydraulic press (400 lbs wt) in building slightly damaged. Nearly complete destruction of houses. Loaded train wagons overturned. Brick panels, 8-12" thick, not reinforced, fail by shearing and flexure. Loaded train box-cars completely demolished. Probable total destruction buildings. Heavy (7000 lb) machine tools moved and badly damaged. Very heavy (12000 lb) machine tools survived. Limit of crater lip.

13/06/2003

VULNPLNT.DOC

Page 7



Rev 0

Table 3.2 - Explosion Overpressure Effects [5] PEAK OVERPRESSURE bar

EFFECTS WITHIN ZONE psi

0.1

1.5

0.35

5

1.0

15

"Repairable Damage". Cladding blown off. Bridges and lifeboats impaired. "Heavy damage". Steel walls blown out. Process plant within module ruptured. Process plant in neighbouring modules damaged. 50% chance of ESD valve closure failing. Columns and buoyant deck of semi-sub ruptured.

2.0

30 Riser wall rupture.

13/06/2003

VULNPLNT.DOC

Page 8


3.2


Rev 0

Effects Of Explosion Overpressure On Passive Fire Protection (PFP)

In many cases, a fire event will be preceded by an explosion. The explosion overpressure may be insufficient to damage the structure but may be strong enough to dislodge the PFP. If the fireproofing is damaged or disbonded by the explosion, then the structural steel will not be adequately fire protected. It is critical for the applied passive fire protection to be able to withstand the predicted explosion overpressure. If the PFP loses its ability to remain effective following an explosion, then the escalation potential associated with the event should be taken into consideration. 3.3

Discussion

The explosion response of the whole structure needs to be simulated, for the identified explosion overpressure cases, in order to obtain predictions of the structural failure locations. The analysis should consider the following points: •

overall and local loads e.g. direct loads on blast walls and blast reaction forces on plant/structure and any redistribution of externally applied or internally transmitted loads.

•

dynamic response, both local and global.

13/06/2003

VULNPLNT.DOC

Page 9


4.

MISSILE LOADING

4.1

Data

i)

Primary Missile Loading


Rev 0

Primary missiles are those ejected during the failure of pressurised plant or rotating machinery. The loading of a missile is characterised by its velocity, mass and drag area. Typical missile geometries for various fracture types and vessel shapes are given in Tables 4.1 to 4.3. Table 4.1 - Primary Missile Geometries [8] Missile Source

Missile Geometry

Cylindrical Vessel

End-cap missile. Rocket missile. Whole vessel missile. Resulting from an axial rupture. A single large fragment ejected from vessel. A single small fragment ejected from vessel. Fragments generated by disintegration of vessel.

Spherical Vessel

Hemispherical fragment release. A single large fragment ejected from vessel. A single small fragment ejected from vessel. Fragments generated by disintegration of vessel.

Rotating Equipment

Fragments generated by disintegration of rotating equipment.

13/06/2003

VULNPLNT.DOC

Page 10



Rev 0

Table 4.2 - Primary Missile Geometries [9] Missile Source

Primary Missile Characteristics

Cylindrical Vessels

There was a 90% probability that the fragments would not exceed a third of the size of the whole vessel, the mean size of the fragments being 1.5% of the whole vessel. There would be less than ten fragments generated, the mean number being about two. There was 95% probability that the fragments would not exceed a quarter of the whole vessel, the mean size of the fragments being about 7%.

Spherical Vessels

There would be less than ten fragments generated, the mean number being less than five. Rotating Equipment [10]

The frequency of turbine rotor blade disintegration/ failure leading to a blade or missile being ejected through the casing is estimated to be in the range 1x10-3 to 1x104 per machine year. Note: If blade containment shielding is provided then the frequency can be assumed to be lower than 1x10-4 per machine year.

Table 5.3 - Primary Missile Characteristic [11] Missile Hazard 80% of fire events that cause ruptures result in missiles. Boiling Liquid Expanding Vapour Explosions (BLEVE) produce four or less missiles Non fire events produce more than four

13/06/2003

VULNPLNT.DOC

Page 11


5.


Rev 0

ONGOING RESEARCH

The Steel Construction Institute, Blast and Fire Engineering Projects for Topside Structures Phase 2. HSE / W.S. Atkins, Vulnerability of Building Occupants to Explosion Events.

13/06/2003

VULNPLNT.DOC

Page 12



Rev 0

6.

REFERENCES

1.

Guidelines for Fire and Explosion Hazard Management. UKOOA, May 1995.

2.

Shell Offshore Flame Impingement Protection Programme, Shell Research Ltd 1990.

3.

Cowley, L.T and Pritchard, M.J., Large Scale Natural Gas and LPG Jet Fires and Thermal Impact on Structures, Paper 3.5, GASTECH90, Amsterdam, December 1990.

4.

Interim Jet Fire Tests. Offshore Technology Report, OTO 93-028.

5.

OCB/Technica(1988), Comparative Safety Evaluation of Arrangements for Accommodating Personnel Offshore, Technica Report C1577, Department of Energy Report OTN-88-175, December 1988.

6.

Clancy, VJ. Diagnostic Features of Explosion Damage. 6th Int. Meeting of Forensic Sciences, Edinburgh 1972.

7.

Wells, GL.Safety in Process Plant Design, George Godwin, 1980. ISBN 0711455066.

8.

Baum, MR. Preliminary Design Guidelines for Fragment Velocity and the Extent of the Hazard Zone, Journal of Pressure Vessel, 110, 169-177,1988.

9.

Neilson, AJ. Procedures for the Design of Impact Protection of Offshore Risers and E.S.Vs. UKAEA (ed),1990.

10.

Lees, FP. Loss Prevention in Process Industries, Butterworth, 1990.

11.

Holden, PL. Assessment of Missile Hazards: Review of Incident Experience Relevant to Major Hazard Plants, SRD/R477, 1988.

13/06/2003

VULNPLNT.DOC

Page 13


13/06/2003


VULNPLNT.DOC

Rev 0

Page 14

Evacuation, Escape and Rescue


Rev 0

EVACUATION, ESCAPE AND RESCUE

13/06/2003

EVACRESC.DOC

Page 1



Rev 0

TABLE OF CONTENTS

1. INTRODUCTION------------------------------------------------------------------------------------- 3 1.1 Scope ---------------------------------------------------------------------------------------------------------------------3 1.2 Application--------------------------------------------------------------------------------------------------------------3

2. DATA AVAILABLE ---------------------------------------------------------------------------------- 4 2.1 Frequency of Platform Evacuation---------------------------------------------------------------------------------4 2.2 Availability of Escape Routes to Muster Areas ------------------------------------------------------------------4 2.3 Lifeboat Embarkation ------------------------------------------------------------------------------------------------5 2.4 Lifeboat Evacuation---------------------------------------------------------------------------------------------------5 2.5 Escape by Sea Entry --------------------------------------------------------------------------------------------------6 2.6 Onshore Data -----------------------------------------------------------------------------------------------------------6

3. DEVELOPMENTS IN EVACUATION, ESCAPE & RESCUE---------------------------- 7 4. REFERENCES --------------------------------------------------------------------------------------- 8 APPENDIX 1 GENERIC STAGES OF EER -------------------------------------------------- 10 APPENDIX 2 TEMPSC EVACUATION -------------------------------------------------------- 11 APPENDIX 3 HELICOPTER EVACUATION ------------------------------------------------- 13 APPENDIX 4 DETERMINING PROBABILITY OF EVACUATION SUCCESS ------ 14 APPENDIX 5 OPERABILITY OF EER METHODS UNDER VARIOUS ACCIDENT CIRCUMSTANCES---------------------------------------------------------------- 15

13/06/2003

EVACRESC.DOC

Page 2


1.

INTRODUCTION

1.1

Scope


Rev 0

This data sheet provides QRA data and guidance for Escape, Evacuation and Rescue (EER) from both offshore and onshore installations. Total evacuation of installations are rare events and each has very different circumstances. Thus, data relating to real EER events are sparse and QRA tends to rely on detailed analysis of escalation scenarios and EER activities within each scenario. This data sheet contains a number of example data rule sets for EER analysis and its appendix holds general guidance. 1.2

Application

All EER activities expose personnel to an element of risk. However, three broad classes of EER can be distinguished: •

Routine Practice Evacuations. These evacuations might be organised numerous times per year at an installation to rehearse the procedures and use of the EER equipment. The timing and conditions of such activities can to a large extent be controlled so that personnel are not put at unnecessary risk. There have historically been few fatalities resulting from this category of evacuations.

•

Precautionary Evacuations. For example, these might occur in the event of a drilling kick, an unignited gas leak, a drifting ship nearby, a minor structural failure or threatening platform movements in rough water. Such an evacuation is not usually done under great pressure, and there have historically been few fatalities in such events.

•

Emergency Evacuation. For example, these might occur in the event of an ignited blowout, leak from process equipment, a collision or a structural collapse. Such evacuations are usually performed with urgency. These are historically more likely to result in fatalities.

In developing predictions about the frequency of evacuation for a given development influences will, for instance, include local environmental factors, the nature and extent of processing facilities, and the intrinsic hazards of the process. There are a multitude of variables that can influence the outcome success of an offshore evacuation. Specifically, the weather is an important factor. Should an emergency evacuation be necessary during severe storm conditions, the risks of the EER activities are greater. As each installation has its own unique characteristics, it is necessary to model the EER operation to give some basis for EER effectiveness. This can be done by using computer models, manual calculation methods, or by a combination of these.

13/06/2003

EVACRESC.DOC

Page 3


2.


Rev 0

DATA AVAILABLE

References [3], [4] and [5] include a useful overview of offshore EER, including fatality assessment, as well as evacuation modelling (helicopters, lifeboats, bridge, sea entry). 2.1

Frequency of Platform Evacuation

Table 2.1: Frequency of partial/total evacuation (Northern North Sea) Survival Craft Evacuation

3 x 10-3 per installation year [2]

Helicopter Evacuation

7.5 x 10-3 per installation year [1]

Over a 25 year platform life this implies a 7.5% probability that there will be a lifeboat evacuation and 19% probability of an evacuation by helicopter.

Discussion The predicted frequency of having to evacuate a platform is derived from generic information. Some platforms may never have an evacuation, others may have several over their lifetime. Helicopter evacuation might not be achievable until some hours after the initiating event. Fire, smoke and gas presence can prevent the use of helicopter. For such cases, lifeboat and bridge transfer (for bridge linked platforms) provide further alternative means of evacuation. 2.2

Availability of Escape Routes to Muster Areas

Table 2.2:

Sample rule sets for criteria of impassability of escape routes due to heat radiation and smoke.

If the underside structure of a route formed by cladding and plate, is still intact, the escape route is impassible if heat radiation level at the underside of the escape route exceeds 37.5 kw/m2. A route, separated from heat effects to the side by a clad wall but that has a grated floor, is impassable if the heat radiation level on other side of the clad wall is more than 12.5 kw/m2. An un-protected route is impassable if the heat radiation level is above 5 kw/m2. An un-protected route is impassable if the smoke concentration is higher than 2.3 %. Reference: Sample extract from a typical Rule Set document of an E&P Forum member. Discussion These criteria are samples of rule sets that can be used to evaluate the number of fatalities to personnel trapped in a fire area over an extended period due to effects from a fire of long duration. The criteria may be considered conservative when escape is possible within a few minutes after the start of a fire. Rule sets should be developed specific to the circumstances. The Vulnerability of Humans data sheet provides complementary data to that shown above.

13/06/2003

EVACRESC.DOC

Page 4


2.3


Rev 0

Lifeboat Embarkation

Table 2.3: Sample rule sets for criteria of in-operability of lifeboat embarkation areas due to heat radiation and explosion effects. • • • • •

Any jet fire impact (with or without water sprays operating). Any pool fire impact (without water sprays operating). Any explosion impact with an overpressure higher than 0.2 bar. Permanent damage to the supporting structure A heat radiation level of more than 12.5 kw/m2 to the underside or outside of the embarkation area.

Reference: Sample extract from a typical Rule Set document of an E&P Forum member. 2.4

Lifeboat Evacuation

Table 2.4: Probabilities of success1 for lifeboat evacuation (computer model predictions) Wind (Beaufort2) (m/sec) Calm Moderate Gale Storm

(0-3)( 0 - 5 m/sec ) (4-6)( 5 - 14 m/sec ) (7-9)( 14 - 24 m/sec ) (>9)( > 24 m/sec )

Typical Davit (On Load Release):[1], [5]

Typical Free Fall [E&P Forum Member]

0.8 0.6 0.1 0.05

0.95 0.9 0.75 0.4

Notes:

“Success”, in this context, is achieved when no fatalities occur during the lifeboat evacuation event. Thus 100% of the personnel on board the lifeboat will be safely transported away from the installation and potentially to the shore. 2 Beaufort refers to the Beaufort Wind Scale whcih is an internationally recognised system of describing observed effects of winds of different velocities. Winds are grouped into speed categories from 1 to 12 and area referred to as Force 1, Force 2, etc. 1

In addition, 'OREDA - 92', Ref [6] includes some recorded failure incident and failure rate data for conventional davit launched life boats. Discussion The various references give a range of predictions for the success rate of lifeboat evacuation. These data figures are not precise, but give an indication that launching of lifeboats does not guarantee safe evacuation. See Appendix (A-1, A-2) for an outline of the various ways in which the lifeboat evacuation process can fail. Lifeboat evacuation success data are generally predictions based on North Sea experience of davit launched TEMPSC lifeboats. Installations in other areas may use lifeboats which are not davit launched TEMPSC. This could affect the success rate for evacuation.

13/06/2003

EVACRESC.DOC

Page 5


2.5


Rev 0

Escape by Sea Entry

Table 2.5.1: Sample rule set for immediate fatality probability due to jumping to sea from North Sea topsides equipment. Fatality Probability.

0.1

Reference: Sample extract from a typical Rule Set document of an E&P Forum member. Note: Does not allow for use of tertiary devices, such as rope ladders etc., or distance to sea. There are insufficient data on the use of liferafts to give reliable figures for the probability of fatality when these devices are available. Table 2.5.2: Sample rule set for fatality probability upon entering the sea to escape (North Sea data) No stand-by vessel present. Weather conditions averaged.

Pfataility 0.8

Stand-by vessel(s) present. Calm Weather (Wind 0 - 5 m/s) No or Low Fire Effects at Sea Level High Fire Effects at Sea Level

0.06 0.15 Moderate Weather (Wind 5 - 12 m/s) 0.22 Severe Weather (Wind >12 m/s) 0.92 Reference: Sample extract from a typical Rule Set document of an E&P Forum member. Notes: • Probabilities cover full scope of evacuation: entering sea; remaining at sea surface; rescue. • Personnel making a sea entry expected to be wearing survival suit and life-jacket. • Above data does not differentiate sea temperature effects on personnel survival rate. In reality, personnel survival time immersed in sea, depends on local sea temperatures and generic human endurance times.

2.6

Onshore Data

Assuming personnel have survived the initial events, personnel EER from onshore facilities tends to be less complex and of inherently lower risk. Qualitative analysis, geared towards provision of suitable escape routes and appropriate rescue and medical contingency planning, will normally be adequate.

13/06/2003

EVACRESC.DOC

Page 6


3.


Rev 0

DEVELOPMENTS IN EVACUATION, ESCAPE & RESCUE

Whatever offshore evacuation technique is used, two areas are developing to improve the success of EER. Firstly there is the development of concept, specification and performance of Temporary Refuges. Secondly, there is increased allowance for human factors, comprising command, control, human behaviour and ergonomics in the design of equipment, procedures etc. A number of innovative EER systems are in various stages of development. Several systems have been adopted by operators as risk reduction measures and best available means for EER. Examples of these innovative systems can generally be grouped into the following categories: • • •

TEMPSC assist systems Individual Person Escape Devices Multiple Personnel Escape Devices.

Levels of operational testing and experience for each particular system varies. Due to their relatively limited application, there is little or no data currently available.

13/06/2003

EVACRESC.DOC

Page 7



Rev 0

4.

REFERENCES

[1]

K. Sykes, "Summary of conclusions drawn from reports produced by, or made available to, the Emergency Evacuation of Offshore Installations Steering Group", MaTSU, January 1986.

[2]

Technica report OTH 88 8285, "Escape II - Risk Assessment of Emergency Evacuation from Offshore Installations", HMSO, ISBN 0-11-412920-7, 1988.

[3]

D. Robertson, "Escape III - The Evaluation of Survival Craft Availability in Platform Evacuation", Technica Ltd., International Offshore Safety Conference, London 1987.

[4]

Section 9 + Appendix 7 of "Comparative Safety Evaluation of Arrangements for Accommodating Personnel Offshore", UK Department of Energy Report, October 1988.

[5]

"Risk Assessment of Emergency Evacuation from Offshore Installation" Technica Report F 158. Prepared for DoE. November 1983

[6]

OREDA. Offshore Reliability Data Handbook. DNV Technica. 2nd Edition. 1993. ISBN 82 515 0188 1.

13/06/2003

EVACRESC.DOC

Page 8



Rev 0

APPENDIX GENERAL GUIDANCE

13/06/2003

EVACRESC.DOC

Page 9


APPENDIX 1


Rev 0

GENERIC STAGES OF EER

Table A.1: Generic stages of EER Stage +Generic Description

Typical Specific Descriptions

Possible Problems

Alarm Appreciation of an incident.

Detection system warns of an unsafe condition. Control room operator decides that there is an emergency and starts emergency procedure. Using the public address system, personnel are told that there is an emergency.

Detection fails. Delay (any cause). Operator error. Public Address System fails. Public Address System not heard.

Local Escape Escape from immediate area of the hazardous condition.

Personnel in the area which includes the hazard become aware that they should escape. They move out of the immediate area.

Personnel do not hear alarms and do not notice the hazard condition. Hazard condition incapacitates personnel before they can leave the area.

Safe Place Personnel move to a place of safety.

Personnel move along escape ways to reach a designated sheltered area.

Escape ways blocked due to hazard or other causes. Personnel ignore procedures and do not escape. Escape ways not understood by personnel. Environment within temporary refuge not tolerable due to accident effects ie smoke, heat.

Transfer Personnel are moved from the platform to another entity (lifeboat, liferaft, helicopter, ship, other platform, drilling tender, flotel)

Personnel mustered and loaded into helicopter. Personnel mustered and launched in lifeboats. Personnel launch and board liferafts. Personnel jump into the water and swim away from the platform. Personnel walk across a bridge to an adjacent platform or floating structure.

Insufficient capacity. Failure during transfer/launch process. No vehicle at place where personnel have gathered. Failure in the organisation or in the judgement of leaders. Lifeboat or other vehicle damaged by fire/explosion. Means of transfer damaged by fire or explosion. Personnel injured by explosion while awaiting order to evacuate. Swimmers affected by cold, heat or other effects of an incident. Possible shark attack in tropical waters.

Refuge Personnel make further transfer to arrive at shore or a place of safety before return to shore.

Helicopter shuttles escapers to base/ship/nearby platform. Lifeboat transfers escapers to helicopter. Lifeboat transfers escapers to ship. Lifeboat reaches shore or another platform. Pickup from liferaft. Swimmers rescued from water. Swimmers arrive at a place of safety.

No further entity for available refuge accessible. Swimmer not noticed. Death before pick-up. Accident during pick-up. Rescue vehicle suffers accident.

The stages of EER presented in table A.1 are provided as a possible set of descriptions for use in EER analysis. The stages of an EER are complex and need to be considered with care during a risk assessment. The stages shown in Table A.1 should be tailored for the particular installation and its potential major accident scenarios.

13/06/2003

EVACRESC.DOC

Page 10


APPENDIX 2


Rev 0

TEMPSC Evacuation

A.2.1 Times and Failures Modes Table A.2.1: Typical times and failure modes for evacuation of a North Sea installation by 40 man TEMPSC [2] Action (with Indicative Timescale)

Possible Problems

Muster Go to stations Head Count Order to abandon (5 - 15 mins)

Effects of incident. Escape ways blocked or unusable. Alarm ignored or not observed by personnel. Problems of command.

Prepare to launch

Muster area exposed to heat or smoke. Craft damaged by effects of incident. Engine defect. Gear stuck. Sea cocks jammed. Craft damaged.

Embark (4 - 10 mins)

Personnel injured. Premature descent. Access blocked. Other delays.

Start to lower Descend under control to near sea level Final descent to sea Release (1 min)

Release/cable/brakes jammed, craft hooked up on gear and various other mechanical defects. Craft hits structure due to wind. Premature release of boat from falls. Wires too short. Release fails. Craft damaged by effects of the incident (heat, fire, blast, fire on sea).

Move away from platform

Steer into structure. Blown back into structure. Tides carries craft into structure. Mechanical failures. No pickup means.

Stay intact while awaiting pickup

Craft not located. Craft sinks or capsizes before pickup. Injured person die before pickup. Excessive delay in pickup leads to death or injury of personnel.

Personnel recovered successfully

Mistakes during pickup. Failure of mechanism.

Recovery unit reaches shore

Helicopter or boat suffers failure.

Table A1 in section A1 provides failure modes for evacuation but does not suggest the effects of failure. It should be recognised that the various types of failure carry different levels of risk for participants. An example is shown later in this data sheet. Table A2.1 presents a more detailed analysis of evacuation failure modes, which is drawn from [2]. This provides a framework for discussion and analysis. For analysis of existing platforms, analysts should be able to use measured times from trials and exercises in place of the typical times shown in the table. The design of a lifeboat to withstand physical effects due to an incident can also affect the success of an evacuation.

13/06/2003

EVACRESC.DOC

Page 11



Rev 0

A.2.2 Factors affecting Probability of Successful Launch of TEMPSC. Reference: E&P Forum member. The offshore oil and gas industry has seen effort to improve the design, hardware and management of EER issues. Such improvements will achieve a reduction in risk for personnel. For example, TEMPSC design and operations improvement studies have covered: • • • • • • • •

Onload / Offload release mechanism Clearance / Offset of the lifeboat from the installation Lifeboats mounted at right angles to the structure or at its corners so as to allow a straight course away from the structure. Improved vessel manoeuverability. Better visibility for Lifeboat Coxwain Better maintenance of Lifeboat Launch Mechanisms. More consideration given to the practicalities of recovering personnel from lifeboats. Improved impact resistance of lifeboats

13/06/2003

EVACRESC.DOC

Page 12


APPENDIX 3


Rev 0

HELICOPTER EVACUATION

Reference: E&P Forum member. Use of helicopter to evacuate is only possible in situations where both helicopter and helideck are available. Some potential major accident scenarios, would make it very dangerous to utilise helicopter transportation. Heat, smoke and flames from fires tend to propagate upwards and can impair a helideck facility. Helicopter evacuation is often more available for performing precautionary evacuations. Any evaluation of helicopter options must include an assessment of: O

The time scale of the supposed incident. O

The possible timing of the incident in relation to the availability of helicopters and crew (i.e. day or night). O

The defined evacuation plan i.e. shore, to ships or other platforms. O

The possible problems in the escape, mustering and loading process.

13/06/2003

EVACRESC.DOC

Page 13


APPENDIX 4


Rev 0

DETERMINING PROBABILITY OF EVACUATION SUCCESS

Reference: E&P Forum member. The actual success rates at each stage of the process of EER for a defined group of personnel can be translated into an overall success rate. Stages of EER may be defined as follows. Probabilities of personnel: O

identifying alarm

=

P1

O

making local escape

=

P2

O

reaching safe place

=

P3

O

effecting transfer (from safe place to away from platform)

=

P4

O

reaching refuge

=

P5

As an example only, suppose we are considering escape of 5 people working in a process area in which there is a rapidly developing fire. It is assumed that evacuation is by lifeboat. Weather conditions may be any of those observed at this location. There is a good back up organisation to retrieve personnel after they have transferred to lifeboats. O

P1

=

0.95

(Visual and thorough alarm system).

O

P2

=

0.80

(Fire effects may overcome personnel).

O

P3

=

0.98

(Good escape routes unlikely to be blocked).

O

P4

=

0.85

(to include allowance for possibility of becoming trapped at the safe place. Also includes derivation for lifeboat launching weighted for different weather conditions).

O

P5

=

0.90

(Emergency organisation for the platform retrieves personnel. Success is good except in poor weather).

=

0.57 for 5 people in the area where the incident takes place. Note that the chance can be improved to 0.75 if people can stay on the platform.

Overall Success

13/06/2003

EVACRESC.DOC

Page 14


APPENDIX 5


Rev 0

OPERABILITY OF EER METHODS UNDER VARIOUS ACCIDENT CIRCUMSTANCES

Table A.5: Operability rating of evacuation / escape methods under various accident circumstances: hazards, evacuation time, weather. Types of Evacuation

Primary TEMPSC

Tertiary

Hazard

Evacuation Time

Weather

Radiant Heat

Gas / H2S / Smoke

< 15 mins

< 60 mins

< 180 mins

Calm

Mod

Severe

Helicopter

2

2

2/2

8/2

9/9

9

9

5

Bridge

5

5

9/9

9/9

9/9

9

9

7

Direct Marine

5

5

2/2

9/5

9/9

9

8

3

Protected Access

9

9

9/7

9/9

N/A

9

6

1

Unprotected Access

3

3

7/7

9/9

N/A

9

6

1

Liferaft, Ropes, Jump etc.

2

2

8/8

N/A

N/A

3

2

0

Reference: via E&P Forum member. Notes: Ratings: Lowest = 0 , Highest = 9 The above ratings are based on how operable the various methods of evacuation / escape are expected to be under different accident circumstances of hazard, evacuation time and weather. A N/A mark indicates that alternative methods of evacuation / escape would be used in these circumstances. Two marks are given for the evacuation times based on the separate cases of total People on Board (PoB) = 20 and total PoB = 200 respectively (ie 8 / 2 refers to 8 for a 20 man installation, 2 for a 200 man installation). Table A.5.2: EER Success Rates Types of Evacuation Helicopter PRIMARY Bridge Direct Marine TEMPSC Tertiary

Historical Success Rates Low (1) High N/A (2)

Protected Access

N/A

Unprotected Access

Low

Liferafts, Ropes, Jumping etc

Low

Reference: via E&P Forum member. Notes: Ranking Categories: High / Medium / Low 1) Helicopters have not generally been available in time for emergency evacuations. 2) No data, as these are more recent developments and are not widely deployed offshore as yet. Discussion Tables A.5.1 and A.5.2 are provided to aid estimates of EER systems effectiveness under different accident circumstances. The data is qualitative estimate of the applicability and success rates for different types of EER equipment.

13/06/2003

EVACRESC.DOC

Page 15


13/06/2003


EVACRESC.DOC

Rev 0

Page 1

HF in the Assessment of E&P Forum QRA Datasheet Directory Fatalities during Escape & Sheltering

Rev 0

HUMAN FACTORS IN THE ASSESSMENT OF FATALITIES DURING ESCAPE & SHELTERING

13/06/2003

HFINESC.DOC

Page 1


Rev 0

TABLE OF CONTENTS

GLOSSARY OF TERMS & ABBREVIATIONS ------------------------------------------------- 3 1 INTRODUCTION-------------------------------------------------------------------------------------- 4 2 SCOPE -------------------------------------------------------------------------------------------------- 5 3 APPLICATION ---------------------------------------------------------------------------------------- 5 4 OVERVIEW OF METHODS FOR CALCULATING FATALITY RATES FROM EXPOSURE TO FIRE, EXPLOSION AND TOXIC HAZARDS ----------------------------- 6 5 METHODS FOR CALCULATING THE PROBABILITY OF EXPOSURE AND DURATION OF EXPOSURE TO A HAZARD (WHILE ESCAPING TO THE TEMPORARY REFUGE (TR))----------------------------------------------------------------------- 7 Description ------------------------------------------------------------------------------------------------------------------7 Data Sources ----------------------------------------------------------------------------------------------------------------9 Reliability and time to respond to alarms (e.g. time to initiate escape to a TR)---------------------------------9 Speed of movement of personnel -------------------------------------------------------------------------------------- 11 Choice of route----------------------------------------------------------------------------------------------------------- 11 Performance in the use of personal protective equipment (PPE) - reliability of success in using PPE and time to use PPE ---------------------------------------------------------------------------------------------------------- 12 Allowing for degradation in human performance due to exposure to a toxic or thermal hazard---------- 13 Availability of Data ------------------------------------------------------------------------------------------------------ 14 Strengths of the Method ------------------------------------------------------------------------------------------------ 14 Limitations of the Method ---------------------------------------------------------------------------------------------- 14


13/06/2003

HFINESC.DOC

Page 2


Rev 0

GLOSSARY OF TERMS & ABBREVIATIONS

Term Escalation

Abbreviation -

Escape

-

Evacuation

-

Human Reliability Analysis Performance Shaping Factor Personal Protective Equipment Quantified Risk Assessment Rescue

HRA

Task Analysis

-

Temporary Refuge

TR

13/06/2003

PPE

Definition The progress of an incident following the initial event in which the damage, injuries or fatalities caused may increase The process of personnel leaving the vicinity of an incident and making their way to a safe location. For an offshore installation the safe location is designated the Temporary Refuge A term used to describe the process of leaving the offshore installation in response to an emergency in order to reach a place of permanent safety A generic term covering all techniques which are used to assess the human component of a system A factor which can influence human performance and human error probability -

QRA

-

-

Following evacuation, this is the recovery of personnel to a place of permanent safety A series of techniques used to analyse and assess the activities performed by people within a system Term used to define a location on an offshore installation where personnel can gain protection, for a finite time, from a hazard

PSF

HFINESC.DOC

Page 3


1.

Rev 0

INTRODUCTION

The purpose of this datasheet is to describe Human Factors methods and associated sources of data which are available for incorporation into quantified risk assessment (QRA). The scope of this datasheet relates to determining fatalities during escape and sheltering. Other datasheets within the directory address methods and data related to other aspects of Human Factors in QRA, these being: • • •

Human Factors in the calculation of loss of containment frequencies (Event Data) Human Factors in determining event outcomes (Safety Systems) Human Factors in determining fatalities during evacuation and rescue (Vulnerability)



HAZID study


Frequency analysis




Risk summation


Criteria


13/06/2003

HFINESC.DOC

Page 4


2.

Rev 0

SCOPE

This datasheet deals with the Human Factors issues which have a significant bearing on the safety of personnel during escape and sheltering. Methods and data are presented for assessing the likelihood of fatalities as events progress. The term "escape" is considered to cover the movement of personnel from their initial location (at the time of the event) to a place of safety. The term "sheltering" is considered to cover the time spent by personnel within the place of safety. In the UK offshore regulations, this place of safety is termed the Temporary Refuge (TR). In estimating fatalities, assessment of the likelihood of personnel being exposed to the hazard and the effect of exposure are required. For hydrocarbon releases the hazards of concern are thermal radiation, explosion overpressure or toxic gas/smoke, for which the methods of assessing the effect of exposure can include the use of tolerability thresholds or Probit equations (see datasheet on Human Vulnerability). The estimation of the likelihood of personnel being exposed to a hazard during the escape and sheltering phases involves both event consequence modelling (e.g. fire propagation, temporary refuge impairment etc.) and human behaviour modelling. In an offshore situation the behaviours of interest include: • • • •

time taken to initiate escape speed of movement to the temporary refuge choice of route so as to minimise exposure use of protective equipment.

Statistics for a QRA must be derived by interpreting data taken from a number of sources. Particular factors to be taken into account in deriving the statistics are: • • • 3.

the reliability of response to alarms and the effect of false alarm frequency on response behaviour; characteristic behaviour patterns in life threatening situations; changes in behaviour when exposed to a hazard. APPLICATION

Fatalities during escape and sheltering can be divided into three sub-categories, e.g. • • •

immediate fatalities - personnel who are in close proximity in the initial stages of the event escape fatalities - personnel who are not initially in close proximity but become exposed to the event as they attempt to reach a temporary refuge sheltering fatalities - personnel who are exposed to a hazard while sheltering in the temporary refuge.

The first section (section 4) gives a brief overview of the issues in calculating fatalities from exposure to thermal, fire and explosion hazards. The second section (section 5), for the estimation of the likelihood of exposure to a hazard, is predominantly relevant to the first two categories of fatalities. 13/06/2003

HFINESC.DOC

Page 5


4.

Rev 0

OVERVIEW OF METHODS FOR CALCULATING FATALITY RATES FROM EXPOSURE TO FIRE, EXPLOSION AND TOXIC HAZARDS

In a scenario which involves exposing personnel to a fire hazard a simple approach is to use the thermal radiation contours calculated as part of the consequence analysis to define the locations where personnel would die. For toxic hazards a similar approach can be used by assessing the concentration in each location occupied by personnel. This method requires recourse to the data on the effect of the substance on people. A more sophisticated approach, which can be used for overpressure, toxic or thermal hazards is to determine the dose received over time and use a probit equation to relate the dose to fatality likelihood. Relevant data can be found in the datasheet on Human Vulnerability.

13/06/2003

HFINESC.DOC

Page 6


Rev 0

5.

METHODS FOR CALCULATING THE PROBABILITY OF EXPOSURE AND DURATION OF EXPOSURE TO A HAZARD (WHILE ESCAPING TO THE TEMPORARY REFUGE (TR))

5.1

Description

Following an incident, there is a possibility that personnel will become exposed to a hazard as they escape to safety. Exposure may be severe enough to cause death. Human Factor issues such as route selection decisions can dominate the likelihood of exposure. The kind of statistical estimates required in an assessment of escape performance are: • • • •

the length of time before personnel receive a warning about the event the likelihood of personnel being in the proximity of the event the time it takes to get to a safe location (i.e. the TR) the steps taken to avoid the hazard while moving to the TR. This includes: - choice of route to avoid a hazard - using protective equipment to isolate the person from the hazard (such as using breathing apparatus in a toxic cloud)

An analyst cannot expect to find universally applicable historical data with which to assess escape performance as this is location specific. For example, in regard to the question of how likely it is that personnel will be in the vicinity of an event, the analyst should consider the types of activities which take place on the installation. A review should consider whether the alarm could be masked by other noises, and the procedures followed to investigate an alarm, which may involve an operator being sent to inspect the area. Using the layout of the installation and details of the incident (such as availability of escape ways, level of hazard) software tools can be used to assist in certain aspects of escape evaluation. Most commonly they are used in the calculation of the time taken for personnel to reach predefined points of safety. The approaches used by the models differ and the scope for using them to estimate escape fatalities varies. Models which may be suitable for applying to offshore installations include: EGRESS [42], MUSTER [43], EVACNET+ [44], SPECS [45], EXIT89 [13]. A simple method for estimating the likelihood of personnel becoming exposed to a hazard is to model the structure as a 3-D grid of cells and then consider, for an event in a specific area, the likelihood of personnel entering the incident area as they make their way to a TR (see figure 2).

13/06/2003

HFINESC.DOC

Page 7


Rev 0

Figure 2: Plan view of a simple bridge-linked platform, demonstrating a method of estimating exposure probabilities Probability of person who starts from this area entering the incident area while travelling to the TR 0.5

0.25

0.1

0.5

Incident area

0.0

0.0 Bridge Link

0.5

0.1

0.05

Production Platform

Temporary Refuge

In estimating the probability associated with each starting point, not only the routing of the walkways can be taken into account but some Human Factors issues can be accommodated in analysis: •

the detectability of the event (i.e. personnel are more likely to see an ignited release than an unignited one and re-route accordingly). Events could be grouped together into categories and a different version of the grid produced for each category. Detectability can be enhanced indirectly by informative announcements over the PA system, therefore relevant procedures can be allowed for in the analysis.

•

Preferences for certain walkways/routes. Bias could be introduced into the probability figures based on the routes used by personnel, including short-cuts that become the norm.

The number of behavioural aspects which have a bearing on escape performance is large, and for many, data are limited or from a different field of activity. Therefore an analyst who wishes to reflect a particular working method within the assessment, such as Buddy-Buddy working, will not have a specific database of statistical evidence with which to work. This does not imply that the analysis cannot reflect such issues, but it does imply that doing so requires some insight into the behavioural implications to be sought. Validating a theoretical analysis of escape performance, whether it be performed with the assistance of a software tool or not, is clearly problematic. Observing the time it takes personnel to move around the installation and perform relevant tasks is a starting point. In order to compare these data to the predictions of a model, due account of the effects of emergency circumstances on the personnel and the platform is needed. An approach to validating predictions of escape performance is proposed in [46].

13/06/2003

HFINESC.DOC

Page 8


Rev 0

Data Sources This section contains a collection of data, drawn from a large number of sources, which have been found to be useful in helping to make judgements about probable patterns of behaviour during escape. The data cover: • • • • •

reliability and time to respond to alarms speed of movement of personnel choice of route performance in the use of personal protective equipment degradation in human performance due to exposure to a toxic or thermal hazard

Since emergency situations are rare and beyond the experience of most people, making it difficult for analysts to relate to the circumstances, it is appropriate to present actual, observed, data. A recurring theme in the analysis of emergencies is an over optimistic view of human performance. Reference to as much actual experience as possible is a useful means of gauging expected performance. Reliability and time to respond to alarms (e.g. time to initiate escape to a TR) The reliability of response to alarms is a key issue in the assessment of mustering performance. A large amount of data has been collected in regard to the factors which affect behaviour following an alarm signal. The findings indicate that the two dominant factors are: • •

previous experience of alarms (false alarms) confirmatory signals (such as smoke, fire, noise)

Data from building evacuations, where a high proportion of fire alarm signals is false, indicate that a significant proportion of people are likely to seek confirmation before commencing escape. Further data to enable the factors affecting false alarm rate and response behaviour to be identified are not available. It is expected that in the offshore environment the proportion of personnel seeking confirmation before commencing escape would be less than suggested by the data in Table 1 because of training and an awareness of the potential danger.

13/06/2003

HFINESC.DOC

Page 9


Rev 0

Table 1: Data on response to alarms Issue

Context

Finding

Ref

Interpretation of alarm

Fire drill in a building (without warning) Fire drill in a building (without warning) Fire drill in a building (without warning) Actual fires in buildings

17% assumed it to be a genuine alarm (sample of 176) false alarm - 83% 14% assumed it to be a genuine alarm

6

Interpretation of alarm Interpretation of alarm Confirmation of hazard Time to respond to an alarm Investigation of the alarm Tackling the hazard Tackling the hazard Use of fire extinguisher

Research into normal alarms

Assisting others

Multiple occupancy fires (hotels etc.)

13/06/2003

Domestic fires Domestic fires Multiple occupancy fires (hotels etc.) Domestic fires

7

14% assumed it to be a genuine alarm (sample of 96)

8

9% (2 of 22) believed there was a fire before seeing flames 77% 9(17 of 22) required visual and other cues 10% chose to evacuate after 35 seconds

9

8

41 people performed 76 investigative acts 50% (268 out or 541) attempted to fight the fire 9% (9 out of 96) attempted to fight the fire Of 268 who knew of the nearby- location of an extinguisher, 50% tackled the fire but only 23% used the extinguisher

10

25 acts of giving assistance (total of 96 people)

5

HFINESC.DOC

11 10 6

Page 10


Rev 0

Speed of movement of personnel Data on speed of movement is relatively plentiful, and studies to assess degradation due to exposure to hazards have been performed. Table 2 summarises some relevant data. Table 2: Data on the speed of movement Issue

Context

Finding

Ref

Density of people

Unhindered walking Movement in congested area Evacuation from buildings Evacuation from buildings Evacuation from buildings

Average speed of 1.4m/s

12

0.05 m/s in density of 0.5m2 per person

12

40% reduction (from normal walking speed)

13

10% reduction in speed (from normal walking speed) with emergency lighting of 0.2 lx 10% reduction in speed (from normal walking speed) if fluorescent strips, arrows and signs are used in pitch black surrounding

14

Evacuation from buildings Unhindered walking

50% reduction in speed (from normal walking speed) in complete darkness

14

From the age of 19 onwards, decrease in speed of 1-2% per decade (average 16% reduction by age of 63)

15

Density of people Effect of smoke on speed of evacuation Effect of lighting level on speed of evacuation Effect of lighting level on speed of evacuation Effect of lighting level on speed of evacuation Age of person

14

The above table is for uninjured personnel. Although no data is available for personnel with damaged limbs, a reduction in speed is expected. The relationship between incapacitation and burns is complicated as burn injuries have a progressive effect. Stoll and Greene [39] show that for second or third degree burns over 100% of body area, the percentage incapacitation is less than 10% within the first 5 minutes, rising to 50% after a few hours and reaching 100% in a day or so. Choice of route The choice of escape route contributes to the likelihood of a person being exposed to the hazard while making their way to the TR. Two specific aspects of human behaviour which have been identified through review of evacuations and are relevant to assessing the likelihood of route choice are: • •

familiarity of personnel with the routes (i.e. seldom used emergency routes versus normal routes); obstacles or hazards on the route (in particular the presence of smoke along the route).

13/06/2003

HFINESC.DOC

Page 11


Rev 0

The data in Table 3 suggest a strong tendency for personnel to use routes with which they have the greatest familiarity. It is worth noting that it is common for personnel to become accustomed to using routes which were not intended to be normal access routes (i.e. creating shortcuts). Such an occurrence can invalidate the assumptions in a safety study. Table 3: Human Behaviour Data on Choice of Evacuation Routes Issue

Context

Finding

Ref

Familiarity with exits

Hotel fire

16

Familiarity with exits Familiarity with exits Moving through smoke Moving through smoke

General evacuations

51% departed through normal entrance 49% departed through fire exit 18% went to known exit without looking for another (sample size 50) 70% left through normal entrance 30% left through the fire exit Choice of exit is more influenced by familiarity with the route than amount of smoke 60% attempted to move through smoke (50% of these moving 10 yards or more)

Evacuation drill in a lecture theatre General evacuations

General evacuations

17 16 18

19

Performance in the use of personal protective equipment (PPE) - reliability of success in using PPE and time to use PPE In an emergency situation it can be the relatively complex type of equipment which is to be used to give additional protection, such as smoke hoods or self contained breathing apparatus. In terms of risk assessment, failures or delays in the use of the necessary PPE can increase the likelihood of fatalities. Therefore, an estimate of the percentage of the population who can use PPE correctly and the likely time taken are relevant. The findings of a study of the reliability of use of re-generative breathing apparatus are presented in Table 4. The study involved visiting mines and asking miners, without warning, to put on their apparatus. The authors used a five point rating scale instead of simple pass or fail categories as they recognised that users may be able to rectify their mistakes, either by themselves or with the assistance of their colleagues. However, the category "failing" implies that a user would have very little chance of ever protecting themselves with the equipment.

13/06/2003

HFINESC.DOC

Page 12


Rev 0

Table 4: Performance in using re-generative breathing apparatus, measured at four mines [20]. Donning Proficiency Profiles at each Mine (% of personnel) Skill Level

Mine A

Mine B

Mine C

Mine D

Failing

6.3

18.2

40.0

6.9

Poor

50

27.3

40.0

6.9

Marginal

15.6

15.2

6.7

6.9

Adequate

15.6

33.3

10.0

44.8

Perfect

12.5

6.0

3.3

34.5

The results of the study show that performance in the use of PPE can be poor. The authors suggested that training was a dominant contributor to the differences between the four mines. However, they did not provide details of the training regimes and therefore insights into the relative importance of induction training or frequency of drills cannot be gained. Data on the time to use breathing apparatus is not available. The findings above suggest that there can be significant differences between personnel who are very familiar and experienced with the equipment, from those who are not. Allowing for degradation in human performance due to toxic or thermal exposure The data given in Table 4 takes no account of exposure to a hazard. It can be expected that exposure to a hazard could significantly degrade human performance. Choice of route, ability to put on a smoke hood, capability to use an escape system, are examples of behaviour which could be impaired by exposure to a hazard. In reviewing the data and considering the degree to which performance could be degraded it is necessary to consider indirect factors such as cognitive performance degradation, sensory performance degradation, and physical performance degradation (e.g. dexterity and coordination) when attempting to assess the effect on performance. The greater the detriment to these performance parameters, the more likely will errors be made and the time to perform tasks will increase. There is limited data on the direct effect of exposure to hazards on human performance and this is predominantly at concentrations below those possible in incidents. Table 5 has data on the effect of smoke inhalation.

13/06/2003

HFINESC.DOC

Page 13


Rev 0

Table 5: Data on the effect of exposure to smoke on cognitive abilities Issue

Context

Finding

Ref

Cognitive abilities

Effect of exposure to smoke on simple arithmetic tasks

100% accuracy at 0.1 l/m 58% accuracy at 1.2 l/m

21

Referring to the data on the effects of Hydrogen Sulphide (see datasheet on Human Vulnerability) it is clear that a person’s ability to see will be impaired, and it is possible that cognitive abilities will be hampered as exposure increases. It is these types of inferences which are necessary in assessing the effect of exposure on escape performance and with due regard to PPE requirements. A viable approach is to assume that a fraction of the lethal concentration is sufficient to disrupt cognitive abilities. A common choice is to use 15% of the LC50 value as a threshold where the rate of decision errors is significantly increased. 5.3


Although the above tables show that there is data relevant to escape performance, most of the data is not from the offshore environment specifically. However, trends indicated by the data (e.g. the effect of false alarms) are meaningful and relevant. 5.4


The approach to calculating escape fatalities is relatively straightforward - estimate how many personnel are exposed and then use the data in the Human Vulnerability datasheet to calculate fatality numbers. Unfortunately the complexity of human behaviour introduces uncertainties into the exposure estimates and there is a tendency to rely on coarse models of behaviour. However, the data in this section provide the analyst with an indicative means of taking account of installation specific issues in a relatively simple way: • • • • 5.5

what level of false alarm rate does the platform have? which routes are used by personnel (including shortcuts)? is personal protective equipment required to be used? what effect would the specific hazard have on escape performance? Limitations of the Method

It is common for the modelling of escape performance in QRA to treat personnel as independent entities. However, it is known that group behaviour, such as an individual taking the lead and directing others, has a significant role in dictating the choice of actions and the outcome of escape performance. The above data does not take account of this facet of behaviour.

13/06/2003

HFINESC.DOC

Page 14


6.

Rev 0

ONGOING RESEARCH

Tools to model the escape process and derive fatality estimates attempt to take account of the dominant factors affecting behaviour. A continuing objective is to create tools which integrate the dynamic modelling of the event to the modelling of escape behaviour.

7.

REFERENCES

[1] Reidel, D. (1982) Risk analysis of Six Potentially Hazardous Industrial Objects in the Rijnmond Area: A Pilot Study, A report to the Rijnmond Public Authority, Dordrecht ("The COVO Study"). [2] Not used [3] Not used [4] Not used [5] Not used [6] Pauls, J. (1980) Building Evacuation: research findings and recommendations in Fires and Human Behaviour (Ed. D. Canter), John Wiley & Sons, Chichester, p251-275. [7] Tong, D. & Canter, D. (1985) The decision to evacuate: A study of the motivations which contribute to evacuation in the event of fire Fire Safety Journal, 9, 257-265. [8] Bellamy, L.J., et al. (1990) Experimental programme to investigate informative fire warning characteristics for motivating fast evacuation, Building Research Establishment, Garston, Watford, U.K. [9] Edelman, H. & Bichman, E. (1980) A model of behaviour in fires applied to a nursing home fire in Fires and Human Behaviour (Ed. Canter, D.) 181-204, Chichester: Wiley. [10] Canter, D. (1980) (ed) Fires and Human Behaviour, Chichester: Wiley. [11] Canter, D. (1984) Studies of human behaviour in fire: empirical results and their implications for education and design. Building Research Establishment, Garston, Watford, U.K. [12] Fruin, J.J. (1970) Designing for pedestrians - A level of service concept. Ph.D. Dissertation, The Polytechnic Institute of Brooklyn, June, 1970. [13] Fahy R.F., EXIT89: an evacuation model for high-rise buildings. In: Fire Safety Science - proceedings of the third international symposium, London. Elsevier, 1991, p 815-823, ISBN 1851667199 [14] Krockeide, G. (1988) An introduction to luminous escape systems in Safety in the Built Environment (Ed. Sime, J.D.) p 134-146. [15] Himann, Cunningham, Rechnitzer & Paterson, 1988 13/06/2003

HFINESC.DOC

Page 15


Rev 0

[16] Sime (1985a) Movement towards the unfamiliar: Person and place affiliation in a fire entrapment setting Environment and Behaviour, 17:6, 697-724. [17] Sixsmith, A.J., Sixsmith, J.A. & Canter, D.V. (1988) When is a door not a door? A study of evacuation route identification in a large shopping mall in Safety in the Built Environment (Ed. Sime, J.D.) 62-74, E&FN SPON, London, 1988. [18] Horiuchi, S., Murozaki, Y. & Hokuso, A. (1986) A case study of fire and evacuation in a multi-purpose office building, Osaka, Japan in Fire Safety Science: Proceedings of the first International Symposium (Eds C.E.Grant & P.J.Pagni) Washington DC, Hemisphere Publishing Corp., Washington DC. [19] Wood (1972) The behaviour of people in fires. Fire research Note 953. Borehamwood: Fire Research Station. UK. [20] Kovac, J.G., Vaught, C., Branich Jr., M.J., Probability of making a successful mine escape while wearing a self-contained self rescuer, Journal of the International Society for Respiratory Protection, Vol 10, Issue 4. [21] Tadhisa & Yamada (1988) [22] Not used [23] Not used [24] US National Institute for Occupational Safety and Health (1977) Criteria for a recommended standard occupational exposure to Hydrogen Sulphide, DHEW (NIOSH) Publication Number 77-158. [25] Yant, W.P., 1930. Hydrogen Sulphide in Industry: Occurrence, Effects and Treatment in, American Journal of Public Health, 20, p 598. [26] Patty, F.A., Ed. (1963) Hydrogen Sulphide, in Industrial Hygiene and Toxicology, Volume 2 New York: Interscience. [27] Evans, C.L., 1967. The toxicity of Hydrogen Sulphide and other Sulphides in Journal of Experimental Physiology, 52 (3), p 231. [28] Ahlborg, G., (1951) Hydrogen Sulphide Poisoning in Shale Oil Industry in Arfch. Industrial Hygiene and Occupational Medecine, 3, p 247. [29] Gafafer, W.M. Ed. (1964) Hydrogen Sulphide, in Occupational Diseases: A Guide to their Recognition, Public Health Service Publication. No. 1097, US Department of Health, Education and Welfare, Washington, DC, p 163. [30] Poda, G.A., (1966) Hydrogen Sulphide can be Handled Safely in Arch. Environmental Health, 12, p 795. [31] Jones, J.P., (1975) Hazards of Hydrogen Sulphide Gas, Selected Papers from the 23rd Annual Gas Measurement Institute, 16.

13/06/2003

HFINESC.DOC

Page 16


Rev 0

[32] American Conference of Governmental Industrial Hygienists, (1980) Hydrogen Sulphide in Documentation of the Threshold Limit Values, 4th Edition, ACGIH, Cincinnati, p 225. [33] Elkins, H.B., (1952) Hydrogen Sulphide in The Chemistry of Industrial Toxicology, New York: John Wiley & Sons, p 95 & 232. [34] Johnstone, R.T. and Saunders, W.B. (Eds.) (1960) Noxious Gases: Hydrogen Sulphide (H2S) in Occupational Diseases and Industrial Medicine, W.B. Saunders, Philadelphia, p 115. [35] Haggard, H.W., 1928. The Toxicology of Hydrogen Sulphide, Journal of Industrial Hygiene, 7, p 113 [36] Eisenberg et al., (1975) Vulnerability Model. A Simulation Systems for Assessing Damage Resulting from Marine Spills. Nat. Tech. Service Report, AD-A015-245, Springfield, VA [37] Not used [38] Herd C.J., Jones R.H., Lewis K., Evacuation, escape and rescue analysis by integrated risk assessment. In: Risk analysis in the offshore industry II, Aberdeen, 25-27 March 1991. IBC Technical Services. [39] Stoll A.M. and Greene L.C., Relationship between pain and tissue damage due to thermal radiation. J. Appl. Physiol., vol.14, p373, 1959 [40] Not used [41] Crossthwaite, P.J., Fitzpatrick, R.D., Hurst, N.W. Risk assessment for the siting of developments near liquefied petroleum gas installations, IChemE Symposium Series 110 [42] Ketchell N., et al, When and how will people muster. In: Response to incidents offshore, 8-9 June 1993, Aberdeen, IBC Technical Services [43] MUSTER, DNV Technica [44] Kisko T.M., Francis R.L., Noble C.R., EVACNET+ User’s Guide, Gainesville, Florida: University of Florida Department of Industrial and Systems Engineering, April 1984 [45] Evacuation Model, Railway Gazette International, Vol 149, no 10, October 1993, p. 713 [46] Jack M., King D., Practical validation of installation evacuation, escape and rescue (EER) systems. In: Response to incidents offshore, 8-9 June 1993, Aberdeen, IBC Technical Services.

13/06/2003

HFINESC.DOC

Page 17


13/06/2003

HFINESC.DOC

Rev 0

Page 18

HF in the Assessment of E&P Forum QRA Datasheet Directory Fatalities during Evacuation & Rescue

Rev 0

HUMAN FACTORS IN THE ASSESSMENT OF FATALITIES DURING EVACUATION AND RESCUE (OFFSHORE FACILITIES)

13/06/2003

HFINEVAC.DOC

Page 1


Rev 0

TABLE OF CONTENTS GLOSSARY OF TERMS & ABBREVIATIONS ------------------------------------------------- 3 1 INTRODUCTION-------------------------------------------------------------------------------------- 4 2 SCOPE -------------------------------------------------------------------------------------------------- 5 3 APPLICATION ---------------------------------------------------------------------------------------- 6 4 ESTIMATING THE PROPORTION OF PERSONNEL WHO ARE UNABLE TO USE PARTICULAR EVACUATION SYSTEMS------------------------------------------------- 6 4.1 Description --------------------------------------------------------------------------------------------------------------6 4.2 Data Sources ------------------------------------------------------------------------------------------------------------7 4.3 Availability of Data-------------------------------------------------------------------------------------------------- 10

5 HUMAN FACTORS IN LIFEBOAT EVACUATION MODELLING--------------------- 11 5.1 Description ------------------------------------------------------------------------------------------------------------ 11 5.2 Data Sources ---------------------------------------------------------------------------------------------------------- 11 5.3 Availability of Data-------------------------------------------------------------------------------------------------- 13 5.4 Strengths of the Method-------------------------------------------------------------------------------------------- 13 5.5 Limitations of the Method ----------------------------------------------------------------------------------------- 13

6 ESTIMATING FATALITIES DURING EVACUATION BY OTHER MEANS ------- 17 6.1 Description ------------------------------------------------------------------------------------------------------------ 17 6.2 Data Sources ---------------------------------------------------------------------------------------------------------- 17


13/06/2003

HFINEVAC.DOC

Page 2


Rev 0

GLOSSARY OF TERMS & ABBREVIATIONS Term Escape

Abbreviation -

Evacuation

-

Human Error Probability

HEP

Human Reliability Analysis Offshore Installation Manager Personal Protective Equipment Quantified Risk Assessment Rescue

HRA

Task Analysis

-

Totally Enclosed Motor Propelled Survival Craft

TEMPSC

13/06/2003

OIM

Definition The process of personnel leaving the vicinity of an incident and making their way to a safe location. For an offshore installation the safe location is designated the Temporary Refuge A term used to describe the process of leaving the offshore installation in response to an emergency in order to reach a place of permanent safety The nominal probability of a person making an error when performing a task. It is normally on a per opportunity basis. The HEP range is from 10-5 per opportunity to 1 per opportunity. For a given task there can be different error modes, each with a nominal HEP. The HEP is dependent on the characteristics of the task and the attributes of the person (e.g. trained or untrained). Human reliability techniques are used to estimate a HEP A generic term covering all techniques which are used to assess the human component of a system Person in charge of an offshore installation

PPE

-

QRA

-

-

Following evacuation, this is the recovery of personnel to a place of permanent safety A series of techniques used to analyse and assess the activities performed by people within a system A type of lifeboat which satisfies certain requirements specified by the International Maritime Organisation

HFINEVAC.DOC

Page 3


1.

Rev 0

INTRODUCTION

The purpose of this datasheet is to describe Human Factors methods and associated sources of data which are available for incorporation into quantified risk assessment (QRA). The scope of this datasheet relates to determining fatalities during evacuation and rescue. Other datasheets within the directory address methods and data related to other aspects of Human Factors in QRA, these being: • • •

Human Factors in the calculation of loss of containment frequencies (Event Data) Human Factors in determining event outcomes (Safety Systems) Human Factors in determining fatalities during escape and sheltering (Vulnerability)



HAZID study


Frequency analysis




Risk summation


Criteria


13/06/2003

HFINEVAC.DOC

Page 4


2.

Rev 0

SCOPE

This datasheet is concerned with taking account of human performance in the use of evacuation systems other than helicopter evacuation. It supplements the data sheet on Evacuation, Escape and Rescue. In modelling evacuation the QRA analyst is interested in estimating the proportion of personnel who survive. Therefore, the analyst needs to make judgements about: • • •

the proportion who use each of the various evacuation options, of those who use a system, how many would be killed when using it, the proportion who would be killed during rescue.

The main difficulty for an analyst is the scarcity of data, increasing the emphasis on judgement. This is also a problem for providing data on the pertinent Human Factors issues. Although the lack of data is a hindrance, the information in this datasheet is able to provide some assistance to making the required judgements. Not surprisingly there are a number of Human Factors issues in evacuation. For there to be a need to evacuate implies that the perceived threat to life is considerable. Consequently the behaviour of personnel will be greatly affected by the stress of the situation such that: • • • • • •

the choice of actions is unlikely to be systematically thought through or weighed-up against all others over-hasty decisions may be made based on incomplete and insufficient information personnel will begin “running on automatic”. There will be a reduction in the intellectual level, with personnel resorting to familiar actions personnel will focus on the immediate task at hand to the exclusion of others and their ability to take on board new information will be reduced personnel may exhibit rigidity in problem solving, e.g. concentrating on one solution even though it does not work performance on seemingly simple tasks will be greatly affected. Tasks requiring manual dexterity will be very much more difficult and require more time to complete than in normal circumstances

These points are pertinent to the performance of the person in overall charge, referred to here as the Offshore Installation Manager (OIM). As the person with the role of evaluating the incident and choosing if, how and when to evacuate, the decisions of the OIM can influence the outcome. The OIM could evaluate the conditions on the installation correctly and order an evacuation at the most opportune moment. However, the OIM could also: • • •

delay the evacuation, or fail to give the command to evacuate incurring greater fatalities than necessary give the order to evacuate when there is no need to do so and therefore expose the personnel to unnecessary risks choose the wrong mode of evacuation.

The OIM needs to have decision criteria with which to judge the situation in order to choose a strategy. Ambiguity in the criteria and uncertainty or inaccuracies in the information 13/06/2003

HFINEVAC.DOC

Page 5


Rev 0

available introduce the chance of a non-optimum strategy being selected. In addition, the stress of the situation will affect the behaviour of the OIM, and exposure to smoke or other toxic substances can affect his cognitive performance (see datasheet on Human Vulnerability), adding weight to the argument that the OIM will not always choose the optimum strategy. 3.

APPLICATION

There are three sections to this datasheet. The first is concerned with restrictions in the use of evacuation systems. Although it is not possible to provide a definitive statement on the proportion of personnel who could not use an evacuation system, the section lists the Human Factors issues relevant to the limitations of using, or not using an evacuation system. The second section is concerned with Human Factors issues which could be included in the modelling of lifeboat evacuation. It is normal to model lifeboat evacuation as a sequence of stages, with failures (and fatalities) possible in each stage. Although modelling of lifeboat evacuation [1] has provided useful data, it is focused on hardware failures and the effect of sea states on evacuation performance. An aspect which is not well addressed is the likelihood of the evacuation being jeopardised by human failures. It is this aspect which is addressed here. The third section is concerned with fatalities from other modes of evacuation (other than lifeboat), which involve personnel entering and needing to be recovered from the sea. 4.

ESTIMATING THE PROPORTION OF PERSONNEL WHO ARE UNABLE TO USE PARTICULAR EVACUATION SYSTEMS

4.1

Description

If all personnel are able to use an evacuation system, i.e. there are no aspects of the system which they are unable to use, fit into, pass through, etc., the system is available to 100% of the population. If there are demands made which a person cannot meet, it is unavailable to that person. For example, in the evacuation from the Alexander Kjelland, one man had to leave his lifejacket behind in order to get through a hatch when the lifeboat capsized [2] - the hatch was not big enough. Unfortunately the size of the man was not reported, permitting the conclusion to be made that he must have been a "giant of a man". This may not have been the case. Excluding the anecdotal evidence above, there is very little directly useful data covering the issues raised in this section. Therefore the issues are unlikely to be addressed specifically in an analysis. It may be argued that they are covered by assumptions in the evacuation modelling (e.g. assumptions about the proportion of personnel jumping into the sea rather than using a lifeboat). There are three components to the availability of escape and evacuation equipment: • •

Physical dimensions of the system (e.g. seat dimensions preventing largest proportion of personnel from using a lifeboat) Physical strength requirements for operating the system (e.g. using controls, opening lifeboat hatches)

13/06/2003

HFINEVAC.DOC

Page 6


•

Rev 0

Physical and mental tolerances required by the system (e.g. tolerances to motions of a lifeboat, willingness to use the system)

It would be hoped that any system in use on an installation had been selected so as to accommodate all able-bodied users. The availability of systems to injured personnel is more difficult to quantify. Lifeboats can carry one or two stretchers, with freefall boats having a place to fix a flat stretcher or having specially shaped stretchers to strap into a seat. The ability of the injured person to withstand the motions of the boat depend more on the nature of the injuries than on the design of the lifeboat. 4.2

Data Sources

Although the extent of data on evacuation and escape equipment is very limited, this section is included in order to give a framework for considering availability. The focus is on lifeboat systems but the principal concerns are appropriate for other types of equipment. The section is divided into three: • • •

anthropometric restrictions physiological restrictions psychological restrictions

Anthropometric Restrictions The measurement of body size (anthropometry) has a long history and much effort has been expended in cataloguing every conceivable dimension. Unfortunately, although the results of this work can be illuminating, it is difficult to use a list of specific measurements to critically review complex work spaces and draw conclusions about anthropometric problems. Also, it is possible for a person to quite literally squeeze through a space which, according to their “static” measurements, they should not be able to pass. Researchers are beginning to compile “dynamic” measurements for specific work spaces to overcome this inaccuracy. At present, for the type of tasks in lifeboat evacuation for which there may be difficulties due to body size (Table 1) the only type of documented data is “static” anthropometric data as presented in Table 2. Table 1:

Anthropometric Restrictions

Task

Issues/Concerns

Data

Passing through entry hatch Fitting into seat

- Space for entry or exit through hatch. - Wearing of survival clothing. - Population extremes (smallest and largest) in terms of proportions unable to use straps or fit into seats. - Wearing of survival clothing.

Anthropometric data (see table 2) Designed for 70 kg person

To make an anthropometric assessment of the evacuation systems on an installation, the analyst is advised to use more direct methods: check whether there have been problems during drills or organise trials to test the systems. 13/06/2003

HFINEVAC.DOC

Page 7


Rev 0

Table 2: Anthropometric estimates for British Adults aged 19-65 years (in mm) (5th, 50th and 95th percentiles) Dimension

Men

Women

5th

50th

95th

5th

50th

95th

Stature

1625

1740

1855

1505

1610

1710

Shoulder height

1315

1425

1535

1215

1310

1405

Elbow height

1005

1090

1180

930

1005

1085

Hip height

840

920

1000

740

810

885

Knuckle height

690

755

825

660

720

780

Fingertip height

590

655

720

560

625

685

Sitting height

850

910

965

795

850

910

Sitting shoulder height

540

595

645

505

555

610

Sitting elbow height

195

245

295

185

235

280

Knee height

490

545

595

455

500

540

Popliteal height

395

440

490

355

400

445

Shoulder breadth (bideltoid)

420

465

510

355

395

435

Shoulder breadth (biacromial) Hip breadth

365 310

400 360

430 405

325 310

355 370

385 435

Chest (bust) depth

215

250

285

210

250

295

Abdominal depth

220

270

325

205

255

305

Upper limb length

720

780

840

655

705

760

Shoulder-grip length

610

665

715

555

600

650

Head length

180

195

205

165

180

190

Head breadth

145

155

165

135

145

150

Hand length

175

190

205

160

175

190

Vertical grip reach (standing)

1925

2060

2190

1790

1905

2020

Vertical grip reach (sitting)

1145

1245

1340

1060

1150

1235

Forward grip reach

720

780

835

650

705

755

Physiological Restrictions The strength requirements to use equipment and tolerance to the forces and accelerations resulting from using it are possible restrictions of which the second is more significant. Accelerations are experienced in accidental collisions (lifeboat striking the installation structure) or as part of the evacuation process (jumping into the sea from a height, freefall lifeboat launch, motions of the boat). Table 3 gives the average levels of linear acceleration (g), in different directions, that can be tolerated on a voluntary basis for specified periods

13/06/2003

HFINEVAC.DOC

Page 8


Rev 0

(adapted from [3]). The figures are provided for acceleration in the x axes (forwards/backwards) and the z axes (upwards/ downwards). Table 3: Average tolerable levels of linear acceleration (units of g = 9.81 ms-2) Direction of Acceleration

Exposure Time 0.3 secs

6 secs

+ gz

15

11

- gz + gx - gx

7 30 22

6 20 15

30 secs 1 min 8 7 3.5 13 10.5

3 11 8

5 mins 10 mins 20 mins 5

4

3.5

2 7 6

1.5 6 5

1.2 5 4

An approach for evaluating acceleration effects in both conventional and free-fall lifeboats has been developed from the Dynamic Response Model [9], initially developed to study the response of pilots during emergency ejection from aircraft [10]. The Dynamic Response Model uses human tolerance criteria and lifeboat accelerations to infer the response of occupants to accelerations acting at the seat support. The method establishes an index for relating accelerations to potential injury. Three levels of risk for acceleration are defined in terms of the probability of injury, where a high level of risk carries a 50 percent probability of injury, a moderate level has a 5 percent probability and a low level has a 0.5 percent probability. The derived index values are presented in Table 4. Table 4: Dynamic Response Index limits for high, moderate and low risk levels Coordinate axis

Dynamic Response Index limits (g) High Risk

Moderate Risk

Low Risk

-x +y

46.0 22.0

35.0 17.0

28.0 14.0

-y +z -z

22.0 22.8 15.0

17.0 18.0 12.0

14.0 15.2 9.0

With regard to the launch of freefall lifeboats, the accelerations are designed to be within tolerable limits and precautions, such as head straps, are included in some designs to further safeguard the occupants. To date, experience has not revealed the launch process to be intolerable. The motion of the boat can cause seasickness. However, there is little evidence that seasickness contributes to death in the TEMPSC [4]. Psychological Restrictions

13/06/2003

HFINEVAC.DOC

Page 9


Rev 0

The use of relatively new evacuation technology, in particular freefall lifeboats, has raised the issue of the willingness of personnel to use evacuation systems. Discussions with training centres give large differences ranging from no recorded refusals to as many as 1 in a 100. Reasons for refusals include concern over prior back pain/injury. It is suggested that the refusal rate among personnel would vary with the type of emergency event on the installation and with the prevailing weather conditions. Refusals are likely to increase in poor weather conditions, but decrease with increasing perceived danger from the incident. 4.3


As has been stated above, data and information about the availability of evacuation systems is sparse. An analyst may find some useful information within reports on drills or exercises conducted on the installation.

13/06/2003

HFINEVAC.DOC

Page 10


5.

HUMAN FACTORS IN LIFEBOAT EVACUATION MODELLING

5.1

Description

Rev 0

A study on behalf of the Department of Energy [3] provided the data for a model of lifeboat evacuation from offshore installations by traditional davit launched totally enclosed motor propelled survival craft (TEMPSC). The approach taken was to model the evacuation process as a sequence of steps, with all steps needing to be completed successfully for the occupants to reach safety without injury. The model could be used to derive installation specific fatality statistics. As well as estimating the probability of human errors the consequences of those errors must be distinguished. In the worst case errors can cause the loss of the boat, while others may mean that the boat cannot depart but its occupants can leave to use another boat or another mode of evacuation, or that the evacuation can continue by the occupants using secondary systems (such as manually releasing hooks). This ability to recover from a failure is important in the modelling of evacuation. Software models are available for assessing lifeboat evacuation, examples being ESCAPE and FARLIFE. The ESCAPE programme [11] is based on the Department of Energy study [3]. The FARLIFE programme [12] is a time based simulator which can use the same data and can include operational errors within the model. 5.2

Data Sources

Time to perform tasks Time based modelling requires data on the times to perform tasks such as embarking, releasing hooks etc. The types of tasks which may be included in the modelling, with suggested times, are listed in Table 5. The required data on task times could be derived from monitoring practice drills, although performance in emergency conditions is likely to be different and allowance for the stress and possible confusion of the situation should be factored into the figures. Factors which affect time to complete tasks are: •

•

% loading of the lifeboat. For most craft the space per person makes the cabin cramped when nearing full loading. Therefore the time taken to embark is not linearly related to the percentage loading (e.g. 100% of capacity will take more than twice the time to load 50% of capacity). presence of trained crew. The crew have specific roles to play which includes checking the boat, controlling the embarkation and operating the controls and other lifeboat systems during descent and departure. The lack of a trained crew would extend the time required to evacuate and increase the probability of errors being made.

13/06/2003

HFINEVAC.DOC

Page 11


Rev 0

Table 5: Estimated Times for tasks in evacuation by traditional davit-launched lifeboat (TEMPSC) Task

Nominal Time

Identify boat is useable (i.e. functioning of systems are checked)

2 min

Embark

6 min

Assess information and decide to descend

30 secs

Delay in descending (if there are difficulties with operating the descent system) Assess information and decide to disconnect

2 min

Delay with disconnection (if there are difficulties with operating the disconnection system) Disconnect Release hooks manually (if there are difficulties with operating the primary release system) Manoeuvre from immediate vicinity of the installation

15 secs 2 min 10 secs 3 min 10 secs

Significant Human Errors A comparative review of davit-launched and freefall lifeboat systems [5] estimated the most likely human errors which would be made during evacuation and defined their consequence. The errors, sub-divided between the following four stages of evacuation, are listed in Table 6 and 7: • • • •

preparing to embark the craft. This involves checking the integrity and safety of the lifeboat including the protection systems such as sprinkler system and air supply. embarkation. This involves getting into the boat. release of the craft from the installation. For a freefall boat this involves strapping in and activating the release mechanism. For a conventional boat it includes the lowering of the boat into the water and releasing it from the wires. moving away from the installation. This includes starting the propulsion system (although this may have been done earlier in the sequence) and manoeuvring the boat away from the structure.

For each identified error the median error probability (per launch) is given along with an error factor. The error factor is guide to the range of a particular error probability. To get the “best” and “worst” estimates of error probability divide and multiply the median error value with the error factor. The data is for use within a comprehensive model of lifeboat evacuation and can be used by an analyst to distinguish between lifeboat types. For example, if two makes of davit launched boat were to be compared, the analyst could adjust each error according to the design of each boat, with a “better” designed boat being given lower human error rates.

13/06/2003

HFINEVAC.DOC

Page 12


5.3

Rev 0


If possible the times for lifeboat evacuation should be based on drills on the actual installation and factored to take account of emergency conditions. The human error probabilities for lifeboat evacuation performance are based on expert judgement. 5.4


Since lifeboat evacuation is normally chosen only when other options are unavailable (e.g. helicopter evacuation, remain until the event is over) it is probable that there will be limited time available to get the lifeboat away from the platform before some life threatening event occurs. Therefore, the time taken to evacuate should be modelled. In the best case the evacuation will be performed smoothly, without delays. However, the data provided enables a model to take account of delays due to difficulties or errors made in the launching process. 5.5

Limitations of the Method

The amount of detail which can be incorporated into the modelling of lifeboat evacuation may make it necessary to develop or acquire a software tool in order to do so. Uncertainties in the assumptions such as the proportion of fatalities during recovery from the lifeboat by helicopter or to a standby vessel (which could be assumed to be up to 5%) can mean that a refined model of lifeboat evacuation is not merited.

13/06/2003

HFINEVAC.DOC

Page 13

HF in the Assessment of Fatalities During Evacuation & Rescue

Table 6:

Rev 0

Estimated human errors probabilities (HEP) and possible outcome in evacuation by freefall lifeboat

Stage

Error

Estimated HEP (and EF1) 10-2(5) 10-1(10) 10-2(3) 10-2(10)

Prepare to embark

Hook release not checked Hook release check fails Fail to correct hook release fault Cradle orientation not checked

Death or injury Death or injury Death or injury Death or injury

10-2(10)

Death or injury

10-3(3)

Death or injury

10-2(5)

Death or injury

Recovery winch connection not checked Fails to detach connected recovery winch

10-2(5)

Occupants stranded in boat

10-3(10)

Occupants stranded in boat

Embarkation

Fail to embark (scenario dependent)

10-3(100) 10-2(3)

Departure

Stretcher carried into boat in wrong orientation Straps not used correctly by a passenger Primary release system used incorrectly Secondary system used incorrectly

Death or injury of an individual Departure delayed

Cradle orientation check fails Fail to correct cradle orientation Protection systems not checked

Move Away

1


Gearbox/prop check not done Gearbox/prop check fails Steering check not done Steering system check fails Starting controls not identified Unable to start propulsion system

Contingent Conditions (necessary for the outcome to be realised) Hook attached Catastrophic fault in hook system Catastrophic fault in hook system Cradle not angled correctly after maintenance/drill Cradle not positioned correctly after maintenance/drill Cradle not positioned correctly after maintenance/drill One or more protection systems has a catastrophic fault

10-3(5)

System has a fault System has a fault System has a fault System has a fault System has a fault System has a fault

Outcome

10-3(5)

Death or injury to the occupant Departure delayed

10-3(5) 10-2(10) 10-3(10) 10-2(10) 10-3(10) 10-3(5) 10-3(5)

Departure delayed Unmanoeuvrable boat Unmanoeuvrable boat Unmanoeuvrable boat Unmanoeuvrable boat Unmanoeuvrable boat Unmanoeuvrable boat

EF= Error Factor

13/06/2003

HFINEVAC.DOC

Page 14


Table 7:


Rev 0

Estimated human errors probabilities (HEP) and possible outcome in evacuation by conventional davit-launched lifeboat

Stage

Error

Contingent Conditions (necessary for the outcome to be realised)

Estimated HEP (EF)

Possible outcome

Prepare to embark

Davit structure not checked Davit structure check fails Winch system not checked Winch system check fails Maintenance Pendants not checked Maintenance Pendants check fails Winch system not checked Winch system check fails Hook release not checked Hook release check fails Fails to correct hook release fault Winch system not checked Winch system check fails All passengers do not embark Stretcher-bound injured do not embark

Catastrophic fault in structure Catastrophic fault in structure Catastrophic fault in winch system Catastrophic fault in winch system Maintenance pendants attached Maintenance pendants attached Winch system not functioning Winch system not functioning Release system not functioning Release system not functioning Release system not functioning Winch system fails during descent Winch system fails during descent

10-3(5) 10-3(3) 10-2(10) 10-2(10) 10-2(5) 10-2(10) 10-2(10) 10-2(10) 10-2(5) 10-1(10) 10-2(3) 10-2(10) 10-2(10) 10-3(100) 10-3(5) 10-3(5) 10-3(5) 10-3(5) 10-3(5) 10-3(5) 10-3(5) 10-3(5) 10-2(10)

Death or injury Death or injury Death or injury Death or injury Departure Prevented Departure Prevented Departure Prevented Departure Prevented Occupants Stranded Occupants Stranded Occupants Stranded Occupants Stranded Occupants Stranded Death or injury of person

Embarkation Departure

13/06/2003

Primary release system used incorrectly Secondary system (if available) used incorrectly Brake release not continuous Wrong controls selected Primary hook release system controls not operated Occupants do not know how to use hook release Occupants don’t know how to manually release hooks Occupants do not know how to override hydrostatic hook release system interlock

HFINEVAC.DOC

Departure Delayed Departure Delayed Departure Delayed Departure Delayed Departure Delayed Departure Delayed Departure Delayed Departure Delayed

Page 15


Move Away

13/06/2003


Incorrect direction navigated Secondary manual release mechanism not operated Primary release mechanism not operated Incorrect direction navigated Gearbox/prop check not done Gearbox/prop check fails Steering check not done Failure of steering check Starting controls not identified Unable to start propulsion system

HFINEVAC.DOC

Rev 0

10-2(5) 10-3(5) 10-3(5) 10-2(5) 10-2(10) 10-3(10) 10-2(10) 10-3(10) 10-3(5) 10-3(5)

Death or injury Departure Prevented Departure Delayed Departure Delayed Unmanoeuvr. Boat Unmanoeuvr. Boat Unmanoeuvr. Boat Unmanoeuvr. Boat Unmanoeuvr. Boat Unmanoeuvr. Boat

Page 16

HF in the Assessment of E&P Forum QRA Datasheet Directory Fatalities During Evacuation & Rescue

Rev 0

6.

ESTIMATING FATALITIES DURING EVACUATION BY OTHER MEANS

6.1

Description

It is a common assumption within a QRA analysis that some personnel leave an installation by means such as a ladder down a jacket leg, knotted rope or jumping from a deck. An analyst needs to consider the likelihood of fatalities for these forms of evacuation. Compared to the modelling of lifeboat evacuation, the level of sophistication employed for such estimates is low. The crudest approach is to apply a fatality estimate to each mode of evacuation. A more detailed approach is to divide the evacuation and rescue process into several phases (e.g. enter water, await recovery, recovery) and make estimates for fatalities in each phase while allowing for the dominant factors such as weather condition (e.g. calm, moderate, severe). Data to support estimates is sparse, placing the emphasis on the judgement of the analyst. 6.2

Data Sources

Escape to Sea The following statistics for fatality rates are given as guidelines. Table 8:

Guidelines for fatality estimates

Mode

Factors

Fatality ranges

Data Source

Personnel killed by escaping direct to sea

Jumping height

1-5% for low heights

Judgement

5-20% for large heights

Judgement

Survival in the water The following survival time data is for personnel not wearing survival suits [6]. Table 9:

50% Survival Times for Conventionally Clothed Persons in Water [6] Water temperature (degree Celsius) 2.5

Survival time for 50% of persons (hrs)

5

1

7.5

1.5

10

2

12.5

3

15

6

0.75

For personnel wearing a survival suit the time is significantly increased. New designs have been shown to protect for over 4 hours at 4 degrees [7]. Further information is presented in the Vulnerability of Humans data sheet. 13/06/2003

HFINEVAC.DOC

Page 17


Rev 0

For the QRA analyst a key concern will be the number who have successfully donned survival suits and life jackets before entering the water. Given that personnel who escape to sea are unlikely to have had much time to prepare for their escape, the likelihood of them putting on the safety clothing will be dependent on its accessibility. The analyst should consider whether the equipment is provided at the probable points of alighting the platform or whether they are stowed in remote lockers. Recovery from the sea A review of the performance of attendant vessels in emergencies offshore [8] suggests that the success for recovering personnel from the sea ranges between approx. 10% to 95% depending on the type of vessel and weather conditions. 7.

ONGOING RESEARCH

Design of evacuation systems are evolving to meet the demands of the offshore sector. Significant changes, such as the freefall lifeboat or the addition of orientation mechanisms to traditional lifeboats (e.g. PROD - Preferred Orientation and Displacement System, TOES TEMPSC Orientation and Evacuation System), pose problems for the QRA analyst as they have no reference data on which to base assumptions.

13/06/2003

HFINEVAC.DOC

Page 18


8.

Rev 0

REFERENCES

[1] Technica (1983) Risk Assessment of Emergency Evacuation from Offshore Installations A study carried out for the UK Department of Energy, Technica-F.158, November 1983. [2] Bignell, V. and Fortune, J. (1984) Understanding systems failures Milton Keynes: Open University Press. [3] Sanders, M.S. and McCormick, E.J (1987). Human Factors in Engineering and Design. Ch17 pp 486-517 6th Edition, McGraw-Hill International Editions 1987. [4] Landolt, J. P. Ph.D., B.Eng., Monaco, C. B.Eng. (1989), Seasickness in Occupants of Totally-Enclosed Motor-Propelled Survival Craft (TEMPSC), Defence & Civil Institute of Environmental Medicine, Department of National Defence CANADA, 1133 Sheppard Avenue West, P.O. Box 2000, Downsview Ontario [5] Four Elements (1993) Freefall versus davit launched lifeboats: Human Factors study, project ref 2334 [6] Golden FstC: Hypothermia a Problem for North Sea Industries. Jou. Soc. Occup. Med. 26, 85-88, 1976 [7] Health and Safety at Work, Tolley Publishing Co Ltd, Croydon, vol 13, no 12, 1991. [8] Technica, The Performance of Attendant Vessels in Emergencies Offshore, A study carried out for the UK Department of Energy, OTH 97 274, 1987 [9] Brinkley, J.W (1984). Personnel Protection concepts for advanced escape system design AGARD conference proceedings, Human Factors Consideration in High Performance Aircraft, pp6-1 - 6-12. [10] Nelson, J.K., Hirsch, T.J. and Phillips, N.S (1989). Evaluation of Occupant accelerations in lifeboats. Journal of Offshore Mechanics and Arctic Engineering pp344349, Vol III, November 1989. [11] ESCAPE, DNV Technica [12] FARLIFE, Four Elements, 1993

13/06/2003

HFINEVAC.DOC

Page 19


13/06/2003

HFINEVAC.DOC

Rev 0

Page 20

E P Forum QRA Data Directory

Recommend Documents