OGP Risk Assessment Data Directory, Report No. 434, Compiled, 2010

Risk Assessment Data Directory Report No. 434 March 2010

Summary International Association of Oil & Gas Producers

P

ublications

Global experience The International Association of Oil & Gas Producers has access to a wealth of technical knowledge and experience with its members operating around the world in many different terrains. We collate and distil this valuable knowledge for the industry to use as guidelines for good practice by individual members.

Consistent high quality database and guidelines Our overall aim is to ensure a consistent approach to training, management and best practice throughout the world. The oil and gas exploration and production industry recognises the need to develop consistent databases and records in certain fields. The OGP’s members are encouraged to use the guidelines as a starting point for their operations or to supplement their own policies and regulations which may apply locally.

Internationally recognised source of industry information Many of our guidelines have been recognised and used by international authorities and safety and environmental bodies. Requests come from governments and non-government organisations around the world as well as from non-member companies.

Disclaimer Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms. This document may provide guidance supplemental to the requirements of local legislation. Nothing herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.

Copyright notice The contents of these pages are © The International Association of Oil and Gas Producers. Permission is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii) the source are acknowledged. All other rights are reserved.” Any other use requires the prior written permission of the OGP. These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.

Risk Aassessment data directory – summary

Background At the end of 1996, the E&P Forum (the previous name of OGP) completed and issued the Risk Assessment Data Directory. Its aim was to provide a catalogue of information that could be used to improve the quality and consistency of risk assessments with readily available benchmark data and references for common types of incident analysed in upstream production operations. Incidents typically analysed in E&P risk assessments were identified and divided into four major categories, within which twenty-six individual datasheets were developed. Each datasheet contained information describing the event: incident frequency, population and causal data and a discussion of the data sources, range, availability and application. These datasheets were made available to OGP members and other interested parties in a loose bound file. They were also available as electronic Word documents and more recently as PDF files in the members’ area of the OGP website (http://members.ogp.org.uk). In 2006, OGP’s Safety Committee formed a task force to consider the future of the data directory. As a first step, the task force undertook a survey of staff in member companies to establish the level of interest in the existing data directory and in an updated directory. The survey showed strong interest in an update. The task force acted accordingly. Another OGP document, Guidelines for the development and application of health, safety and environmental management systems (1994), identifies “evaluation and risk management” as a key element of an effective HSE management system. The use of formal risk assessment in achieving the goal-setting objectives of this element has become widely accepted in the E&P industry. It is now an essential framework in recent legislation. Experience shows that the application of risk assessment is important both to improved plant and system integrity and to cost effectiveness. It provides valuable information for risk-based decision-making. Formal risk assessment is a structured, systematic process. It supplements traditional design and risk management processes. It can be based on qualitative or quantitative methods or a combination thereof. The objective of formal risk assessment is to analyse and evaluate risk. Risk assessment is made up of the following fundamental steps: hazard identification to identify what could go wrong, consequence assessment to address the potential effects, frequency assessment to determine the underlying causes and likelihood or probability of occurrence of a hazardous event, assessing the risks and evaluating potential risk reduction measures. In risk assessment, frequency is estimated based on knowledge and expert judgment, historical experience, and analytical methods. These combine to support judgments made by risk assessment teams. Historical experience is expressed in terms of statistical data gathered from existing operations, generally in the form of incidents, base failure rates and failure probabilities. A key issue when using risk assessment is the uncertainties associated with the results. This has a bearing on the confidence with which the information can be used to influence decisions. Therein lies the need for reliable data to support E&P risk assessment work.

Risk Assessment Data Directory The objective of the Risk assessment data directory is to provide data and information that can be used to improve the quality and consistency of risk assessments with readily available benchmark data. The directory includes references for common incidents analysed in upstream production operations. The original 1996 data directory included 26 individual datasheets. The updated directory (2009) now includes 20 datasheets, although the scope of the material presented is similar to the original with some reorganisation. The structure of four major categories from the 1996 directory is retained. Each datasheet contains: • • • •

information describing the event incident frequency population and causal data a discussion of the data sources, range, availability and application.

©OGP

1

International Association of Oil & Gas Producers

The intention is that the Risk assessment data directory may facilitate the systematic assessment of risks within individual OGP member companies and across the E&P industry. It is hoped that the updated directory will continue to be a valuable reference document. Examples of specific applications of the directory include: • • • • •

Estimating screening level and order of magnitude incident frequencies Reviewing external risk assessment (ie those performed by consultants, design contractors, etc) Evaluating risk in QRAs and qualitative assessments Comparing industry and corporate performance Identifying important risk contributors

The directory also provides reference lists of data sources that can be consulted for more detailed information. The directory is not intended to be a comprehensive source of incident data. Applications requiring more comprehensive data should consult the original references as well as other publicly available information and company data sources. Sources for the data include information available to the public and industry such as may be obtained from industry projects and the literature. That is, the directory contains organised publicly available information and data contributed by individual companies, which has been previously submitted by others. While every reasonable effort has been made to ensure the quality and accuracy of the information and data provided, it is the responsibility of each company or organisation using the data to review the information and determine that the material is suitable for their specific application.

Directory update process The original data directory was developed as a QRA Subcommittee activity without any central funding of external consultants. For this, update the task force decided to rely on a centrally funded consultant to update and revise the datasheet in a consistent manner. With this approach in mind, a number of consultants operating in the risk assessment field were invited to submit bids for the update of the entire data directory. They were also invited to make proposals for how the directory might be modified or improved based on their experience and developments made in the quantitative risk assessment field in recent years. The work was awarded to DNV Energy, which proposed some deletions, recombination and additional datasheets. To spread the cost to OGP, update work was commenced in 2007 and continued through 2008 and into the early part of 2009. A focal point for each datasheet was appointed. He or she had the responsibility of collecting and compiling comments from the task force and their organisations on the various datasheets. Periodic meetings with DNV Energy provided opportunities to discuss and agree the comments. OGP agreed to make the datasheets available on the OGP website and carried out the necessary work to do this. Datasheets are available as PDF files and also provide hyperlinks to other more detailed or useful data sources. As a quality assurance check, an independent expert reviewed the draft directory. After approval from the OGP Safety Committee, the Data Directory was issued in the third quarter of 2009. As with all OGP documents the data directory is available to the public at no charge.

2

©OGP

Risk Aassessment data directory – summary

Directory scope and content The directory covers both onshore and offshore E&P activities. The data have been collated under four major categories: Accident data:

Collated statistical data of accidents (i.e., events that have led to detrimental effects in terms of loss of life, environmental damage or property damage)

Event data:

Collated statistical data of hazardous events (i.e., events that led to or had the potential to lead to an accident)

Safety systems:

Collated statistical data on the reliability of various safety systems employed to prevent and/or mitigate hazardous events.

Vulnerabilities:

Criteria for assessing the vulnerability of plant and humans to hazardous events.

Under each category, there is a series of individual datasheets. The original 1996 Data Directory had a total of 26 datasheets as follows: Accident Data 7; Event Data 8; Safety Systems 6; Vulnerabilities 5. In the updated directory the number of datasheets in each category is revised to 6, 8, 1 and 4 respectively. These changes arise from reordering, recombination, splitting and deletion of certain datasheets. Accident and Event datasheet subject matter remains largely unchanged with the exception that separate Ignition Probability and Consequence modelling datasheets have been created. This type of data was then removed from other event datasheets. The four human factors datasheets from the 1996 directory have been organised in a single human factors datasheet. Extreme weather has been included in the structural failure risks datasheet. These changes leave a total of twenty datasheets as listed below: Accident data:

Major accidents Occupational risk Land transport accident statistics Aviation transport accident statistics Water transport accident statistics Construction risk for offshore units

Event data:

Process release frequencies Risers & pipeline release frequencies Storage incident frequencies Blowout frequencies Mechanical lifting failures Ship/installation collisions Ignition probabilities Consequence modelling Structural risk for offshore installations

Safety systems:

Guide to finding and using reliability data for QRA

Vulnerabilities:

Vulnerability of humans Vulnerability of plant/structure Escape, evacuation and rescue Human factors in QRA

©OGP

3

International Association of Oil & Gas Producers

The basic content of each datasheet is as follows: 1. Scope and application

Brief outline of data presented in datasheet and details of the situation for which the datasheet would be applicable. This includes statements regarding where care should be exercised in its use.

2. Summary of recommended data:

Data presented in a tabular and/or graphical format.

3. Guidance on data use:

Guidance on general validity and precautions to be applied in using the data. Consideration of uncertainties.

4. Review of data sources:

The data sources used to obtain the data presented in section 2.

5. Recommended data sources for further information:

Listing of sources of more detailed and specific data.

6. References:

Detailed list of references.

Note that the format presented above is general. Individual datasheets vary to some extent, depending on relevance and availability of information. The objective has been to identify so far as practical data available in the public domain and to discuss their applicability. However in a few isolated cases, reference is made to data not publicly available yet held by an OGP. Where this is the case, the judgment of the RADD Task Force is that these data are sufficiently robust to include even though the user is not able to source the data directly. It is not the intention of the Directory to address or comment in any way on the best approach or methods for risk assessment studies. In some of the datasheets, particularly for Safety Systems, the key data presented are in terms of how ‘reliable’ these systems are. “Reliability Analysis” is a distinct specialist area. Any detailed assessment would require expert assistance. Another area that is recognised as directly influencing the frequency of accidents and events is Human factors. Again, this is a distinct specialist area, which would require expert assistance if any detailed assessment work was to be undertaken. It should also be noted that there are many other areas where expert assistance would be needed to undertake an in-depth study, eg assessing structural vulnerabilities or marine hazards.

Updating plans It is recognised and accepted that the data presented in OGP’s Risk assessment data directory will become out-of-date. Nevertheless, many of the data bases identified are actively maintained and by directly accessing these source databases, up-to-date information can be obtained. This update is the first to take place since the directory was originally issued in 1996/97. This is considered too long a delay between revisions. New arrangements will allow users to provide feedback on errors, omissions and potential revisions or any new or better information, or data from other geographic areas on the OGP website. Users and other interested parties are encouraged to make use of this facility. OGP will then arrange to review this information periodically and update the datasheets as required. Some datasheets have been allocated to other OGP Task Forces or Subcommittees to maintain the data more frequently.

4

©OGP

Risk Assessment Data Directory Report No. 434 – 1 March 2010

Process release frequencies International Association of Oil & Gas Producers

RADD – Process release frequencies

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Equipment ....................................................................................................... 1 Release types .................................................................................................. 2

2.0

Summary of Recommended Data ............................................ 2

3.0 3.1 3.2 3.3

Guidance on use of data ...................................................... 19 General validity ............................................................................................. 19 Uncertainties ................................................................................................. 20 Definition of release types ........................................................................... 20

3.3.1 3.3.2 3.3.3

Full releases.............................................................................................................. 20 Limited releases ....................................................................................................... 21 Zero pressure releases ............................................................................................ 21

3.4 3.5

Consequence modelling for the largest release size ................................ 21 Modification of frequencies for factors specific to plant conditions ....... 22

3.5.1 3.5.2 3.5.3 3.5.4 3.5.5

General considerations ........................................................................................... 22 API 581 Approach..................................................................................................... 22 Safety Management.................................................................................................. 24 Inter-unit piping ........................................................................................................ 25 Flanges...................................................................................................................... 26

4.0 4.1

Review of data sources ....................................................... 27 Basis of data presented ............................................................................... 27

4.1.1 4.1.2 4.1.3 4.1.4 4.1.5

Summary of release statistics................................................................................. 28 Methodology for obtaining release frequencies ................................................... 28 Uncertainties in release frequencies...................................................................... 29 Comparison with experience .................................................................................. 29 Conclusions.............................................................................................................. 30

4.2

Other data sources ....................................................................................... 30

5.0

Recommended data sources for further information ............ 31

6.0 6.1 6.2

References .......................................................................... 31 References for Sections 2.0 to 4.0 .............................................................. 31 References for other data sources examined ............................................ 32

©OGP

RADD – Process release frequencies

Abbreviations: ANSI API DNV ESD HC HCRD HSE LNG OREDA OSHA PSM QRA UKCS

American National Standards Institute American Petroleum Institute Det Norske Veritas Emergency Shutdown Hydrocarbon Hydrocarbon Release Database (UK) Health and Safety Executive Liquefied Natural gas Offshore Reliability Data Occupational Safety and Health Administration Process Safety Management Quantitative Risk Assessment (sometimes Analysis) United Kingdom Continental Shelf

©OGP

RADD – Process release frequencies

1.0

Scope and Definitions

1.1

Equipment

This datasheet presents (Section 2.0) frequencies of releases from the following process equipment types. They are intended to be applied to process equipment on the topsides of offshore installations and on onshore facilities handling hydrocarbons but are not restricted to releases of hydrocarbons. 1. Steel process pipes

10. Compressors: Reciprocating

2. Flanges

11. Heat exchangers: Shell & Tube, shell side HC

3. Manual valves

12. Heat exchangers: Shell & Tube, tube side HC

4. Actuated valves 5. Instrument connections

13. Heat exchangers: Plate

6. Process (pressure) vessels

14. Heat exchangers: Air-cooled

7. Pumps: Centrifugal

15. Filters

8. Pumps: Reciprocating

16. Pig traps (launchers/receivers)

9. Compressors: Centrifugal

OREDA [1] gives frequencies of releases from subsea equipment. If these are used, it should be noted that these are based on only a small number of incidents (a total of 13 from several different components) and so are subject to considerable statistical uncertainty. It is suggested that use of onshore/topsides failure frequencies, i.e. the frequencies for the corresponding equipment types from nos. 1 to 16 above, is preferable. The precise definition of each equipment type is given with the data in Section 2.0. Besides the equipment defined in the above list, the equipment types listed in Table 1.1 are also covered by the data given in Section 2.0. Table 1.1 Other Equipm ent Types Covered Equipment Type

See Datasheet or Section No.

Equipment Type

See Datasheet or Section No.

Absorbers

6

Grayloc flanges

Clamp connections Columns

2 6

Knock-out drums Pipe connections

6 2

Distillation columns

6

Process reactors

6

ESD valves Fin-fan coolers

4 14

Reactors Scrubbers

6 6

Fittings (small-bore)

5

Separators

6

Small-bore fittings

5

Gaskets

Section 3.5.5

©OGP

Section 3.5.5

1

RADD – Process release frequencies

1.2

Release types

According to analysis of historic process release frequency data [2], releases can be split into three different types: •

Full releases: consistent with flow through the defined hole, beginning at the normal operating pressure, and continuing until controlled by emergency shut-down and blowdown (if present and operable) or inventory exhaustion. This scenario is invariably modelled in any QRA.

•

Lim ited releases: cases where the pressure is not zero but the quantity released is much less than from a full release. This may be because the release is isolated locally by human intervention (e.g. closing an inadvertently opened valve), or by a restriction in the flow from the system inventory (e.g. releases of fluid accumulated between pump shaft seals). This scenario may be modelled, depending on the detail of the QRA, but the consequences should reflect the limited release quantities.

•

Zero pressure releases: cases where pressure inside the leaking equipment is virtually zero (0.01 barg or less). This may be because the equipment has a normal operating pressure of zero (e.g. open drains), or because the equipment has been depressurised for maintenance. This scenario is typically excluded from QRA, and is included mainly for consistency with the original HSE data (see Sections 3.3, 4.0).

Therefore, the release frequencies are tabulated for each of these release types, as well as the overall frequencies for all release types taken together being tabulated1.

2.0

Summary of Recommended Data

A datasheet is given below for each of the equipment types listed in Section 1.1. The definitions given of the equipment types are consistent with those used by the UK HSE.

1

Note that these overall frequencies are not the sum of the frequencies for each release type; they are calculated by a separate mathematical function, as described in Section 4.1.2, fitted to the release data. 2

©OGP

RADD – Process release frequencies

Equipment Type: (1) Steel process pipes Definition: Offshore: Includes pipes located on topsides (between well and riser) and subsea (between well and pipeline). Onshore: Includes pipes within process units, but not inter-unit pipes or cross-country pipelines. The scope includes welds but excludes all valves, flanges, and instruments. (a) All piping release frequencies (per metre year) by pipe diameter HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 9.0E-05 3.8E-05 2.7E-05 0.0E+00 0.0E+00 1.5E-04

6" DIA (150 mm) 4.1E-05 1.7E-05 7.4E-06 7.6E-06 0.0E+00 7.4E-05

12" DIA (300 mm) 3.7E-05 1.6E-05 6.7E-06 1.4E-06 5.9E-06 6.7E-05

18" DIA (450 mm) 3.6E-05 1.5E-05 6.5E-06 1.4E-06 5.9E-06 6.5E-05

24" DIA (600 mm) 3.6E-05 1.5E-05 6.5E-06 1.4E-06 5.9E-06 6.5E-05

36" DIA (900 mm) 3.6E-05 1.5E-05 6.5E-06 1.4E-06 5.9E-06 6.5E-05

(b) Full piping release frequencies (per metre year) by pipe diameter HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 5.5E-05 1.8E-05 7.0E-06 0.0E+00 0.0E+00 8.0E-05

6" DIA (150 mm) 2.6E-05 8.5E-06 2.7E-06 6.0E-07 0.0E+00 3.8E-05

12" DIA (300 mm) 2.3E-05 7.6E-06 2.4E-06 3.7E-07 1.7E-07 3.4E-05

18" DIA (450 mm) 2.3E-05 7.5E-06 2.4E-06 3.6E-07 1.7E-07 3.3E-05

24" DIA (600 mm) 2.3E-05 7.4E-06 2.4E-06 3.6E-07 1.6E-07 3.3E-05

36" DIA (900 mm) 2.3E-05 7.4E-06 2.3E-06 3.6E-07 1.6E-07 3.3E-05

(c) Limited piping release frequencies (per metre year) by pipe diameter HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 3.1E-05 1.5E-05 1.3E-05 0.0E+00 0.0E+00 5.9E-05

6" DIA (150 mm) 9.9E-06 4.9E-06 2.5E-06 3.2E-06 0.0E+00 2.0E-05

12" DIA (300 mm) 8.1E-06 4.0E-06 2.0E-06 5.2E-07 2.4E-06 1.7E-05

18" DIA (450 mm) 7.8E-06 3.8E-06 1.9E-06 5.0E-07 2.4E-06 1.6E-05

24" DIA (600 mm) 7.7E-06 3.8E-06 1.9E-06 4.9E-07 2.4E-06 1.6E-05

36" DIA (900 mm) 7.6E-06 3.7E-06 1.9E-06 4.9E-07 2.4E-06 1.6E-05

(d) Zero pressure piping release frequencies (per metre year) by pipe diameter HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 3.7E-06 2.7E-06 6.0E-06 0.0E+00 0.0E+00 1.24E-05

6" DIA (150 mm) 3.2E-06 2.3E-06 1.9E-06 3.4E-06 0.0E+00 1.07E-05

12" DIA (300 mm) 3.1E-06 2.3E-06 1.8E-06 7.7E-07 2.6E-06 1.06E-05

©OGP

18" DIA (450 mm) 3.1E-06 2.3E-06 1.8E-06 7.6E-07 2.6E-06 1.05E-05

24" DIA (600 mm) 3.1E-06 2.3E-06 1.8E-06 7.6E-07 2.6E-06 1.05E-05

36" DIA (900 mm) 3.1E-06 2.3E-06 1.8E-06 7.6E-07 2.6E-06 1.05E-05

3

RADD – Process release frequencies

Equipment Type: (2) Flanges Definition: The following frequencies refer to a flanged joint, comprising two flange faces, a gasket (where fitted), and two welds to the pipe. Flange types include ring type joint, spiral wound, clamp (Grayloc) and hammer union (Chicksan). (a) All flange release frequencies (per flanged joint year) by flange diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 4.4E-05 1.8E-05 1.5E-05 0.0E+00 0.0E+00 7.6E-05

6" DIA (150 mm) 6.5E-05 2.6E-05 1.1E-05 8.5E-06 0.0E+00 1.1E-04

12" DIA (300 mm) 9.6E-05 3.9E-05 1.6E-05 3.2E-06 7.0E-06 1.6E-04

18" DIA (450 mm) 1.2E-04 5.1E-05 2.1E-05 4.1E-06 7.6E-06 2.1E-04

24" DIA (600 mm) 1.5E-04 6.2E-05 2.5E-05 5.1E-06 8.2E-06 2.5E-04

36" DIA (900 mm) 2.1E-04 8.5E-05 3.4E-05 6.9E-06 9.3E-06 3.4E-04

(b) Full flange release frequencies (per flanged joint year) by flange diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 2.6E-05 7.6E-06 4.0E-06 0.0E+00 0.0E+00 3.8E-05

6" DIA (150 mm) 3.7E-05 1.1E-05 3.0E-06 2.0E-06 0.0E+00 5.3E-05

12" DIA (300 mm) 5.9E-05 1.7E-05 4.7E-06 6.1E-07 1.7E-06 8.3E-05

18" DIA (450 mm) 8.3E-05 2.4E-05 6.6E-06 8.7E-07 1.8E-06 1.2E-04

24" DIA (600 mm) 1.1E-04 3.2E-05 8.8E-06 1.1E-06 1.9E-06 1.5E-04

36" DIA (900 mm) 1.7E-04 4.9E-05 1.4E-05 1.8E-06 2.2E-06 2.4E-04

(c) Limited flange release frequencies (per flanged joint year) by flange diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 1.5E-05 7.9E-06 8.6E-06 0.0E+00 0.0E+00 3.2E-05

6" DIA (150 mm) 2.3E-05 1.2E-05 6.4E-06 5.4E-06 0.0E+00 4.7E-05

12" DIA (300 mm) 3.1E-05 1.6E-05 8.7E-06 2.4E-06 4.3E-06 6.2E-05

18" DIA (450 mm) 3.8E-05 2.0E-05 1.1E-05 2.9E-06 4.8E-06 7.5E-05

24" DIA (600 mm) 4.4E-05 2.3E-05 1.2E-05 3.4E-06 5.2E-06 8.7E-05

36" DIA (900 mm) 5.4E-05 2.8E-05 1.5E-05 4.1E-06 5.9E-06 1.1E-04

(d) Zero pressure flange release frequencies (per flanged joint year) by flange diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

4

2" DIA (50 mm) 1.5E-06 1.1E-06 2.0E-06 0.0E+00 0.0E+00 4.6E-06

6" DIA (150 mm) 1.7E-06 1.2E-06 1.0E-06 1.3E-06 0.0E+00 5.3E-06

12" DIA (300 mm) 2.6E-06 1.9E-06 1.5E-06 6.4E-07 1.4E-06 7.9E-06

©OGP

18" DIA (450 mm) 4.2E-06 3.1E-06 2.5E-06 1.1E-06 2.2E-06 1.3E-05

24" DIA (600 mm) 6.7E-06 4.9E-06 4.0E-06 1.7E-06 3.5E-06 2.1E-05

36" DIA (900 mm) 1.4E-05 1.1E-05 8.6E-06 3.6E-06 7.6E-06 4.5E-05

RADD – Process release frequencies

Equipment Type: (3) Manual valves Definition: Includes all types of manual valves (block, bleed, check and choke); valve types gate, ball, plug, globe, needle and butterfly. The scope includes the valve body, stem and packer, but excludes flanges, controls and instrumentation. (a) All manual valve release frequencies (per valve year) by valve diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 4.4E-05 2.3E-05 2.1E-05 0.0E+00 0.0E+00 8.8E-05

6" DIA (150 mm) 6.6E-05 3.4E-05 1.8E-05 1.1E-05 0.0E+00 1.3E-04

12" DIA (300 mm) 8.4E-05 4.3E-05 2.3E-05 6.3E-06 7.8E-06 1.7E-04

18" DIA (450 mm) 9.8E-05 5.0E-05 2.7E-05 7.3E-06 8.7E-06 1.9E-04

24" DIA (600 mm) 1.1E-04 5.6E-05 3.0E-05 8.0E-06 9.5E-06 2.1E-04

36" DIA (900 mm) 1.3E-04 6.4E-05 3.4E-05 9.3E-06 1.1E-05 2.4E-04

(b) Full manual valve release frequencies (per valve year) by valve diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 2.0E-05 7.7E-06 4.9E-06 0.0E+00 0.0E+00 3.2E-05

6" DIA (150 mm) 3.1E-05 1.2E-05 4.7E-06 2.4E-06 0.0E+00 5.0E-05

12" DIA (300 mm) 4.3E-05 1.7E-05 6.5E-06 1.2E-06 1.7E-06 6.9E-05

18" DIA (450 mm) 5.3E-05 2.1E-05 8.0E-06 1.5E-06 1.9E-06 8.5E-05

24" DIA (600 mm) 6.2E-05 2.4E-05 9.4E-06 1.8E-06 2.1E-06 1.0E-04

36" DIA (900 mm) 7.8E-05 3.0E-05 1.2E-05 2.2E-06 2.3E-06 1.2E-04

(c) Limited manual valve release frequencies (per valve year) by valve diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 2.4E-05 1.4E-05 1.4E-05 0.0E+00 0.0E+00 5.1E-05

6" DIA (150 mm) 2.7E-05 1.5E-05 9.5E-06 6.4E-06 0.0E+00 5.8E-05

12" DIA (300 mm) 3.2E-05 1.8E-05 1.1E-05 3.5E-06 4.1E-06 6.9E-05

18" DIA (450 mm) 3.7E-05 2.1E-05 1.3E-05 4.1E-06 4.8E-06 8.1E-05

24" DIA (600 mm) 4.3E-05 2.5E-05 1.5E-05 4.7E-06 5.5E-06 9.3E-05

36" DIA (900 mm) 5.4E-05 3.1E-05 1.9E-05 6.0E-06 7.0E-06 1.2E-04

(d) Zero pressure manual valve release frequencies (per valve year) by valve diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 3.6E-07 3.5E-07 2.4E-06 0.0E+00 0.0E+00 3.1E-06

6" DIA (150 mm) 7.1E-07 6.9E-07 7.8E-07 4.0E-06 0.0E+00 6.2E-06

12" DIA (300 mm) 1.1E-06 1.1E-06 1.2E-06 7.1E-07 5.4E-06 9.5E-06

©OGP

18" DIA (450 mm) 1.4E-06 1.4E-06 1.6E-06 9.2E-07 7.0E-06 1.2E-05

24" DIA (600 mm) 1.7E-06 1.7E-06 1.9E-06 1.1E-06 8.5E-06 1.5E-05

36" DIA (900 mm) 2.2E-06 2.1E-06 2.4E-06 1.4E-06 1.1E-05 1.9E-05

5

RADD – Process release frequencies

Equipment Type: (4) Actuated valves Definition: Includes all types of actuated valves (block, blowdown, choke, control, ESDV and relief), but not actuated pipeline valves (pipeline ESDV and SSIV). Valve types include gate, ball, plug, globe and needle. The scope includes the valve body, stem and packer, but excludes flanges, controls and instrumentation. (a) All actuated valve release frequencies (per valve year) by valve diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 4.2E-04 1.8E-04 1.1E-04 0.0E+00 0.0E+00 7.1E-04

6" DIA (150 mm) 3.6E-04 1.5E-04 6.6E-05 3.3E-05 0.0E+00 6.2E-04

12" DIA (300 mm) 3.3E-04 1.4E-04 6.0E-05 1.3E-05 1.8E-05 5.6E-04

18" DIA (450 mm) 3.1E-04 1.3E-04 5.6E-05 1.2E-05 1.8E-05 5.3E-04

24" DIA (600 mm) 3.0E-04 1.3E-04 5.4E-05 1.1E-05 1.8E-05 5.0E-04

36" DIA (900 mm) 2.8E-04 1.2E-04 5.0E-05 1.1E-05 1.7E-05 4.7E-04

(b) Full actuated valve release frequencies (per valve year) by valve diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 2.4E-04 7.3E-05 3.0E-05 0.0E+00 0.0E+00 3.5E-04

6" DIA (150 mm) 2.2E-04 6.6E-05 1.9E-05 8.6E-06 0.0E+00 3.2E-04

12" DIA (300 mm) 2.1E-04 6.3E-05 1.8E-05 2.4E-06 6.0E-06 3.0E-04

18" DIA (450 mm) 2.0E-04 6.0E-05 1.7E-05 2.3E-06 5.9E-06 2.9E-04

24" DIA (600 mm) 2.0E-04 5.9E-05 1.7E-05 2.2E-06 5.9E-06 2.8E-04

36" DIA (900 mm) 1.9E-04 5.6E-05 1.6E-05 2.2E-06 5.9E-06 2.7E-04

(c) Limited actuated valve release frequencies (per valve year) by valve diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

2" DIA (50 mm) 1.7E-04 8.8E-05 7.8E-05 0.0E+00 0.0E+00 3.3E-04

6" DIA (150 mm) 1.3E-04 6.9E-05 3.8E-05 2.3E-05 0.0E+00 2.6E-04

12" DIA (300 mm) 1.1E-04 5.7E-05 3.2E-05 9.0E-06 1.1E-05 2.2E-04

18" DIA (450 mm) 9.7E-05 5.1E-05 2.8E-05 8.0E-06 9.8E-06 1.9E-04

24" DIA (600 mm) 8.9E-05 4.7E-05 2.6E-05 7.3E-06 9.2E-06 1.8E-04

36" DIA (900 mm) 7.7E-05 4.1E-05 2.3E-05 6.4E-06 8.3E-06 1.6E-04

(d) Zero pressure actuated valve release frequencies (per valve year) by valve diameter

HOLE DIA RANGE (mm) 1 to 3 3 to 10 10 to 50 50 to 150 >150 TOTAL

6

2" DIA (50 mm) 1.1E-05 7.8E-06 1.3E-05 0.0E+00 0.0E+00 3.2E-05

6" DIA (150 mm) 1.8E-05 1.3E-05 9.6E-06 1.1E-05 0.0E+00 5.1E-05

12" DIA (300 mm) 2.5E-05 1.7E-05 1.3E-05 5.2E-06 9.3E-06 6.9E-05

©OGP

18" DIA (450 mm) 3.0E-05 2.1E-05 1.6E-05 6.2E-06 1.1E-05 8.3E-05

24" DIA (600 mm) 3.4E-05 2.3E-05 1.8E-05 7.1E-06 1.3E-05 9.5E-05

36" DIA (900 mm) 4.1E-05 2.8E-05 2.2E-05 8.5E-06 1.5E-05 1.1E-04

RADD – Process release frequencies

Equipment Type: (5) Instrument connections Definition: Includes small-bore connections for flow, pressure and temperature sensing. The scope includes the instrument itself plus up to 2 instrument valves, 4 flanges, 1 fitting and associated small-bore piping, usually 25 mm diameter or less. Instrument connection release frequencies (per instrument year; sizes 10 to 50 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

3.5E-04

1.8E-04

1.6E-04

8.8E-06

3 to 10 10 to 50 TOTAL

1.5E-04 6.5E-05

6.8E-05 2.5E-05

7.4E-05 3.6E-05

5.5E-06 3.8E-06

5.7E-04

2.8E-04

2.7E-04

1.8E-05

©OGP

7

RADD – Process release frequencies

Equipment Type: (6) Process (pressure) vessels Definition: Offshore: Includes all types of pressure vessel (horizontal/vertical absorber, knock-out drum, reboiler, scrubber, separator and stabiliser), but not the HCRD category “other”, which are mainly hydrocyclones. Onshore: Includes process vessels and columns, but not storage vessels. The scope includes the vessel itself and any nozzles or inspection openings, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Pressure vessel release frequencies (per vessel year; connections 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3 3 to 10

9.6E-04 5.6E-04

3.9E-04 2.0E-04

3.5E-04 2.0E-04

1.8E-04 1.4E-04

10 to 50 >50 TOTAL

3.5E-04

1.0E-04

1.2E-04

1.2E-04

2.8E-04 2.2E-03

5.1E-05 7.4E-04

7.9E-05 7.4E-04

1.8E-04 6.3E-04

Pressure vessel release frequencies (per vessel year; connections >150 mm diameter)

8

HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

1 to 3

9.6E-04

3.9E-04

3.5E-04

ZERO PRESSURE RELEASES 1.8E-04

3 to 10

5.6E-04

2.0E-04

2.0E-04

1.4E-04

10 to 50 50 to 150

3.5E-04 1.1E-04

1.0E-04 2.7E-05

1.2E-04 3.7E-05

1.2E-04 5.5E-05

>150 TOTAL

1.7E-04

2.4E-05

4.2E-05

1.4E-04

2.2E-03

7.4E-04

7.4E-04

6.3E-04

©OGP

RADD – Process release frequencies

Equipment Type: (7) Pumps: Centrifugal Definition: Centrifugal pumps including single-seal and double-seal types*. The scope includes the pump itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. * Analysis has shown that there is no statistical difference between single- and double-seal types for releases in the size range considered. Centrifugal pump release frequencies (per pump year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

5.1E-03

3.4E-03

1.3E-03

2.4E-04

3 to 10 10 to 50 >50

1.8E-03 5.9E-04

1.0E-03 2.9E-04

5.6E-04 2.4E-04

1.4E-04 9.4E-05

1.4E-04

5.4E-05

8.3E-05

7.2E-05

TOTAL

7.6E-03

4.8E-03

2.2E-03

5.5E-04

Centrifugal pump release frequencies (per pump year; inlets >150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3 3 to 10

5.1E-03 1.8E-03

3.4E-03 1.0E-03

1.3E-03 5.6E-04

2.4E-04 1.4E-04

10 to 50

5.9E-04

2.9E-04

2.4E-04

9.4E-05

50 to 150 >150

9.7E-05 4.8E-05

3.9E-05 1.5E-05

5.0E-05 3.3E-05

3.1E-05 4.1E-05

TOTAL

7.6E-03

4.8E-03

2.2E-03

5.5E-04

©OGP

9

RADD – Process release frequencies

Equipment Type: (8) Pumps: Reciprocating Definition: Reciprocating pumps including single-seal and double-seal types*. The scope includes the pump itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. * Analysis has shown that there is no statistical difference between single- and double-seal types for releases in the size range considered. Reciprocating pump release frequencies (per pump year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

3.3E-03

2.1E-03

8.9E-04

0.0E+00

3 to 10 10 to 50 >50

1.9E-03 1.2E-03

1.2E-03 7.4E-04

6.2E-04 4.7E-04

0.0E+00 0.0E+00

8.0E-04

5.0E-04

5.3E-04

0.0E+00

TOTAL

7.2E-03

4.5E-03

2.5E-03

0.0E+00

Reciprocating pump release frequencies (per pump year; inlets >150 mm diameter)

10

HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

3.3E-03

2.1E-03

8.9E-04

0.0E+00

3 to 10

1.9E-03

1.2E-03

6.2E-04

0.0E+00

10 to 50 50 to 150 >150

1.2E-03 3.7E-04

7.4E-04 2.3E-04

4.7E-04 1.9E-04

0.0E+00 0.0E+00

4.3E-04

2.7E-04

3.4E-04

0.0E+00

TOTAL

7.2E-03

4.5E-03

2.5E-03

0.0E+00

©OGP

RADD – Process release frequencies

Equipment Type: (9) Compressors: Centrifugal Definition: The scope includes the compressor itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Centrifugal compressor release frequencies (per compressor year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

6.7E-03

3.4E-03

2.9E-03

3.7E-04

3 to 10 10 to 50 >50

2.6E-03 1.0E-03

6.8E-04 1.3E-04

1.4E-03 7.4E-04

2.4E-04 1.8E-04

3.0E-04

1.3E-05

3.5E-04

1.8E-04

TOTAL

1.1E-02

4.2E-03

5.5E-03

9.6E-04

Centrifugal compressor release frequencies (per compressor year; inlets >150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

1 to 3

6.7E-03

3.4E-03

2.9E-03

ZERO PRESSURE RELEASES 3.7E-04

3 to 10

2.6E-03

6.8E-04

1.4E-03

2.4E-04

10 to 50 50 to 150 >150

1.0E-03 1.9E-04

1.3E-04 1.0E-05

7.4E-04 1.9E-04

1.8E-04 6.7E-05

1.1E-04

2.5E-06

1.6E-04

1.1E-04

TOTAL

1.1E-02

4.2E-03

5.5E-03

9.6E-04

©OGP

11

RADD – Process release frequencies

Equipment Type: (10) Compressors: Reciprocating Definition: The scope includes the compressor itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Reciprocating compressor release frequencies (per compressor year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

4.5E-02

2.4E-02

1.9E-02

0.0E+00

3 to 10 10 to 50 >50

1.7E-02 6.7E-03

8.0E-03 2.6E-03

9.4E-03 4.7E-03

0.0E+00 0.0E+00

2.0E-03

8.8E-04

2.2E-03

0.0E+00

TOTAL

7.1E-02

3.6E-02

3.6E-02

0.0E+00

Reciprocating compressor release frequencies (per compressor year; inlets >150 mm diameter)

12

HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

4.5E-02

2.4E-02

1.9E-02

0.0E+00

3 to 10

1.7E-02

8.0E-03

9.4E-03

0.0E+00

10 to 50 50 to 150 >150

6.7E-03 1.3E-03

2.6E-03 4.0E-04

4.7E-03 1.2E-03

0.0E+00 0.0E+00

7.3E-04

4.8E-04

1.0E-03

0.0E+00

TOTAL

7.1E-02

3.6E-02

3.6E-02

0.0E+00

©OGP

RADD – Process release frequencies

Equipment Type: (11) Heat exchangers: Shell & Tube, shell side HC Definition: Shell & tube type heat exchangers with hydrocarbon in the shell side. The scope includes the heat exchanger itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

2.2E-03

1.2E-03

1.2E-03

0.0E+00

3 to 10

1.1E-03

4.1E-04

7.3E-04

0.0E+00

10 to 50 >50

5.6E-04 2.6E-04

1.4E-04 3.6E-05

4.9E-04 4.0E-04

0.0E+00 0.0E+00

TOTAL

4.1E-03

1.8E-03

2.8E-03

0.0E+00

Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3 3 to 10

2.2E-03 1.1E-03

1.2E-03 4.1E-04

1.2E-03 7.3E-04

0.0E+00 0.0E+00

10 to 50

5.6E-04

1.4E-04

4.9E-04

0.0E+00

50 to 150 >150

1.4E-04 1.2E-04

2.4E-05 1.2E-05

1.7E-04 2.3E-04

0.0E+00 0.0E+00

TOTAL

4.1E-03

1.8E-03

2.8E-03

0.0E+00

©OGP

13

RADD – Process release frequencies

Equipment Type: (12) Heat exchangers: Shell & Tube, tube side HC Definition: Shell & tube type heat exchangers with hydrocarbon in the tube side. The scope includes the heat exchanger itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

2.0E-03

8.2E-04

7.9E-04

1.8E-04

3 to 10 10 to 50 >50

8.8E-04 4.0E-04

3.8E-04 1.8E-04

4.3E-04 2.5E-04

7.7E-05 3.4E-05

2.0E-04

7.6E-05

1.9E-04

1.3E-05

TOTAL

3.4E-03

1.5E-03

1.7E-03

3.0E-04

Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm diameter)

14

HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3 3 to 10

2.0E-03 8.8E-04

8.2E-04 3.8E-04

7.9E-04 4.3E-04

1.8E-04 7.7E-05

10 to 50

4.0E-04

1.8E-04

2.5E-04

3.4E-05

50 to 150 >150

9.1E-05 1.1E-04

4.3E-05 3.3E-05

7.4E-05 1.2E-04

7.7E-06 5.4E-06

TOTAL

3.4E-03

1.5E-03

1.7E-03

3.0E-04

©OGP

RADD – Process release frequencies

Equipment Type: (13) Heat exchangers: Plate Definition: The scope includes the heat exchanger itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

5.1E-03

3.9E-03

2.7E-03

0.0E+00

3 to 10 10 to 50 >50

2.8E-03 1.6E-03

2.0E-03 1.1E-03

1.3E-03 6.7E-04

0.0E+00 0.0E+00

9.9E-04

6.3E-04

3.2E-04

0.0E+00

TOTAL

1.0E-02

7.3E-03

5.0E-03

0.0E+00

Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3 3 to 10

5.1E-03 2.8E-03

3.9E-03 2.0E-03

2.7E-03 1.3E-03

0.0E+00 0.0E+00

10 to 50

1.6E-03

1.1E-03

6.7E-04

0.0E+00

50 to 150 >150

4.8E-04 5.1E-04

3.2E-04 3.1E-04

1.7E-04 1.5E-04

0.0E+00 0.0E+00

TOTAL

1.0E-02

7.3E-03

5.0E-03

0.0E+00

©OGP

15

RADD – Process release frequencies

Equipment Type: (14) Heat exchangers: Air-cooled Definition: Often referred to as fin-fan coolers but in principle includes all air-cooled type heat exchangers. The scope includes the heat exchanger itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Heat exchanger release frequencies (per heat exchanger year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

1.0E-03

1.0E-03

0.0E+00

0.0E+00

3 to 10 10 to 50 >50

4.9E-04 2.4E-04

4.9E-04 2.4E-04

0.0E+00 0.0E+00

0.0E+00 0.0E+00

1.1E-04

1.1E-04

0.0E+00

0.0E+00

TOTAL

1.0E-03

1.0E-03

0.0E+00

0.0E+00

Heat exchanger release frequencies (per heat exchanger year; inlets >150 mm diameter)

16

HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

1 to 3

1.0E-03

1.0E-03

0.0E+00

ZERO PRESSURE RELEASES 0.0E+00

3 to 10

4.9E-04

4.9E-04

0.0E+00

0.0E+00

10 to 50 50 to 150 >150

2.4E-04 6.0E-05

2.4E-04 6.0E-05

0.0E+00 0.0E+00

0.0E+00 0.0E+00

4.9E-05

4.9E-05

0.0E+00

0.0E+00

TOTAL

1.0E-03

1.0E-03

0.0E+00

0.0E+00

©OGP

RADD – Process release frequencies

Equipment Type: (15) Filters Definition: The scope includes the filter body itself and any nozzles or inspection openings, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Filter release frequencies (per filter year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

1 to 3

2.0E-03

1.3E-03

5.1E-04

ZERO PRESSURE RELEASES 1.3E-04

3 to 10

1.0E-03

5.1E-04

3.3E-04

9.3E-05

10 to 50 >50

5.2E-04 2.6E-04

1.9E-04 5.5E-05

2.3E-04 2.1E-04

7.7E-05 1.0E-04

TOTAL

3.8E-03

2.1E-03

1.3E-03

4.0E-04

Filter release frequencies (per filter year; inlets >150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

2.0E-03

1.3E-03

5.1E-04

1.3E-04

3 to 10 10 to 50

1.0E-03 5.2E-04

5.1E-04 1.9E-04

3.3E-04 2.3E-04

9.3E-05 7.7E-05

50 to 150 >150 TOTAL

1.4E-04

3.5E-05

8.4E-05

3.3E-05

1.2E-04 3.8E-03

2.0E-05 2.1E-03

1.3E-04 1.3E-03

7.2E-05 4.0E-04

©OGP

17

RADD – Process release frequencies

Equipment Type: (16) Pig traps Definition: Includes pig launchers and pig receivers. The scope includes the pig trap itself, but excludes all attached valves, piping, flanges, instruments and fittings beyond the first flange. The first flange itself is also excluded. Pig trap release frequencies (per pig trap year; inlets 50 to 150 mm diameter) HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

1 to 3

3.2E-03

2.3E-03

7.4E-04

ZERO PRESSURE RELEASES 2.7E-04

3 to 10

1.9E-03

7.2E-04

5.6E-04

2.3E-04

10 to 50 >50

1.2E-03 8.3E-04

2.2E-04 4.7E-05

4.8E-04 7.1E-04

2.3E-04 5.2E-04

TOTAL

7.0E-03

3.3E-03

2.5E-03

1.3E-03

Pig trap release frequencies (per pig trap year; inlets >150 mm diameter)

18

HOLE DIA RANGE (mm)

ALL RELEASES

FULL RELEASES

LIMITED RELEASES

ZERO PRESSURE RELEASES

1 to 3

3.2E-03

2.3E-03

7.4E-04

2.7E-04

3 to 10 10 to 50

1.9E-03 1.2E-03

7.2E-04 2.2E-04

5.6E-04 4.8E-04

2.3E-04 2.3E-04

50 to 150 >150 TOTAL

3.7E-04

3.3E-05

2.1E-04

1.1E-04

4.6E-04 7.0E-03

1.4E-05 3.3E-03

5.0E-04 2.5E-03

4.1E-04 1.3E-03

©OGP

RADD – Process release frequencies

3.0

Guidance on use of data

3.1

General validity

The data presented in Section 2.0 can be used for process equipment on the topsides of offshore installations and for onshore facilities handling hydrocarbons2, and could also be used as appropriate for subsea completions. DNV [3] have compared failure rate data for LNG facilities with the data presented in Section 2.0. The comparison indicates that LNG failure frequencies may be around 40% to 65% of those given here. However, this has not been verified and the data for LNG installations is relatively sparse. We therefore recommend use of the same frequencies for LNG installations as given in Section 2.0. A 50% reduction could be considered as a sensitivity but decisions based on this would need to be fully justified. The release frequencies given in Section 2.0 are valid for holes of diameter (d) from 1 mm to the diameter of the equipment (D). Frequencies of smaller holes may be estimated by extrapolation of the frequencies to smaller hole sizes, but this is beyond the range of the HSE data (see Section 4.0). The data are not sufficient to determine the frequencies of larger holes (e.g. long splits or guillotine breaks allowing flow from both sides) and this can only be addressed using engineering judgment. The release frequencies are valid for equipment diameters (D) within the normal range of offshore equipment. This is not precisely defined in the available equipment population data. Using judgment based on the trends of the estimated diameter dependence and the average diameters of the available data groups, the following ranges of validity are suggested: •

Pipes:

20 to 1000 mm

•

•

Flanges: 10 to 1000 mm Manual valves: 10 to 1000 mm

•

•

•

Actuated valves: 10 to 1000 mm

Instruments: • Pig traps: mm All other equipment: 40 to 400 mm

10 to 100 mm 100 to

1000

With lesser confidence, the datasheets in Section 2.0 can be used to estimate frequencies over larger ranges, but they should be subject to sensitivity testing. These functions have been checked for mathematical consistency over a range of equipment diameters from 10 to 1000 mm. The frequencies are not recommended for equipment outside this range.

2

The justification for using offshore data for onshore facilities is two-fold. First, no public domain dataset for onshore facilities is available that is comparable to HCRD, considering both the equipment population and completeness of recording releases. Second, although offshore facilities operate in a more challenging (e.g. more corrosive) environment, this is compensated for in the design, inspection and maintenance. Hence there is no apparent reason why onshore and offshore release frequencies should differ significantly. However, some environmental factors are considered in Section 3.5. The standard of the safety management system is also believed to have a major influence on release frequencies, regardless of operating environment, as also discussed in Section 3.5. ©OGP

19

RADD – Process release frequencies

3.2

Uncertainties

The sources of uncertainties in the estimated release frequencies are discussed in Section 4.1.3. The uncertainty in the release frequencies presented in Section 2.0 tends to be greatest for large hole sizes, for equipment sizes far from the centres of the ranges of validity given in Section 3.1, and for equipment types where fewer releases have been recorded (see Section 4.1.1). No quantitative representations of the uncertainty in the release frequency results have yet been derived. Based on the sensitivity test that have been conducted and on previous analyses of the same dataset, the uncertainly in the results may be a factor or 3 (higher or lower) for frequencies of holes in the region of 1 mm diameter, rising to a factor of 10 (higher or lower) for frequencies of holes in the region of 100 mm diameter. A simple sensitivity test would therefore be to use the frequencies for All releases in place of the Full release frequencies.

3.3

Definition of release types

The three release frequency types defined in Section 1.0, and for which frequencies are given separately in Section 2.0, are described in further detail in the following subsections. 3.3.1

Full releases

This scenario is intended to be consistent with QRA models that assume a release through the defined hole, beginning at the normal operating pressure, until controlled by ESD and blowdown, with a small probability of ESD/blowdown failure. Full releases are defined as cases where the outflow is greater than or broadly comparable with that predicted for a release at the operating pressure (since the normal pressure is unknown in HCRD) controlled by the quickest credible ESD (within 1 minute) and blowdown (nominally a 30 mm orifice3). This is subdivided as follows: •

ESD isolated releases, presumed to be controlled by ESD and blowdown of the leaking system.

•

Late isolated releases, presumed to be cases where there is no effective ESD of the leaking system, resulting in a greater outflow.

Typical use in the QRA: These events should always be included in quantified risk assessments. They have the potential of developing into serious events endangering personnel and critical safety functions. These releases represent approximately 31% of all releases in the HSE HCRD for 19922006.

3

The actual orifice diameter should be used in QRA modelling, or preferably the orifice diameter that gives blowdown to a specified pressure in the actual time 20

©OGP

RADD – Process release frequencies

3.3.2

Limited releases

This scenario includes all other pressurised releases. They are defined as cases where the equipment is under pressure (over 0.01 barg) but the outflow is less than from a release at the operating pressure controlled by the quickest credible ESD (within 1 minute) and blowdown (through an orifice nominally of 30 mm diameter). This may be because the release is isolated locally by human intervention (e.g. closing an inadvertently opened valve), or by a restriction in the flow from the system inventory (e.g. releases of fluid accumulated between pump shaft seals). Typical use in the QRA: a) Coarse QRAs. Limited Releases should normally be included in the risk analysis, and treated as Full Releases with regards to the consequence modelling. This is a conservative approach, which normally is in line with the nature of Coarse QRA. b) Detailed QRAs. Limited Releases could be considered for their expected (realistic) consequences. These events may be of concern for personnel risk, but it is less likely that they develop into any major concern for other safety functions, such as structural integrity, evacuation means, escalation, etc. Any consequence calculations should reflect that these events involve limited release volumes. If the consequences are not specifically assessed, the approach of a) above apply also for detailed QRAs. There are two possible approaches to modelling these releases, depending on whether the limitation is on the duration (through prompt local isolation) or the flow (through a restriction). In the first case (limited duration), flow is likely to be at the same release rate as for a full release but reduced to a short duration (e.g. 30 seconds). In the second case, the release rate will be much lower than for the corresponding full release and the quantity released also smaller. In this case an approach previously suggested [4] has been to model the flow rate as 8% of the full release rate and the duration as 6% of the full release duration. These releases represent approximately 59% of all releases in the HSE HCRD for 19922006. 3.3.3

Zero pressure releases

This scenario includes all releases where the pressure inside the releasing equipment is virtually zero (0.01 barg or less). This may be because the equipment has a normal operating pressure of zero (e.g. open drains), or because the equipment has been depressurised for maintenance. Typical use in the QRA (but not limited to this example): These are events that typically are excluded from QRA assessments. Most likely there are no serious consequences and if so, the contribution to the overall risk level is considered insignificant. These events are mainly included for consistency with the original HSE data.

The event is likely to result in release of a small quantity of hydrocarbon. This could be taken as the inventory of the system hydrocarbon full at atmospheric pressure. These releases represent approximately 10% of all releases in the HSE HCRD for 1992-2006.

3.4

Consequence modelling for the largest release size

Where the data tables in Section 2.0 show “>50 mm” or “>150 mm” for the largest hole diameter range, the consequences of the release should be modelled using the size of the actual pipe/valve/flange or the largest connection to other equipment types.

©OGP

21

RADD – Process release frequencies

3.5

Modification of frequencies for factors specific to plant conditions

3.5.1

General considerations

The frequencies tabulated in Section 2.0 are generic frequencies for installations designed and operating to “typical” European / North American standards. A large number of possible factors may suggest that these generic frequencies ought to be modified to make them specific to the local conditions. These factors include the physical characteristics of the equipment, the operating conditions, and characteristics of the management system in place. Factors related to the physical characteristics and operating conditions could include: • • • • •

Design code Material of construction Fluid inside equipment Operating pressure Operating temperature

• • • • •

Operating environment Cold or hot weather Equipment age Seismic activity Integrity status

• • • •

Process continuity Stress cycling Welds Radiography

Many of these are addressed in Section 8.3 of API 581 1st ed. [14], discussed in Section 3.5.2. Some more specific factors relating to inter-unit piping and flanges are presented in Sections 3.5.3 (piping) and 3.5.5 (flanges). The influence of safety management, well recognized as influencing release rates, is discussed in Section 3.5.3. 3.5.2

API 581 Approach

3.5.2.1 1st Edition An equipment modification factor is developed for each equipment item, based on the specific environment in which the item operates. This factor is composed of four subfactors illustrated in Figure 3.1. These subfactors are summarised as follows: •

The Technical Module Subfactor is the systematic method used to assess the effect of specific failure mechanisms on the likelihood of failure. The module evaluates: 1. The deterioration rate of the equipment item’s material of construction (i.e. corrosion), resulting from its operating environment. 2. The effectiveness of the facility’s inspection programme to identify and monitor the operative damage mechanisms prior to failure.

•

The Universal Subfactor covers conditions that equally affect all equipment items in the facility: plant condition, cold weather operation, and seismic activity.

•

The M echanical Subfactor addresses conditions related primarily to the design and fabrication of the equipment item.

•

Conditions that are most influenced by the process and how the facility is operated are included in the Process Subfactor.

The API 581 document provides full details of how the four factors can be evaluated individually and combined to obtain the overall equipment modification factor for each equipment item. This can then be applied to the generic frequencies given in Section 2.04. 4

However, it should be noted that Section 8.2 of API 581 includes generic leak frequencies for many of the equipment types covered in this Datasheet. The factors are presumably intended to be used with those frequencies, although there is nothing to suggest that this is obligatory. Hence the equipment modification factor approach set out in API 581 is considered suitable for more detailed analysis based on the generic frequencies presented in this datasheet.

22

©OGP

RADD – Process release frequencies

Figure 3.1 Overview of Equipm ent Modification Factor (from API 581 1st ed.)

©OGP

RADD – Process release frequencies

3.5.2.2 Possible Changes for 2nd Edition The 2nd edition is currently out for consultation with interested parties so its final content is not fixed. However, some of the proposed changes affect the approach summarised in Section 3.5.2.1 as follows: •

Parts of the universal and mechanical subfactors will be removed.

•

The entirety of the process subfactor will be removed.

•

Additional factors will be introduced to address very specific issues: − − − − − − −

Thinning Component lining damage Stress corrosion cracking External corrosion Brittle fracture Embrittlement Piping mechanical fatigue

Users of the API 581 1st edition approach are recommended to apprise themselves of changes in the 2nd edition, which will be finalised subsequent to the issue of this datasheet. 3.5.3

Safety Management

The quality of operation, inspection, maintenance etc is a critical influence on release frequencies, as illustrated by the Flixborough accident (Section 2.4). The selected pipe release frequencies reflect safety management in UK offshore installations during 19922006, which is believed to be a good modern standard. The release frequencies at plants with lesser standards may be much higher. In order to reflect the standard of safety management at an individual plant, it is possible to quantify this using a safety management audit, and convert the audit score into an overall management factor (MF), by which all the generic failure frequencies can be multiplied. Due to lack of experience with this technique, the relationship between the audit scores and management factors is highly speculative. Several such techniques have been used, of which the most recent studies [11][12] suggest that MF values should lie between 0.1 and 10.0 (i.e. from 10 times better than average to 10 times worse than average)5. API 581 [14] provides a management systems evaluation audit scheme, summarised in Section 8.4 and set out in full in a workbook forming Appendix III. The subject areas, from the OSHA PSM standard [14], are: • • • • • • •

Leadership and administration Process safety information Process hazard analysis Management of change Operating procedures Safe work practices Training

• • • • • •

5

Mechanical integrity Pre-startup safety review Emergency response Incident investigation Contractors Audits

Although it has been suggested [13] that the degradation in plant condition that occurred at Bhopal as a result of safety management deficiencies led to the risk of a major accident increasing by a factor of 1000. 24

©OGP

RADD – Process release frequencies

The audit comprises 101 questions, and the answers are scored to obtain a percentage. This is converted to a management factor that applies to the whole unit or facility studied. The conversion is based on assuming, first, that an “average” US petrochemical plant would score 50%, giving a management factor of 1 (i.e. generic frequencies, which are multiplied by this factor, are unchanged). A “perfect” score of 100% would yield an order of magnitude reduction in total unit risk, i.e. a factor of 0.1. A score of 0% would result in an order of magnitude increase in total unit risk, i.e. a factor of 10. Figure 3.2 shows the resulting conversion graph. Figure 3.2 Frequency Moification Factor vs. Managem ent System Evaluation (API 581)

Note that the scoring is stated to be against an “average US petrochemical plant”. Since the frequencies presented in Section 2.0 are based on offshore UKCS data, it should not be assumed that safety management in that environment is comparable with that on an average US petrochemical plant. However, no comparative study and corresponding conversion system has been developed for offshore UK, hence use of this system requires some care and guidance is beyond the scope of this datasheet. 3.5.4

Inter-unit piping

The frequencies given in datasheet 1 for steel piping are, for onshore installations, intended to be applied within process units. For piping linking process units (inter-unit pipe) and piping to/from storage or loading facilities (transfer pipe), the following release frequency modification factors can be applied: • •

Inter-unit pipe: Transfer pipe:

0.9 0.8

These have been derived from detailed analysis of the causes of piping failure [5] and application to this analysis of judgemental modifications to account for the differences in inter-unit and transfer pipes [6].

©OGP

25

RADD – Process release frequencies

3.5.5

Flanges

Studies [7], [8] of the effect of flange type on flange failure frequency developed modification factors to the frequencies presented on datasheet 2. These functions should be applied when performing detailed risk analyses where the flange types are known, alternatively as decision input to design when flange types are to be decided. The flange types considered are: • • • •

ANSI Ring Joint ANSI Raised faced Compact flange Grayloc flange.

The release frequency for each flange type is based on the release frequency for flange from HCRD data. HCRD data for flanges include ring joint, spiral wound, Grayloc and hammer union, but the contribution from each type can not be identified from the flange frequency. The ANSI Ring Joint, at this time the most common flange type, is assumed to be represented by the HCRD data for flanges. Because different flanges will have different failure modes, and thereby both different release frequencies and different distribution of release frequencies, dependent on hole size or release rate, the release frequency for the different flange types will be adjusted relative to the release frequency for ANSI Ring Joint flanges. The resulting modification factors are set out in Table 3.1.

26

©OGP

RADD – Process release frequencies

Table 3.1 Release Frequency Modifications for Different Flange Types Flange type

Hole diameter range (mm)

ANSI Ring Joint

Modification

1-3

None

3-10 10-50

None None

50-150

None

>150 1-3

None 10% of total flange release frequency

3-10

10% of total flange release frequency

10-50

30% of total flange release frequency

50-150

30% of total flange release frequency

>150 1-3

20% of total flange release frequency × 0.062

3-10

× 0.062

10-50 50-150

× 0.062 × 0.991

>150

× 0.991

1-3 3-10

× 0.064 × 0.064

10-50

× 0.064

50-150 >150

× 1.020 × 1.020

ANSI Raised Face

Compact

Grayloc

4.0

Review of data sources

4.1

Basis of data presented

The release frequencies for the main process equipment items presented in Section 2.0 are based on an analysis of the HSE hydrocarbon release database (HCRD) for 19922006 [9], according to a methodology described in [4]. An overview of this methodology is given in Section 4.1.2. The HSE hydrocarbon release database (HCRD) has become the standard source of release frequencies for offshore QRA and provides a large, high-quality collection of release experience, now available on-line. All offshore releases of hydrocarbons are required to be reported to the HSE Offshore Safety Division (OSD) as dangerous occurrences under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 (RIDDOR), which became effective offshore on 1 April 1996. The Hydrocarbon Releases (HCR) system contains detailed voluntary information on offshore hydrocarbon release incidents supplementary to that provided under RIDDOR (and previous offshore legislation that applied prior to April 1996). The database contains reports of 3824 releases dating from 1 October 1992 to 31 March 2006, of which 2551 relate to the equipment types addressed in this datasheet.

©OGP

27

RADD – Process release frequencies

The database is considered to be “high-quality” on a combination of two features: •

The equipment population is believed to be highly accurate

•

The incident population is believed to be reasonably complete, and not to suffer so much from the under-reporting of small incidents that often occurs

Hence it has been selected in preference to other data sources discussed in Section 4.2. 4.1.1

Summary of release statistics

Table 4.1 summarises the number of releases and exposure (population) for each equipment type represented in the HSE HCRD. Table 4.1 Sum m ary of Release Statistics for HSE HCRD 1992-2006 Equipment type

All Releases

Releases excluding < 1 mm

1. Steel process pipes

700

646

5,958,814 pipe metre years

2. Flanges 3. Manual valves

327 175

298 154

3,368,520 flange joint years 1,498,038 valve years

4. Actuated valves

264

221

329,562 valve years

5. Instrument connections 6. Process (pressure) vessels

528 42

442 37

749,786 instrument years 17,494 vessel years

7. Pumps: Centrifugal

126

110

14,564 pump years

8. Pumps: Reciprocating 9. Compressors: Centrifugal

21 40

19 33

2,652 pump years 3,110 compressor years

10. Compressors: Reciprocating

43

36

11. Heat exchangers: Shell & Tube, shell side 12. Heat exchangers: Shell & Tube, tube side

18

14

3,398 exchanger years

26

21

6,165 exchanger years

13. Heat exchangers: Plate 14. Heat exchangers: Aircooled

31 5

30 2

2,865 exchanger years 1,069 exchanger years

15. Filters

48

47

16. Pig traps

29

28

4.1.2

Exposure

507 compressor years

12,495 filter years 3,994 pig trap years

Methodology for obtaining release frequencies

The method of obtaining release frequencies from HCRD consists of three main steps: •

Grouping data for different types and sizes of equipment, where there is insufficient experience to show significant differences between them.

•

Fitting analytical frequency functions to the data, in order to obtain a smooth variation of release frequency varying with equipment type and hole size. For some equipment types the influence of equipment size can also be inferred.

•

Splitting the release frequencies into the different release scenarios described above (Sections 1.0, 3.3).

28

©OGP

RADD – Process release frequencies

The release size distribution is represented by an analytical frequency function [2], which ensures non-zero release frequencies for all holes sizes between 1 mm and the diameter of the inlet pipe. In the case where the frequency depends on the equipment size (Steel process pipes, Flanges, Manual valves), the function is of the general form:

where:

F(d)

= frequency per year of releases exceeding size d (mm)

D

= equipment diameter

Frup

= rupture frequency per year

C,a,m,n

= constants specific to the equipment type and release scenario

In the case where the frequency does not depend on the equipment size the function is of the simpler general form:

where the symbols have the same meanings as above. The function can then be used to calculate the frequency of a release in any size range (such as the ranges used in Section 2.0) d1 to d2 as F(d1) – F(d2). The rupture frequency Frup and constants C,a,m,n referred to above are derived by a combination of mathematical curve fitting and expert judgment. 4.1.3

Uncertainties in release frequencies

Uncertainties in the estimated release frequencies arise from three main sources: •

Incorrect information in HCRD about the releases that have occurred. This included the possibility of under-reporting of small releases, errors in measuring the hole diameter or estimating the quantity released etc. Although the data in HCRD appears to be of unusually high quality, the possibility of bias or error is recognized.

•

Inappropriate categorisation of the releases into the different scenarios.

•

Inappropriate representation of the release frequency distributions by the fitted release frequency distributions. This results in part from the small datasets, but also from the simplifications inherent in the chosen functions, and their use to extrapolate frequencies in areas where no releases have yet been recorded.

Sensitivity tests have been carried out [4] on the release frequency functions. sensitivity tests indicated that the results are sensitive to: •

The choice of isolation and blowdown times.

•

The accuracy of the recorded release quantities.

•

The treatment of cases where the inventory is not recorded.

4.1.4

The

Comparison with experience

A comparison has been made between historical release frequencies for a North Sea platform and the corresponding frequencies predicted by the model described in the preceding sub-sections. The results are set out in Table 4.2.

©OGP

29

RADD – Process release frequencies

Table 4.2 Com parison of Predicted Release Frequencies with Historical Experience for One North Sea Platform Data Source

Release Categor y

Historical data

HCRD (see Note below)

Release Rate (kg/s)

Full Releases

Gas Release Frequency (/year) Limited Releases

Small

0–1

N/A

Medium

1 – 10

Large TOTAL

N/A

Zero Pressure Releases N/A

1.3 × 10

N/A

N/A

N/A

0

> 10 All

N/A N/A

N/A N/A

N/A N/A

0 -1 1.3 × 10

Small

0–1

6.0 × 10

Medium Large

1 – 10 > 10

2.4 × 10 -3 6.0 × 10

TOTAL

All

9.1 × 10

-2

3.3 × 10

-2

-2

5.6 × 10 -2 3.8 × 10

-2

1.4 × 10

-2

-1

5.1 × 10

-3

1.4 × 10

-1

-1 -2

0 0 3.4 × 10

TOTAL

8.0 × 10 -2 4.4 × 10 -2

2.7 × 10

-1

Note: Frequencies as predicted by model described in the preceding sub-sections, based on HCRD data up to 2003.

From the comparison in Table 4.2, the following observations and conclusions were made: •

Compared to the original risk analysis frequencies, based on data from a 1995 analysis, the new total release frequencies estimated based on the HRCD data are reduced significantly, by about 84%.

•

Compared to the adjusted risk analysis frequencies, the new total release estimated based on the HRCD data are reduced significantly, by about 71%.

•

Compared to the historical release frequencies, the new total and full release frequencies estimated based on the HRCD data are within a factor of about 2 (noting that the platform concerned had only one recorded release during the period of operation considered, introducing uncertainty into the estimate of the true historical rate).

4.1.5

Conclusions

Others have also analysed the HCRD and obtained different functional forms for the release frequencies. However, the release scenarios identified in Section 1.0 provide: •

A plausible representation of the different circumstances in which releases have been found to occur;

•

A model that ensures the frequencies of “full” releases (typically modelled in all QRAs) are not over-estimated;

•

A model that, overall, is consistent with experience.

On this basis, the data tabulated in Section 2.0 are presented as the best available analysis of the best available data.

4.2

Other data sources

A large number of other data sources and analyses of process release frequencies were analysed previously. These are listed in Section 6.2 (not all of these address all the equipment types for which frequencies are given in Section 2.0).

30

©OGP

RADD – Process release frequencies

5.0

Recommended data sources for further information

For further information, the data sources used to develop the release frequencies presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted. These references are shown in bold in Section 6.1.

6.0

References

6.1

References for Sections 2.0 to 4.0

The principal references are shown in bold; the others were used to provide supplementary information. [1]

SINTEF, 2002 (OREDA 2002). Offshore Reliability Data, 4th. ed.

[2]

Spouge, J R, 2005. New Generic Leak Frequencies for Process Equipment, Process Safety Progress, 24(4), 249-257.

[3]

DNV, 2006. Confidential Report 2006-1269.

[4]

DNV, 2004. Confidential Report 2004-0869.

[5]

Technica, 1989. Confidential Report for UK HSE.

[6]

DNV Technica, 1993. Confidential Report.

[7]

DNV, 1997. Reliability Evaluation of SPO Compact Flange System, DNV Technical Report 97-3547, rev. 2, for Steelproducts Offshore A/S.

[8]

DNV, 2005. Decision model for choosing flange or weld connection, DNV Technical Report (in Norweigan) 2005-0462, rev. 2.

[9]

HSE HCRD. Hydrocarbon Releases (HCR) System , Health and Safety Executive. https://www.hse.gov.uk/hcr3/ (Full data only available to authorised users.)

[10] Pitblado, R M, Williams, J and Slater, D H, 1990. Quantitative Assessment of Process Safety Programs, Plant Operations Progress, 9(3), AIChemE. (Presented at CCPS Conference on Technical Management of Process Safety, Toronto). [11] Hurst, N, Young, S, Donald, I, Gibson, H and Muyselaar, A, 1996. Measures of Safety Management and Performance and Attitudes to Safety at Major Hazard Sites, J. Loss Prevention in the Process Industries, 9(2). [12]

DNV, 1998. BRD on Risk Based Inspection, API Committee on Refinery Equipment, unpublished draft.

[13] Wells, G L, Phang, C, and Reeves, A B, 1991. HAZCHECK and the Development of Major Incidents, IChemE Symp. Ser. No. 124, 305-316, IChemE, Oxford: Pergamon Press. [14] API, 2000. 1st ed.

Risk-Based Inspection Base Resource Document, API Publication 581,

[15] OSHA, 1992. 29 CFR 1910.119, Process Safety Management of Highly Hazardous Chemicals; Final Rule; February 24, 1992. Federal Register, 57(36), 6356-6417.

©OGP

31

RADD – Process release frequencies

6.2

References for other data sources examined

ACDS, 1991. Major Hazard Aspects of the Transport of Dangerous Substances, Advisory Committee on Dangerous Substances, Health & Safety Commission, HMSO. AEA, 1998. Hydrocarbon Release Statistics Review, Report for UKOOA, AEA Technology. AEA, 2000. A Preliminary Analysis of the HCR99 Data, Report for UKOOA, AEA Technology. AME (1998), PARLOC 96: The Update of Loss of Containment Data for Offshore Pipelines, Offshore Technology Report OTH 551, Health & Safety Executive Ames, S. & Crowhurst, D, 1988. Domestic Explosion Hazards from Small LPG Containers, J. Haz. Mat., 19, 183-194. Arulanatham, D.C. & Lees, F.P., 1981. Some Data on the Reliability of Pressure Equipment in the Chemical Plant Environment, Int. J. Pres. Ves & Piping, 9, 327-338. Aupied J.R., Le Coguiec, A. & Procaccia, H., 1983. Valves and Pumps Operating Experience in French Nuclear Plants, Reliability Engineering, 6, 133-151. Batstone, R.J. & Tomi, D.T., 1980. Hazard Analysis in Planning Industrial Developments, Loss Prevention, 13, 7. Baldock, P.J., 1980. Accidental Releases of Ammonia - An Analysis of Reported Incidents, Loss Prevention, 13, 35-42. Blything, K.W. & Reeves, A.B., 1988. An Initial Prediction of the BLEVE Frequency of a 100 te Butane Storage Vessel, UKAEA, SRD R448. Bush, S.H., 1978. Reliability of Piping in Light Water Reactors, Symposium on Application of Reliability Technology to Nuclear Power Plants, International Atomic Energy Agency, vol. 1, IAEA-SM-218/11. Bush, S.H., 1988. Statistics of Pressure Vessel and Piping Failures, J. Pressure Vessel Technology, 110/227. Cox, A.W., Lees, F.P. & Ang, M.L., 1990. Classification of Hazardous Locations, Rugby, UK: Institution of Chemical Engineers. Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W., 1988. Risk Assessment for the Siting of Developments near Liquefied Petroleum Gas Installations, IChemE Symposium Series No 110. Data Engineering, 1998. Hydrocarbon Release Database, Population Data Statistics, OTO 98 158, Health & Safety Executive, Offshore Safety Division. Davenport, T.J., 1991. A Further Survey of Pressure Vessel Failures in the UK, Reliability 91, London. E&P Forum, 1992. Hydrocarbon Leak and Ignition Database, Report 11.4/180. GEAP, 1964. Survey of Piping Failures for the Reactor Primary Coolant Pipe Rupture Study, Report 4574, General Electric Atomic Power. Green A.E. & Bourne A.J., 1972. Reliability Technology, New York: Wiley Gulf Oil, 1978. A review of Gulf and other data. Hannaman, G.W., 1978. GCR Reliability Data Bank Status Report, General Atomic Company, Project 3228. Hawksley, J.L., 1984. Some Social, Technical and Economic Aspects of the Risks of Large Plants, CHEMRAWN III.

32

©OGP

RADD – Process release frequencies

HSE (1978), A Safety Evaluation of the Proposed St Fergus to Mossmorran Natural Gas Liquids and St Fergus to Boddam Gas Pipelines, Health and Safety Executive HSE, 1997. Offshore Hydrocarbon Releases Statistics 1997, Offshore Technology Report OTO 97 950, Health & Safety Executive, London: HMSO. HSE, 2000. Offshore Hydrocarbon Release Statistics 1999, Offshore Technology Report OTO 1999 079, Health & Safety Executive, London: HMSO. IAEA, 1988. Component Reliability Data for Use in Probabilistic Safety Assessment, International Atomic Energy Authority Technical Document 4/8. IEEE, 1984. IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component and Mechanical Equipment Reliability Data for Nuclear-Power Generating Stations, Institute of Electrical & Electronics Engineers, Std 500-1984. Johnson, D.W. & Welker, J.R., 1981. Development of an Improved LNG Plant Failure Rate Data Base, Applied Technology Corporation, Report No. GRI-80/0093. Kellerman, O. et al., 1973. Considerations about the Reliability of Nuclear Pressure Vessels, International Conference on Pressure Vessel Technology, San Antonio, Texas, USA. Lees, F.P., 1996. Loss Prevention in the Process Industries, 2nd Ed., Oxford: ButterworthHeinemann. Oberender, W. et al , 1978. Statistical Evaluations on the Failure of Mechanically Stressed Components of Conventional Pressure Vessels, Technischen Uberwachungs-Vereine Working Group on Nuclear Technology. Pape, R.P. & Nussey, C., 1985. A Basic Approach for the Analysis of Risks From Major Toxic Hazards, paper presented at Assessment and Control of Major Hazards, EFCE event no. 322, Manchester, UK, IChemE Symposium Series 93, 367-388. Phillips, C.A.G. & Warwick, R.G., 1969. A Survey of Defects in Pressure Vessels Built to High Standards of Construction and its Relevance to Nuclear Primary Circuits, UKAEA AHSB(S) R162. Reeves, A.B., Minah, F.C. & Chow, V.H.K., 1997. Quantitative Risk Assessment Methodology for LPG Installations, EMSD Symposium on Risk and Safety Management in the Gas Industry, Hong Kong. Rijnmond Public Authority, 1982. A Risk Analysis of Six Potentially Hazardous Industrial Objects in the Rijnmond Area - A Pilot Study, COVO, Dordrecht: D. Reidel Publishing Co. Scandpower, 1981. Risk Analysis, Gas and Oil Leakages, Report for Statoil, Scandpower Report 2.64.28. Sherwin, D.J. & Lees, F.P., 1980. An Investigation of the Application of Failure Rate Data Analysis to decision-Making in Maintenance of Process Plants, Proc. Instn. Mech. Engrs, 194, 301-308. Smith, D.J., 1997. Reliability, Maintainability and Risk, 5th Ed., Oxfrod: ButterworthHeinemann. Smith, T.A. & Warwick, R.G., 1974. The Second Survey of Defects in Pressure Vessels Built to High Standards of Construction and its Relevance to Nuclear Primary Circuits, UKAEA Safety and Reliability Directorate Report SRD R30. Smith, T.A. & Warwick, R.G., 1981. A Survey of Defects in Pressure Vessels in the UK for the Period 1962-78, and its Relevance to Nuclear Primary Circuits, UKAEA Safety and Reliability Directorate Report SRD R203. Sooby, W. & Tolchard, J.M., 1993. Estimation of Cold Failure Frequency of LPG Tanks in Europe, Conference on Risk & Safety Management in the Gas Industry, Hong Kong. ©OGP

33

RADD – Process release frequencies

Svensson, L.G. & Sjögren, S., 1988. Reliability of Plate Heat Exchangers in the Power Industry, American Society of Mechanical Engineers, Power Generation Conference, Philadelphia, USA. USNRC, 1975. Reactor Safety Study, Appendix III - Failure Data, US Nuclear Regulatory Commission, NUREG-75/014, WASH-1400. USNRC, 1980. ata Summaries of Licensee Event Reports of Valves at US Commercial Nuclear Power Plants, by W.H. Hubble & C.F. Miller, EG&G Idaho Inc, for US Nuclear Regulatory Commission, NUREG/CR-1363. USNRC., 1981. Nuclear Plant Reliability Data System (NPRDS), US Nuclear Regulatory Commission, NUREG/CR-2232, Annual Report. Veritec, 1992. QRA handbook, DNV Technica Report 92-3147. Wright, R.E., Steverson, J.A., & Zuroff, W.F., 1987. Pipe Break Frequency Estimation for Nuclear Power Plants, US Nuclear Regulatory Commission, NUREG/CR-4407, Washington DC. Whittle, K., 1993. LPG Installation Design and General Risk Assessment Methodology Employed by the Gas Standards Office, Conference on Risk & Safety Management in the Gas Industry, Hong Kong.

34

©OGP

Risk Assessment Data Directory Report No. 434 – 2 March 2010

Blowout frequencies International Association of Oil & Gas Producers

RADD – Blowout frequencies

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0

Summary of Recommended Data ............................................ 2

3.0 3.1 3.2 3.3

Guidance on use of data ........................................................ 6 General validity ............................................................................................... 6 Uncertainties ................................................................................................... 6 Example ........................................................................................................... 6

4.0 4.1 4.2 4.3

Review of data sources ......................................................... 7 Basis of data presented ................................................................................. 7 Onshore blowouts ........................................................................................ 11 Other data sources ....................................................................................... 12

5.0

Recommended data sources for further information ............ 12

6.0

References .......................................................................... 13

©OGP

1

RADD – Blowout frequencies

Abbreviations: BOP DNV EUB GoM HPHT NSS OCS UKCS

2

Blowout Preventer Det Norske Veritas Alberta Energy and Utilities Board Gulf of Mexico High Pressure High Temperature North Sea Standard (US) Outer Continental Shelf United Kingdom Continental Shelf

©OGP

RADD – Blowout frequencies

1.0

Scope and Definitions

1.1

Application

This datasheet presents (Section 2.0) frequencies of blowouts and well control incidents. They are intended to be applied to well operations worldwide, both offshore and onshore, as indicated in the table headings.

1.2

Definitions

The following definitions are taken from [1]: •

Blowout

An incident where formation fluid flows out of the well or between formation layers after all the predefined technical well barriers or the activation of the same have failed.

•

W ell release

An incident where hydrocarbons flow from the well at some point where flow was not intended and the flow was stopped by use of the barrier system that was available on the well at the time of the incident,

•

Shallow gas release

An incident where shallow gas is released from the well after a gas zone has been penetrated before the BOP has been installed (any zone penetrated after the BOP is installed is not a shallow gas incidents)

•

Oil well

A well where the formation has an estimated gas/oil ratio (GOR) less than 1,000

•

Gas well

A well where the formation has an estimated gas/oil ratio (GOR) exceeding 1,000

•

HPHT well

A well with an expected shut-in pressure equal to or above 690 bar (10,000 psi) and/or bottom hole temperatures equal to or above 150°C (300°F)

•

North Sea Standard (NSS) operation

Operation performed with BOP installed including shear ram and two barrier principle followed

•

Production

Production, injection and closed in production wells

•

W ell intervention

Completion, wireline, coiled tubing, snubbing and other workover operations

•

W ireline

Wireline operations in production or injection wells (i.e. not wireline operations carried out as part of drilling and completion operations)

•

W orkover

Workover activities (not including wireline, snubbing or coiled tubing operations). Often referred to as "heavy workover"

©OGP

1

RADD – Blowout frequencies

2.0

Summary of Recommended Data

For well operations in the North Sea and in other offshore areas where the equipment is of North Sea Standard (see Section 1.2), Scandpower’s analysis [2] of SINTEF’s blowout database is recommended. For well operations in other areas of the world, SINTEF’s own analysis [1] of the database is recommended. Both sets of data are tabulated below. In the original reports [1,2] they are presented in different ways, however so far as possible the tables below are consistent in layout for easy comparison. For North Sea Standard operations, [2] does not give separate frequencies for topside and subsea releases, except for shallow gas releases. DNV have estimated the fractions of subsea releases where applicable; these are also included in the table below. For onshore operations, comparable data were not found. It is recommended to use the offshore data presented here. Some possibly indicative values are presented in Section 4.2.

2

©OGP

RADD – Blowout frequencies

Blowout and W ell Release Frequencies for Offshore Operations of North Sea Standard Operation

Category Averag e

Exploration Drilling, shallow gas

Development Drilling, shallow gas

Gas

Frequency Oil

Topside Blowout

6.0 × 10

-4

-

Diverted Well Release

8.3 × 10

-4

-

Well Release

9.3 × 10

-5

-

Subsea Blowout

9.8 × 10

-4

-

Topside Blowout

4.7 × 10

-4

-

Diverted Well Release

6.5 × 10

-4

-

Well Release

7.3 × 10

-5

-

Subsea Blowout

7.4 × 10

-4

-

Unit

Blowout

3.1 × 10

-4

3.6 × 10

-4

2.5 × 10

-4

Well Release

2.5 × 10

-3

2.9 × 10

-3

2.0 × 10

-3

Blowout

1.9 × 10

-3

2.2 × 10

-3

1.5 × 10

-3

Well Release

1.6 × 10

-2

1.8 × 10

-2

1.2 × 10

-2

Development Drilling, deep Blowout (normal wells) Well Release

6.0 × 10

-5

7.0 × 10

-5

4.8 × 10

-5

4.9 × 10

-4

5.7 × 10

-4

3.9 × 10

-4

Development Drilling, deep Blowout (HPHT wells) Well Release

3.7 × 10

-4

4.3 × 10

-4

3.0 × 10

-4

3.0 × 10

-3

3.5 × 10

-3

2.4 × 10

-3

Completion

9.7 × 10 -4 3.9 × 10 -6 6.5 × 10 -5 1.1 × 10 -4 1.4 × 10 -4 2.3 × 10 -4 3.4 × 10 -4 1.8 × 10 -4 1.8 × 10 -4 5.8 × 10 -6 9.7 × 10 -5 1.1 × 10 -5 3.9 × 10 -6 2.4 × 10 -

-5

1.4 × 10 -4 5.8 × 10 -6 9.4 × 10 -5 1.6 × 10 -4 2.0 × 10 -4 3.4 × 10 -4 4.9 × 10 -4 2.6 × 10 -4 2.6 × 10 -4 8.3 × 10 -5 1.8 × 10 -5 2.0 × 10 -5 3.9 × 10 -5 1.8 × 10 -5 2.0 × 10 -

-4

5.4 × 10 -4 2.2 × 10 -6 3.6 × 10 -6 6.1 × 10 -5 7.8 × 10 -4 1.3 × 10 -4 1.9 × 10 -4 1.0 × 10 -4 1.0 × 10 -4 3.2 × 10 -6 2.6 × 10 -6 2.9 × 10 -5 3.9 × 10 -

Exploration Drilling, deep (normal wells)

Exploration Drilling, deep (HPHT wells)

Blowout Well Release Wirelining Blowout Well Release Coiled Tubing Blowout Well Release Snubbing Blowout Well Release Workover Blowout Well Release Producing Wells Blowout (excluding external causes) Well Release Producing Wells, external Blowout causes Well Release Gas Injection Wells Blowout Well Release Water Injection Wells Blowout Well Release

©OGP

-5

per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per operation per operation per operation per operation per operation per operation per operation per operation per operation per operation per well year per well year per well year per well year per well year per well year per well year per well year

Fractio n Subsea

0.39 0.39 0.39 0.39 0.33 0.33 0.33 0.33 0 0 0 0 0 0 0 0 0 0 0.125 0.125 0.125 0.125 0.125 0.125 -

3

RADD – Blowout frequencies

Blowout and W ell Release Frequencies for Offshore Operations Not of North Sea Standard Operation

Exploration Drilling, shallow gas

Category

Well Type Appraisal

1.3 × 10

-3

Wildcat

1.9 × 10

-3

Appraisal

0

1

Wildcat

0

1

Appraisal

3.2 × 10

-4

Wildcat

9.3 × 10

-4

Appraisal

3.2 × 10

-4

Wildcat

2.7 × 10

-4

Blowout (surface flow)

-

9.6 × 10

-4

Blowout (underground flow)

-

4.4 × 10

-5

Diverted well release

-

7.0 × 10

-4

Well release

-

8.8 × 10

-5

Appraisal

1.4 × 10

-3

Wildcat

1.7 × 10

-3

Appraisal

0

Wildcat

9.3 × 10

Appraisal

0

1

Wildcat

0

1

Appraisal

0

1

Wildcat

0

1

-

3.5 × 10

-4

Blowout (underground flow)

-

1.3 × 10

-4

Diverted well release

-

0

Well release

-

2.2 × 10

-4

Blowout (surface flow)

-

4.6 × 10

-4

Blowout (underground flow)

-

0

Diverted well release

-

3.1 × 10

Well release

-

0

Blowout (surface flow)

Blowout (underground flow)

Diverted well release

Well release

Development Drilling, shallow gas

Exploration Drilling, deep

Blowout (surface flow)

Blowout (underground flow)

Diverted well release

Well release

Development Drilling, deep Blowout (surface flow)

Completion

4

Frequency

©OGP

1 -4

1

1

1

-4

per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per drilled well per completion per completion per completion per completion

Fractio n Subsea 0.59 0.59 0

2

0

2

0 0 1.0 1.0 0.18 0

2

0 0 0.41 0.41 0.17

2

1.0

3

1.0

3

0.14 0

2

0.25 0 0 0 0

RADD – Blowout frequencies

Blowout and W ell Release Frequencies for Offshore Operations Not of North Sea Standard Operation Production

Workover

Wireline

Category

Well Type

Frequency -5

Blowout (surface flow) Blowout (underground flow) Diverted well release Well release Blowout (surface flow) Blowout (underground flow) Diverted well release Well release Blowout (surface flow)

-

3.3 × 10 -6 4.7 × 10 1 0 -6 9.5 × 10 -3 1.0 × 10 1 0 1 0 -4 8.5 × 10 -5 1.1 × 10

Blowout (underground flow)

-

0

1

Diverted well release

-

0

1

Well release

-

1.1 × 10

-5

per well year per well year per well year per well year per workover per workover per workover per workover per wireline job per wireline job per wireline job per wireline job

Fractio n Subsea 0.43 2 0 0 0 0.05 2 0 0 0 0 0 0 0

Notes

1. Based on no incidents to date. However, these scenarios are considered credible. Table 4.1 gives population data, from which estimates can be made of these frequencies if required.

2. For underground flow releases there are no topsides releases.

For all other releases,

fractions of releases occurring at topsides = (1 - fraction subsea).

3. Only 2 occurrences, both located at subsea wellhead (see Section 4.1). Subsea fraction = 0 if wellheads are located at topsides.

©OGP

5

RADD – Blowout frequencies

3.0

Guidance on use of data

3.1

General validity

The data presented in Section 2.0 should be considered valid for the North Sea and US GoM OCS. They can also be applied to other areas of the world, according to whether or not standards are considered to be equivalent to those in the North Sea. For onshore operations it is recommended to use the offshore data presented in Section 2.0.

3.2

Uncertainties

As in any analysis of historical frequencies, there are uncertainties in: •

The population (in this case, wells drilled, well operations or well years)

•

The incident data

In particular, where incidents are infrequent, another incident just after the data period may significantly increase the statistical frequency, especially when no incidents have been recorded to date but are nevertheless credible (as is the case with some of the SINTEF category – well type combinations). The SINTEF database [1] has been extensively reviewed to ensure that it is as complete as possible in regard both to population and incidents, minimising so far as possible these uncertainties. According to [1]: “It is SINTEF’s belief that from 1980-01-01 most blowouts occurring in the US Gulf of Mexico (GoM) Outer Continental Shelf (OCS), the UK and Norway have been included in the database.” Therefore, they present frequencies based on this period and these geographical areas. Neither SINTEF [1] nor Scandpower [2] have, in their reports, quantified these uncertainties in the way that, for example, OREDA [5] does for equipment reliability; instead they have focused on data quality. Further potential uncertainties arise where the frequencies are used outside the context of the data, for example, in other areas of the world. SINTEF present data for all blowouts in their database, covering 49 countries/areas, and incident data for 4 other countries/waters. However, the populations and numbers of blowouts in each case are small, and hence SINTEF do not recommend using frequency estimates obtained from these data in preference to the data used to obtain the frequencies presented in Section 2.0 (see Section 4.1). Hence there is greater uncertainty in using the data for other countries/waters but no quantification of this uncertainty is available. Using the frequencies for operations not of North Sea Standard will introduce an element of conservatism to any analysis.

3.3

Example

A hypothetical North Sea platform has 8 oil producing wells and 2 gas injection wells. There are one workover and two wireline jobs per year on the platform oil wells. The following extract from Section 2.0 highlights the relevant frequencies:

6

©OGP

RADD – Blowout frequencies

Operation

Category Averag e

Gas

Frequency Oil

-6

9.4 × 10

-6

3.6 × 10

-6

1.1 × 10

-5

1.6 × 10

-5

6.1 × 10

-6

Blowout

1.8 × 10

-4

2.6 × 10

-4

1.0 × 10

-4

Well Release

5.8 × 10

-4

8.3 × 10

-4

3.2 × 10

-4

Producing Wells Blowout (excluding external causes) Well Release

9.7 × 10

-6

1.8 × 10

-5

2.6 × 10

-6

1.1 × 10

-5

2.0 × 10

-5

2.9 × 10

-6

Wirelining

Workover

Gas Injection Wells

Blowout

6.5 × 10

Well Release

Blowout

-

1.8 × 10

-5

-

Well Release

-

2.0 × 10

-5

-

Fractio n Subsea

Unit

per operation per operation

0

per operation per operation per well year per well year

0

per well year per well year

0

0 0.125 0.125

0.125 0.125

The annual frequencies of blowouts and well releases are then: Blowouts:

(8 × 2.6 × 10-6) + (2 × 1.8 × 10-5) + (1 × 1.0 × 10-4) + (2 × 3.6 × 10-6) ≈ 1.6 × 10-4

Well releases: 4.0 × 10-4

(8 × 2.9 × 10-6) + (2 × 2.0 × 10-5) + (1 × 3.2 × 10-4) + (2 × 6.1 × 10-6) ≈

The annual frequencies of topsides and subsea blowouts are: Topsides Blowouts: (0.875 × 8 × 2.6 × 10-6) + (0.875 ×2 × 1.8 × 10-5) + (1 × 1.0 × 10-4) + (2 × 3.6 × 10-6) ≈ 1.6 × 10-4 Subsea Blowouts:

(0.125 × 8 × 2.6 × 10-6) + (0.125 ×2 × 1.8 × 10-5) ≈ 7.1 × 10-6

Topsides Well releases: (0.875 × 8 × 2.9 × 10-6) + (0.875 × 2 × 2.0 × 10-5) + (1 × 3.2 × 10-4) + (2 × 6.1 × 10-6) ≈ 3.9 × 10-4 Subsea Well releases:

(0.125 × 8 × 2.9 × 10-6) + (0.125 × 2 × 2.0 × 10-5) ≈ 7.9 × 10-6

4.0

Review of data sources

4.1

Basis of data presented

The key data source is the SINTEF Offshore Blowout Database, described in [1]. SINTEF have performed their own analysis of this database, updated annually, in order to obtain the frequencies set out in Section 2.0. These are based on blowout data from the US Gulf of Mexico OCS, UKCS and Norwegian waters for the period 1st January 1980 to 1st January 2005. Table 4.1 gives the numbers of wells and incidents in the database for these areas and period. Scandpower [2] annually review the SINTEF database and analyse it further to obtain blowout frequencies applicable specifically to the North Sea (and other places where equipment standards are comparable). They use the most recent 20 years’ data

©OGP

7

RADD – Blowout frequencies

available. Their report explains how the analysis is done, however two key elements of this are: •

Elimination of irrelevant incidents

•

Adjustment due to trend over time

Table 4.2 sets out the numbers of wells and incidents used in their analysis. [4] provides the basis for the HPHT well frequencies, concluding that the blowout frequency for an HPHT well is 12.3 times higher than for a normal well (including underground blowouts).

8

©OGP

RADD – Blowout frequencies

Table 4.1 Num bers of W ells and Incidents in SINTEF Offshore Blowout Database [1] Operation

Exploration Drilling, shallow gas

Category

Well Type

Number of Exploration Wells Drilled Blowout (surface flow) Blowout (underground flow) Diverted well release Well release

Development Drilling, shallow gas

Number of Development Wells Drilled Blowout (surface flow) Blowout (underground flow) Diverted well release Well release Exploration Drilling, deep Number of Exploration Wells Drilled Blowout (surface flow) Blowout (underground flow) Diverted well release Well release Development Drilling, deep

Workover

Number of Development Wells Drilled Blowout (surface flow) Blowout (underground flow) Diverted well release Well release Number of Completions Blowout (surface flow) Blowout (underground flow) Diverted well release Well release Number of Well Years in Service Blowout (surface flow) Blowout (underground flow) Diverted well release Well release Number of Workovers

Wirelining

Blowout (surface flow) Blowout (underground flow) Diverted well release Well release Number of Wireline Jobs

Completion

Production

©OGP

Appraisal Wildcat Appraisal Wildcat Appraisal Wildcat Appraisal Wildcat Appraisal Wildcat -

No. of Wells/ Incidents 6,257 Wells 7,505 Wells 8 14 0 0 2 7 2 2 22,833 Wells

-

22 1

Appraisal Wildcat Appraisal Wildcat Appraisal Wildcat Appraisal Wildcat Appraisal Wildcat

16 2 6,257 Wells 7,505 Wells 9 13 0 7 1 0 1 0 3 3 22,833 Wells

-

8 3

-

0 5 20,328 Wells 9 0

-

-

-

6 0 211,142 Well Years 7 1 0 2 19,920 Workovers 20 0 0 17 358,941

9

RADD – Blowout frequencies

Operation

Category

Well Type

Blowout (surface flow) Blowout (underground flow) Diverted well release Well release

-

No. of Wells/ Incidents Wireline Jobs 4 0

-

0 4

Table 4.2 Num bers of W ells and Incidents in Scandpower Blowout Analysis [2] Operation

Category

Exploration Drilling (shallow gas) Development Drilling (shallow gas) Drilling (deep)

Number of Wells Drilled Incidents Number of Wells Drilled Incidents Number of Wells Drilled Blowout Number of Wells Drilled Well release Number of Oil Well Years in Service Number of Gas Well Years in Service Number of Completions

All Well Interventions

Completion

Wireline

Coiled Tubing

Snubbing

Workover

Production

Blowout Well release Number of Wireline Ops Per 2 Year Blowout Well release 3 Number of Coiled Tubing Ops 2 Number of Well Years Blowout Well release 3 Number of Snubbing Operations 2 Number of Well Years Blowout Well release Workover Interval – Oil Wells [3] Workover Interval – Gas Wells [3] Blowout Well release Number of Well Years in Service Blowout – external causes Blowout – not external causes Well release

No. of Wells/ Incidents 9,172 Wells 26 13,022 Wells 29 9,744 Wells 2 2,854 Wells 4 95,270 Wells Years 82,204 Wells Years 16,381 Completions 4 4 1.7 Ops/Year 4 2 358 Ops 4,214 Well Years 2 2 196 Ops 4,214 well years 3 1 5 years 7 years 8 11 177,474 Well Years 7 5 2

Notes to Table 4.1 and Table 4.2

1. No number of incidents is given in the report for this scenario. It has been assumed that there have been 0 such incidents to date.

2. Assumed based on feedback from oil companies.

10

©OGP

RADD – Blowout frequencies

3. Norwegian Sector only used as basis for frequency estimates. The basis for the subsea fractions for North Sea Standard operations are as follows: •

Exploration drilling, deep blowouts: 12 out of 31 from outside casing or underground − Assumed also to apply to exploration drilling, deep well releases − Assumed to be the same for HPHT wells as for normal wells

•

Development drilling, deep blowouts: 5 out of 15 from outside casing or underground − Assumed also to apply to development drilling, deep well releases − Assumed to be the same for HPHT wells as for normal wells

•

Production well releases (excluding external causes): assumed to be the same as for production blowouts (excluding external causes) − Assumed also to apply to production well releases, external causes − Assumed also to apply to gas and water injection wells

From the SINTEF report [1], Tables 4.5 to 4.7, the basis for the subsea fractions for operations not of North Sea Standard are as follows: •

Exploration drilling, shallow gas blowouts: − Surface flow: 13 out of 22 with known location − Diverted well release: 9, assumed to have been topsides − Well release: 2 out of 2 at subsea wellhead − All assumed to be same for appraisal and wildcat wells

•

Development drilling, shallow gas blowouts: − Surface flow: 4 out of 22 − Underground: 1 at wellhead, assumed topsides − Diverted well release: 16 at wellhead, assumed topsides − Well release: 1 at subsea wellhead

•

Exploration drilling, deep blowouts: − Surface flow: 9 out of 22 with known location − Underground: 1 out of 6 with known location (remainder no surface flow) − Diverted well release, well release: all topsides

•

Development drilling, deep blowouts: − Surface flow: 1 out of 7 with known location − Underground: 3 out of 3 no surface flow − Well release: 1 out of 4 with known location

•

Completion blowouts: 0 out of 15 subsea

•

Production blowouts: − Surface flow: 3 out of 7 with known location − Underground: 1 out of 1 no surface flow − Well release: 0 out of 2 with known location

•

Workover blowouts: − Surface flow: 1 out of 19 with known location − Well release: 0 out of 17

•

Wireline blowouts: 0 out of 7 with known location

4.2

Onshore blowouts

For onshore blowouts, the Alberta Energy and Utilities Board (EUB) maintains a database of onshore drilling incidents [6]. This database includes drilling occurrence ©OGP

11

RADD – Blowout frequencies

data for Alberta from 1975 till 1990 with a total of 87,944 wells drilled. The database contains incident reports for individual well control occurrences. The occurrence data are presented below. Category drilled)

Number of Occurrences

Blow* Blowout Total

Frequency (per well 6.0 x 10-4 4.9 x 10-4 1.1 x 10 -3

53 43 96

* A category of well control incident defined as an uncontrolled release of wellbore fluids to atmosphere that can be shut-in or diverted to flare in a short period of time. They are assumed here to be equivalent to well releases as defined in the SINTEF and Scandpower work.

The total frequency is about 40% of the corresponding value for offshore drilling blowouts. During 2002 – 2006 there were 39 blowouts and 88,856 wells drilled (blows no longer being recorded). Of the 39 blowouts, 7 involved release of gas, the remainder released only fresh water. Taking the full number of blowouts gives a frequency of 4.4 × 10-4 blowouts per well drilled, about 10% smaller than the frequency above from 1975 – 1990 data and hence not significantly lower. For comparison, this is about 40% of the corresponding value for offshore drilling blowouts and well releases presented in Section 2.0. However it should be noted that Alberta wells are believed to be sour, with precautions being taken accordingly to minimise the likelihood of releases. Hence use of the above frequencies is not recommended except in a similar context. EUB also records the numbers of blowouts during well interventions and other blowouts (from producing or suspended wells) but they do not record the corresponding population data (numbers of well interventions, producing wells and suspended wells).

4.3

Other data sources

Other databases previously used have been: •

BLOWOUT, an internal DNV compilation of blowouts and well control incidents from the North Sea and US waters during 1970-89.

•

WOAD (World Offshore Accident Databank), a public-domain database maintained by DNV covering all offshore hazards.

The data from both of these are now included in the SINTEF database and hence are superseded.

5.0

Recommended data sources for further information

The SINTEF and Scandpower reports [1,2] should be consulted for further information. In particular, the Scandpower report [2] explains how the frequencies presented in Section 2.0 are derived from the statistics in Table 4.2.

12

©OGP

RADD – Blowout frequencies

6.0

References

1. SINTEF 2006. Blowout and Well Release Characteristics and Frequencies, 2006, Report No. STF50 F06112. 2. Scandpower Risk Management AS 2006. Blowout and Well Release Frequencies – Based on SINTEF Offshore Blowout Database, 2006, Report No. 90.005.001/R2. 3. Nilsen, E F 1999. Basis utblåsningsfrekvenser 1999, internal technical memo, Statoil HMS T&T SIK. 4. SINTEF Safety and Reliability, Alliance Technology, Scandpower 1998. Estimation of Blowout Probability of HPHT Wells, Report No. STF38 F98420. 5. OREDA 2002. 6. Alberta Energy and Utilities Board. Oil and Gas Well Blowout Reports.

©OGP

13

Risk Assessment Data Directory Report No. 434 – 3 March 2010

Storage incident frequencies International Association of Oil & Gas Producers

RADD – Storage incident frequencies

Contents: 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

1.2.1 1.2.2 1.2.3 1.2.4 1.2.5

Atmospheric Storage Tanks...................................................................................... 1 Refrigerated Storage Tank Designs ......................................................................... 2 Pressurised Storage Vessels .................................................................................... 3 Non-process Hydrocarbon Storage Offshore.......................................................... 3 Underground Storage Tanks..................................................................................... 4

2.0 2.1 2.2 2.3 2.4 2.5 2.6

Summary of Recommended Data ............................................ 4 Atmospheric Storage Tanks .......................................................................... 4 Refrigerated Storage Tanks ........................................................................... 5 Pressurised Storage Vessels......................................................................... 6 Oil Storage on FPSOs..................................................................................... 6 Non-process Hydrocarbon Storage Offshore .............................................. 6 Underground Storage Tanks ......................................................................... 7

3.0 3.1 3.2

Guidance on Use of Data ....................................................... 7 General validity ............................................................................................... 7 Uncertainties ................................................................................................... 7

4.0 4.1

Review of Data Sources ......................................................... 8 Atmospheric Storage Tanks .......................................................................... 8

4.1.1 4.1.2

Selection of Generic Value for Atmospheric Storage Tanks ................................. 8 Overfilling.................................................................................................................... 9

4.2

Refrigerated Storage Tanks ......................................................................... 10

4.2.1

Selection of Generic Value for Refrigerated Storage Tanks ................................ 10

4.3

Pressurised Storage Vessels....................................................................... 11

4.3.1 4.3.2

Accident Source Data .............................................................................................. 11 Selection of Generic Value for Pressurised Storage Vessels.............................. 12

4.4 4.5

Oil Storage on FPSOs................................................................................... 13 Non-process Hydrocarbon Storage Offshore ............................................ 13

4.5.1 4.5.2

Methanol.................................................................................................................... 14 Diesel......................................................................................................................... 14

5.0

Recommended Data Sources for Further Information ........... 15

6.0

References .......................................................................... 15

©OGP

1

RADD – Storage incident frequencies

Abbreviations: API ASME ATK BG BLEVE DNV FPSO GRI HSE IPO LNG LPG MIC OREDA QRA SRD WOAD

2

American Petroleum Institute American Society of Mechanical Engineers Aviation Turbine Kerosene British Gas Boiling liquid expanding vapour explosion Det Norske Veritas Floating Production, Storage and Offloading Unit Gas Research Institute Health & Safety Executive Interprovinciaal Overleg Liquefied Natural Gas Liquefied Petroleum Gas Methyl Isocyanate Offshore Reliability Database Quantified Risk Assessment Safety and Reliability Directorate World-wide Offshore Accident Databank

©OGP

RADD – Storage incident frequencies

1.0

Scope and Definitions

1.1

Application

This datasheet presents (Section 2.0) frequencies of releases from the following types of storage: 1. Atmospheric storage 2. Refrigerated storage 3. Pressurised storage 4. Oil storage on FPSOs 5. Non-process Hydrocarbon Storage Offshore 6. Underground storage For refrigerated storage tanks previous studies and available historical data have been reviewed to produce a consistent set of estimates of frequencies of catastrophic rupture for different designs of refrigerated storage tanks. FPSOs typically store large quantities of crude oil in cargo oil tanks; this is periodically transferred to shuttle tankers. Only fires/explosions from the cargo oil tanks are considered, Non-process hydrocarbon storage offshore includes methanol, diesel and ATK systems together with the associated pipework. Underground storage tanks can be divided into buried or mounded storage tanks (mainly for fuels such as petrol and LPG), and excavated or leached storage caverns. Section 2.0 presents guidance how failure frequencies for buried or mounded storage tanks might be estimated.

1.2

Definitions

1.2.1

Atmospheric Storage Tanks

Atmospheric storage tanks contain liquids ambient pressure and at or near ambient temperature. They are usually fabricated from mild steel on a concrete base, surrounded by a low bund wall. They are designed to withstand an internal pressure/vacuum of 0.07 bar. The main types are [1]: •

Fixed roof tanks. These have a vapour space between the liquid surface and the tank roof. They require a vent for vapour at the top of the tank. They are subdivided by roof design: − −

•

Floating roof tanks. These have a roof that floats on the liquid surface to reduce vapour loss. The roof requires a seal around the edge against the tank walls. Types of roof design include: − − −

•

Domed roof – up to about 20 m diameter. Cone roof – up to about 76 m diameter.

Pan roof. Annular pontoon roof. Double-deck roof.

Fixed plus internal floating roof tanks. These are a combination of both types.

©OGP

1

RADD – Storage incident frequencies

In Section 2.0 failures from the tank walls are considered. Strictly, failures of associated equipment such as inlet/outlet valves, pipes within the bund and pressure relief valves should be excluded. In practice, many studies include failures at these points because available failure data often does not distinguish them clearly from failures of the tank itself. However, when considering tank ruptures and roof fires, the distinction is not important. 1.2.2

Refrigerated Storage Tank Designs

There are several different designs of refrigerated storage tank, and different failure frequencies may be applicable. The main types are [2]: •

Single containm ent tanks. These are a single primary container and generally an outer shell designed and constructed so that the primary container is required to meet the low temperature ductility requirements for storage of the product.

•

Double containm ent tanks. These are designed and constructed so that both the inner self supporting primary container and the secondary container are capable of independently containing the refrigerated liquid stored. To minimise the pool of escaping liquid, the secondary container should be located at a distance not exceeding 6m from the primary container. The primary container contains the refrigerated liquid under normal operating conditions. The secondary container is intended to contain any leakage of the refrigerated liquid, but is not intended to contain any vapour resulting from this leakage.

•

Full containm ent tanks. These are designed and constructed so that both self supporting primary container and the secondary container are capable of independently containing the refrigerated liquid stored and for one of them its vapour. The secondary container can be 1m to 2m distance from the primary container. The primary container contains the refrigerated liquid under normal operating conditions. The outer roof is supported by the secondary container. The secondary containment shall be capable both of containing the refrigerated liquid and of controlled venting of the vapour resulting from product leakage after a credible event.

•

Spherical Storage Tanks. Spherical, single containment tanks consisting of an unstiffened, sphere supported at the equator by a vertical cylinder. For onshore tanks, the lower part of the support cylinder is made of concrete and the tank is protected by a domed concrete cover. The outside of the tank and the aluminium part of the support cylinder are insulated by means of a panel system to the required thickness for the specified boil-off rate.

•

Mem brane tank. These are designed and constructed so that the primary container, constituted by a membrane, is capable of containing both the liquefied gas and its vapour under normal operating conditions and the concrete secondary container, which supports the primary container, should be capable of containing all the liquefied gas stored in the primary container and of controlled venting of the vapour resulting from product leakage of the inner tank. The vapour of the primary container is contained by a steel liner which forms with the membrane an integral gastight containment. The action of the liquefied gas acting on the primary container (the metal membrane) is transferred directly to the pre-stressed concrete secondary container through the load bearing insulation.

Underground tanks have been constructed in the past. These are typically earth pits where the ground around the pit is frozen by the cold liquid, thus providing a seal. Due to practical difficulties, this type is now rare.

2

©OGP

RADD – Storage incident frequencies

The characteristics of each type are set out in BS EN 1473.

1.2.3

Pressurised Storage Vessels

Pressurised storage tanks are considered to be storage tanks operating under pressure of at least 0.5 bar. They include a wide variety of vessels, and are categorised for the purposes of QRA (quantified risk assessment) as follows: •

•

Storage vessels – in which fluids are held under stable conditions. subdivided for this analysis into:

These are

−

Large storage vessels – spheres and bullets (long cylindrical tanks) in excess of approximately 50 m3 capacity, typically used in dedicated storage installations.

−

Medium storage vessels – fixed cylindrical tanks less than approximately 50 m3 capacity, typically used in industrial or domestic installations.

Small containers – portable cylinders and drums less than approximately 2 m3 capacity.

The main UK design code is BS 5500:1991 Specification for Unfired Fusion Welded Pressure Vessels (see [1] p12/20). It divides vessels into 3 categories. The highest standard, Category 1, requires full non-destructive testing of main seam welds. The corresponding US code is the ASME Boiler and Pressure Vessel Code, 1992. Section 2.0 covers pressure vessels and any equipment directly associated with them, i.e. nozzles and instrumentation (with associated flanges), and the inspection cover (manway). Connection points are included up to the first flange, although the flange itself is not included. Lines into and out of the vessel, and the associated flanges and valves are not included in the scope. Although the lines into and out of the vessel are not included in the scope, the actual number of lines would have an influence on the failure rate, as failures are more likely at the connection points where these lines join the vessel. Other equipment may influence the failure rate, such as relief systems being blocked. Such issues are not addressed in this datasheet but should be considered separately if appropriate, 1.2.4

Non-process Hydrocarbon Storage Offshore

The term “non-process fires” covers any fires and explosions that are not covered by the modelling of process hydrocarbon events. Most types of non-process fire involve materials other than hydrocarbons (e.g. electrical fires, chemical gas explosions). However, non process hydrocarbons such as diesel and ATK, and other hazardous materials such as methanol, are frequently stored on offshore installations in unpressurised tanks of a few m3 capacity. In the event of a leak or rupture, these materials may be ignited and so have the potential to cause a fire that could result in injury or possibly fatality. Some data are available for such systems. Although most non-process fires are very small incidents (e.g. a chip-pan fire in the galley lasting a few seconds), some have been larger causing damage and fatalities. The frequency of non-process fires may be larger than process fires, suggesting that they should not be overlooked if the risk analysis is to be comprehensive.

©OGP

3

RADD – Storage incident frequencies

1.2.5

Underground Storage Tanks

There are several types of underground storage tanks: •

Petrol filling station tanks – small buried atmospheric tanks, typically used for petrol at filling stations.

•

Underground pressure vessels – small buried or mounded pressure vessels, typically used for LPG.

•

Caverns – large excavated in-ground tanks, typically used for liquefied gas or crude oil storage at refineries or storage terminals.

•

Salt dome caverns – large capacity storage located deep underground in natural rock formations, typically used for storage of gas under pressure.

In Section 2.0 failures of the first two types are discussed. Only failures of the tank itself are considered; surface facilities are excluded. On a petrol tank, the surface facilities may include underground pipes, and metering as well as above-ground dispensing pumps. On a gas storage tank, surface facilities may include surge vessels, injection pumps, gas driers and metering systems. Failures of the supply system, such as loading from road tankers and leaks from loading hoses are also excluded.

2.0

Summary of Recommended Data

2.1

Atmospheric Storage Tanks

The best available estimates of leak frequencies for atmospheric tanks are summarised in Table 2.1. Table 2.1 Atm ospheric Storage Tank Leak Frequencies Type of Tank Floating roof Fixed/ floating roof

Type of Release

Leak Frequency (per tank year)

Liquid spill on roof

1.6 × 10

-3

Sunken roof

1.1 × 10

-3

Liquid spill outside tank

2.8 × 10

-3

Tank rupture

3.0 × 10

-6

The frequencies of different types of fire/explosion are summarised in Table 2.2.

4

©OGP

RADD – Storage incident frequencies

Table 2.2 Atm ospheric Storage Tank Fire Frequencies Type of Fire

Floating Roof Tank (per tank year)

Rim seal fire

1.6 × 10

-3

Full surface fire on roof

1.2 × 10

-4

Fixed Roof Tank (per tank year)

Fixed plus Internal Floating Roof Tank (per tank year) 1.6 × 10

-3

Internal explosion & full surface fire

9.0 × 10

-5

9.0 × 10

-5

Internal explosion without fire

2.5 × 10

-5

2.5 × 10

-5

Vent fire

9.0 × 10

-5

Small bund fire

9.0 × 10

-5

9.0 × 10

-5

9.0 × 10

-5

Large bund fire (full bund area)

6.0 × 10

-5

6.0 × 10

-5

6.0 × 10

-5

2.2

Refrigerated Storage Tanks

Estimates of frequencies of catastrophic rupture for different designs of refrigerated storage tanks are shown in Table 2.3. Table 2.3 Sum m ary of Refrigerated Storage Tank Leak Frequencies Tank Design

Catastrophic Rupture Frequency (per tank per year) Primary Containment Only 1

Secondary Containment 2

Leak Frequency (per connection year) Primary Containment Only

Existing Single Containment Tanks

2.3 × 10

-5

7.3 × 10

-6

1.0 × 10

-5

New Single Containment Tanks

2.3 × 10

-6

7.3 × 10

-7

1.0 × 10

-5

Double Containment Tanks

1.0 × 10

-7

2.5 × 10

-8

1.0 × 10

-5

Full containment tanks3

1.0 × 10

-7

1.0 × 10

-8

0

1.0 × 10

-7

1.0 × 10

-8

0

Membrane tank

3

1

The pool area is that of the secondary containment For single containment tanks this scenario corresponds to bund overtopping 3 No collapse is considered for these tank types if they have a concrete roof 2

A leak or rupture of the tank, releasing some or all of its contents, can be caused by brittle failure of tank walls, welds or connected pipework due to use of inadequate materials, combined with loading such as wind, earthquake or impact. Where there is the potential for such loading – in particular, in seismically active zones – specialist analysis of the failure likelihood should be sought.

©OGP

5

RADD – Storage incident frequencies

2.3

Pressurised Storage Vessels

Table 2.4 gives leak frequencies for typical hole size categories. Table 2.4 Sum m ary of Pressure Vessel Leak Frequencies Hole Diameter Range

Leak Frequency (per vessel year)

Nominal

Storage Vessels

Small Containers

1-3 mm

2 mm

2.3 × 10

-5

4.4 × 10

-7

3-10 mm

5 mm

1.2 × 10

-5

4.6 × 10

-7

10–50 mm

25 mm

7.1 × 10

-6

50-150 mm

100 mm*

4.3 × 10

-6

>150 mm

Catastrophic

4.7 × 10

-7

1.0 × 10

-7

4.7 × 10

-5

1.0 × 10

-6

TOTAL

*Or diameter of largest pipe connection if this is smaller

The frequency of a tank BLEVE (Boiling Liquid Expanding Vapour Explosion) should be calculated using fault tree analysis, taking account of adjacent fire sources capable of causing this event. Previous such analysis indicates that a frequency in the range 10-7 to 10-5 per vessel year would be expected for a large storage vessel.

2.4

Oil Storage on FPSOs

A frequency of fires in cargo oil tanks of 8.8 x 10-4 per tanker year was derived from data on oil tankers [33]. This data is over 15 years old and based on oil tankers, and there was very limited experience with FPSOs at that time compared with now. However, more recent data (see Section 4.4) does not permit a better estimate. A suitable frequency for QRA is therefore best obtained by a theoretical approach, e.g. using fault tree analysis, taking account of the specific design features of the installation and the potential for human error.

2.5

Non-process Hydrocarbon Storage Offshore

Table 2.5 and Table 2.6 present release frequencies for methanol and diesel/ATK systems offshore, where the system includes the tank and the associated pipework. Where there is more than one tank, the tank frequencies given can be multiplied up and the totals recalculated. Table 2.5 Offshore Methanol Storage Leak Frequencies (per year) Small

Large

Rupture

Tank

1.6 × 10

Pipework

7.9 × 10

-3

1.6 × 10

-3

1.1 × 10

-3

Total

9.5 × 10

-3

2.0 × 10

-3

1.3 × 10

-3

Fraction

6

Medium -3

74%

4.6 × 10

-4

2.3 × 10

-4

15%

10%

©OGP

3.0 × 10

-5

3.0 × 10 0.2%

-5

Total 2.3 × 10

-3

1.1 × 10

-2

1.3 × 10

-2

100%

RADD – Storage incident frequencies

Table 2.6 Offshore Diesel/ATK Storage Leak Frequencies (per year) Small Tank

1.6 × 10

Pipework

2.1 × 10

-2

4.1 × 10

Total

2.2 × 10

-2

4.6x 10

Fraction

2.6

Medium -3

74%

Large

Rupture

4.6 × 10

-4

2.3 × 10

-4

-3

2.8 × 10

-3

-3

2.9 × 10

-3

15%

10%

3.0 × 10

-5

3.0 × 10 0.1%

-5

Total 2.3 × 10

-3

2.7 × 10

-2

3.0 × 10

-2

100%

Underground Storage Tanks

There is inadequate data to estimate the frequencies of failures of underground tanks directly, and they are usually obtained using data for above ground tanks and eliminating contributions from hazards that are not relevant. In general, this involves eliminating external impact and fire escalation cases. These approaches are not yet sufficiently developed to recommend standard frequencies and so for buried/ mounded tanks a specific assessment by a risk specialist is recommended. Note also that a leak from a buried or mounded tank is likely first to be into the surrounding soil and may not reach the open air; even if it does, it may not eject the intervening soil and so may be limited in rate and velocity by this. Likewise, there is inadequate data to estimate the frequencies of leaks from storage caverns and a specialist assessment of this is recommended.

3.0

Guidance on Use of Data

3.1

General validity

The data presented in Section 2.0 can be used for storage tanks and containers for onshore facilities containing refrigerated and ambient liquids; those presented in Section 2.4 should be used for unpressurised storage of methanol and non-process hydrocarbons offshore. The derivation and application of the data is discussed further in Section 4.0.

3.2

Uncertainties

The sources of uncertainty in the estimated leak and fire frequencies are discussed in Section 4.0 for the different tank types. The uncertainty in the frequencies presented in Section 2.0 tends to be greatest for catastrophic failures due to lack of failure experience. Furthermore, the applicability of the failure modes in the historical events to modern tank designs may also be inappropriate because of improvements in tank design. The uncertainty in values for atmospheric storage tanks could be represented by a range of at least a factor of 10 higher or lower. Estimates of leak frequencies for large pressure vessels, for both the overall leak frequencies and the rupture frequencies, range over 4 orders of magnitude.

©OGP

7

RADD – Storage incident frequencies

4.0

Review of Data Sources

4.1

Atmospheric Storage Tanks

Failure experience was reviewed from a number of sources: •

[3] includes 122 cases of atmospheric storage tank fires world-wide during 1965-89.

•

[4] lists 69 such events during 1981-96.

•

[5] lists 107 events during 1951-95 (see [1] App I).

4.1.1

Selection of Generic Value for Atmospheric Storage Tanks

A wide variation is apparent in the source data. The LASTFIRE data [4] is considered the most reliable source for releases from floating roof tanks. The frequency based on US petroleum industry tanks >10,000 bbl is believed to be the best estimate for rupture frequency. For large floating roof tanks, the LASTFIRE study [4] provides the best available fire frequencies. In the absence of any other data, they are assumed applicable to all sizes of floating roof tanks. The bund fire frequencies are assumed applicable to all types of tanks. For fixed roof tanks, the best available estimate is from a Technica study for tank operators in Singapore [3]. For explosions in fixed roof tanks, the ratio of fires and explosions in world-wide event data has been used. For tanks with both fixed and internal floating roof, the frequencies of appropriate fire/explosion types have been selected from the other tank types. For catastrophic ruptures, an estimate based on US petroleum industry experience has been used, which is consistent with the absence of ruptures in the LASTFIRE data. Comparison of sources for atmospheric tank leak frequency data suggests that the uncertainty in these values could be represented by a range of at least a factor of 10 higher or lower. For fixed roof tanks, the Singapore study [3] and API [5] give values in the range 1.8 × 10-4 to 3.0 × 10-4 per tank year. The Singapore data is considered to be comprehensive and is more recent, so the value of 1.8 × 10-4 per tank year is adopted here. The full surface fire frequency is 50% of this, i.e. 9 × 10-5 per tank year. For tanks with fixed plus internal floating roof, the fire frequency might be expected to be lower than for the other designs. However, these tend to be used for more highly flammable products, so this may offset any reduction in the average fire frequency. In the absence of better information, it is assumed that the frequency of rim seal fires is as for open-top floating roof tanks, while the frequency of full-surface fires is as for fixed roof tanks. Explosions may occur inside fixed roof tanks if flammable vapour is ignited. If the tank contains liquid, this is likely to result in a full-surface fire. If the tank is empty but not gas free, there may be no further fire, although the event may be fatal for people inside the tank at the time (e.g. 2 events described in [6]). Explosions inside fixed roof tanks may produce debris that damages adjacent tanks (e.g. Romeoville, 24 September 1977). Floating roof tanks are designed to eliminate flammable vapour within the tank, but in principle explosions may also occur: •

8

Inside the tank when empty, while the roof is supported on legs above the tank base. However, no such incidents are known.

©OGP

RADD – Storage incident frequencies

•

Above the roof but inside the shell, if vapour leaks past the floating roof. In an opentop tank, this is expected to produce a flash fire rather than an explosion, if ignited. However, such explosions may occur in tanks with fixed plus internal floating roof.

•

Outside the tank area, if vapour drifts into a confined space before ignition occurs. However, this should be modelled in the risk analysis as a tank leak.

No previous estimate of explosion frequency is available for storage tanks. Most reports of explosions are derived from press accounts (e.g. MHIDAS), which do not identify the type of tank involved. They also refer to world-wide experience, for which the tank population is not known. LASTFIRE [4] gives no cases of explosions in 33,906 tank years for open-top floatingroof tanks. Making the common assumption that this is equivalent to “0.7 explosions to date”, the frequency is assumed to be 2 × 10-5 per tank year. This may be conservative, as it is similar to the frequency for tanks with fixed plus internal floating roof estimated below. Technica [3] analysed 122 tank fires from MHIDAS, in which 2% were initiated by explosions. A total of about 22% of these incidents were recorded as involving explosions. It is not known how many of these were in fixed or floating roof tanks. These would be included in the fire frequencies above. DNV [7] analysed MHIDAS reports of fires on crude oil tanks, in which 19 out of 92 were reported as explosions followed by fires. This suggests that as many as 20% of fires may begin with explosion-like events. It is not known how many of these were in fixed or floating roof tanks. Failure experience for fires/explosions where there is definite information about the roof type and ignition consequences indicate that in tanks without an internal floating roof, all full surface fires began with explosions. In addition, there were 3 explosions that did not result in fires in the tank. Based on the frequency of 9 × 10-5 per year adopted above for full surface fires, this suggests an additional frequency of 2.5 × 10-5 per year for explosions without fires. In tanks with an internal floating roof, there has been one incident of a full-surface fire with no report of any preceding explosion. However, this event has little practical significance for risk analysis. There is insufficient information to give a ratio of fires and explosions significantly different to that estimated above for open top floating roof tanks. 4.1.2

Overfilling

The main causes of liquid spill onto the roof were roof fracture and overfill. The LASTFIRE report suggests that 19% of all leaks outside of a storage tanks were caused by overfilling. There are a large number of variables involved in the mechanism for overfill. It is therefore recommended that to model overfill effectively would require detailed analysis using fault tree techniques.

©OGP

9

RADD – Storage incident frequencies

4.2

Refrigerated Storage Tanks

There have been several estimates of the failure frequency for refrigerated storage tanks, addressing different tank designs. Historical data is mainly influenced by single wall tanks. The Second Canvey Study [8] addressed double-wall LNG tanks; the COVO study [9] addressed double integrity tanks; and IPO [10] further addressed double and full containment tanks. No single study is superior in all respects. All these sources and available historical data have been reviewed to produce a consistent set of estimates of frequencies of catastrophic rupture for different designs of refrigerated storage tanks. 4.2.1

Selection of Generic Value for Refrigerated Storage Tanks

During the last 30 years, there have been only 2 spontaneous catastrophic ruptures of large refrigerated tanks although this might rise to 3 if the small tank at Varennes was included and to 4 if the escalation event at Guayaquil was included. The world-wide population of refrigerated storage tanks is not known with any precision, although it has been estimated as approximately 2000 tanks. This would give a historical catastrophic rupture frequency of 2/(2000 × 30) = 3 × 10-5 per tank year. This would be 6 × 10-5 per tank year if the small tank and escalation events were included. This approach is very uncertain, and the applicability of the failure modes in the historical events to modern tank designs is unclear. Nevertheless, it does indicate that rupture frequencies as low as 10-6 per tank year would be very difficult to justify when compared to actual accident experience. 16 leaks from refrigerated storage tanks have been reported during the period 1965-95. The total number of liquid leaks may be lower, since some of these may have been vapour leaks, but this may be offset if some events have been omitted from MHIDAS. Using this value, an overall leak frequency is 16 / (2000 × 30) = 2.7 × 10-4 per tank year. Excluding ruptures and escalation events, this becomes 2.1 × 10-4 per tank year. These leaks were mainly small. A number of sources were reviewed in estimating the generic values for refrigerated storage. These include: • • • • • • • •

First Canvey Report [11] BG Estimate [12, 13, 14] Second Canvey Report [8] SRD LPG Study LA LNG Study COVO Study [9] GRI Data IPO Values [10]

None of the above analyses are superior in all respects. The BG estimate is based on the most extensive engineering investigation of failure modes, but it appears to neglect some failure modes (e.g. aircraft impacts) and is strongly influenced by judgement. The estimate based on historical failure experience automatically includes all failure modes, but some may not be applicable to modern tanks, and both the failure experience and the tank exposure estimates may be inaccurate. The values from the Second Canvey Report are between the BG and historical estimates above. They also have the merit of having been used in a well-known public-domain QRA. They are therefore adopted as cautious best estimates. The BG and historical

10

©OGP

RADD – Storage incident frequencies

estimates could be used as optimistic and pessimistic sensitivity tests respectively. The IPO values could be used as a more optimistic sensitivity test. There have been no formal considerations of the effects of tank design on failure frequencies. With the exception of the IPO study, each of the studies referenced above addresses a different type of tank, so frequencies cannot be compared. The historical data is probably dominated by single-wall ammonia tanks, and hence the catastrophic failure frequency of 3 × 10-5 is appropriate for them. The Canvey studies related to double-wall LNG tanks, and hence the value of 7.3 × 10-6 is appropriate for them. The difference is a factor of 4, which seems subjectively realistic. This can be compared to the difference of a factor of 10 assumed in the LA LNG study. The effect of double integrity tanks would be to reduce the frequency further. The COVO value [9] of 1 × 10-6 may be appropriate for this, i.e. a further reduction by a factor of 7. Double containment tanks have the same frequencies, but these apply to releases into the middle space. The further probability of release beyond the secondary containment depends on the likelihood of common cause failures. The IPO judgements suggest a probability of 0.25. Full containment tanks do reduce the frequencies of release further. The IPO judgements suggest a frequency of 1 × 10-8 may be appropriate for them, i.e. a further reduction by a factor of 100 compared to double integrity tanks.

4.3

Pressurised Storage Vessels

4.3.1

Accident Source Data

Lees [1] lists several major accidents involving large storage vessels including: •

Ruptures, BLEVEs and leaks of LPG tanks, including the well known Feyzin and Mexico City disasters.

•

The rupture of an ammonia tank at Potchefstroom, South Africa, 13 July 1973, that caused 18 fatalities.

•

A leak from a chlorine tank, Baton Rouge, Louisiana, USA, 10 December 1976. There were no fatalities but 10,000 people were evacuated.

Major accidents involving medium storage vessels listed by Lees [1] include: •

Leak from of LPG tank, Wealdstone, Middlesex, UK, 20 November 1980.

•

Leak of MIC from tank, Bhopal, India, 3 December 1984. A 46 m3 refrigerated stainless steel pressure vessel containing methyl isocyanate (MIC) suffered a release through the relief valve. The release may have been due to entry of water causing an exothermic reaction that increased the temperature and pressure until the relief valve lifted. The cloud of toxic gas caused approximately 2000 fatalities among nearby residents.

•

Rupture of a CO2 tank, Worms, Germany, 21 November 1988.

•

Rupture of an ammonia tank, Dakar, Senegal, March 1992, causing 41 fatalities.

Gould [15] lists 16 failures of chlorine tanks in the range 4 to 30 tonnes.

©OGP

11

RADD – Storage incident frequencies

4.3.1.1 Additional Source Data for BLEVEs In the UK, only one BLEVE of a fixed LPG vessel is known (a domestic vessel of less than 1 tonne capacity, at Kings Ripton in 1988) in a population of approximately 925,000 vessel years up to 1989 [16]. This indicates a BLEVE frequency of 1 × 10-6 per vessel year. An earlier published estimate was 3 × 10-6 per vessel year [17]. Using the population of 132,000 vessels in 1991 [18] allows the exposure up to the end of 1998 to be estimated as 2,113,000 vessel years, giving a frequency of 5 × 10-7 per vessel year. Since 98% of the exposure relates to vessels under 5 tonnes capacity, this is appropriate for medium storage vessels. 4.3.2

Selection of Generic Value for Pressurised Storage Vessels

The best available source of leak frequencies for hydrocarbon process pressure vessels is provided by the HSE hydrocarbon release database [19]. In the absence of any collection of data on leak frequencies from storage vessels (spheres and bullet tanks), available analyses indicate that these are not significantly different to the leak frequencies from steam boilers [20]. This source does not give a leak size distribution, but it gives frequencies a factor of 100 lower than estimated above for process vessels, and therefore this factor has been applied to the process vessel size distribution. Available estimates of leak frequencies from small containers (drums and cylinders) for liquefied gases indicate leak frequencies a further factor of 50 lower than for steam boilers. Comparison of the above estimates of leak frequencies for large pressure vessels suggests both the overall leak frequencies and the rupture frequencies range over 4 orders of magnitude. Pressure vessel design and inspection involves extensive effort to avoid catastrophic cold rupture. Some studies have argued that such events are not possible. Fracture mechanics analysis [21] has indicated that under normal circumstances defects in a stress-relieved vessel will cause a leak rather than a catastrophic failure. For vessels that are not stress-relieved, critical crack lengths could be so short that a leak-beforebreak condition can be excluded. A realistic leak size distribution might therefore use a continuous function up to the size of the largest connecting pipe, together with a rupture probability. However, for modelling purposes, the catastrophic rupture of the vessel will need to be represented in a different way to a rupture the size of the connecting pipe. For large/medium storage vessels, there is no high-quality data on leak frequency. Most studies have used data on steam boilers, which is of questionable relevance, although Davenport [20] shows no significant difference in the frequencies. Nevertheless, its use is only justifiable in the absence of better data. Gould [15] considered that the air receiver data from [20] was more appropriate for storage vessels, due to the absence of temperature cycling. Arulanantham & Lees [22] show a leak frequency for storage vessels that is not significantly different to that for process vessels, but this is not supported by other sources. Several judgmental reviews of data applied to LPG storage vessels [9,23,24,25] give leak frequencies in the range 5 × 10-6 to 6 × 10-5 per vessel year. These appear to be based on Davenport [20]. None are particularly authoritative. These judgements could be represented by a size distribution 100 times lower than the HSE offshore data. This would be a leak frequency of 5 × 10-5 per vessel year and a rupture frequency of 5 × 10-7 per year. 12

©OGP

RADD – Storage incident frequencies

The published estimate of rupture frequency of 2.7 × 10-8 by Sooby & Tolchard [18] is as yet unsupported by any collection of failure data. It is a factor of 20 below that proposed above, and is considered suitable for a sensitivity test. Similar leak frequencies have been observed for process vessels in the onshore process industry [22] and the offshore industry (OREDA and HSE). It is therefore assumed that otherwise similar pressure vessels in different industries have approximately the same leak frequencies. 4.3.2.1 BLEVE Data There were at least 25 large storage spheres world-wide subjected to fire impingement during 1955-87, of which 12 were destroyed by BLEVE, leading to a BLEVE frequency of approximately 10-5 per vessel year [27]. This value does not take account of design improvements that resulted from these events. Few BLEVEs of storage vessels have been reported since 1984. Therefore the current frequency should be lower. The likelihood of a BLEVE on a given tank depends on its fire protection measures and the site layout. This is best addressed using a fault tree approach, combined with modelling of possible fire scenarios and their impact on the tank.

4.4

Oil Storage on FPSOs

A 1990 study [33] obtained a frequency of fires/explosions on oil tankers over 6000 GRT of 2.2 × 10-3 per year from IMO data [34] for the period 1982-86. This frequency was adjusted assuming the COT fire frequency is related to the number of tanks, and hence the tanker frequency was reduced by 50% (6 tanks on FPSO compared with typically 12 on tankers.) A further 20% reduction was applied to reflect the historical trend in risk between 1972 and 1986 to obtain a frequency of 8.8 × 10-4 per year for cargo tank fires/explosions on FPSOs. Based on data in [32], there have been no fire/explosion incidents on FPSOs operating in UKCS up to 2005. There have been 2 incidents involving cargo tanks. One involved overfilling and the other involved dropping liquid nitrogen onto the deck (above a tank), which consequently cracked; both of these can be considered to be due to human error. In neither case was there ignition. There have been no incidents of FPSO cargo oil tank failure up to 2005 [32] other than due to human error.

4.5

Non-process Hydrocarbon Storage Offshore

The main source of data on non-process fires is the WOAD database [28]. It includes 802 fire/explosion events up to 1996, of which 516 did not involve a hydrocarbon leak and hence were probably non-process fires. Most of these were recently reported events in the Norwegian Sector, where reporting standards are highest. Since WOAD relies on public domain reports, classification into process and non-process fires may be imprecise. The HSE hydrocarbon release database includes 117 leaks involving non-process hydrocarbons in the UK Sector during 1992-97, 43 of which ignited. The published report [29] includes system populations and leak frequencies for different utilities systems. The installation names and incident dates are not available, and hence this data is impossible to combine with the WOAD data. The HSE offshore accident and incident

©OGP

13

RADD – Storage incident frequencies

statistics reports (e.g. [30]) include numbers of fires/explosions, but do not provide any information to distinguish process and non-process fires. 4.5.1

Methanol

In [29] methanol leaks may be included under several systems. Although leak size distributions are included, there is insufficient leak experience to give smooth distributions. Calculating methanol leak frequencies is awkward because the systems in the HSE database include both methanol and other fluids. For flow lines and manifolds, the systems are dedicated to a single product, but the population data includes condensate lines. Therefore the frequency should use the total number of leaks. This assumes that the frequencies are the same for methanol and condensate. For process systems, both methanol and other lines are included in all systems. Therefore the frequency should use only the methanol leaks, and leaks from the oil and gas lines should be included under process leaks. An alternative approach is to use generic equipment leak frequencies. For example, the tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year. In the HSE database, none of the 12 methanol leaks during 1992-97 were from methanol tanks. Methanol leaks might occur due to over-filling of the tank, and a fault tree analysis could be made of this, taking account of the filling frequency and the tank’s high-level and high-pressure trips. A further contribution to the failure frequency might arise from escalation of other events near to the tank. The deluge system should be adequate to cover the whole tank evenly as well as the tank supports, to prevent collapse of the tank in a fire. The data presented in Table 2.5 is a “system” leak frequency combining a tank leak frequency distribution and a pipe work leak. The total number of leaks from a methanol system is taken from [31] and set at 1.3 × 10-2 per system year. Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year. The rupture frequency is 3.0 × 10-5 per yr and the remaining small, medium and large tank leak frequencies are calculated based on a continuous leak frequency function. The contribution from pipework, pumps and flanges is calculated by dividing the remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large (10%) releases. 4.5.2

Diesel

In [29] diesel leaks may be included under several systems. Although leak size distributions are included, there is insufficient leak experience to give smooth distributions. Calculating diesel leak frequencies from these is awkward because the systems in the HSE database include both diesel and other fluids. The HSE use the 31 leaks categorised as “utilities, oil, diesel” and an exposure 1511 diesel utilities systems, to give a frequency of 2.1 × 10-2 per system year. However, this omits diesel leaks from other systems. An alternative approach would be to divide the total of 52 leaks by the 1511 diesel utilities systems, to give a frequency of 3.4 × 10-2 per system year. An alternative approach is to use generic equipment leak frequencies. For example, the tank leak frequency could be based on the pressure vessel value of 1.5 × 10-4 per year. 14

©OGP

RADD – Storage incident frequencies

In the HSE database, 5 of the 52 diesel leaks during 1992-97 were from tanks and one was from a pressure vessel. Assuming that each of the diesel systems had one tank, these 6 leaks in 1511 system-years would give a frequency of 4 × 10-3 per tank year. The data presented in Table 2.6 have been calculated using a similar approach to that used for methanol leaks. The total number of leaks from a diesel system is taken from [31] and set at 3.4 × 10-2 per year. However, this frequency includes oil export and well systems. Eliminating leaks involving these systems gives a system leak frequency of 3.0 × 10-2 per year. Using data from [29] the overall contribution from tank leaks is 2.6 × 10-3 per tank year. The rupture frequency is 3.0 × 10-5 per year and the remaining small, medium and large tank leak frequencies are calculated based on a continuous leak frequency function. The contribution from pipework, pumps and flanges is calculated by dividing the remaining leak frequency (system - tank) between Small (75%), Medium (15%) and Large (10%) releases.

5.0

Recommended Data Sources for Further Information

For further information, the data sources used to develop the release frequencies presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted.

6.0

References

The principal source references are shown in bold. 1. Lees, F.P. 1996. Loss Prevention in the Process Industries, 2nd. ed., Oxford: Butterworth-Heinemann. 2. BS EN 1473: 1997. onshore installations.

Installation and equipment of liquefied natural gas – Design of

3. Technica 1990. Atmospheric Storage Tank Study, Confidential Report for Oil & Petrochem ical Industries Technical and Safety Com m ittee, Singapore, Project No. C1998. 4. LASTFIRE 1997. Large Atmospheric Storage Tank Fires - A Joint Oil Industry Project to Review the Fire Related Risks of Large Open-Top Floating Roof Storage Tanks. 5. API 1998. Interim Study - Prevention and Suppression of Fires in Large Aboveground Atmospheric Storage Tanks, Am erican Petroleum Institute Publication 2021A. 6. DNV 1997. Fires and Explosions in Atmospheric Fixed Roof Storage Tanks, Confidential Report for Oil Refineries Ltd, Project No. C8263. 7. DNV 1998. HAZOP Study and Risk Assessment of Venezia Refinery, Confidential Report for AgipPetroli SpA, Project No. C383005. 8. HSE 1981. Canvey - A Second Report - An Investigation of Potential Hazards from Operations in the Canvey Island/Thurrock Area 3 years After Publication of the Canvey Report, Health & Safety Executive, London: HMSO. 9. Rijnm ond Public Authority 1982. A Risk Analysis of Six Potentially Hazardous Industrial Objects in the Rijnmond Area - A Pilot Study, (the “COVO Study”), Dordrecht: D. Reidel Publishing Co. ©OGP

15

RADD – Storage incident frequencies

10. IPO 1994. Handleiding voor het opstellen en beoordelen van een extern veiligheidsrapport, Interprovinciaal Overleg. 11. HSE 1978. Canvey – An Investigation of Potential Hazards from Operations in the Canvey Island/Thurrock Area, Health & Safety Executive, London: HMSO. 12. British Gas 1979. Further Studies on the Integrity and Modes of Failure of Canvey Above Ground Storage Tanks, British Gas Engineering Research Station Report ERS R1983. 13. British Gas 1981a. The Hazard of Rollover – Canvey Terminal Above Ground Storage Tanks, British Gas Fundamental Studies Group Report FST 812. 14. British Gas 1981b. An Assessment of the Probability of Unintentionally Filling to the Roof an Above Ground LNG Storage Tank at the Canvey Island Methane Terminal. 15. Gould, J. 1993. Fault Tree Analysis of the Catastrophic Failure of Bulk Chlorine Vessels, AEA Technology, Report SRD/HSE/R603, London: HMSO. 16. ACDS 1991. 17. Blything, K.W. & Reeves, A.B. 1988. An Initial Prediction of the BLEVE Frequency of a 100 Tonne Butane Storage Vessel, SRD Report R488. 18. Sooby, W. & Tolchard, J.M. 1993. Estimation of Cold Failure Frequency of LPG Tanks in Europe”, Conference on Risk & Safety Management in the Gas Industry, Hong Kong. 19. HSE 2000. Offshore Hydrocarbon Releases Statistics 1999, Offshore Technology Report OTO 1999 079, Health & Safety Executive, London: HMSO. 20. Davenport, T.J. 1991. Reliability 91, London.

A Further Survey of Pressure Vessel Failures in the UK,

21. Smith, T.A. 1986. An Analysis of a 100 te Propane Storage Vesse”, UKAEA Safety and Reliability Directorate Report SRD R314. 22. Arulanatham, D.C. & Lees, F.P. 1981. Some Data on the Reliability of Pressure Equipment in the Chemical Plant Environment, Int. J. Pres. Ves & Piping 9 327-338. 23. Crossthwaite, P.J., Fitzpatrick, R.D. & Hurst, N.W. 1988. Risk Assessment for the Siting of Developments near Liquefied Petroleum Gas Installations, IChemE Symp. Ser. 110. 24. Pape, R.P. and Nussey, C. 1985. A Basic Approach for the Analysis of Risks From Major Toxic Hazards, Assessment and Control of Major Hazards, EFCE event no. 322, Manchester, UK, IChemE Symp. Ser. 93, 367-388. 25. Whittle, K. 1993. LPG Installation Design and General Risk Assessment Methodology Employed by the Gas Standards Office, Conference on Risk & Safety Management in the Gas Industry, Hong Kong, October. 26. Reeves, A.B., Minah, F.C. & Chow, V.H.K. 1997. Quantitative Risk Assessment Methodology for LPG Installations, EMSD Symposium on Risk and Safety Management in the Gas Industry, Hong Kong, March. 27. Selway, M. 1988, The Predicted BLEVE Frequency of a Selected 200 m3 Butane Sphere on a Refinery Site, SRD Report R492. 28. W OAD. W orld Offshore Accident Database, DNV. 29. HSE (1997a): Offshore Hydrocarbon Release Statistics, 1997, Offshore Technology Report OTO 97 950, Health & Safety Executive.

16

©OGP

RADD – Storage incident frequencies

30. HSE (1997b): Offshore Accident and Incident Statistics Report, 1997, Offshore Technology Report OTO 97 951, Health & Safety Executive. 31. Spouge, J R 1999. A Guide to Quantitative Risk Assessment for Offshore Installations, Publication No. 99/100, ISBN 1 870553 365, London: CMPT. 32. Det Norkse Veritas 2007. Accident statistics for floating offshore units on the UK Continental Shelf 1980-2005, Research Report RR567, Health & Safety Executive. 33. Technica, 1990. Port Risks in Great Britain from Marine Transport of Dangerous Substances in Bulk: A Risk Assessment, Report for The Health & Safety Executive, Project No. C1216. 34. IMO, 1987. Casualty Statistics, Report of the Steering Group, Annexes 1 – 3 (Analyses of Casualties to Tankers, 1972-1986), MSC 54/INf 6, 26.

©OGP

17

Risk Assessment Data Directory Report No. 434 – 4 March 2010

Riser & pipeline release frequencies International Association of Oil & Gas Producers

RADD – Riser & pipeline release frequencies

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0

Summary of Recommended Data ............................................ 2

3.0 3.1 3.2 3.3

Guidance on use of data ........................................................ 3 General validity ............................................................................................... 3 Uncertainties ................................................................................................... 3 Application of frequencies to specific pipelines ......................................... 3

3.3.1 3.3.2

Offshore pipelines...................................................................................................... 4 Onshore pipelines ...................................................................................................... 6

3.4

Application to pipelines conveying fluids other than hydrocarbons ........ 6

4.0 4.1

Review of data sources ......................................................... 6 Basis of data presented ................................................................................. 6

4.1.1 4.1.2 4.1.3

Risers and offshore pipelines ................................................................................... 6 Onshore gas pipelines............................................................................................... 8 Onshore oil pipelines................................................................................................. 9

4.2

Other data sources ....................................................................................... 10

5.0

Recommended data sources for further information ............ 11

6.0 6.1 6.2

References .......................................................................... 11 References for Sections 2.0 to 4.0 .............................................................. 11 References for other data sources.............................................................. 11

©OGP

1

RADD – Riser & pipeline release frequencies

Abbreviations: AGA ANSI API ASME CONCAWE DNV DOT EGIG ESDV PARLOC UK HSE UKOPA VIV

2

American Gas Association American National Standards Institute American Petroleum Institute American Society of Mechanical Engineers Conservation of Clean Air and Water in Europe Det Norske Veritas (US) Department of Transportation European Gas Pipeline Incident Data Group Emergency Shutdown Valve Pipeline And Riser Loss Of Containment United Kingdom Health and Safety Executive United Kingdom Pipeline Operators’ Association Vortex Induced Vibration

©OGP

RADD – Riser & pipeline release frequencies

1.0

Scope and Definitions

1.1

Application

This datasheet presents (Section 2.0) frequencies of riser and pipeline releases. Frequencies for offshore and onshore pipelines are included. The frequencies given are based on analysis for pipelines conveying hydrocarbons. They may be applied to pipelines conveying other fluids as discussed in Section 3.4.

1.2

Definitions

The pipeline frequencies are given for four different sections as shown in Figure 1.1. Risers are considered to comprise three sections: • • •

Above water (often taken to be the topsides section below the riser ESDV) Splash zone (exposed to aggressive corrosion conditions and ship collisions) Below water (to the flange connection with the pipeline or a spool piece) Figure 1.1 Definition of Pipeline Sections

For offshore sections, frequencies are given for steel and flexible risers and pipelines. “Flexible” should be understood in the context of the source data (see Section 4.1.1), which is from the North Sea. It therefore includes risers from FPSOs, TLPs and semisubmersibles but would not include deepwater technologies such as steel catenary risers. These are a specialist and relatively new area, and the failure frequency analysis should accordingly be undertaken utilising suitable expertise.

©OGP

1

RADD – Riser & pipeline release frequencies

2.0

Summary of Recommended Data

The recommended frequencies and associated data are presented as follows: • • •

Table 2.1 Recommended Riser and Pipelines failure Frequencies Table 2.2 Recommended Hole Size Distributions for Risers and Pipelines Table 2.3 Release Location Distribution for Risers

Note that separate failure frequencies are not given for Segment III, Landfall zone. This segment, representing the tidal zone, is defined as the area where the pipeline may be wet and dry at different times. This allows the anode system to function. Onshore pipelines are often more affected by corrosion than pipelines in the tidal zone. Hence frequencies for onshore pipelines should be used in tidal zones. A pipeline in the landfall zone may also be subject to increased risk of external impact, e.g. due to grounding ships. Such risks may have to be assessed separately. Table 2.1 Recom m ended Riser and Pipelines failure Frequencies Pipeline

Category

Subsea pipeline: in open sea

Well stream pipeline and other small pipelines containing unprocessed fluid

Failure frequency -4 5.0 × 10

Unit per km-year

Processed oil or gas, pipeline diameter ≤ 24 inch Processed oil or gas, pipeline diameter > 24 inch

5.1 × 10

-5

per km-year

1.4 × 10

-5

per km-year

Subsea pipeline: external loads causing damage in safety zone Flexible pipelines: subsea

Diameter ≤ 16 inch

7.9 × 10

-4

per year

1.9 × 10

-4

per year

All

2.3 × 10

-3

per km-year

Risers

Steel - diameter ≤ 16 inch

9.1 × 10

-4

per year

-4

per year per year

-3

per km-year

-4

Oil pipelines onshore

Gas pipelines onshore

Diameter > 16 inch

Steel – diameter > 16 inch Flexible

1.2 × 10 -3 6.0 × 10

Diameter < 8 inch

1.0 × 10

8 inch ≤ diameter ≤ 14 inch 16 inch ≤ diameter ≤ 22 inch

8.0 × 10 -4 1.2 × 10

per km-year per km-year

24 inch ≤ diameter ≤ 28 inch

2.5 × 10

-4

per km-year

-4

Diameter > 28 inch Wall thickness ≤ 5 mm

2.5 × 10 -4 4.0 × 10

per km-year per km-year

5 mm < wall thickness ≤ 10 mm

1.7 × 10

-4

per km-year

8.1 × 10

-5

per km-year

4.1 × 10

-5

per km-year

10 mm < wall thickness ≤ 15 mm Wall thickness > 15 mm

2

©OGP

RADD – Riser & pipeline release frequencies

Table 2.2 Recom m ended Hole Size Distributions for Risers and Pipelines Hole size

Subsea pipeline

Onshore pipeline Gas Oil

Riser

Small (< 20 mm)

74%

50%

23%

60%

Medium (20 to 80 mm) Large (> 80 mm)

16% 2%

18% 18%

33% 15%

15%

8%

14%

29%

Full rupture

25%

Table 2.3 Release Location Distribution for Risers Release location Above water Splash zone Subsea

3.0

Guidance on use of data

3.1

General validity

Distribution 20% 50% 30%

The frequencies given are based on analysis for pipelines conveying hydrocarbons. They may be applied to pipelines conveying other fluids as discussed in Section 3.4. There is an implicit assumption that the pipelines are built to a recognized international standard such as ANSI/ASME B31.4/8 [1,2] or (for subsea pipelines) DNV-OS-F101 [3].

3.2

Uncertainties

In addition to the known causes of fluid release from transport pipelines, as discussed in Section 4.0, new or unforeseen factors may cause shutdown of pipelines. It is impossible to estimate the contribution from such incidents to the release frequencies, neither is it possible to state that it is more likely that some pipelines will sustain failure before others. Accordingly, unknown factors cannot be used either to identify pipelines which are especially exposed to the possibility of leakage or to prioritize risk mitigation measures.

3.3

Application of frequencies to specific pipelines

In Table 2.1, most frequencies are given per km-year as they are dependent on the length of the pipeline. For a typical pipeline of length ℓ (km) with release frequency fkm, the release frequency F along the full length of the pipeline is simply given by: F = ℓ × fkm per year: There are several causes that can result in the release frequency for a specific pipeline, or for a section of a pipeline, being different from that obtained simply using the Section 2.0 frequencies.

©OGP

3

RADD – Riser & pipeline release frequencies

In general there are two main groups of causes causing pipeline failures. The first group is related to loads exceeding pipeline critical loads, usually resulting in an isolated incident. The second group is related to effects gradually weakening the pipeline over a period of time. Those considered here are: Isolated incidents – offshore

Mechanisms acting over time – offshore

Loads from trawl boards Ship anchor / sinking ship Subsea landslide Isolated incidents – onshore • External interference e.g. digging • Hot-tap made by error • Ground movement e.g. landslide

• • •

• • •

Corrosion Open spans causing fatigue Buckling Mechanisms acting over time – onshore • Construction defect • Material failure • Ground movement e.g. mining • Corrosion

These are discussed further in Sections 3.3.1 (offshore pipelines) and 3.3.2 (onshore pipelines), with some guidance given on modifying the Section 2.0 frequencies. However, in situations where several of these causes pertain or critical decisions are dependent on the analysis results, a detailed analysis should be carried out utilising appropriate expertise and data specific to the situation. Such analysis is beyond the scope of this datasheet. 3.3.1

Offshore pipelines

Where none of the additional causes listed in Section 3.3 that could exacerbate the likelihood of a release are present, the release frequency can be reduced by 50%. On pipeline sections where loads from trawl boards pose a threat, it is suggested that frequencies could be up to a factor of 5 higher (see Section 3.3.1.1). On pipeline sections where the other causes pose a threat, it is suggested that frequencies could be up to a factor of 2 higher (see Sections 3.3.1.2 to 3.3.1.5). 3.3.1.1 Loads from trawl boards Pipelines located in areas where trawling activity takes place may be damaged. Pipelines are normally dimensioned to withstand loads from a trawl, such as impacts, overdraw1 or hook up2. The pipe wall is normally covered by a concrete coating giving protection against local impact loads to the pipeline, and it gives the pipeline the necessary weight to gain stability. Overdraw and hook ups can initiate buckling of the pipeline. Free spans will exacerbate the effect of trawl impacts. A trawl can also catch other equipments such as exposed flanges and bolts, and a trawl hook up may cause pipeline fracture on smaller pipelines.

1

Overdraw is a situation where the trawl board comes in under the pipeline and is drawn over applying force sideways. 2 Hook up is a situation where the trawl board gets stuck beneath the pipeline. The pipeline may be damaged if the vessel tries to bring in the trawl. 4

©OGP

RADD – Riser & pipeline release frequencies

Trawling with lump weights is a relatively new practice and consequently most pipelines are not designed to tackle such loads. Even though no serious damage due to lump weights has yet been registered, it is still uncertain what consequences boom trawl and lump weights may cause. 3.3.1.2 Ship anchor / impact from sinking ships Pipelines located in areas with shipping traffic may be damaged by anchors getting hold of the pipeline, or a sinking ship hitting the line. The relevant factors include shipping traffic density, distance from shore or port, water depth, vessel traffic surveillance. 3.3.1.3 Material left behind from war years If a pipeline is laid through coastal areas that were mined during war years, there may still be material present that poses a threat to the pipeline even if these areas were cleared before installation of the pipeline. 3.3.1.4 Fatigue (mainly due to free spans) Free spans can result in fatigue if the span is excited by current, and the pipeline can fracture relatively quickly. Some spans develop as the soil beneath the pipeline is washed away, and an already existing span may evolve quickly since the free spans influence local currents near the pipeline. Only one example, from China, is known to be caused by free spans. The incident was caused by extreme climatic conditions (2 following cyclones) and the free span was longer than what the pipeline was designed for. Vortex Induced Vibration (VIV) has caused leakages in the past, but today’s pipelines are designed to resist the associated stress. 3.3.1.5 Buckling Buckling (bends) may occur if the pipeline is prevented from extension forced by pressure tension in the axial direction. This can cause buckling sideways or upwards. Some pipelines are designed to allow for a controlled buckling to relieve axial tension. It is important that the buckling takes place over a long distance. In extremely disadvantaged situations, when the buckling is very local, great strain may be placed on the pipeline. The consequence may be pipeline leakage and subsequent replacement. Buckling will normally occur during the first years of operation when temperatures are at their highest, but may occur if operational conditions are changed, new connections of pipeline or new compressor stations. 3.3.1.6 Material damage/failures If there are indications of pipelines being especially exposed to a specific type of failure, then corrections should be made utilising suitable engineering expertise. Typical correction factors would be in the range 2 to 3, applied to the contribution from the specific failure mechanism affected; expert engineering judgment should be used to determine a suitable factor.

©OGP

5

RADD – Riser & pipeline release frequencies

3.3.1.7 Fluid medium Both wet and dry gas should be properly processed to avoid corrosion or keep corrosion under control. For example, control and monitoring techniques of the pipelines operated by Norwegian companies is considered to be so good that wet gas pipelines do not have a higher probability of corrosion than the dry gas pipelines. The same applies to processed gas. Hence in general no correction need be applied for fluid medium. However, if it is known that the control techniques in place or planned do not meet current best practice, then a correction should be made in the same way as described for material damage/failures (Section 3.3.1.6). 3.3.2

Onshore pipelines

The EGIG and CONCAWE reports [7,8] give breakdowns of release frequencies by cause and release size. These are partially reproduced in Sections 4.1.2 (gas pipelines) and 4.1.3 (oil pipelines), and further data are available in the EGIG and CONCAWE reports. These sources of information could be used to obtain more location specific estimates of the release frequencies. However, in situations where several of these causes pertain or critical decisions are dependent on the analysis results, a detailed analysis should be carried out utilising appropriate expertise and data specific to the situation. Such analysis is beyond the scope of this datasheet.

3.4

Application to pipelines conveying fluids other than hydrocarbons

Certain non hydrocarbon fluids can increase the likelihood of failure through specific mechanisms. For example, under certain circumstances ammonia may cause stress corrosion cracking, increasing the contributions from internal and external corrosion. In the first European Benchmark Study, DNV [5] estimated a factor-of-3 increase in these contributions to the overall failure frequency. As already discussed in Section 3.3.1, the factor should be estimated using expert engineering judgment.

4.0

Review of data sources

4.1

Basis of data presented

4.1.1

Risers and offshore pipelines

The frequencies and distributions presented in Section 2.0 for risers and offshore pipelines are derived from DNV’s re-analysis [6] of the data presented in PARLOC 2001 [4]. The re-analysis was performed because of recognised errors in the frequencies given in PARLOC 2001 itself. Table 4.1 presents the data used as the basis of the analysis. Allocation of failures to failure mechanisms vary according to source. Table 4.2 indicates how much different mechanisms contribute to the overall failure frequency. This can be used to determine how specific features of the pipeline design may affect the frequency. Section 3.3 provides some general guidance that is not dependent on failure mechanism. Expert judgment should be used where the likelihood of failure by a specific mechanism is affected by specific features of the pipeline design (see Section 3.3.1).

6

©OGP

RADD – Riser & pipeline release frequencies

Table 4.1 Incident and Population Data for Offshore Pipelines from [4] Pipeline description

No. of releases

Exposure time

Well stream pipelines and other small pipelines containing unprocessed fluid, diameter ≤ 16 inch

30

60033 km-years 10576 pipe-years

Well stream pipelines and other small pipelines containing unprocessed fluid, diameter > 16 inch

3

36925 km-years (pipe-years not available)

Processed oil or gas pipeline, diameter ≤ 24 inch

3

59003 km-years 4320 pipe-years

2

147608 km-years 2949 pipe-years

7

8836 years

Processed oil or gas pipeline, diameter > 24 inch External load causing pipeline 1 damage , diameter ≤ 24 inch External load causing pipeline 1 damage , diameter > 24 inch Steel riser, diameter< 16 inch

0.7

Flexible pipeline Steel riser, diameter > 16 inch Flexible riser

2

3734 years

10

10979 riser-years

11

3447 km-years 3898 pipe-years

0.7 5

2

5937 riser-years 5 riser-years

Notes 1. Applies to near platform zone 2. No releases to date; estimate using standard statistical techniques.

Table 4.2: Allocation of Failure Mechanism s from [4]: Offshore Pipelines, All Diam eters Failure mechanism Corrosion

Distribution 36%

Material

13%

External loads causing damage Construction damage

38% 2%

Other

11%

Note: This is a summary. The distribution varies between hole sizes. For further information refer to the source report [4].

Table 4.3: Hole Size Distribution for Offshore Pipelines from [4] Hole size

Number of releases Pipelines 37

Risers 9

Medium (20 to 80 mm)

8

2

Large (> 80 mm)

1

4

Small (< 20 mm)

©OGP

7

RADD – Riser & pipeline release frequencies

4.1.2

Full rupture

4

Total

50

15

Onshore gas pipelines

The frequencies presented in Section 2.0 for onshore gas pipelines are based on data from EGIG’s most recently available report [7]. The EGIG database spans the period 1970-2004; it includes 1123 incidents on pipelines with a total exposure of approximately 2.77 million km-years. It shows an average incident frequency over this period of 4.1 × 10-4 per km-year and an average over the period 2000-2004 of 1.7 × 10-4 per km-year. Table 4.4 reproduces the breakdown of failures by cause given in the EGIG report [7]. Table 4.4: Allocation of Failure Mechanism s from [7]: Onshore Gas Pipelines, All Diam eters / W all Thicknesses Failure mechanism

Distribution

External interference

49.7%

Construction defect / Material failure

16.7%

Corrosion

15.1%

Ground movement Hot-tap made in error

7.1% 4.6%

Other/unknown

6.7%

The report also presents a graph showing the frequencies by cause separately for three sizes of failure: •

Pinhole/crack: diameter of hole ≤ 20 mm.

•

Hole: 20 mm ≤ diameter of hole ≤ pipeline diameter

•

Rupture: hole diameter > pipeline diameter

The report presents more detailed frequencies for each of the causes listed above. Those showing the dependence of the frequencies of failure due to external interference and corrosion on pipeline wall thickness have been used to derive the frequencies presented in Section 2.0 for pipelines with a wall thickness up to 15 mm. For thicker walled pipes, it has been assumed that the frequency is 50% of that for pipelines with a wall thickness of 10 – 15 mm based on the trend with diameter. Wall thickness rather than pipeline diameter has been found to be the most significant factor in determining pipeline failure rates. To some extent it is dependent on diameter, so accordingly some dependence on diameter is implicit in the data presented. Based on the rolling 5-year average total frequencies presented in the report, it has been assumed that current frequencies are approximately 50% of the 1970-2004 average. The frequencies in Section 2.0 include this trend factor. The report contains more detailed analysis of pipeline failure rate dependencies than is presented here, addressing: •

8

External interference: pipeline diameter, depth of cover and wall thickness

©OGP

RADD – Riser & pipeline release frequencies

•

Construction defect / Material failure: year of construction

•

Corrosion: year of construction, type of coating and wall thickness

•

Ground movement: pipeline diameter

•

Hot-tap made by error: pipeline diameter

•

Other / unknown: main causes

For more detailed analysis of these factors, reference should be made to the report directly. 4.1.3

Onshore oil pipelines

The frequencies presented in Section 2.0 for onshore oil pipelines are based on data in CONCAWE [8]. The data include 379 failures on pipelines with a total exposure for pipelines containing crude oil and products of approximately 667,000 km-years. More detailed analysis has enabled the diameter specific frequencies presented in Section 2.0 to be derived. The CONCAWE report [8] includes a detailed breakdown of failure size and mechanism, partially reproduced in Table 4.5. Based on the definitions of the failure sizes in the CONCAWE report [8], the hole size distribution given in Table 2.2 has been derived as follows: •

Pinhole + Fissure: Small (diameter of hole ≤ 20 mm.)

•

Hole: Medium (20 mm ≤ diameter of hole ≤ 80 mm)

•

Split: Large (diameter of hole > 80 mm)

•

Rupture: Rupture (pipeline diameter) Table 4.5: Allocation of Failure Mechanism s from [8]: Onshore Oil Pipelines, All Diam eters / W all Thicknesses Failure mechanism

Distribution Pinhole

Fissure

Hole

Split

Rupture

Overall

Total no. of failures Percentage of total

20 12%

21 12%

58 34%

27 16%

50 29%

176 100%

Mechanical failure

5%

19%

12%

22%

24%

17%

0% 90%

5% 33%

2% 29%

11% 30%

4% 18%

4% 34%

Natural hazard

0%

5%

2%

11%

2%

3%

Third party

5%

38%

55%

26%

52%

43%

Operational Corrosion

1

Note 1: Hole size data was only available for 176 out of the 379 failures.

©OGP

9

RADD – Riser & pipeline release frequencies

4.2

Other data sources

For risers and offshore pipelines, the PARLOC 2001 data [4] is regarded as the best source despite the shortcomings in the report noted in Section 4.1.1. It should be noted, however, that the previous cycle of 2-yearly revisions has lapsed. Other data sources from which onshore pipeline failure frequency data can be obtained included:1. US Department of Transportation. The US Department of Transportation Office of Pipeline Safety maintains a database of leaks from hazardous liquid and gas pipelines, together with exposure data. The database covers 800,000 km of pipelines, and is the largest of its kind. An analysis of the gas transmission and gathering line data was prepared for several years for the American Gas Association (AGA) by Batelle (e.g. Jones & Eiber 1989). An analysis of liquid pipeline data was prepared for DOT and API by Keifner & Associates (Keifner et al 1999). The database itself can be obtained from the DOT website at ops.dot.gov/libindex.htm. It includes files of pipeline incidents for natural gas transmission/gathering and distribution lines and liquid lines. Each is split into 1984 to date and pre-1984, due to a change in inclusion criteria. Pipeline population data is available in separate files for each year for 1995-98 for gas transmission/gathering and distribution lines. Summary statistics, together with population data for liquid lines since 1986 are at ops.dot.gov/stats.htm. 2. United Kingdom Onshore Pipeline Operators’ Association (UKOPA). UKOPA has issued a report (2005) that analyses pipeline product loss incidents in the UK over the period 1962-2004, covering about 21,700 pipeline km at the end of 2004 and 650,000 km-years pipeline exposure. Products covered are: natural gas (dry), natural gas liquid, ethane, ethylene, propane, propylene, LPG, butane, condensate and crude oil (spiked). Overall incident frequencies are calculated for 5-year periods. For the whole 43-year period the report presents frequencies by hole size (not related to pipeline diameter), and by cause and size of leak. There is further breakdown by hole size of the frequencies for external interference and corrosion as follows: External interference • • •

External corrosion

Pipeline diameter Measured wall thickness Area classification

• • • •

Wall thickness class Year of construction External coating type Type of backfill

3. UK HSE (1999). This study of the risk from UK gasoline pipelines collected data on events worldwide involving gasoline leaks from cross country pipelines. The data were used to determine the likelihood of events such as leaks and fires, and also to generate consequence models based on the available data. The report references CONCAWE and US DOT data. 4. UK HSE (2001). This study specifically addresses third party damage to onshore pipelines, comparing EGIG data and BG Transco’s incident database. The latter represents nearly 460,000 km-years exposure, with 32 third party incidents, 32 loss events, and 564 incidents altogether. The third part activity failure model takes into account such factors as: pipeline diameter, wall thickness and location; depth of cover; damage prevention measures in place.

10

©OGP

RADD – Riser & pipeline release frequencies

5.0

Recommended data sources for further information

For further information, the data sources used to develop the release frequencies presented in Section 2.0 and discussed in Sections 0 and 4.0 should be consulted. These references are shown in bold in Section 6.0.

6.0

References

6.1

References for Sections 2.0 to 4.0

1. ANSI/ASME B31.4:2006. Pipeline Transportation Systems for Liquid Hydrocarbons and other Liquids. 2. ANSI/ASME B31.8:2003. Gas Transmission and Distribution Piping Systems. 3. DNV-OS-F101 2000 amended Oct. 2005. Standard.

Submarine pipeline systems, Offshore

4. PARLOC 2001 – The Update of Loss of Containm ent Data for Offshore Pipelines, prepared by Mott McDonald for the UK HSE, UKOOA and IP, 2003. 5. DNV 1989. Analysis.

Phase 1 Report, CEC Benchmark Study – Project HH, Independent Risk

6. DNV 2006. Riser/Pipeline Leak Frequencies, Technical Note T7, rev. 02, unpublished internal document. 7. EGIG 2005. 6 th EGIG-report 1970-2004 Gas Pipeline Incidents, 6 th report of the European Gas Pipeline Incident Data Group, Doc. No. EGIG 05.R.0002. 8. CONCAW E 2002. Performance of crosscountry oil pipelines in W estern Europe, Report No. 1/02.

6.2

References for other data sources

(US) Department of Transportation. Refer ops.dot.gov/stats/stats.htm. ((UK) Health and Safety Executive 1999. Assessing the risk from gasoline pipelines in the United Kigdom based on a review of historical experience, Contract Research Report 210/1999, prepared by WS Atkins Safety & Reliability. http://www.hse.gov.uk/research/crr_pdf/1999/crr99210.pdf. (UK) Health and Safety Executive 2001. An assessment of measures in use for gas pipelines to mitigate against damage caused by third party activity, Contract Research Report 372/2001, prepared by WS Atkins Consultants Ltd. http://www.hse.gov.uk/research/crr_pdf/2001/crr01372.pdf. UKOPA 2005. Pipeline Product Loss Incidents (1962 - 2004), prepared by Advantica, Report Ref. R 8099, for UKOPA FDMG. http://www.ukopa.co.uk/.

©OGP

11

Risk Assessment Data Directory Report No. 434 – 5 March 2010

Human factors in QRA International Association of Oil & Gas Producers

P

ublications

Global experience The International Association of Oil & Gas Producers has access to a wealth of technical knowledge and experience with its members operating around the world in many different terrains. We collate and distil this valuable knowledge for the industry to use as guidelines for good practice by individual members.

Consistent high quality database and guidelines Our overall aim is to ensure a consistent approach to training, management and best practice throughout the world. The oil and gas exploration and production industry recognises the need to develop consistent databases and records in certain fields. The OGP’s members are encouraged to use the guidelines as a starting point for their operations or to supplement their own policies and regulations which may apply locally.

Internationally recognised source of industry information Many of our guidelines have been recognised and used by international authorities and safety and environmental bodies. Requests come from governments and non-government organisations around the world as well as from non-member companies.

Disclaimer Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms. This document may provide guidance supplemental to the requirements of local legislation. Nothing herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.

Copyright notice The contents of these pages are © The International Association of Oil and Gas Producers. Permission is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii) the source are acknowledged. All other rights are reserved.” Any other use requires the prior written permission of the OGP. These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.

RADD – Human factors in QRA

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions and Terminology of HF ............................................................... 1

1.2.1 1.2.2

Definitions................................................................................................................... 1 Terminology................................................................................................................ 2

2.0 2.1

Human Factors Process Descriptions .................................... 3 Human Factors in Offshore Safety Cases .................................................... 3

2.1.1 2.1.2

Rationale ..................................................................................................................... 3 Stages ......................................................................................................................... 3

2.2

Human Factors in UK Onshore Safety Cases .............................................. 5

2.2.1 2.2.2

Rationale ..................................................................................................................... 5 Stages ......................................................................................................................... 6

2.3

Workload Assessment ................................................................................... 7

2.3.1 2.3.2

Rationale ..................................................................................................................... 7 Stages ......................................................................................................................... 8

2.4

Human Error Identification........................................................................... 11

2.4.1 2.4.2 2.4.3

Rationale ................................................................................................................... 11 Stages ....................................................................................................................... 12 Techniques ............................................................................................................... 14

2.5

Human Reliability Assessment.................................................................... 15

2.5.1 2.5.2 2.5.3

Rationale ................................................................................................................... 15 Stages ....................................................................................................................... 15 Techniques ............................................................................................................... 19

2.6

Human Factors in Loss of Containment Frequencies............................... 19

2.6.1 2.6.2 2.6.3

Rationale ................................................................................................................... 19 Stages ....................................................................................................................... 19 Techniques ............................................................................................................... 28

2.7

Human Factors in the determination of event outcomes.......................... 28

2.7.1 2.7.2 2.7.3

Rationale ................................................................................................................... 28 Stages ....................................................................................................................... 28 Techniques ............................................................................................................... 31

2.8

Human Factors in the assessment of fatalities during escape and sheltering....................................................................................................... 32

2.8.1 2.8.2

Rationale ................................................................................................................... 32 Stages ....................................................................................................................... 33

2.9

Human Factors in the assessment of fatalities during evacuation, rescue and recovery.................................................................................................. 38

2.9.1 2.9.2 2.9.3

Rationale ................................................................................................................... 38 Stages ....................................................................................................................... 39 Techniques ............................................................................................................... 46

3.0 3.1

Additional Resources .......................................................... 48 Legislation, guidelines and standards........................................................ 48

3.1.1 3.1.2

UK Legislation, Guidelines and Standards............................................................ 48 Key Guidance and References ............................................................................... 48

3.2

Key Societies and Centres........................................................................... 50

3.2.1 3.2.2

United Kingdom ....................................................................................................... 50 Europe ....................................................................................................................... 50

©OGP

RADD – Human factors in QRA

3.2.3 3.2.4 3.2.5 3.2.6 3.2.7

Scandinavia .............................................................................................................. 51 United States and Canada ....................................................................................... 51 South America .......................................................................................................... 51 Australia and New Zealand ..................................................................................... 51 Rest of the World ..................................................................................................... 51

4.0 4.1 4.2

References & Bibliography .................................................. 52 References..................................................................................................... 52 Bibliography .................................................................................................. 55

©OGP

RADD – Human factors in QRA

Abbreviations: ALARP APJ COMAH CREE CREAM DNV EEM ETA FMEA FTA HAZOP HAZID HCI HEA HEART HEI HEP HF HMI HRA HSC HSE HTA LOC NORSOK MAH OIM OSHA PA PEM PFEER POS PRA PPE PSA PSF PTW QRA RIDDOR SHARP SHERPA SMS SRK SWIFT THERP TR UK

As Low As Reasonably Practicable Absolute Probability Judgement Control of Major Accident Hazard regulations The Centre for Registration of European Ergonomists Comprehensive Risk Evaluation And Management Det Norske Veritas External Error Modes Event Tree Analysis Failure Modes and Effect Analysis Fault Tree Analysis Hazard and Operability study Hazard Identification Human Computer Interaction Human Error Assessment Human Error Analysis and Reduction Technique Human Error Identification Human Error Rate Probability Human Factors Human Machine Interface Human Reliability Assessment Health and Safety Commission Health and Safety Executive Hierarchical Task Analysis Loss of Containment The competitive standing of the Norwegian offshore sector (Norsk sokkels konkurranseposisjon) Major Accident Hazards Offshore Installation Manager Operational Safety Hazard Analysis Public Address Psychological Error Mechanisms Prevention of Fire, Explosion and Emergency Response Point of Safety Probability Risk Assessment Personal Protective Equipment Probability Safety Assessment Performance Shaping Factors Permit to Work Quantitative Risk Assessment Reporting of Injuries, Diseases and Dangerous Occurrences Regulations Systematic Human Action Reliability Procedure Systematic Human Error Reduction and Prediction Approach Safety Management System Skill, Rule, Knowledge Structured What If Technique Technique for Human Error Rate Prediction Temporary Refuge United Kingdom

©OGP

RADD – Human factors in QRA

1.0

Scope and Definitions

1.1

Application

This report contains guidance material for Human Factors (HF) studies within the various forms of risk and error assessment and analysis. It defines the terminology used in such studies, and includes information on applicable legislation, guidelines and standards; process descriptions and techniques. In Safety, Health and Environment, Human Factors (also called ergonomics) is concerned with "environmental, organisational and job factors, and human and individual characteristics, which influence behaviour at work in a way which can affect health and safety” [1]. As a multidisciplinary field involving psychology, physiology, and engineering, among other disciplines, Human Factors is a broad subject. It is involved in the design, development, operation and maintenance of systems in all industrial sectors. This datasheet aims to provide the user with a greater awareness of Human Factors theory and practice It should be borne in mind that much of the material used in human factors is drawn from a number of industry sources. Hence, for example human error rates are often context specific (i.e. using data based upon error rates for control room operators it will be necessary to determine if it requires some modification when considering error rates in a different environment). It is important to understand the processes that can be followed for Human Factors since they often utilise a number of similar techniques. This datasheet outlines the processes and makes reference to the techniques. In Section 2.0, nine HF processes are described as follows: 1. Human Factors in Offshore Safety Cases 2. Human Factors in UK Onshore Safety Cases 3. Workload Assessment 4. Human Error Identification 5. Human Reliability Assessment 6. Human Factors in Loss of Containment Frequencies 7. Human Factors in the determination of event outcomes 8. Human Factors in the assessment of fatalities during escape & sheltering 9. Human Factors in the assessment of fatalities during evacuation, rescue and recovery

1.2

Definitions and Terminology of HF

1.2.1

Definitions

‘Human Factors’ or ‘Ergonomics’ can be defined [2] as: “that branch of science and technology that includes what is known and theorised about human behavioural and biological characteristics that can be validly applied to the specification, design, evaluation, operation, and maintenance of products and systems to enhance safe, effective, and satisfying use by individuals, groups, and organisations”.

1

©OGP

RADD – Human factors in QRA

Put simply, this means “designing for human use”. The user or operator is seen as a central part of the system. Accident statistics from a wide variety of industries reveal that Human Factors, whether in operation, supervision, training, maintenance, or design, are the main cause of the vast majority of incidents and accidents. Human Factors attempts to avoid such problems by fitting technology, jobs and processes to people, and not vice versa. This involves the study of how people carry out work-related tasks, particularly in relation to equipment and machines. When considering the use of HF technology in safety-related systems, it is worth noting a further Human Factors definition [1]: “environmental, organisational and job factors, and human and individual characteristics, which influence behaviour at work in a way which can affect health and safety” Human Factors or ergonomics is generally considered to be an applied discipline that is informed by fundamental research in a number of fields, notably psychology, engineering, medicine (physiology and anatomy) and sociology. 1.2.2

Terminology

The term “Human Factors” has many synonyms and related terms. Most of these are shown below, with explanation of key differences where generally agreed: Ergonomics - the term ergonomics literally means “laws of work”. It is the traditional term used in Europe, but is considered synonymous with “Human Factors”, a North American-derived term. Some associate the term ergonomics more with physical workplace assessment, but this is an arbitrary distinction. Other terms include Human Engineering and Human Factors Engineering Cognitive Ergonomics or Engineering Psychology - this is a branch of Human Factors or ergonomics that emphasises the study of cognitive or mental aspects of work, particularly those aspects involving high levels of human-machine interaction, automation, decision-making, situation awareness, mental workload, and skill acquisition and retention. Human-Machine Interaction (HMI) or Human-Computer Interaction (HCI) – the applied study of how people interact with machines or computers. Working Environment - this emphasises the environmental and task factors that affect task performance.

©OGP

2

RADD – Human factors in QRA

2.0

Human Factors Process Descriptions

2.1

Human Factors in Offshore Safety Cases

2.1.1

Rationale

The UK's Offshore Safety Case Regulations came into force in 1992. A ‘Safety Case’ is a written document within which the company must demonstrate that an effective management system is in place to control risks to workers and, in particular, to reduce to a As Low As Reasonably Practicable (ALARP) the risks from a major accident. The duty holder (owner or operator) of every offshore installation operating in British waters is required to prepare a ‘Safety Case’ and submit it to the UK HSE Offshore Safety Division for formal acceptance. The main thrust of a Safety Case is a demonstration by the installation operator that the risks to the installation from Major Accident Hazards (MAH) have been reduced to ALARP. Traditionally the offshore industry has found it difficult to integrate Human Factors into the Safety Cases. Although there is a requirement to address human factor issues, the guidance has been unclear on how this should be achieved. A variety of tools and techniques have been initiated by a legislative focus and these are used to varying degrees by different operators. There are two sections within Safety Cases that are of high importance, the Safety Management System and Risk Assessment sections. Within these are a number of factors that should be addressed in order to meet the legislative requirements of the Safety Case.

2.1.2

Stages

The main part of the safety case which Human Factors issues are relevant to is the Safety Management System (SMS). Within the SMS there are a number of areas that should demonstrate the consideration of Human Factors issues. Areas include: Human Reliability And Major Accident Hazards The management system should demonstrate suitable methods for ensuring human reliability and the control of major accident hazards. Offshore installation risk assessments consist of both quantitative and qualitative components, considering the following: •

Hazard Identification

•

Assessment of Consequences

•

Prevention, detection, control, mitigation, and emergency response.

Key approaches, both qualitative and qualitative, include HAZOPs and other Hazard Identification (HAZID) techniques. HAZOP is an identification method designed predominantly for the identification of hardware and people related hazards. Engineering system HAZOPs are generally poor in their coverage of human factor issues though this is mainly due to the knowledge and expertise of the participants and the facilitator. Specific Human Factors and Procedural HAZOPs are available for use. Structured What IF Technique (SWIFT) is an increasingly used technique for hazard identification that is particularly good for examining organisational and Human Factors issues.

3

©OGP

RADD – Human factors in QRA

Workforce Involvement A key component in the effectiveness of the management of installation MAHs is the involvement of the workforce in the identification of MAHs and the development of specific prevention, detection, control, mitigation and emergency response measures. Involving the workforce helps to ‘buy-in’ support and ensure personnel are well informed of changes. This is a key aspect required by the UK HSE when it decides on the acceptance of the Safety Case and has been reinforced by changes in 2005 “By involving the workforce, they become more familiar with how they manage their safety in their day to day operations, enabling the safety case to be part of their daily operations, achieving the objective of having a ‘live’ safety case.” Incident and Accident Investigation The RIDDOR regulations state that reporting of accidents and incidents is mandatory. Efforts are being made to increase the reporting levels of near miss incidents [3]. Incident and accident investigation is a formal requirement within an effective safety management system. It is one of the key tools for continuous improvement, a requirement for demonstrating continuous safe operation and that risks are being continuously driven to ALARP. Safety Culture and Behavioural Safety (Observational Based Programs) Many offshore installations now operate a behavioural safety programme within the management system. Behavioural safety programmes may be a proprietary package or developed in-house specifically for the operator’s organisation. A variety of behavioural safety programmes are available and are designed to improve the safety culture of the organisation [4]. There are also methods and proprietary packages for the assessment and monitoring of an organisation's safety culture and climate. Emergency Response The safety management system should make consideration of the following areas of emergency response: •

Emergency egress and mustering i.e. consideration of the route layout, alarm sounding etc in relation to various foreseeable accident scenarios.

•

Evacuation and rescue modelling. This is vital for identifying the weakness / effectiveness of procedures

•

Demonstration of a good prospect of rescue and recovery in accordance with the Prevention of Fire, Explosion and Emergency Response (PFEER) regulations.

•

Emergency training and crisis management, i.e. regular drills are held offshore on a weekly basis.

•

Survival Training. This is given to all offshore personnel and is refreshed on a regular basis, the intervals being defined by age scales.

Work Design The inclusion and consideration of personnel’s working arrangement is an important part of the Safety Case. It can impact heavily upon the working performance and safety behaviours of personnel. Current research is looking into the implications of shift work on safety behaviours [5]. ©OGP

4

RADD – Human factors in QRA

Of further importance is the handover process by personnel between shifts. Workload and Manning Levels Efforts have been made to reduce manning levels on installations to a safe operational minimum. Various methods are available to enable risk assessment of these manning levels (see Section 2.3). Permit to Work Systems The UK HSE and the Norwegian Oil Industry Association (OLF) have published guidance for onshore and offshore activities [6], [7]. Working Environment Key working environment issues offshore include lighting, access for maintenance and operation, noise, vibration and exposure to weather. All of these affect the operator’s ability to work effectively. The UK HSE is currently reviewing legislative requirements to bring them in line with the Norwegian NORSOK standards. Training and Competency Assurance Training and competency assurance is increasingly being recognised as a vital human factors issue. Demonstration of personnel training and competency is a requirement within the safety management system. Training needs of personnel should be identified and competency demonstrated and verified by an appropriate authority [8]. In addition to the demonstration that an effective safety management system is in place, the Safety Case should demonstrate that the major accident hazards on the installation have been identified and controlled. This can be demonstrated through the use of Safety Critical Task Analysis in addition to complementary methods of analysis such as Quantified Risk Assessment, HAZOPs and HAZID techniques.

2.2

Human Factors in UK Onshore Safety Cases

2.2.1

Rationale

It is generally understood that virtually all major accidents include Human Factors among the root causes and that prevention of major accidents depends upon human reliability at all onshore sites, no matter how automated. Assessment is a team process; it is important that the team members do not examine their topic in isolation, but in the context of an overall ALARP demonstration. 2.2.2 2.2.2.1

Stages Identify potential for human failures

The COMAH safety report needs to show that measures taken and SMS are built upon a real understanding of the potential part that human reliability or failure can play in initiating, preventing, controlling, mitigating and responding to major accidents. Occasionally quantitative human reliability data is quoted: this should be treated with caution. Local factors make considerable impacts so generic data, if used, must be accompanied by an explanation as to why it is applicable for the site.

5

©OGP

RADD – Human factors in QRA

2.2.2.2

Choosing and justifying the measures

Few COMAH safety reports justify or explain how the choice is made between functions that are automatic and those that are manual. Yet this can be key to showing that all necessary measures are in place or that risks are ALARP, following principles of inherent safety. There should not be over reliance on training and procedures in place of reasonably practical physical measures. 2.2.2.3

Implementing control measures

Once the potential human contribution has been identified, this should be reflected in the choice and design of measures in place. All sites rely to a degree on compliance with procedures. Yet many sites have areas of ineffective compliance rates and few, if any, will ever reach 100%. Therefore regular reviews should be conducted of safety critical procedures. 2.2.2.4

Management assurance

The main functions of a safety management system are to bring consistency and discipline to the necessary measures by means of a quality assurance system by maintaining good industry practice (which under pins the ALARP argument). This is done by completing documentation, audit and control; and to ensure continuous improvements towards ALARP by means of capturing lessons learned and setting and meeting appropriate targets in relation to the major accident hazard. The UK HSE has funded research into creating a model that allowed the easy integration of HF issues into the identification of major chemical hazards, safety management systems for managing those hazards and related organisational issues. Although, the research for this model is based on onshore industries, the principles within it could also be applied to the offshore industry. This model was trialled in a workshop with UK HSE specialists from a broad range of industries. The feedback was both positive and negative with a summary being that the model was usable but required packaging differently so that it could be more easily understood and applied by a wider audience [9].

2.3

Workload Assessment

2.3.1

Rationale

The construct of workload has no universally acceptable definition. Stein [10] uses the following definition: “The experience of workload is based on the amount of effort, both physical and psychological, expended in response to system demands (task load) and also in accordance with the operator’s internal standard of performance.” (p. 157). Put simply, workload problems occur where a person has more things to do than can be reasonably coped with. Workload can be experienced as either mental, or physical, or both, and will be associated with various factors, such as: •

Time spent on tasks.

•

Number, type (e.g. manual, visual), and combination of tasks. ©OGP

6

RADD – Human factors in QRA

•

Task pacing and scheduling.

•

Operator experience, state, and perceptions.

•

Environmental factors (e.g. noise, temperature).

•

Time, in relation to work-sleep cycle.

Problems with workload can occur when workload is too high (overload) or too low (underload). Some examples of causes of workload are shown in Table 2.1. Table 2.1 Som e Exam ples of Causes of Excessive and Insufficient W orkload EXCESSIVE W ORKLOAD

INSUFFICIENT W ORKLOA D

Rapid task scheduling (e.g. excessive task cycle times). Signals occurring too rapidly, particularly in the same sensory modality (e.g. several visual alarms presented at the same time).

Slow or intermittent task scheduling (e.g. downtime). Signals occurring infrequently (e.g. monitoring a radar display in an area of very low activity).

Unfamiliarity or lack of skill (e.g. a trainee operator keeping up with a fast production line). Complexity of information (e.g. an air traffic controller dealing with traffic at various speeds, directions, at flight levels).

Excessive skill relative to job (e.g. a highly skilled operator packing boxes). Monotonous or highly predictable information

Personal factors (e.g. emotional stress).

At the upper limits of human performance, excessive workload may result in poor task performance and operator stress. Underload, may be experienced as boredom, with associated distraction. Both may result in ‘human error’ - failing to perform part of a task, or performing it incorrectly. Workload assessment may be used as part of the investigation of several problems, such as: •

Manning requirements and de-manning.

•

Shift organisation.

•

Information and HMI design.

•

Job design.

•

Team design.

2.3.2 2.3.2.1

Stages Problem definition

First determine whether the problem is one of excessive or insufficient task load, and whether the workload is primarily physical or mental. Then investigate, by discussing with operators and supervisors, the source of the workload problem, e.g.: •

7

Manning arrangements - too many or too few operators will cause workload problems.

©OGP

RADD – Human factors in QRA

•

Shift organisation - poor shift organisation can result in manning problems, but may have other effects such as fatigue, which will have further effects on workload.

•

Information and HMI design - problems with information display (e.g. too much, poorly organised, badly designed, etc.) can overload the operator.

•

Job design - poor task scheduling or organisation can lead to under- or overload.

•

Team design and supervision - poor team design and supervision may result in some operators being overloaded or underloaded.

•

Competing Initiatives – Competition between teams can be good for productivity but can also lead to an increase in operator workload as more tries to be carried out in the same period of time.

•

Unreliable hardware – If machinery is constantly failing then maintainers and operators will have to work harder to achieve a reasonable level of performance.

2.3.2.2

Collection of background information

Important background information may include: •

Number of operators (and number affected by workload problem).

•

Operator availability (particularly for safety-critical tasks).

•

Cover arrangements for sickness, holiday/vacation, training, etc.

•

Team design.

•

Approximate percentages of time operators spend on different tasks.

•

Extraneous operator duties (e.g. fire crew, first aid, forklift truck driver, etc.).

•

Shift pattern/working hours.

•

Overtime arrangements.

•

Management and supervision (level of supervisor).

•

Previous incidents associated with workload.

•

Environmental and physiological information (heat, etc).

2.3.2.3

Selection and application of assessment method

The assessment method required will depend upon the source of the workload problem: •

Manning arrangements

•

Shift organisation

•

Information and Human-Machine Interface (HMI) design

•

Job design (see Human Error Identification)

•

Team design and supervision

In addition, a number of other more direct measures of workload are available. These can be divided into the following categories: •

Primary task performance - indicates the extent to which the operator is able to perform the principal work mission (e.g. production to schedule). These types of measures can be difficult to implement and have little sensitivity when highlighting problem areas.

©OGP

8

RADD – Human factors in QRA

•

Secondary task performance - these measures involve the operator performing two tasks, a primary and a secondary task. Both tasks are measured, but depending on the purpose and scope of the task, either the primary or secondary task is given priority. Errors or performance decrements may be measured. These techniques are generally only suited to simulated or experimental settings.

•

Physiological and psycho-physiological techniques - these techniques measure a physiological function, and in the case of mental workload, one that is known to have some relationship with psychological functions. Examples include respiratory activity (physical workload), cardiac activity (mental and physical workload), brain activity (mental workload), and eye activity (mental workload). Again, these measures generally require a base-line (or control) for that participant to be recorded so that the ‘delta’ as a result of that variable can be established.

•

Subjective assessment techniques - these techniques provide an estimate of workload based on judgement, usually by the person undertaking the task.

•

Task analytic techniques - these techniques aim to predict mental workload at an earlier stage of the system life-cycle, using task analysis and time-line analysis. The rationale is that the more time is spent on tasks, especially overlapping or concurrent ones, the greater the workload. The approaches assume that mental resources must be limited and use various models of mental workload. These techniques can also be used to highlight simple workload conflicts such as an operator not being in the location of an alarm when necessary.

In practical settings, the main techniques for workload assessment are subjective and analysis specific tasks or sub-tasks. Some examples of these techniques are shown in Table 2.2. These are mainly intended for the assessment of mental workload, but must involve some physical component. However, they are not suitable for purely physical tasks (e.g. assessing physical fatigue). Also, most were developed for the aviation industry, but may be adapted fairly easily for other industries. Table 2.2 Som e Subjective and Task Analytic W orkload Assessm ent Techniques TYPE / METHOD

DESCRIPTION

Subjective Techniques Uni-dimensional rating Assess workload along a single dimension with a verbal scales descriptor (e.g. Workload), with a scale (e.g. ‘Low’ to ‘High’). 10cm line

Workload is simply rated on a scale from 1 to 10.

Modified CooperHarper Scale

Scale developed for use with pilots, with scale descriptors of mental effort.

Bedford Rating Scale

Developed from the Modified Cooper-Harper Scale. Descriptors make reference to spare mental capacity.

Multi-dimensional Rating Scales NASA-TLX

Assess the different factors that are thought to contribute to workload. More diagnostic than uni-dimensional scales. Assesses six dimensions: mental demand, physical demand, temporal demand, performance, effort, and frustration. Ratings are made on a scale from 1 to 20, then the dimensions are weighted using a paired comparisons technique. The weighted ratings can be summed to provide an overall score.

9

©OGP

RADD – Human factors in QRA

TYPE / METHOD

DESCRIPTION

General Questionnaires and Interviews

General questionnaires can be developed and applied, or interviews can be conducted, to ask about specific aspects of workload, e.g. how much, when, who, why, etc.

Instantaneous Assessment

Measures that can ‘track’ workload over a time period, allowing investigation of workload peaks and troughs.

Instantaneous Self Assessment (ISA)

Workload is rated at specific intervals on a scale of 1 (underutilised) to 5 (excessive). The operator presses one of five buttons every two minutes, when signalled by a flashing light. The results for all operators are fed to a computer terminal for observation.

C-SAW

The operator watches a video replay of the task and applies a rating on a scale of 1 to 10 using the Bedford Scale.

Task Analytic Techniques Timeline analysis Timeline analysis is a general; task analysis technique that maps operator tasks along the time dimension, taking account of frequency and duration, and interactions with other task and personnel. This method is most suited to tasks that are consistently structured (in terms of task steps, durations, frequency, etc), with little variation in how they are performed. Workload can be rated in retrospect (by an expert) on a 5- or 6- point scale from 0% to 100%. Timeline Analysis and A timeline analysis is conducted for observable tasks and Prediction (TLAP) their durations. The tasks are assumed to have different channels: vision (looking); audition (listening); hands (manipulating by hand); feet (using feet); and cognition (thinking). By observing and listening to the operator, an estimate can be made of the amount of time required for each task. Visual, Auditory, Cognitive, Psychomotor

This uses experience subject matter experts to rate a variety of tasks between 0 (no demand) to 7 (highest demand) to the following workload channels: visual; auditory; cognitive and psychomotor (movement). The demand on the channels is summed to give a score, and a scope is available for ‘excessive workload’.

Workload Index (W/INDEX)

W/INDEX is based on Wickens’ Multiple Resource Theory, which describes humans as fixed capacity information processors with access to different pools of resources. Six channels are used: visual, auditory, spatial cognition, verbal cognition, manual response, and voice response. W/INDEX also tries to weight the interference between channels (e.g. speaking and listening to speech at the same time).

Micro-SAINT

Micro-SAINT is a computer simulation that simulates the operator activities in responding to events.

Sometimes, techniques may be used with the entire population of operators affected. At other times, it may be necessary to apply the technique on a sample of operators. This will depend on the scope of the project, and the number of operators affected by the workload problem. It may be sensible to employ more than one technique.

©OGP

10

RADD – Human factors in QRA

2.3.2.4

Workload smoothing

If workload is excessive or insufficient, it may be necessary to redesign the task, job, or equipment, or re-organise the shift pattern, manning arrangements, etc. A sample of operators should be involved in this process.

2.4

Human Error Identification

2.4.1

Rationale

Human Error Identification (HEI) is a generic term for a set of analytical techniques that aim to predict and classify the types of human errors that can occur within a system so that more effective and safer systems can be developed. HEI can be either a standalone process or part of a wider Human Reliability Assessment (HRA) (see Section 2.5). The concept of human error is at the heart of HRA and HEI. Reason [11] defines human error as: “a generic term to encompass all those occasions in which a planned sequence of mental or physical activities fails to achieve its intended outcome, and when these failures cannot be attributed to the intervention of some chance agency” (p.9). HEI provides a comprehensive account of potential errors, which may be frequent or rare, from simple errors in selecting switches to ‘cognitive errors’ of problem-solving and decision-making. Some errors will be foreseen or ‘predicted’ informally during system development, but many will not. It is often then left to the operators to detect and recover from these errors, or automated systems to mitigate them. HEI can be a difficult task because humans have a vast repertoire of responses. However, a limited number of error forms occur in accident sequences, and many are predictable. HEI is an important part of HRA because errors that have not been identified cannot be quantified, and might not be addressed at all. Kirwan [12] considers that HEI is at least as critical to assessing risk accurately as the quantification of error likelihoods. HEI can also identify the Performance Shaping Factors (PSFs), which may be used in the quantification stage, and will be necessary for error reduction. HEI can be used for various types of error such as [13]: •

Maintenance testing errors affecting system availability.

•

Operating errors initiating the event/incident.

•

Errors during recovery actions by which operators can terminate the event/incident.

•

Errors which can prolong or aggravate the situation.

•

Errors during actions by which operators can restore initially unavailable equipment and systems.

Two models of human error underlie most techniques. The first is Rasmussen’s [14] ‘skill’, ‘rule’ and ‘knowledge’ (SRK) based performance distinction. The majority of physical, communication or procedural errors are ‘skill' or ‘rule' based whilst the majority of ‘cognitive’ errors of planning and decision-making are ‘knowledge-based’. The second model is Reason’s [11] distinction of slips, lapses and mistakes. Slips and lapses are: 'errors resulting from some failure in the execution and/or storage stage of an action sequence, regardless of whether or not the plan which guided them was adequate to achieve its objective'.

11

©OGP

RADD – Human factors in QRA

Slips are associated with faulty action execution, where actions do not proceed as planned. Lapses are associated with failures of memory. These errors tend to occur during the performance of fairly ‘automatic’ or routine tasks in familiar surroundings, and attention is captured by something other than the task in hand. Examples include misreading a display, forgetting to press a switch, or accidentally batching the wrong amount to a batch counter. Reason [11] also defines mistakes as: 'deficiencies in the judgmental and/or inferential processes involved in the selection of an objective or in the specification of the means to achieve it, irrespective of whether or not the actions directed by this decision-scheme run according to plan'. So intended actions may proceed as planned, but fail to achieve their intended outcome. Mistakes are difficult to detect and likely to be more subtle, more complex, and more dangerous than slips. Detection may rely on intervention by someone else, or the emergence of unwanted consequences. Examples include misdiagnosing the interaction between various process variables and then carrying out incorrect actions. Violations are situations where operators deliberately carry out actions that are contrary to organisational rules and safe operating procedures. 2.4.2

Stages

The first task is to determine the scope of the HEI, including: •

Is it a standalone HEI or HRA study?

•

What are the types of tasks and errors to be studied?

•

What is the stage of system development?

•

Are there any existing HEIs or task analyses?

•

What is the level of detail required?

2.4.2.1

Task analysis

HEI requires a thorough analysis of the task. This is because each stage of the task, and the sequence and conditions in which sub-tasks are performed, must be described before potential errors at each stage can be identified. ‘Task analysis’ covers a range of techniques for the study of what an operator is required to do to achieve a system goal. The most widely used method is called ‘Hierarchical Task Analysis’ or HTA. This produces a numbered hierarchy of tasks and sub-tasks, usually represented in a tree diagram format, but may also be represented in a tabular format. It will be necessary to decide the level of resolution or detail required. In some cases, button presses, keystrokes etc may need to be described, in other cases, description may be at the task level. An operator may need to be involved in the study. Once a task analysis has been developed, HEI can take place. 2.4.2.2

Human Error Identification Worksheet

A typical HEI worksheet may include the following information: •

Task Step - this may be at button-press/key-stoke level or task level depending on the detail required.

•

External Error Modes (EEM) - the external failure keywords.

©OGP

12

RADD – Human factors in QRA

•

Psychological Error Mechanisms (PEM) - underlying psychological process producing the error.

•

Causes and Consequences.

•

Safeguards and Recovery - automated safeguards and potential human recovery actions.

•

Recommendations - in terms of procedures, equipment, training, etc.

2.4.2.3

Screening

It is then necessary to comb through the HEI worksheets to find errors that are not adequately protected against by safe guards. In particular, where there are no technological safeguards and human recovery is required (especially the same operator), then such errors should be taken further forward for analysis (qualitative or quantitative). 2.4.2.4

Human Error Reduction

Human error reduction strategies or recommendations may be required where the safeguards in place are not adequate in light of the risk of human error. Recommendations may be made during the HEI or during the HRA itself, so this stage may involve reviewing such recommendations in light of the screening exercise. Human Factors should be considered during the implementation of solutions, and any recommendations should be considered in an integrated fashion, taking into account the context of the working environment and organisation. Kirwan [15] notes four types of error reduction: •

Prevention by hardware or software changes - e.g. interlocks, automation.

•

Increase system tolerance - e.g. flexibility or self-correction to allow variability in operator inputs.

•

Enhance error recovery - e.g. improved feedback, checking, supervision, automatic monitoring.

•

Error reduction at source - e.g. training, procedures, interface and equipment design.

Typically, error reduction might focus on the following: •

Workplace design and Human Machine Interface

•

Equipment design

•

Ambient environment

•

Job design

•

Procedures

•

Training

•

Communication

•

Team work

•

Supervision and monitoring

Often, error reduction strategies are not as effective as envisaged, due to inadequate implementation, a misinterpretation of measures, side-effects of measures (e.g.

13

©OGP

RADD – Human factors in QRA

operators removing interlocks), or acclimatisation to measures motivational). Hence, the efficacy of measures should be monitored. 2.4.2.5

(especially

if

Documentation and Quality Assurance

Results and methods are documented such that they are auditable. The rationale and all assumptions should be made clear. This is important for error reduction strategies to ensure that they remain effective and that the error reduction potential is realised and maintained. Ensure that the worksheets are reviewed by any operators involved. It is also useful to involve an independent auditor. HEI can become too reliant on the individual analyst, which can result in biases where the analyst loses sight of interactions, becomes too focused on detail, and the analysis becomes repetitive and routine. An external auditor (i.e. a second, independent assessor) can prevent this. 2.4.3

Techniques

A number of HEI techniques have been developed. Most existing techniques are either generic error classification systems or are specific to the nuclear and process industries, or aviation. These techniques range from simple lists of error types, to classification systems based around a model of how the operator performs the task. Some of the most popular techniques for Human Error Identification are: •

Systematic Human Error Reduction and Prediction Process-SHERPA

•

Comprehensive Risk Evaluation And Management - CREAM

•

Human Factors Structured What IF Technique - SWIFT

•

Human Hazard and Operability Study - HAZOP

•

Human Failure Modes and Effects Analysis - FMEA

2.5

Human Reliability Assessment

2.5.1

Rationale

Human error has been seen as a key factor associated with almost every major accident, with catastrophic consequences to people, property and the environment. Accidents with major human contributions are not limited to any particular parts of the world, or any particular industry, and include the Aberfan mining disaster (1966), the Bhopal chemical release (1984), the Chernobyl melt-down and radioactivity release (1986), the Piper Alpha platform explosion (1988) and the Kegworth air disaster (1989). The study of human error was given a major spur by the Three Mile Island accident (1979). Human Reliability Assessment (HRA) can be defined as a method to assess the impact of potential human errors on the proper functioning of a system composed of equipment and people. HRA emerged in the 1950s as an input to Probabilistic Safety (or Risk) Assessments (PSA or PRA). HRA provided a rigorous and systematic identification and probabilistic quantification of undesired system consequences resulting from human unreliability that could result from the operation of a system. HRA developed into a hybrid discipline, involving reliability engineers, ergonomists and psychologists. The concept of human error is at the heart of HRA. Reason [11] defines human error as:

©OGP

14

RADD – Human factors in QRA

“a generic term to encompass all those occasions in which a planned sequence of mental or physical activities fails to achieve its intended outcome, and when these failures cannot be attributed to the intervention of some chance agency” (p. 9). It is necessary to understand several aspects of the socio-technical system in order to perform a HRA. First, an understanding of the engineering of the system is required so that system interaction can be explored in terms of error potential and error impact. Second, HRA requires an appreciation of the nature of human error, in terms of underlying Psychological Error Mechanisms (PEMs) as well as Human Factors issues (called Performance Shaping Factors, PSFs) that affect performance. Third, if the HRA is part of a PSA, reliability and risk estimation methods must be appreciated so that HRA can be integrated into the system’s risk assessment as a whole. A focus on quantification emerged due to the need for HRA to fit into the probabilistic framework of risk assessments, which define the consequences and probabilities of accidents associated with systems, and compare the output to regulatory criteria for that industry. If the risks are deemed unacceptable, they must be reduced or the system will be cancelled or shut down. Indeed, most HRAs are nowadays PSA-driven Human error quantification techniques which use combinations of expert judgement and database material to make a quantified assessment of human unreliability in situations where the actual probability of error may be small but where the consequences could be catastrophic and expensive. 2.5.2

Stages

The HRA approach has qualitative and quantitative components, and the following can be seen as the three primary functions of HRA: •

Human Error Identification

•

Human Error Quantification

•

Human Error Reduction.

The qualitative parts of HRA are the identification or prediction of errors (along with the preceding task analyses), the identification of any related PSFs such as poor procedures, system feedback, or training, and the subsequent selection of measures to control or reduce their prevalence. The quantitative part of HRA includes the estimation of time-dependent and time-independent human error probabilities (HEPs) and the estimation of the consequences of each error on system integrity and performance. These estimations are based on human performance data, human performance models, analytical methods, and expert judgement, described in more detail below. There are 10 stages to HRA [15]: 1. Problem Definition. 2. Task Analysis. 3. Human Error Identification. 4. Human Error Representation. 5. Screening. 6. Human Error Quantification. 7. Impact Assessment. 8. Human Error Reduction.

15

©OGP

RADD – Human factors in QRA

9. Quality Assurance. 10. Documentation. 2.5.2.1

Problem Definition

Determine the scope of the HRA, including: •

Is it a standalone or PSA driven assessment?

•

What are the types of scenarios, tasks (operation, maintenance, etc.) and errors to be studied?

•

What is the stage of system development?

•

What are the system goals for which operator actions are required, and how do safety goals fit in?

•

Is quantification is required - absolute or relative?

•

What is the level of detail required?

•

What are the risk assessment criteria (e.g. deaths, damage)?

•

Are there any existing HRAs (including HEIs and task analysis)?

This will require discussions with system design and plant engineers, and operational and managerial personnel. The problem definition may shift with respect to above questions as the assessment proceeds (e.g. the identification of new scenarios). 2.5.2.2

Task analysis

Task analysis is required to provide a complete and comprehensive description of the tasks that have to be assessed. Several methods may be used, such as Hierarchical Task Analysis or Tabular Task Analysis. The main methods of obtaining information for the task analysis are observation, interviews, walk-throughs, and examination of procedures, system documentation, training material. For a proceduralised task, HTA is probably most appropriate. Operational personnel should verify the task analysis throughout if possible. 2.5.2.3

Human Error Identification

Human Error Identification (HEI) is a generic term for a set of analytical techniques that aim to predict and classify the types of human errors that can occur within a system so that more effective and safer systems can be developed (see Section 2.4). 2.5.2.4

Human Error Representation

Representation allows the assessor to evaluate the importance of each error, and to combine risk probabilities of failures (hardware, software, human, and environmental). The main representation techniques used in HRA are Fault Tree Analysis (FTA) and Event Tree Analysis (ETA). These: •

enable the use of mathematical formula to calculate all significant combinations of failures

•

calculate the probabilities

•

indicate the degree of importance of each event to system risk and

©OGP

16

RADD – Human factors in QRA

•

allow cost-benefit analysis.

FTA is a logical structure that defines what events must occur for an undesirable event to occur. The undesirable event is usually placed at the top of the FTA. Typically two types of gates are used to show how events at one level can proceed to the next level up but others do exist. The typical types of gates are: •

OR gate - the event above this occurs if any one of the events joined below this gate occurs.

•

AND gate - the event above this occurs if all of the events joined below this gate occur.

FTA can be used for simple or complex failure paths, comprising human errors alone or a mixture of hardware, software, human, and/or environmental events. The structured events can be quantified, thus deriving a top event frequency. FTA is a good way of incorporating Human Errors that act as contributors to initiating events in the reliability assessment. One issue of consideration is the level of component data that is available (e.g. failure to perform a single action or as a result of the failure to carry out a task). ETA proceeds from an initiating event typically at the left-hand side of the tree, to consider a set of sequential events, each of which may or may not occur. This results normally in binary branches at each node, which continue until an end state of success or failure in safety terms is reached for each branch. ETA is a good way of representing the reliability of human actions as a response to an event, particularly where human performance is dependent upon previous actions or events in the scenario sequence. This is primarily because ETA represents a time sequence and most operator responses are based on a sequence of actions that usually have to be carried out in a pre-defined sequence. Within both FTA and ETA it is important to recognise the potential of the human to be a cause of dependent failure. This can either be through the fact that failure to carry out an initial part of the task influences the probability of succeeding in the remainder of the task, or that the same error is made when performing the task more than once. A good example of the potential for dependent failure to occur would be the faulty maintenance of redundant trains of equipment or miscalibration of multiple sets of instruments being carried out by the same team. Such errors must not be treated independently, since underestimation will result. Dependency is generally associated with mistakes rather than slips. Additionally poor procedures or working practices can also be a frequent cause of dependent failures. 2.5.2.5

Screening

Screening analysis identifies where the major effort in the quantification effort should be applied, i.e. those that make the greatest contribution to system risk. In general terms, it is usually easier to quantify error which refers to the failure to perform a single action. However it is also unusual to have sufficient resource to, for example, identify all the potential modes of maintenance error. Therefore a balance must be struck between the level of modelling and the criticality of the failure. The Systematic Human Action Reliability Procedure (SHARP) defines three methods of screening logically structured human errors: I.

Screening out human errors that could only affect system goals if they occur in conjunction with an extremely unlikely hardware failure or environmental event.

II.

Screening out human errors that would have negligible consequences on system goals.

17

©OGP

RADD – Human factors in QRA

III. Assigning broad probabilities to the categorisation, e.g. as given in Table 2.3.

human

errors

based

on

a

simple

Table 2.3 Generic Hum an Error Probabilities [15] CATEGORY Simple, frequently performed task, minimal stress

FAILURE PROBABILITY -3 10

More complex task, less time variable, some care necessary

10

-2

Complex unfamiliar task, with little feedback, and some distractions Highly complex task, considerable stress, little performance time

10

-1

Extreme Stress, rarely performed task

10 (= 1)

3 ×  10

-1

0

Note: Table 2.7 also contains some generic human error probabilities from a different source

2.5.2.6

Human Error Quantification

Human Error Quantification techniques quantify the Human Error Probability, defined as:

Human error quantification is perhaps the most developed phase of HRA, yet there is relatively little objective data on human error. Some human error databases are now becoming available [15], [16]. The use of expert judgement is therefore required with some of the available techniques that use existing data, where it exists. Most of the best tools available are in the public domain. 2.5.2.7

Impact Assessment

In order to consider impacts, the results of HRA can be: •

used as absolute probabilities and utilised within PSAs. It would be necessary to demonstrate whether human error was a major contributor to inadequate system performance, via analysis of the fault tree to determine the most important events. Here, HEPs would be used in conjunction with system models to demonstrate that the system meets acceptable criteria.

•

used comparatively to compare alternative work systems to determine which constitute the higher relative risk and therefore the higher priority for action.

2.5.2.8

Quality and Documentation Assurance

The HRA process must be documented clearly such that they are auditable. Rationale and all assumptions should be clear, so that the study can be audited, reviewed (e.g. in the case of a future accident), updated or replicated if necessary.

2.5.3

Techniques

Widely used and available techniques for HRA are:

©OGP

18

RADD – Human factors in QRA

•

HEART (Human Error Assessment and Reduction Technique)

•

THERP (Technique for Human Error Rate Prediction)

•

APJ (Absolute Probability Judgement)

2.6

Human Factors in Loss of Containment Frequencies

2.6.1

Rationale

This section describes how Human Factors methods can be used to estimate the human error component of loss of containment (LOC) frequencies. According to some sources, the identification of management mechanisms which could have prevented or recovered unsafe conditions leading to Loss of Containment accidents, indicates that some 90% of LOC accidents are preventable. However, before an accident can be prevented the hazard associated with it needs to be identified and mitigated. These, accidents can be modelled and quantified by estimating the Human Error rate and probability associated with the event. This in turn can be used to determine whether the mitigation is truly ALARP. 2.6.2

Stages

To be able to estimate the human error component of LOC, three activities that need to take place: 1. The human errors need to be established that lead to the LOC 2. The probability of that error occurring needs to be calculated. 3. If there is more than one error, this needs to be combined correctly to provide an accurate result. 2.6.2.1

Establishing the Human Errors

Before the errors can be assessed their cause and direct consequence need to be established. This can be established systematically using Hierarchical Task Analysis, or from expert opinion via a HAZID, HAZOP or OSHA. These error and events can then be logged and verified as being valid before being combined with the probability data. Most people only consider operator errors when looking for the sources of error. However, examination of major accidents shows management failures to often underlie these errors in the following organisational areas [17]: •

19

Poor control of communication and coordination: −

between shifts;

−

upward from front line personnel to higher management in the organisational hierarchy and downward in terms of implementing safety policy and standards throughout the line of management (particularly in a multi-tiered organisation);

−

between different functional groups (e.g. between operations and maintenance, between mechanical and electrical);

−

between geographically separated groups;

©OGP

RADD – Human factors in QRA

•

•

•

−

in inter-organisational grouping (particularly where roles and responsibilities overlap) such as in the use of sub-contractors, or in an operation which requires the co-ordination of multiple groups within the same operational "space";

−

in heeding warnings (which is one of the important manifestations of the above where the indicators of latent failures within an organisation become lost or buried).

Inadequate control of pressures: −

in minimising group or social pressures

−

in controlling the influence of workload and time pressures

−

of production schedules

−

of conflicting objectives (e.g. causing diversion of effort away from safety considerations)

Inadequacies in control of human and equipment resources: −

where there is sharing of resources (where different groups operate on the same equipment), coupled with communication problems, e.g. lack of a permit-to-work (PTW) system.

−

where personnel competencies are inadequate for the job or there is a shortage of staff

−

particularly where means of communication are inadequate

−

where equipment and information (e.g. at the man-machine or in support documentation) are inadequate to do the job

Rigidity in system norms such that systems do not exist to: −

adequately assess the effects and requirements of change (e.g. a novel situation arises, new equipment is introduced)

−

upgrade and implement procedures in the event of change

−

ensure that the correct procedures are being implemented and followed

−

intervene when assumptions made by front line personnel are at odds with the status of the system

−

control the informal learning processes which maintain organisational rigidity

These are types of failure which can be addressed in a Safety Management System (SMS) audit to derive an evaluation of the management system. Further work had been carried out to look at the effectiveness of these error establishing processes. In a study of accidents [18], [19] in the chemical processing industry sponsored by the UK Health and Safety Executive, around 1000 loss of containment accidents from pipework and vessels from onshore chemical and petrochemical plants were analysed, and the direct and underlying causes of failure were assessed. The underlying causes were defined in terms of a matrix which expressed (a) the activity in which the key failure occurred, and (b) the preventive mechanism failure (i.e. what management did not do to prevent or rectify the error). The preventive mechanisms are described below. Hazard study (of design or as-built)

©OGP

20

RADD – Human factors in QRA

Hazard studies of design, such as HAZard and OPerability studies (HAZOP), should identify and determine design errors and potential operational or maintenance errors to the extent they fall within the scope of the review. Some underlying causes of failure will be recoverable at the as-built stage such as certain layout aspects or wrong locations of equipment. Hazard study covers: •

inadequacies or failures in conducting an appropriate hazard study of design;

•

failure to follow-up recommendations of the HAZOP or other hazard study.

Human Factors review This category specifically refers to cases of failure to recover those underlying causes of unsafe conditions which resulted in human errors within the operator or maintainer hardware system, including interfaces and procedures. These errors are of the type that can be addressed with a Human Factors oriented review. The unrecovered errors will be information processing or action errors in the following categories: •

failure to follow procedures due to poor procedural design, poor communication, lack of detail in PTW, inadequate resources, inadequate training, etc.;

•

recognition failures due to inadequate plant or equipment identification, or lack of training, etc.;

•

inability or difficulty in carrying out actions due to poor location or design of controls.

Task Checking Checks, inspections and tests after tasks that have been completed should identify errors such as installing equipment at the wrong location or failure to check that a system has been properly isolated as part of maintenance. Routine Checking The above are all routine activities in the sense that they are part of a vigilance system on regular look-out for recoverable unsafe conditions in plant / process. These activities may be similar to the task checking category activities but they are not task driven. This category also includes failure to follow-up, given identification of an unsafe condition as part of routine testing or inspection. Evidence for events that would be included in this category would be: •

equipment in a state of disrepair;

•

inadequate routine inspection and testing

The distribution of failures is shown in Table 2.4 and Table 2.5, and graphically in Figure 2.1. Human Factors aspects of maintenance and normal operations account for around 30% of LOC incidents (a similar proportion could have been prevented by a hazard study of the design (by HAZOP, QRA etc.). A study of 402 North Sea offshore industry release incidents, from a single operator, indicates results consistent with those obtained for the onshore plant pipework study [20].

21

©OGP

RADD – Human factors in QRA

Figure 2.1 Contributions to Pipework Failures According to Underlying Causes and Preventive Mechanism s [19]

Table 2.4 Distribution of direct causes of pipework and vessel failures [18],[19][18] Cause Of Failure Overpressure Operator Error (direct) Corrosion Temperature Impact External Loading Wrong Equipment/Location Vibration Erosion Other

% Of Known Causes Pipework Vessels 20.5 45.2 30.9 24.5 15.6 6.3 6.4 11.2 8.1 5.6 5.0 2.6 6.7 1.9 2.5 0 1.3 0.2 2.5 2.6

Table 2.5 Percentage Contribution of underlying causes to pipework (P) (n=492) and vessel (V) failures (n=193) (all unknown origins and unknown recovery failures rem oved) [19][18] RECOVERY MECHANISM

NOT RECOVER ABLE

HAZARDS STUDY

HUMAN FACTORS

©OGP

TASK CHECKIN G

ROUTINE CHECKIN G

TOTAL

22

RADD – Human factors in QRA

P

V

Natural causes Design

Origin

1.8

0.5

0

P 0

V 0

P 0

V

0.2

P 0

V 0

P 0

V 2

P

0.5

V

0

0

25

29

2

0

0

0

0.2

0.5

27.2

29.5

Manufacture

0

0

0

0

0

0

2.5

0

0

0

2.5

0

Construction Operations

0.1 0

0 0

0.2 0.1

0.3 5.4

2 11.3

0 24.5

7.6 1.6

1.8 2.1

0.2 0.2

0 0

10.1 13.2

2.1 32

Maintenance

0

0

0.4

2.1

14.8

5.7

13

3.6

10.5

10.8

38.7

22.2

Sabotage Domino

1.2 4.6

1 11.9

0 0.2

0 0.3

0 0

0 0

0 0

0 0

0 0.3

0 0.5

1.2 5.1

1.0 12.7

Total

7.7

13.4

25.9

37.1

30.1

30.2

24.9

7.5

11.4

11.8

100

100

The key areas already mentioned for the control of loss of containment incidents, can be listed as follows (in order of importance for preventing pipework failures): •

Hazard review of design

•

Human Factors review of maintenance activities

•

Supervision and checking of maintenance tasks

•

Routine inspection and testing for maintenance

•

Human Factors review of operations

•

Supervision and checking of construction/installation work

•

Hazard review (audit) of operations

•

Supervision and checking of operations

Swain and Guttman [21] have identified a global set of action errors which are developed in numerous sources on error identification. The following list from [22] can be used: •

Error of omission: omission of required behaviour

•

Error of commission: operation performed incorrectly (e.g. too much, too little), wrong action, action out of sequence.

•

Action not in time: failure to complete an action in time or performing it too late/too early.

•

Extraneous act: performing an action when there is no task demand.

•

Error recovery failure: many errors can be recovered before they have a significant consequence; failure to do this can itself be an error.

2.6.2.2

The Probability of the Error Occurring

Table 2.6 shows the results of research carried out to determine the split on causes of LOC between the human and equipment failure. Table 2.6 Split of causes for LOC s in differing industries SOURCE DOMAIN

23

% CAUSED BY HUMAN

% CAUSED BY EQUIP

©OGP

REFERENCE

RADD – Human factors in QRA

Generic LOC Crane Accidents Chemical Process Petrochemical

40 55 60-90 50

60 45 40-10 50

[23] [24],[25],[26],[27][28] [28] [28]

Furthermore, in a study of 402 offshore LOC incidents, 47% originated in maintenance, 30% originated in design, 15% in operations, and 8% in construction. Of the maintenance failures, 65% were due to errors in performing maintenance and 35% failure to carry out the required activity. The data which identify the relative contribution of human and hardware failures are useful for benchmarking in fault tree analysis. This serves as a comparison about whether the analysis is giving results consistent with the historical data, which is particularly important when human failure probabilities in fault trees are derived primarily from expert judgement. 2.6.2.2.1 Example Human Error Rates

A simple guide to generic human error rates is contained in Table 2.7. Table 2.7 Exam ple Generic Hum an Error Rates [29] Error type

Type of behaviour

1

Extraordinary errors of the type difficult to conceive how they could occur: stress free, powerful cues initiating for success.

2

Error in regularly performed commonplace simple tasks with minimum stress. Errors of commission such as operating the wrong button or reading the wrong display. More complex task, less time available, some cues necessary.

10

-4

10

-3

Errors of omission where dependence is placed on situation cues and memory. Complex, unfamiliar task with little feedback and some distractions. Highly complex task, considerable stress, little time to perform it.

10

-2

10

-1

3

4

5

Nominal human error probability (per demand) -5 10

-1

6

Process involving creative thinking, unfamiliar complex 10 to 1 operation where time is short, stress is high. Note: Table 2.3 also contains some generic human error probabilities from a different source

2.6.2.2.2 Performance Shaping Factors

Although a great deal is known about the effects of different conditions on human performance, their quantification in terms of the extent to which error likelihood is affected is poorly researched. Human Reliability Assessment techniques often provide a database of the effects of PSFs, and these are generally based on judgement. The PSFs with the biggest influence, such as high stress or lack of training, are broadly estimated to result in an order of magnitude increase in error likelihood. Other effects

©OGP

24

RADD – Human factors in QRA

relate to performance over time such as a decrease in the ability to remain vigilant over long periods and hence detect changes in the environment. Some data on the factors influencing the performance of an individual when carrying out a task are shown in Table 2.8. Table 2.8 M ultipliers for Perform ance Shaping Factors [30],[31] (Maxim um predicted value by which unreliability m ight change going from "good" conditions to "bad") Error-Producing condition Unfamiliarity with a situation which is potentially important but which only occurs infrequently or which is novel.

Multiplier 17

A shortage of time available for error detection and correction.

11

A low signal-noise ratio. A means of suppressing or over-riding information or features which is too easily accessible.

10 9

No means of conveying spatial and functional information to operators in a form which they can readily assimilate. A mismatch between an operator's model of the world and that imagined by a designer.

8

No obvious means of reversing an unintended action.

8

A channel capacity overload particularly one caused by simultaneous presentation of non-redundant information. A need to unlearn a technique and apply one which requires the application of an opposing philosophy.

6

The need to transfer specific knowledge from task to task without loss. Ambiguity in the required performance standards.

8

6 5.5 5

A mismatch between perceived and real risk.

4

Poor, ambiguous or ill-matched system feedback.

4

No clear direct and timely confirmation of an intended action from the portion of the systems over which control is to be exerted. Operator inexperience (e.g. newly-qualified tradesman vs. "expert").

4

An impoverished quality of information conveyed by procedures and person/person interaction.

3

3

Little or no independent checking or testing of output A conflict between immediate and long-term objectives.

3 2.5

No diversity of information input for veracity checks.

2.5

A mismatch between the educational achievement level of an individual and the requirements of the task. An incentive to use more dangerous procedures.

2

Little opportunity to exercise mind and body outside the immediate confines of a job. Unreliable instrumentation (enough that it is noticed).

1.8

A need for absolute judgements which are beyond the capabilities or experience of an operator.

1.6

Unclear allocation of function and responsibility. No obvious way to keep track of progress during an activity.

1.6 1.4

A danger that finite physical capabilities will be exceeded.

1.4

25

©OGP

2

1.6

RADD – Human factors in QRA

Error-Producing condition

Multiplier

Little or no intrinsic meaning in a task. High-level emotional stress

1.4 1.3

Evidence of ill-health amongst operatives, especially fever.

1.2

Low workforce morale. Inconsistency in meaning of displays and procedures.

1.2 1.2

A poor or hostile environment (below 75% of health or life-threatening severity).

1.15

Prolonged inactivity or high repetitious cycling of low mental workload tasks

st

1.1 for 1 half-hour, 1.05 for each hour thereafter

Disruption of normal work-sleep cycles.

1.1

Task Pacing caused by the intervention of others. Additional team members over and above those necessary to perform task normally and satisfactorily. Multiply per man

1.06 1.03

Age of personnel performing perceptual task.

1.02

This is a mature and commonly used approach. It is relatively simple to follow and there are a large number of generic data sources for HEPs. However, it is very dependent upon the skill of the analyst in identifying opportunities for error. It usually requires at least a two person specialist team, one for the equipment and one for the human reliability identification, with some mutual understanding of the operation of the human-technical system. 2.6.2.3

Overall result

Operator error is incorporated through identification of opportunities for error which could lead to the initiation of an accident. The opportunities for error could include: •

directly causing an initiating event (e.g. leaving a valve open and starting a pump)

•

failing to recover (identify and correct) a mechanical failure or operator error which directly or indirectly could cause an initiating event (e.g. failure to identify a stuck valve, fail to check procedure completed)

•

indirectly causing an initiating event (e.g. a calculation error, installing the wrong piece of equipment)

Figure 2.2 shows the overall structure of incorporating human error into FTA

OR

AND

©OGP

26

RADD – Human factors in QRA

Figure 2.2 Overall Structure of Incorporating Hum an Error into FTA

AND

To quantify this event so that the probability of the event occurring can be established, the human error scores or the probability values, along with the performance shaping factors need to be added to the stages within the FTA. These scores, when combined together will give a overall likelihood of the event occurring. Note that the term "operator error" is frequently used to cover all cases of front line human error such as in maintenance, operations, task supervision, and start-stop decisions. When identifying opportunities for error, it is usual to express each error as an external (observable) mode of failure, such as an action error (E.g. doing something incorrectly). This is preferable to using internal modes of failure (E.g. short term memory failure). There is a tendency to overestimate human error probabilities relative to the hardware failure estimates. One reason is that human error recovery mechanisms are often forgotten. For example, a maintenance error could be recovered by checking by the supervisor. This means that in FTA, many human errors should have an AND gate with error recovery failure. The latter would be 1 if there is no opportunity for error recovery. For a well designed error management system, the practice is to use an error recovery failure probability of 10-2. The data provide a statistical model which has been used as a basis for factoring Generic LOC data using a Modification of Risk Factor derived from an assessment of the quality of Safety Management. The modification factor for generic failure rates ranges between 0.1 and 100 for good and poor management respectively [32], but more typically between 0.5 and 10 in practice. 2.6.3

Techniques

To complete this task of predicting LOC the following techniques could be used as a set or individually: •

Hierarchical Task Analysis

•

Human Error Assessment and Reduction Technique

•

Fault Tree Analysis

27

©OGP

RADD – Human factors in QRA

And supported by: •

HAZIDs

•

HAZOPs

•

OSHAs

2.7

Human Factors in the determination of event outcomes

2.7.1

Rationale

Event outcome modelling is normally concerned with mitigation and escalation of an initiating event. The outcome of events can be dependent on operator intervention, either because the operator is required to perform a primary role, or because the operator must rectify failures of automatic systems, e.g. if an automatic system fails or an operator is aware of the event prior to automatic detection. There are two approaches to event modelling. The first focuses purely on the activities, errors or lapses that need to occur for the top event to occur. The second adds the element of time into the equation so that scenarios where the outcome is affected by response or reaction time can still be accurately modelled. 2.7.2

Stages

Before the event tree can be established, the initiating event and the tasks below that need to be established. In addition, three human factor issues need to be considered as part of the event tree. These are:•

Human detection and recognition of the incident

•

Operator activation of an emergency system

•

Operator application of a specific procedure

Furthermore, factors that could affect these are: •

reliability of an operator recognising an emergency situation (clarity of the alerting signal and subsequent information)

•

familiarity with the task

•

increased stress due to perceived threat

Each of these factors are applicable to both the time related ETA and the non-time ETA. 2.7.2.1

Establishing the top level event

The initiating event can be established from a number of sources. These include:•

Practical experience – if the analysis is being carried out on a currently operating system

•

HAZID, HAZOP or OSHA – where expert judgement is used to define the critical events

•

Task Analysis – where the primary tasks and outcomes can be established.

©OGP

28

RADD – Human factors in QRA

2.7.2.2

Event Tree Analysis

Once the initiating event has been established the event tree can be built around it. The event tree is constructed by working thorough each of the possible actions that occur after the initiating event to determine the likelihood of each outcome. Quantification can be applied to the likelihood of an event occurring. The figures for this can come from a number of sources including Fault Tree Analysis, Human Error Analysis, expert opinion and user judgement. These figures are then multiplied together to give a likelihood score for that end event occurring. The example in Figure 2.3 shows the consequences of a rupture or leak in an unloading hose at a chemical plant. The contribution of the human to the event tree could be added as an extra branch along the top of the tree. Figure 2.3 An exam ple of an event tree

2.7.2.3

Simulating Human Contribution to Event Mitigation

This process differs from the first approach to event tree modelling by quantifying the time taken to carry out that task. Therefore, a Task Analysis needs to be carried out to define the steps taken during the event. To each of these tasks a time needs to be allocated. These times can established either by observation of the task during trial operational or during training runs. The captured times need to include reaction and response times to actions as well as the time taken to actually perform the task. This additional information can then be applied to the model to provide a time based response to the top event. An example of the time allocation can be seen in Table 2.9. Table 2.9 Exam ple tim es per task Task

29

Time taken

Recognise the incident

70 seconds

Request sufficient power to be available to operate the winches

10 seconds

Determine the direction to move the installation

20 seconds

©OGP

RADD – Human factors in QRA

Operate the winches so as to slacken and reel in opposing winches

30 seconds

Recognise the failure to request sufficient power Recognise that the wrong direction has been selected

30 seconds 120 seconds

Recognise that the winches have been operated in the wrong combination

80 seconds

2.7.2.4

Modifiers

As with all Human Factors and human performance issues, the ability to carry out tasks can be altered by the environment in which they occur. These are called modifiers and can affect time to complete the task, the procedure selected and the likelihood of an error occurring. Example modifiers are: •

The clarity of the signal. If the signal is clear, highly attention gaining, and very difficult to confuse with any other type of signal (including a false alarm) and the required action by an operator is do nothing more than acknowledge it, the -4 -5 likelihood of an operator error is small (in the region of 10 to 10 per demand). Increasing the complexity of warning signals, therefore requiring the operator to interpret a pattern of signals, raises the likelihood of error. The effect of a "low signal to noise ratio" (i.e. signal masked by competing signals, or of low strength in terms of perceptibility) can increase the likelihood of misdiagnosis by up to a factor of 10.

•

False alarm frequency. Data on human behaviour in fires in buildings shows that 80% to 90% of people assume a fire alarm to be false in the first instance (see Section 2.8.2.2.2).

•

Operator fam iliarity with the task. Due to the low probability of emergency events operators can have little familiarity with the tasks that they have to perform. This results in an increased likelihood of error. Table 2.10 below shows the human error probabilities (HEP) for rule based actions by control room personnel after diagnosis of an abnormal event [21]. Table 2.10 The hum an error probabilities (HEP) for rule based actions by control room personnel after diagnosis of an abnorm al event Potential Errors

Hum an Error error factor probability Failure to perform rule-based actions correctly when written procedures are available and used: Errors per critical step with recovery factors Errors per critical step without recovery factors

0.05 0.25

10 10

Failure to perform rule-based actions correctly when written procedures are not available or used: Errors per critical step with or without recovery factors

1.0

-

Stress can also effect how a person reacts and has been shown to increase the likelihood of error. Example modifiers are provided in Table 2.11.

©OGP

30

RADD – Human factors in QRA

Table 2.11 Exam ple of Modifiers when Calculating Event Tree Probabilities Stress Level

Modifiers (Multipliers) of Nom inal HEPs Skilled

Novice

2

2

Step-by-step task

1

1

Dynamic task

1

2

Step-by-step task

2

4

Dynamic task

5

10

Very low (Very low task load)

Optimum (Optimum task load):

Moderately high (Heavy task load):

Extremely High (Threat stress): Step-by-step task Diagnosis task

5

10

Error probability = 0.25 (EF = 5)

Error probability = 0.5 (EF = 5)

Furthermore, where an operator is to perform a number of tasks as part of a predefined procedure the analyst must decide whether to apply the modifier to some or all of the errors which may be made in following the procedure. It can be argued that the modifier should be applied once (i.e. to the procedure as a whole) rather than to each error, since the tasks are inherently linked by the procedure rather than being independent actions 2.7.3

Techniques

For this process there is not one recommended technique. However the use of Hierarchical Task Analysis, HEART, THERP and APJ together will help input to the event tree itself.

2.8

Human Factors in the assessment of fatalities during escape and sheltering

2.8.1

Rationale

This section deals with the Human Factors issues which have a significant bearing on the safety of personnel during escape and sheltering. Methods and data are presented for assessing the likelihood of fatalities as events progress. The term "escape" is considered to cover the movement of personnel from their initial location (at the time of the event) to a place of safety. The term "sheltering" is considered to cover the time spent by personnel within the place of safety. In the UK offshore regulations, this place of safety is termed the Temporary Refuge (TR) or Place of Safety (POS). For onshore installations these can include muster points. Fatalities during escape and sheltering can be divided into three sub-categories, e.g.: •

immediate fatalities - personnel who are in close proximity in the initial stages of the event

•

escape fatalities - personnel who are not initially in close proximity but become exposed to the event as they attempt to reach a temporary refuge or place of safety.

31

©OGP

RADD – Human factors in QRA

•

sheltering fatalities - personnel who are exposed to a hazard while sheltering in the temporary refuge or place of safety.

In estimating fatalities, assessment of the likelihood of personnel being exposed to the hazard and the effect of exposure are required. For hydrocarbon releases the hazards of concern are thermal radiation, explosion overpressure or toxic gas/smoke inhalation and narcotic effects of hydrocarbon inhalation, for which the methods of assessing the effect of exposure can include the use of tolerability thresholds or Probit equations (see Human Vulnerability datasheet). The estimation of the likelihood of personnel being exposed to a hazard during the escape and sheltering phases involves both event consequence modelling (e.g. fire propagation, temporary refuge impairment etc.) and human behaviour modelling. In an offshore situation the behaviours of interest include: •

time taken to initiate escape

•

speed of movement to the temporary refuge

•

choice of route so as to minimise exposure

•

choice of route based on perception of the hazard

•

use of protective equipment.

Statistics for a QRA must be derived by interpreting data taken from a number of sources. Particular factors to be taken into account in deriving the statistics are: •

the reliability of response to alarms and the effect of false alarm frequency on response behaviour;

•

characteristic behaviour patterns in life threatening situations

•

changes in behaviour when exposed to a hazard (e.g. 2 operators died on the Brent Bravo platform 2003 after they were exposed to light hydrocarbon which dulled their senses and prevented rational decision making)

2.8.2

Stages

There are 3 key stages that need to be gone through in order to predict the number of fatalities associated with escape and sheltering. These are:•

Define the variables (including the Human Factors variables)

•

Quantify those variables

•

Model the variables

2.8.2.1

Defining the variables

The following list states some of the variables that could be manipulated to determine the number of fatalities associated with these events: •

Number of people escaping

•

The route they take

•

Person reaction (time to respond and type of response)

•

Where the incident occurred in relation to the temporary refuge / place of safety

•

The temporary refuge (size, location, purpose)

©OGP

32

RADD – Human factors in QRA

•

Availability of Personal Protective Equipment / Personal Survival Equipment

•

Training of the escapees in use of PPE and emergency procedures

•

Degradation of human performance under the event conditions (stress, exposure to toxic substances, smoke etc)

•

Effect of other persons behaviour (team leader, following the person in front etc )

•

Time of day

•

Environmental conditions

•

A person’s previous experiences

This list is not exhaustive and there may be some site specific variables that could be added. 2.8.2.2

Quantification of the variables

The data within this section can be used to quantify some of the variables above during the modelling process. 2.8.2.2.1 Varying the location of the event and the escapee

In analysing, the analyst cannot expect to find universally applicable historical data with which to assess escape performance as this is location specific. For example, in regard to the question of how likely it is that personnel will be in the vicinity of an event, the analyst should consider the types of activities which take place on the installation. A review should consider whether the alarm could be masked by other noises, and the procedures followed to investigate an alarm, which may involve an operator being sent to inspect the area. Using the layout of the installation and details of the incident (such as availability of escape ways, level of hazard) software tools can be used to assist in certain aspects of escape evaluation. Most commonly they are used in the calculation of the time taken for personnel to reach predefined points of safety. The approaches used by the models differ and the scope for using them to estimate escape fatalities varies. Models which may be suitable for applying to offshore installations include: EGRESS, MUSTER, EVACNET+, SPECS, EXIT89. A simple method for estimating the likelihood of personnel becoming exposed to a hazard is to model the structure as a 3-D grid of cells and then consider, for an event in a specific area, the likelihood of personnel entering the incident area as they make their way to a TR/POS (see Figure 2.4).

33

©OGP

RADD – Human factors in QRA

Figure 2.4 Plan view of a sim ple bridge-linked platform , dem onstrat m ethod of estim ating exposure probabilities

In estimating the probability associated with each starting point, not only the routing of the walkways can be taken into account but some Human Factors issues can be accommodated in the analysis: •

the detectability of the event (i.e. personnel are more likely to see an ignited release than an unignited one and re-route accordingly). Events could be grouped together into categories and a different version of the grid produced for each category. Detectability can be enhanced indirectly by informative announcements over the PA system, therefore relevant procedures can be considered in the analysis.

•

Preferences for certain walkways/routes. Bias could be introduced into the probability figures based on the routes used by personnel, including short-cuts that may have become the norm.

The number of behavioural aspects which have a bearing on escape performance is large, and for many, data are limited or from a different field of activity. Therefore an analyst who wishes to reflect a particular working method within the assessment, such as Buddy-Buddy working, will not have a specific database of statistical evidence with which to work. This does not imply that the analysis cannot reflect such issues, but it does imply that doing so requires some insight into the behavioural implications. Validating a theoretical analysis of escape performance, whether it be performed with the assistance of a software tool or not, is clearly problematic. Observing the time it takes personnel to move around the installation and perform relevant tasks is a starting point. In order to compare these data to the predictions of a model, due account must be taken of the effects of emergency circumstances on the personnel and the platform is needed. An approach to validating predictions of escape performance is proposed in [33]. 2.8.2.2.2

Reliability and time to respond to alarms (e.g. time to initiate escape to a TR/POS)

The reliability of response to alarms is a key issue in the assessment of mustering performance. A large amount of data has been collected with regard to the factors which affect behaviour following an alarm signal. The findings indicate that the two dominant factors are: •

previous experience of alarms (false alarms) ©OGP

34

RADD – Human factors in QRA

•

confirmatory signals (such as smoke, fire, noise)

Data from building evacuations, where a high proportion of fire alarm signals are false, indicate that a significant proportion of people are likely to seek confirmation before commencing escape. Further data to enable the factors affecting false alarm rate and response behaviour to be identified are not available. It is expected that in the offshore environment the proportion of personnel seeking confirmation before commencing escape would be less than suggested by the data in Table 2.12 because of training and an awareness of the potential danger. Table 2.12 Data on response to alarm s Issue

Context

Finding

Interpretation of alarm

Fire drill in a building (without warning)

17% assumed it to be a genuine alarm (sample of 176) false alarm - 83%

Interpretation of alarm

Fire drill in a building (without warning)

14% assumed it to be a genuine alarm

Interpretation of alarm

Fire drill in a building (without warning)

14% assumed it to be a genuine alarm (sample of 96)

Confirmation of hazard

Actual fires in buildings

9% (2 of 22) believed there was a fire before seeing flames 77% (17 of 22) required visual and other cues

Time to respond to an alarm

Research into normal alarms

10% chose to evacuate after 35 seconds

Investigation of the alarm

Domestic fires

41 people performed 76 investigative acts

Tackling the hazard

Domestic fires

50% (268 out or 541) attempted to fight the fire

Tackling the hazard

Multiple occupancy fires

9% (9 out of 96) attempted to fight the fire

Use of fire extinguisher

Domestic fires

Of 268 who knew of the nearby- location of an extinguisher, 50% tackled the fire but only 23% used the extinguisher

Assisting others

Multiple occupancy fires

25 acts of giving assistance (total of 96 people)

2.8.2.2.3 Speed of movement of personnel

Data on speed of movement is relatively plentiful, and studies to assess degradation due to exposure to hazards have been performed. Table 2.13 summarises some relevant data. Table 2.13 Data on the speed of m ovem ent Issue Density of people

Context Unhindered walking

Finding Average speed of 1.4m/s

Density of people

Movement in congested area Evacuation from buildings

0.05 m/s in density of 0.5m per person

Effect of smoke on speed of evacuation

35

2

40% reduction (from normal walking speed)

©OGP

RADD – Human factors in QRA

Effect of lighting level on speed of evacuation Effect of lighting level on speed of evacuation

Evacuation from buildings

10% reduction in speed (from normal walking speed) with emergency lighting of 0.2 lux

Evacuation from buildings

10% reduction in speed (from normal walking speed) if fluorescent strips, arrows and signs are used in pitch black surrounding

Effect of lighting level on speed of evacuation Age of person

Evacuation from buildings

50% reduction in speed (from normal walking speed) in complete darkness

Unhindered walking

From the age of 19 onwards, decrease in speed of 12% per decade (average 16% reduction by age of 63)

The above table is for uninjured personnel. Although data is not available for personnel with damaged limbs, a reduction in speed is expected. The relationship between incapacitation and burns is complicated as burn injuries have a progressive effect. Stoll and Greene [34] show that for second or third degree burns over 100% of body area, the percentage incapacitation is less than 10% within the first 5 minutes, rising to 50% after a few hours and reaching 100% in a day or so. 2.8.2.2.4 Choice of route

The choice of escape route contributes to the likelihood of a person being exposed to the hazard while making their way to the TR/POS. Two specific aspects of human behaviour which have been identified through review of evacuations and are relevant to assessing the likelihood of route choice are: •

familiarity of personnel with the routes (i.e. seldom used emergency routes versus normal routes);

•

obstacles or hazards on the route (in particular the presence of smoke along the route).

The data in Table 2.14 suggest a strong tendency for personnel to use routes with which they have the greatest familiarity. It is worth noting that it is common for personnel to become accustomed to using routes which were not intended to be normal access routes (i.e. creating shortcuts). Such an occurrence can invalidate the assumptions in a safety study. Table 2.14 Hum an Behaviour Data on Choice of Evacuation Routes Issue Familiarity with exits

Context Hotel fire

Finding 51% departed through normal entrance 49% departed through fire exit

Ref. [35]

Familiarity with exits

General evacuations

[36]

Familiarity with exits

Evacuation drill in a lecture theatre

18% went to known exit without looking for another (sample size 50) 70% left through normal entrance 30% left through the fire exit

Moving through smoke

General evacuations

Choice of exit is more influenced by familiarity with the route than amount of smoke

[37]

Moving through smoke

General evacuations

60% attempted to move through smoke (50% of these moving 10 yards or more)

[38]

©OGP

[35]

36

RADD – Human factors in QRA

2.8.2.2.5 Performance in the use of Personal Protective Equipment (PPE) or Personal Survival Equipment (PSE) - reliability of success in using PPE/PSE and time to use PPE/PSE

In an emergency situation the PPE required to give additional protection can be relatively complex equipment such as smoke hoods or self contained breathing apparatus. In terms of risk assessment, failures or delays in the use of the necessary PPE/PSE can increase the likelihood of fatalities. Therefore, an estimate of the percentage of the population who can use PPE/PSE correctly and the likely time taken are relevant. The findings of a study of the reliability of use of re-generative breathing apparatus are presented in Table 2.15. The study involved visiting mines and asking miners, without warning, to put on their apparatus. The authors used a five point rating scale instead of simple pass or fail categories as they recognised that users may be able to rectify their mistakes, either by themselves or with the assistance of their colleagues. However, the category "failing" implies that a user would have very little chance of ever protecting themselves with the equipment. Table 2.15 Perform ance in using re-generative breathing apparatus, m easured at four m ines

Skill Level Failing Poor Marginal Adequate Perfect

Donning Proficiency Profiles at each Mine (% of personnel) M ine A Mine B Mine C Mine D 6.3 18.2 40.0 6.9 50 27.3 40.0 6.9 15.6 15.2 6.7 6.9 15.6 33.3 10.0 44.8 12.5 6.0 3.3 34.5

The results of the study show that performance in the use of PPE can be poor. The authors suggested that training was a dominant contributor to the differences between the four mines. However, they did not provide details of the training regimes and therefore insights into the relative importance of induction training or frequency of drills cannot be gained. Data on the time to use breathing apparatus is not available. The findings above suggest that there can be significant differences between personnel who are very familiar and experienced with the equipment, from those who are not. 2.8.2.2.6 Allowing for degradation in human performance due to toxic or thermal exposure

The data given in Table 2.15 takes no account of exposure to a hazard. It can be expected that exposure to a hazard could significantly degrade human performance. Choice of route, ability to put on a smoke hood, and capability to use an escape system are examples of behaviour which could be impaired by exposure to a hazard. In reviewing the data and considering the degree to which performance could be degraded it is necessary to consider indirect factors such as cognitive performance degradation, sensory performance degradation, and physical performance degradation

37

©OGP

RADD – Human factors in QRA

(e.g. dexterity and co-ordination) when attempting to assess the effect on performance. The greater the detriment to these performance parameters, the more likely will errors be made and the time to perform tasks will increase. There is limited data on the direct effect of exposure to hazards on human performance and this is predominantly at concentrations below those possible in incidents. Table 2.16 has data on the effect of smoke inhalation. Table 2.16 Data on the effect of exposure to sm oke on cognitive abilities Issue Cognitive abilities

Context Effect of exposure to smoke on simple arithmetic tasks

Finding 100% accuracy at 0.1 ltr/min 58% accuracy at 1.2 ltr/min

Referring to the data on the effects of Hydrogen Sulphide (see Human Vulnerability datasheet) it is clear that a person’s ability to see will be impaired, and it is possible that cognitive abilities will be hampered as exposure increases. It is these types of inferences which are necessary in assessing the effect of exposure on escape performance and with due regard to PPE requirements. A viable approach is to assume that a fraction of the lethal concentration is sufficient to disrupt cognitive abilities. A common choice is to use 15% of the LC50 value as a threshold where the rate of decision errors is significantly increased.

2.9

Human Factors in the assessment of fatalities during evacuation, rescue and recovery

2.9.1

Rationale

To evaluate the number of fatalities during evacuation, rescue and recovery, the person and the environment in which the evacuation and rescue are being made should be considered along with the equipment to be used and its location. This section will focus on the Human Factors issues that should be considered as part of the QRA, however during the QRA both the effect of the equipment and the HF issues mentioned should be considered in unison. 2.9.2 2.9.2.1

Stages Scenario definition

Before this analysis can be run the scenario and variables that are to be modelled or considered need to be determined. For example, the following should be considered: •

Number of people evacuating

•

Physical characteristics (size and strength / Anthropometry) of those people

•

Layout of the facility to be evacuated

•

Route to be taken

•

Equipment to be used during the evacuation and rescue

•

Environmental conditions

©OGP

38

RADD – Human factors in QRA

•

Type of event that has caused the escape and rescue. Specifically, the warning time about the event, whether this event will cause confusion about the best form of evacuation and rescue.

•

Familiarity of the personnel to the evacuation and rescue procedures

•

The history of the facility (number of false alarms, personal reaction to alarms)

This list is not exhaustive and there may be some additional site specific considerations that need to be reviewed. 2.9.2.2

Task Analysis

Once the scenario for modelling has been defined, the detailed tasks to be carried out need to be established so that the time duration and error analysis can be undertaken. The most widely used method is called ‘Hierarchical Task Analysis’ or HTA. This produces a numbered hierarchy of tasks and sub-tasks, usually represented in a tree diagram format, but may also be represented in a tabular format. It will be necessary to decide the level of resolution or detail required. In some cases, button presses, keystrokes etc may need to be described, in other cases, description may be at the task level. An operator may need to be involved in the study. Once the HTA is complete, each stage can be reviewed to establish what the human limitations are so that they can be considered within the analysis. 2.9.2.3

Issue Identification

Below is a summary of the potentially limiting factors that should be considered. Anthropometry •

A person’s size and shape will have an effect on their ability to fit through escape hatches and other confined spaces.

•

The size of the individuals will effect the number of people who can fit into and move around an escape craft.

Physiological •

The variations in the human ability to withstand the accelerations associated with escape (e.g. deploying a life raft) need to be considered.

•

The variation in the human body’s ability to survive at sea (cold adaptation, level of training and survival skills etc)

•

The range of strength when comparing individuals. This could affect a person’s ability to open doors or hatches etc.

Psychological The requirement for an evacuation implies that there is a significant risk to life. Consequently the behaviour of personnel will be greatly affected by the stress of the situation such that: •

39

the choice of actions is unlikely to be systematically thought through or weighed-up against all others

©OGP

RADD – Human factors in QRA

•

over-hasty decisions may be made based on incomplete and insufficient information

•

personnel will begin “running on automatic”. There will be a reduction in the intellectual level, with personnel resorting to familiar actions

•

personnel will focus on the immediate task at hand to the exclusion of others and their ability to take on board new information will be reduced

•

personnel may exhibit rigidity in problem solving, e.g. concentrating on one solution even though it does not work

•

performance on seemingly simple tasks will be greatly affected. Tasks requiring manual dexterity will be very much more difficult and require more time to complete than in normal circumstances

Other •

The clothing and the kit that the person is wearing / carrying will affect the likelihood of a person surviving an evacuation and rescue.

•

Location of the survival equipment, and the accessibility of it will affect how its used.

These points are pertinent to the performance of the person in overall charge, referred to here as the Offshore Installation Manager (OIM). As the person with the role of evaluating the incident and choosing if, how and when to evacuate, the decisions of the OIM can influence the outcome. The OIM could evaluate the conditions on the installation correctly and order an evacuation at the most opportune moment. The OIM will have been trained in these sort of events on training simulators. However, the OIM could also: •

delay the evacuation, or fail to give the command to evacuate incurring greater fatalities than necessary

•

give the order to evacuate when there is no need to do so and therefore expose the personnel to unnecessary risks

•

choose the wrong mode of evacuation.

The OIM needs to have decision criteria with which to judge the situation in order to choose a strategy. Ambiguity in the criteria and uncertainty or inaccuracies in the information available introduce the chance of a non-optimum strategy being selected. In addition, the stress of the situation may affect the behaviour of the OIM, and exposure to smoke or other toxic substances can affect his cognitive performance (see Human Vulnerability datasheet), adding weight to the argument that the OIM will not always choose the optimum strategy. Furthermore, the OIM’s training and personal experiences will affect this decision criteria and this aspect is virtually unquantifiable but yet needs to be considered. 2.9.2.4

Quantification

Quantification within this process comes in a number of forms, these could be: •

The time taken to complete an activity can be established by either running user trials or by witnessing training events. The timings taken from these events should be considered against the environment in which they were taken and then compared

©OGP

40

RADD – Human factors in QRA

to the environment in which they will finally be carried out. It is likely that the final environment is a stressful one which may alter the recorded task time. For example, under a more stressful environment a person may rush to complete a task (making it quicker) but this could increase the likelihood of making a mistake (which could result in the action needing repeating or indeed different action having to be taken). •

Using anthropometric data it is possible to workout the proportion of the population who cannot use, fit or access a piece of equipment. This will allow a percentage to given about how many people could use it to escape.

•

Human physiological limitations can be defined. This can be used to establish the number of people who would be able to withstand the physical environment within which the evacuation is taking place.

•

A human error assessment can be carried out on the four stages of evacuation when using a davit launched or freefall lifeboat system. This can be seen in [39]. This is only one area of error that could occur. The likelihood of an error occurring should be established on a case by case basis.

•

Research can be carried out to establish how long humans can survive in an escape made to the sea. The survivability of a person once they are in the water depends on, water temperature, sea state, physiology of the person, equipment they are using and their psychological state.

This list is not exhaustive and the variables applicable to the specific scenarios need to be established. 2.9.2.5

Useful Data

This section is split into data applicable to three scenarios. These are: •

Estimating the proportion of personnel who are unable to use particular evacuation systems

•

Human Factors in lifeboat evacuation modelling

•

Estimating fatalities during evacuation by other means

2.9.2.5.1 Estimating the proportion of personnel who are unable to use particular evacuation systems

Human Physiological Limitations Accelerations are experienced in accidental collisions (lifeboat striking the installation structure) or as part of the evacuation process (jumping into the sea from a height, freefall lifeboat launch, motions of the boat). Table 2.17 gives the average levels of linear acceleration (g), in different directions, which can be tolerated on a voluntary basis for specified periods). The figures are provided for acceleration in the x axes (forwards/backwards) and the z axes (upwards/ downwards) [40]. Table 2.17 Average tolerable levels of linear acceleration (units of g = 9.81 m /s 2 ) Direction of Acceleration

41

Exposure Time 0.3 secs

6 secs

30 secs

©OGP

1 min

5 mins

10 mins

20 mins

RADD – Human factors in QRA

+gz

15

11

8

7

5

4

3.5

-gz

7

6

3.5

3

2

1.5

1.2

+gx

30

20

13

11

7

6

5

-gx

22

15

10.5

8

6

5

4

An approach for evaluating acceleration effects in both conventional and free-fall lifeboats has been developed from the Dynamic Response Model [41], initially developed to study the response of pilots during emergency ejection from aircraft [42]. The Dynamic Response Model uses human tolerance criteria and lifeboat accelerations to infer the response of occupants to accelerations acting at the seat support. The method establishes an index for relating accelerations to potential injury. Three levels of risk for acceleration are defined in terms of the probability of injury, where a high level of risk carries a 50 percent probability of injury, a moderate level has a 5 percent probability and a low level has a 0.5 percent probability. The derived index values are presented in Table 2.18. Table 2.18 Dynam ic Response Index lim its for high, m oderate and low risk levels Coordinate axis -x +y -y +z -z

Dynam ic Response Index lim its (g) High Risk Moderate Low Risk Risk 46.0 35.0 28.0 22.0 17.0 14.0 22.0 17.0 14.0 22.8 18.0 15.2 15.0 12.0 9.0

With regard to the launch of freefall lifeboats, the accelerations are designed to be within tolerable limits and precautions, such as headrest straps, are included in some designs to further safeguard the occupants. To date, experience has not revealed the launch process to be intolerable. The motion of the boat can cause seasickness. However, there is little evidence that seasickness contributes to death in a TEMPSC [43]. Psychological Restrictions The use of relatively new evacuation technology, in particular freefall lifeboats, has raised the issue of the willingness of personnel to use evacuation systems. Discussions with training centres give large differences ranging from no recorded refusals to as many as 1 in a 100. Reasons for refusals include concern over prior back pain/injury. It is suggested that the refusal rate among personnel would vary with the type of emergency event on the installation and with the prevailing weather conditions.

©OGP

42

RADD – Human factors in QRA

Refusals are likely to increase in poor weather conditions, but decrease with increasing perceived danger from the incident. 2.9.2.5.2 Human Factors in lifeboat evacuation modelling

Time taken to complete tasks Table 2.19 shows example times taken to complete the various tasks carried out during life boat launch. Table 2.19 Estim ated Tim es for tasks in evacuation by traditional davitlaunched lifeboat (TEMPSC) Task Identify boat is useable (i.e. functioning of systems are checked) Embark Assess information and decide to descend Delay in descending (if there are difficulties with operating the descent system) Assess information and decide to disconnect Delay with disconnection (if there are difficulties with operating the disconnection system) Disconnect Release hooks manually (if there are difficulties with operating the primary release system) Manoeuvre from immediate vicinity of the installation

Nom inal Tim e 2 min 6 min 30 secs 2 min 15 secs 2 min 10 secs 3 min 2 mins

Task Specific Human Error Rates Table 2.20 and Table 2.21 present human error rates taken from a study that compared freefall and davit launched lifeboats [39].

43

©OGP

RADD – Human factors in QRA

Table 2.20 Estim ated hum an errors probabilities (HEP) and possible outcom e in evacuation by freefall lifeboat Stage

Error

Contingent Conditions (necessary for the outcome to be realised)

Estimated HEP (and 1 EF )

Prepare to embark

Hook release not checked Hook release check fails Fail to correct hook release fault Cradle orientation not checked Cradle orientation check fails Fail to correct cradle orientation Protection systems not checked Recovery winch connection not checked Fails to detach connected recovery winch

Hook attached Catastrophic fault in hook system Catastrophic fault in hook system Cradle not angled correctly after maintenance/drill Cradle not positioned correctly after maintenance/drill Cradle not positioned correctly after maintenance/drill One or more protection systems has a catastrophic fault

10 (5) -1 10 (10) -2 10 (3) -2 10 (10) -2 10 (10) -3 10 (3) -2 10 (5) -2 10 (5) -3 10 (10)

Embarkation

Fail to embark (scenario dependent) Stretcher carried into boat in wrong orientation

10 (100) -2 10 (3)

Departure

Straps not used correctly by a passenger Primary release system used incorrectly Secondary system used incorrectly

10 (5) -3 10 (5) -3 10 (5)

Move Away

Gearbox/prop check not done Gearbox/prop check fails Steering check not done Steering system check fails Starting controls not identified Unable to start propulsion system

1

EF = Error Factor

1

EF= Error Factor

System has a fault System has a fault System has a fault System has a fault System has a fault System has a fault

-2

Death or injury Death or injury Death or injury Death or injury Death or injury Death or injury Death or injury Occupants stranded in boat Occupants stranded in boat

-3

Death or injury of an individual Departure delayed

-3

Death or injury to the occupant Departure delayed Departure delayed

-2

Unmanoeuvrable boat Unmanoeuvrable boat Unmanoeuvrable boat Unmanoeuvrable boat Unmanoeuvrable boat Unmanoeuvrable boat

10 (10) -3 10 (10) -2 10 (10) -3 10 (10) -3 10 (5) -3 10 (5)

©OGP

Outcome

44

RADD – Human factors in QRA

Table 2.21 Estim ated hum an errors probabilities (HEP) and possible outcom e in evacuation by conventional davitlaunched lifeboat

1

Stage

Error

Contingent Conditions (necessary for the outcome to be realised)

Estimated HEP (EF)

Prepare to embark

Davit structure not checked Davit structure check fails Winch system not checked Winch system check fails Maintenance Pendants not checked Maintenance Pendants check fails Winch system not checked Winch system check fails Hook release not checked Hook release check fails Fails to correct hook release fault Winch system not checked Winch system check fails

Catastrophic fault in structure Catastrophic fault in structure Catastrophic fault in winch system Catastrophic fault in winch system Maintenance pendants attached Maintenance pendants attached Winch system not functioning Winch system not functioning Release system not functioning Release system not functioning Release system not functioning Winch system fails during descent Winch system fails during descent

10 (5) -3 10 (3) -2 10 (10) -2 10 (10) -2 10 (5) -2 10 (10) -2 10 (10) -2 10 (10) -2 10 (5) -1 10 (10) -2 10 (3) -2 10 (10) -2 10 (10)

Embarkation

All passengers do not embark Stretcher-bound injured do not embark

10 (100) -3 10 (5)

Departure

Primary release system used incorrectly Secondary system (if available) used incorrectly Brake release not continuous Wrong controls selected Primary hook release system controls not operated Occupants do not know how to use hook release Occupants don’t know how to manually release hooks Occupants do not know how to override hydrostatic hook release system interlock

10 (5) -3 10 (5) -3 10 (5) -3 10 (5) -3 10 (5) -3 10 (5) -3 10 (5) -2 10 (10)

Move Away

Incorrect direction navigated Secondary manual release mechanism not operated Primary release mechanism not operated Incorrect direction navigated Gearbox/prop check not done Gearbox/prop check fails Steering check not done Failure of steering check Starting controls not identified Unable to start propulsion system

10 (5) -3 10 (5) -3 10 (5) -2 10 (5) -2 10 (10) -3 10 (10) -2 10 (10) -3 10 (10) -3 10 (5) -3 10 (5)

EF = Error Factor

45

©OGP

Possible outcome

-3

Death or injury Death or injury Death or injury Death or injury Departure Prevented Departure Prevented Departure Prevented Departure Prevented Occupants Stranded Occupants Stranded Occupants Stranded Occupants Stranded Occupants Stranded

-3

Death or injury of person

-3

Departure Delayed Departure Delayed Departure Delayed Departure Delayed Departure Delayed Departure Delayed Departure Delayed Departure Delayed

-2

Death or injury Departure Prevented Departure Delayed Departure Delayed Unmanoeuvr. Boat Unmanoeuvr. Boat Unmanoeuvr. Boat Unmanoeuvr. Boat Unmanoeuvr. Boat Unmanoeuvr. Boat

RADD – Human factors in QRA

2.9.3

Techniques

To complete this assessment a number of different techniques could be employed. There is no one correct answer and the structure, order and detail of the individual assessments will depend on the level of risk associated with the event and the level of detail required in the output. Software models are available for assessing lifeboat evacuation, examples being ESCAPE and FARLIFE. The ESCAPE programme is based on the Department of Energy study. The FARLIFE programme is a time based simulator which can use the same data and can include operational errors within the model 2.9.3.1

Estimating fatalities during evacuation by other means

2.9.3.1.1 Escape to Sea

Table 2.22 gives statistics for fatality rates as guidelines. Table 2.22 Guidelines for fatality estim ates M ode

Factors

Fatality ranges

Personnel killed by escaping direct to sea

Jumping height

1-5% for low heights

Data Source Judgement

5-20% for large heights

Judgement

2.9.3.1.1.1 Survival in the water

Table 2.23 gives survival time data or personnel not wearing survival suits [44]. Table 2.23 50% Survival Tim es for Conventionally Clothed Persons in still water [44] W ater tem perature (°C)

Survival tim e for 50% of persons (hrs) 0.75 1 1.5 2 3 6

2.5 5 7.5 10 12.5 15

For personnel wearing a survival suit the time is significantly increased. New designs have been shown to protect for over 4 hours at water temperature of 4°C [45]. Further information is presented in the Human Vulnerability datasheet. For the QRA analyst a key concern will be the number who have successfully donned survival suits and life jackets before entering the water. Given that personnel who escape to sea are unlikely to have had much time to prepare for their escape, the likelihood of them putting on the safety clothing will be dependent on its accessibility. ©OGP

46

RADD – Human factors in QRA

The analyst should consider whether the equipment is provided at the probable points of alighting the installation or whether they are stowed in remote lockers. The initial risk when entering the sea is from ‘cold shock’ which can cause you to inhale even when underwater due to an involuntary gasping reflex [46]. 2.9.3.1.1.2 Recovery from the sea

A review of the performance of attendant vessels in emergencies offshore [47] suggests that the success for recovering personnel from the sea ranges between approximately 10% and 95% depending on the type of vessel and weather conditions. Once individuals have been in the water for 3hrs or more they will become scattered making locating and rescuing them more difficult. Once recovery has been achieved there is still the risk of post-immersion collapse. This could occur as the individual looses the hydrostatic assistance to circulation, leading to collapse of blood pressure and consequent reduced cardiac output [46]. 2.9.3.1.1.3 Modelling of Survivability

Robertson [46] found the Wissler model to be the most usable computer model when predicting fatalities once they are in the water. This model uses the following assumptions that are useful to note: •

Survival time will be reduced by 50% if the sea state is at Beaufort scale 3 rather than 0. This is due to the increase in activity required to stay afloat and prevent drowning.

•

Survival time will be reduced by 10% if there is a 1 litre leakage of water into the survival suit.

•

An insulated immersion suit could increase the survival time by a factor of ten when compared with a membrane suit.

•

This model uses data about survival rate and water temperature to assessment survivability.

•

Each percentage of body fat equates approximately to a 0.1°C rise in deep body temperature.

Many parameters can be varied within this model. However, there are many variable which can effect a persons ability to survive and some of these are impossible to determine. For example, the psychological factor of ‘giving up’ or ‘determination’ could play a large part in a person’s ability to survive especially over drawn out period of time.

47

©OGP

RADD – Human factors in QRA

3.0

Additional Resources

3.1

Legislation, guidelines and standards

3.1.1

UK Legislation, Guidelines and Standards

The European Commission now defines many of the legal requirements for the UK. Each Member State is then responsible for incorporating these requirements into their domestic law. The Health & Safety Com m ission (HSC) are the UK body that controls all health and safety issues within the UK. The Health and Safety Executive (HSE) are the government agency responsible for regulations and their enforcement through inspection and investigation. See http://www.hse.gov.uk/. 3.1.2 3.1.2.1

Key Guidance and References HSE Publications

http://www.hsebooks.co.uk/ http://www.hse.gov.uk/signpost/index.htm http://www.hmso.gov.uk/ •

HSE (1990) Noise at work: Noise assessment, information and control: Guidance notes. HSE Books.

•

HSE (1995) Improving compliance with safety procedures: Reducing industrial violations. HSE Books.

•

HSE (1997) Successful health and safety management, HSG 65. HSE Books.

•

HSE (1998) Manual Handling: Guidance on Manual Handling Operations Regulations 1992, L23. HSE Books.

•

HSE (1998) A guide to the Offshore Installations (Safety Representatives and Safety

•

Committees) Regulations 1989: Guidance on Regulations, L110. HSE Books.

•

HSE (1998) A guide to the Offshore Installations (Safety Case) Regulations 1992: Guidance on Regulations, L30. HSE Books.

•

HSE (1998) Safe use of lifting equipment: Approved code of practice and guidance for the Lifting Operations and Lifting Equipment Regulations 1998, L113. HSE Books.

•

HSE (1999) A guide to the Control of Major Accident Hazards Regulations 1999: Guidance on Regulations, L111. HSE Books.

•

HSE (1999) Reducing error and influencing behaviour, HSG 48. HSE Books.

•

HFRG (2000) Improving maintenance: A guide to reducing human error. HSE Books.

3.1.2.2

British Standards

http://bsonline.techindex.co.uk/ •

BS EN ISO 9241-1 (1997) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 1: General introduction.

•

BS EN 9241-2 (1993) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 2: Guidance on task requirements.

©OGP

48

RADD – Human factors in QRA

•

BS EN 9241-3 (1993) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 3: Visual display requirements.

•

BS EN ISO 9241-4 (1998) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 4: Keyboard requirements.

•

BS EN ISO 9241-5 (1999) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 5: Workstation layout and postural requirement.

•

BS EN ISO 9241-6 (2000) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 6: Guidance on the work environment.

•

BS EN ISO 9241-7 (1998) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 7: Requirements for display with reflections.

•

BS EN ISO 9241-8 (1998) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 8: Requirements for displayed colours.

•

BS EN ISO 9241-9 (2000) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 9: Requirements for non-keyboard input devices.

•

BS EN ISO 9241-10 (1996) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 10: Dialogue principles.

•

BS EN ISO 9241-11 (1998) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 11: Guidance on usability.

•

BS EN ISO 9241-12 (1999) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 12: Presentation of information.

•

BS EN ISO 9241-13 (1999) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 13: User guidance.

•

BS ISO 9241-14 (1997) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 14: Menu dialogues.

•

BS EN ISO 9241-15 (1998) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 15: Command dialogues.

•

BS EN ISO 9241-16 (1999) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 16: Direct manipulation dialogues.

•

BS EN ISO 9241-17 (1998) Ergonomics requirements for office work with visual display terminals (VDTs) - Part 17: Form-filling dialogues.

•

BS EN ISO 7250 (1998) Basic human body measurements for technological design.

•

DD 202 (1991) Ergonomics principles in the design of work systems Draft for development.

•

BS EN 60073 (1997) Basic and safety principles for man-machine interface, marking and identification - Coding principles for indication devices and actuators.

3.1.2.3

ISO Standards

http://www.iso.ch/iso/en/ISOOnline.frontpage •

ISO 11064-1 (2000) Ergonomic design of control centres - Part 1: Principles for the design of control centres, Working draft.

•

ISO 11064-2 (2000) Ergonomic design of control centres - Part 2: Principles for control suite arrangement.

49

©OGP

RADD – Human factors in QRA

•

ISO 11064-3 (2000) Ergonomic design of control centres - Part 3: Control room layout.

•

ISO 11064-4 (2000) Ergonomic design of control centres - Part 4: Workstation layout and dimensions

•

ISO 11064-5 (2000) Ergonomic design of control centres - Part 5: Displays and controls.

•

ISO 11064-6 (2000) Ergonomic design of control centres - Part 6: Environmental requirements, Working draft.

•

ISO 11064-7 (2000) Ergonomic design of control centres - Part 7: Principles for the evaluation of control centres.

•

ISO 11064-8 (2000) Ergonomic design of control centres - Part 8: Ergonomics requirements for specific applications.

3.2

Key Societies and Centres

There are several main bodies worldwide that cover Human Factors professionals. 3.2.1

United Kingdom

The Ergonomics Society is the professional body within the UK for ergonomics and Human Factors practitioners. Individual registered members are required to have completed an accredited university degree and have at least three years professional experience. The Society outlines a Code of Conduct with which all members are required to comply. For further information see http://www.ergonomics.org.uk/ 3.2.2

Europe

The Centre for Registration of European Ergonom ists (CREE) holds a similar register. Individuals must have a broad-based ergonomics degree qualification, together with further experience in the use and application of ergonomics in practical situations over a period of at least two years. The European Ergonomist category is approximately equivalent to the Ergonomic Society’s Registered Member grade. For further information see http://www.eurerg.org/ The Hum an Factors and Ergonom ics Society, Europe Chapter, is organised to serve the needs of the Human Factors profession in Europe. This is a sub-society of the US-based Human Factors and Ergonomics Society. For further information about their aims and roles see http://www.hfes-europe.org/ Other ergonomics and Human Factors societies exist throughout Europe. Further information can be found at the following websites: •

Federation of European Ergonom ics Societies: http://www.fees-network.org/

•

Irish Ergonom ics Society: http://www.ul.ie/~ies/

•

Society for French Speaking Ergonom ists: http://www.ergonomie-self.org/

•

Germ an Ergonom ics Society: http://www.gfa-online.de/englisch/english.php

•

Dutch ergonom ics Society: http://www.ergonoom.nl/NVvE/en

•

Italian Ergonom ics Society: http://www.societadiergonomia.it/

©OGP

50

RADD – Human factors in QRA

•

Hellenic Ergonom ics Society: http://www.ergonomics.gr/index_en.htm

•

Belgian Ergonom ics Society: http://www.besweb.be/

•

Swiss Ergonom ics Society: http://www.swissergo.ch/en/index.php

3.2.3

Scandinavia

Ergonomics has a high profile in Scandinavian countries. There are several national societies: •

Norwegian Ergonom ics Society: http://www.ergonom.no/ (Nowegian only)

•

Swedish Only)

•

Finnish Ergonom ics Society: http://www.ergonomiayhdistys.fi/

Ergonom ics

Society: http://www.ergonomisallskapet.se/ (Swedish

Addresses and further details of how to contact these societies can be found at the Nordic Ergonomics Society’s website http://www.ergonom.no/Html_english/s02a01c01.html 3.2.4

United States and Canada

The Hum an Factors & Ergonom ics Society encourages education and training for those entering the Human Factors and ergonomics profession and for those who conceive, design, develop, manufacture, test, manage, and participate in systems. For more information see http://hfes.org/ Association of Canadian Ergonom ists (Formerly the Human Factors Association of Canada) http://www.ace-ergocanada.ca/

3.2.5

South America

•

Argentinean Ergonom ics (Spanish only)

•

Chilean Ergonom ics Society: http://sochergo.ergonomia.cl/ (Chilean Only)

3.2.6

Society:

www.geocities.com/CapeCanaveral/6616/

Australia and New Zealand

The Ergonom ics Society of Australia (ESA) is the professional organisation of Ergonomists in Australia. Its purpose is to promote the principles and practice of ergonomics throughout the community. It has over 500 members. ESA is one of 36 federated societies worldwide that comprise the International Ergonomics Association (IEA). See http://www.ergonomics.org.au/ New Zealand Ergonom ics http://www.ergonomics.org.nz/

3.2.7

Society

(NZES)

can

be

found

at

Rest of the World

The International Ergonom ics Association is the federation of ergonomics and Human Factors societies from around the world. The mission of IEA is to elaborate and advance ergonomics science and practice, and to improve the quality of life by

51

©OGP

RADD – Human factors in QRA

expanding its scope of application and contribution to society. The IEA is governed by the Council with representatives from the federated societies. Day-to-day administration is performed by the Executive Committee that consists of the elected Officers and Chairs of the Standing Committees. See http://www.iea.cc/ Further websites available for the rest of the world include: • The Hong Kong Ergonom ics Society: http://www.ergonomics.org.hk/ •

Iranian Ergonom ics Society: http://www.modares.ac.ir/ies/

•

Ergonom ics Society of Korean: http://esk.or.kr/(Korean Only)

•

Ergonom ics Society of Taiwan: http://esk.or.kr/

•

Ergonom ics Society of Thailand: http://www.est.or.th/index.html (Thai Only)

•

Indian Society of Ergonom ics: http://www.ise.org.in/

•

Ergonom ics Society of South http://www.ergonomics-sa.org.za/

Africa

has

its

own

website

at

4.0

References & Bibliography

4.1

References

[1]

HSE, 1999. Reducing error and influencing behaviour (HSG48). HSE Books.

[2]

Christensen, JM. Human Factors definitions, Human Factors Society Bull., 31(3), 8-9.

[3]

HSE, 2003. Development of Human Factors methods and associated standards for major hazard industries, RR081/2003. http://www.hse.gov.uk/research/rrhtm/rr081.htm

[4]

HSE, 2002. Strategies to promote safe behaviour as part of a health and safety management system, CRR430/2002. http://www.hse.gov.uk/research/crr_htm/2002/crr02430.htm

[5]

HSE, 2006. Managing shiftwork: health and safety guidance, HSG256, Sudbury, Suffolk: HSE Books.

[6]

HSE, 1997. Guidance on permit-to-work systems in the petroleum industry, ISBN 0 7176 1281 3, Sudbury, Suffolk: HSE Books.

[7]

OLF Guideline no. 088 Common model for work permits. http://www.olf.no/guidelines/common-model-for-work-permits-article2954301.html

[8]

HSE, 2003. Competence assessment for the hazardous industries. http://www.hse.gov.uk/research/rrhtm/rr086.htm

[9]

HSE, 2007. Development of a working model of how Human Factors, safety management systems and wider organisational issues fit together, RR543/2007. http://www.hse.gov.uk/research/rrhtm/rr543.htm

[10]

Stein, E.S. and Rosenberg, B, 1983. The Measurement of Pilot Workload, Federal Aviation Authority, Report DOT/FAA/CT82-23, NTIS No. ADA124582, Atlantic City.

[11]

Reason, J., 1990. Human Error, Cambridge: Cambridge University Press.

[12]

Kirwan, B., 1992a. Human error identification in human reliability assessment. Part 1: Overview of approaches. Applied Ergonomics, 23(5), 299-318.

©OGP

RR086/2003.

52

RADD – Human factors in QRA

[13]

Spurgin, A.J., Lydell, B.D., Hannaman, G.W. and Lukic, Y., 1987. Human Reliability Assessment: A Systematic Approach. In Reliability ‘87, NEC, Birmingham, England.

[14]

Rasmussen, J., 1981. Human Errors. A Taxonomy for Describing Human Malfunction in Industrial Installations, Risø National Laboratory, DK-4000, Roskilde, Denmark.

[15]

Kirwan, B., 1994. Human reliability assessment. In J.R. Wilson and E.N. Corlett (eds.), Evaluation of Human Work. London: Taylor and Francis, pp. 921-968.

[16]

Gibson, W.H. and Megaw, T.D., 1999. The Implementation of CORE-DATA, a Computerised Human Error Probability Database. HSE Contract Research Report 245/1999. http://www.hse.gov.uk/research/crr_pdf/1999/crr99245.pdf

[17]

Bellamy, L.J., Wright, M.S. and Hurst, N.W., 1993. History and development of a safety management system audit for incorporation into quantitative risk assessment, International Process Safety Management Workshop, San Francisco, 22-24 September, AIChemE/CCPS.

[18]

Bellamy, L.J. and Geyer, T.A.W., 1991. Organisational, Management and Human Factors in Quantified Risk Assessment, HSE Contract Research Report 33/1991. http://www.hse.gov.uk/research/crr_pdf/1999/crr99245.pdf

[19]

Bellamy, L.J., Geyer, T.A.W., and Astley, J.A.A., 1989. Evaluation of the human contribution to pipework and in-line equipment failure frequencies, HSE Contract Research Report No. 89/15. http://www.hse.gov.uk/research/crr_pdf/1989/crr89015.pdf

[20]

Four Elements, 1993. Report No. 2258.

[21]

Swain, A.D. and Guttman, H.E., 1983. A Handbook of Human Reliability Analysis withEmphasis on Nuclear Power Applications. NUREG/CR-1278, USNRC, Washington DC-20555.

[22]

Bellamy, L.J., 1986. The Safety Management Factor: An Analysis of the Human Error Aspects of the Bhopal Disaster, Safety and Reliability Society Symposium, 25 September , Southport, UK.

[23]

Hurst, N.W., Bellamy, L.J. and Geyer, T.A.W., 1991. A classification scheme for pipework failures to include human and sociotechnical errors and their contribution to pipework failure frequencies, J. Haz. Mat., 26, 159-186.

[24]

Danos W., and Bennett L.E., 1984. Risk Analysis of Crane Accidents, U.S. Department of the Interior/Minerals Management Service, OCS Report MMS 840056.

[25]

Sutton R., and Towill D.R., 1982. A model of the crane operator as a manmachine element, Proc. Second European Annual Conference on Human Decision Making and Manual Control, pp25-42, June 2-4, University of Bonn, Poppelsdorfer Schloss. Forschungsinstitut fur Anthropotechnik, FGAN/FAT, Federal Republic of Germany: Wachtberg-Werhoven.

[26]

Butler A.J., 1978. An investigation into crane accidents, their causes and repair costs, Building Research Establishment Report CP75/78, Department of the Environment.

[27]

Wiken H., 1978. Offshore Crane Operations, Progress Report no 1, Study of offshore crane casualties in the North Sea, Det Norske Veritas Technical Report 78-633.

53

©OGP

RADD – Human factors in QRA

[28]

Kariuki, G. & Löwe, K., 2004. Incorporation Of Human Factors In The Design Process , guide prepared for PRSIM Focus Group 4, Institute for Plant and Process Technology, Process Safety and Plant Technology, Technische Universität Berlin, Germany.

[29]

Hunns, DM and Daniels, BK, 1980. The Method of Paired Comparisons, Proceedings 6th Symp. on Advances in Reliability Technology, Report NCSR R23 and R24, UK Atomic Energy Authority.

[30]

Williams, J.C., 1988. A data-based method for assessing and reducing human error to improve operational experience, Proc. IEEE 4th Conference on Human Factors in Power Plants, Monterey, CA, 6-9 June.

[31]

SRD/Humphreys, P. (ed.), 1988. Human Reliability Assessors Guide, Safety and Reliability Directorate Publication RTS 88/95Q, Warrington: UK Atomic Energy Authority

[32]

Muyselaar, A.J. and Bellamy, L.J., 1993. An audit technique for the evaluation and management of risks, CEC DGXI workshop on Safety Management in the Process Industry, October 7-8, Ravello, Italy.

[33]

Jack M., King D., 1993. Practical validation of installation evacuation, escape and rescue, (EER) systems, Response to incidents offshore, 8-9 June, Aberdeen, IBC Technical Services.

[34]

Stoll A.M. and Greene L.C., 1959. Relationship between pain and tissue damage due to thermal radiation, J. Appl. Physiol., 14, 373.

[35]

Sime, 1985a. Movement towards the unfamiliar: Person and place affiliation in a fire entrapment setting, Environment and Behaviour, 17:6, 697-724.

[36]

Sixsmith, A.J., Sixsmith, J.A. & Canter, D.V., 1988. When is a door not a door? A study of evacuation route identification in a large shopping mall, in Safety in the Built Environment, ed. Sime, J.D., 62-74, E&FN SPON, London.

[37]

Horiuchi, S., Murozaki, Y. & Hokuso, A., 1986. A case study of fire and evacuation in a multi-purpose office building, Osaka, Japan, in Fire Safety Science: Proceedings of the first International Symposium, eds. C.E.Grant & P.J.Pagni, Washington DC, Hemisphere Publishing Corp., Washington DC.

[38]

Wood, 1972. The behaviour of people in fires, Fire Research Note 953. Borehamwood: Fire Research Station. UK.

[39]

Four Elements, 1993. Freefall versus davit launched lifeboats: Human Factors study, Project Ref. 2334.

[40]

Sanders, M.S. and McCormick, E.J, 1987. Human Factors in Engineering and Design, 6th. ed., ch17, 486-517, McGraw-Hill International Editions.

[41]

Brinkley, J.W, 1984. Personnel Protection concepts for advanced escape system design, AGARD conference proceedings, Human Factors Consideration in High Performance Aircraft, pp6-1 to 6-12.

[42]

Nelson, J.K., Hirsch, T.J. and Phillips, N.S, 1989. Evaluation of Occupant accelerations in lifeboats, J. Offshore Mechanics and Arctic Engineering, III, 344349.

©OGP

54

RADD – Human factors in QRA

[43]

Landolt, J.P., Monaco, C., 1989. Seasickness in Occupants of Totally-Enclosed Motor-Propelled Survival Craft (TEMPSC),

[44]

Golden FstC. 1976. Hypothermia a Problem for North Sea Industries, J. Soc. Occup. Med., 26, 85-88.

[45]

Health and Safety at Work, 13:12, Croydon: Tolley Publishing Co Ltd..

[46]

Robertson, D.H. and Simpson, M.E.. Review of Probable Survival Times for Immersion in the North Sea, Offshore Technology Report OTO 95 038. http://www.hse.gov.uk/research/otopdf/1995/oto95038.pdf

[47]

Technica, 1987. The Performance of Attendant Vessels in Emergencies Offshore, A study carried out for the UK Department of Energy, OTH 97 274.

4.2

Bibliography

American Conference of Governmental Industrial Hygienists, (1980) Hydrogen Sulphide in Documentation of the Threshold Limit Values, 4th Edition, ACGIH, Cincinnati, p 225.Ahlborg, G., (1951) Hydrogen Sulphide Poisoning in Shale Oil Industry in Arfch. Industrial Hygiene and Occupational Medecine, 3, p 247. Bellamy, L.J., et al. (1990) Experimental programme to investigate informative fire warning characteristics for motivating fast evacuation, Building Research Establishment, Garston, Watford, U.K. Bellamy, L.J., Geyer, T.A.W., and Astley, J.A.A. (1989) Evaluation of the human contribution to pipework and in-line equipment failure frequencies. HSE Contract Research Report No. 89/15. Brabazon P.G., Gibson W.H., Tinline G., Leathley B.A., Practical Applications of Human Factors Methods in Offshore Installation Design. Offshore South East Asia, 6-9 December, 1994 Brown W et al., The qualification of human variability and its effect on nuclear power plant risk, Brookhaven National Laboratory, Upton, NY, 1990 Canter, D. (1980) (ed) Fires and Human Behaviour, Chichester: Wiley. Canter, D. (1984) Studies of human behaviour in fire: empirical results and their implications for education and design. Building Research Establishment, Garston, Watford, U.K. Crossthwaite, P.J., Fitzpatrick, R.D., Hurst, N.W. Risk assessment for the siting of developments near liquefied petroleum gas installations, IChemE Symposium Series 110 Dalkey, N. C. (1972. The Delphi method: An experimental study of group opinion. In N. C. Dalkey, D. L. Rourke, R. Lewis, & D. Snyder (Eds.. Studies in the quality of life: Delphi and decision-making (pp. 13-54. Lexington, MA: Lexington Books. DeGroot, M. (1974), " Reaching a consensus", Journal of the American Statistical Association, Vol. 69 No.345, pp.118-21. Edelman, H. & Bichman, E. (1980) A model of behaviour in fires applied to a nursing home fire in Fires and Human Behaviour (Ed. Canter, D.) 181-204, Chichester: Wiley. Eisenberg et al., (1975) Vulnerability Model. A Simulation Systems for Assessing Damage Resulting from Marine Spills. Nat. Tech. Service Report, AD-A015-245, Springfield, VA Elkins, H.B., (1952) Hydrogen Sulphide in The Chemistry of Industrial Toxicology, New York: John Wiley & Sons, p 95 & 232.

55

©OGP

RADD – Human factors in QRA

Embrey, D.E. (1986. SHERPA - a systematic human error reduction and prediction approach. Paper presented at the International Topical Meeting on Advances in Human Factors in NuclearPower Systems, Knoxville, Tennessee. Ergonomics, 33 (10/11), 1365-1375. ESCAPE, DNV Technica Evacuation Model, Railway Gazette International, Vol 149, no 10, October 1993, p. 713 Evans, C.L., 1967. The toxicity of Hydrogen Sulphide and other Sulphides in Journal of Experimental Physiology, 52 (3), p 231. Fahy R.F., EXIT89: an evacuation model for high-rise buildings. In: Fire Safety Science proceedings of the third international symposium, London. Elsevier, 1991, p 815-823, ISBN 1851667199 FARLIFE, Four Elements, 1993 Fruin, J.J. (1970) Designing for pedestrians - A level of service concept. Ph.D. Dissertation, The Polytechnic Institute of Brooklyn, June, 1970. Gafafer, W.M. Ed. (1964) Hydrogen Sulphide, in Occupational Diseases: A Guide to their Recognition, Public Health Service Publication. No. 1097, US Department of Health, Education and Welfare, Washington, DC, p 163. Gibson, H., Basra, G., and Kirwan, B. Development of the CORE-DATA database. Safety & Reliability Journal, Safety and Reliability Society, Manchester, 19, 1, 6-20, 1999. Grandjean, E & Kroemer, K.H.E. (1999. (5th Ed.) Fitting To The Task; A Textbook Of Occupational Ergonomics. Taylor & Francis: London. Haggard, H.W., 1928. The Toxicology of Hydrogen Sulphide, Journal of Industrial Hygiene, 7, p 113 Health and Safety Executive (1996. Collection of Offshore Human Error Probability Data Volume 1: Main Report; Volume 2: Appendices. Health & Safety Executive, London, Offshore Technology Report - OTO 95 037. Herd C.J., Jones R.H., Lewis K., Evacuation, escape and rescue analysis by integrated risk assessment. In: Risk analysis in the offshore industry II, Aberdeen, 25-27 March 1991. IBC Technical Services. HFRG (1995. Improving compliance with safety procedures: reducing industrial violations. HSE Books. Himann, Cunningham, Rechnitzer & Paterson, 1988 Hollnagel, E. (1993. Human Reliability Analysis: Context and Control. London: Academic Press. HSE (1997. Successful Health and Safety Management (HSG65. HSE Books. HSE (1998), Assessment principles for Offshore Safety Cases, HSG181, HSE Books, Norwich. HSE (2001), Human Factors for COMAH Safety Report Assessors, HID Central Division Human Factors Team. Human factors: Inspectors human factors toolkit. http://www.hse.gov.uk/humanfactors/comah/toolkit.htm

©OGP

56

RADD – Human factors in QRA

Humphreys, P. (1988. Human reliability assessors guide: an overview. In B.A. Sayers (Ed.), Human Factors and Decision Making: Their Influence on Safety and Reliability. London: Elsevier Applied Science, pp. 71-86. Humphreys, P. (Ed.) (1995. Human Reliability Assessors Guide: A Report By The Human Factors In Reliability Group. SRD Association, Warrington. Johnstone, R.T. and Saunders, W.B. (Eds.) (1960). Noxious Gases: Hydrogen Sulphide (H2S) in Occupational Diseases and Industrial Medicine, W.B. Saunders, Philadelphia, p 115. Jones, J.P., (1975) Hazards of Hydrogen Sulphide Gas, Selected Papers from the 23rd Annual Gas Measurement Institute, 16. Ketchell N., et al, When and how will people muster. In: Response to incidents offshore, 89 June 1993, Aberdeen, IBC Technical Services Kirwan, B & Ainsworth, L.K. (1992. A Guide To Task Analysis. Taylor & Francis: London. Kirwan, B. (1988. A comparative evaluation of five human reliability assessment techniques. In B.A. Sayers (Ed.), Human Factors and Decision Making: Their Influence on Safety and Reliability. London: Elsevier Applied Science, pp. 87-109. Kirwan, B. (1992. Human error identification in human reliability assessment. Part 1: Detailed comparison of techniques. Applied Ergonomics, 23 (6), 371-381. Kirwan, B. (1996. The validation of three Human Reliability Quantification techniques THERP, HEART and JHEDI: Part I - Technique descriptions and validation issues. Applied Ergonomics, 27 (6), 359-373. Kirwan, B. (1997. The validation of three Human Reliability Quantification techniques THERP, HEART and JHEDI: Part III - Practical aspects of the usage of the techniques. Applied Ergonomics, 28 (1), 27-39. Kirwan, B. (1997. Validation of Human Reliability Assessment techniques: Part 1 – Validation issues. Safety Science, 27 (1), 25-41. Kirwan, B. (1997. Validation of Human Reliability Assessment techniques: Part 2 – Validation results. Safety Science, 27 (1), 43-75. Kirwan, B. (1998. Human error identification techniques for risk assessment of high risk systems - Part 1: review and evaluation of techniques. Applied Ergonomics, 29 (3), 157177. Kirwan, B. (1998. Human error identification techniques for risk assessment of high-risk systems - Part 2: towards a framework approach. Applied Ergonomics, 29 (5), 299-318. Kirwan, B. Basra, G. Taylor-Adams, S.E, CORE-DATA: a computerised human error database for humanreliability support., Human Factors and Power Plants, 1997. 'Global Perspectives of Human Factors in Power Generation'., Proceedings of the 1997 IEEE Sixth Conference, 1997, On page(s): 9/7-912 Kirwan, B., Gibson, H., Kennedy, R., Edmunds, J., Cooksley, G. And Umbers, I. (2004) Nuclear Action Reliability Assessment (NARA): A data-based HRA tool. In Probabilistic Safety Assessment and Management 2004, Spitzer, C., Schmocker, U., and Dang, VN (Eds), London, Springer, pp 1206-1211. Kirwan, B., Kennedy, R., Taylor-Adams, S., Lambert, B. (1997. The validation of three Human Reliability Quantification techniques - THERP, HEART and JHEDI: Part II Results of validation exercise. Applied Ergonomics, 28 (1), 17-25.

57

©OGP

RADD – Human factors in QRA

Kirwan, B., Scannali, S. and Robinson, L. (1996. Applied HRA: A case study. Applied Ergonomics, 27 (5), 289 - 302. Kisko T.M., Francis R.L., Noble C.R., EVACNET+ User’s Guide, Gainesville, Florida: University of Florida Department of Industrial and Systems Engineering, April 1984 Kovac, J.G., Vaught, C., Branich Jr., M.J., Probability of making a successful mine escape while wearing a self-contained self rescuer, Journal of the International Society for Respiratory Protection, Vol 10, Issue 4. Krockeide, G. (1988) An introduction to luminous escape systems in Safety in the Built Environment (Ed. Sime, J.D.) p 134-146. Meshkati, N., Hancock, P.A., Rahimi, M. and Dawes, S.M. (1995. Techniques in mental workload assessment. In J.R. Wilson an E.N. Corlett, Evaluation of Human Work. London: Taylor and Francis. Concise description of techniques for mental workload assessment. MUSTER, DNV Technica. Patty, F.A., Ed. (1963) Hydrogen Sulphide, in Industrial Hygiene and Toxicology, Volume 2 New York: Interscience. Pauls, J. (1980) Building Evacuation: research findings and recommendations in Fires and Human Behaviour (Ed. D. Canter), John Wiley & Sons, Chichester, p251-275. Pheasant, S, Bodyspace: Anthropometry, Ergonomics and the Design of the Work, Second Edition 1996 Poda, G.A., (1966) Health, 12, p 795.

Hydrogen Sulphide can be Handled Safely in Arch. Environmental

Reason, J. (1990. A systems approach to organisational error. Ergonomics, 38 (8), 17081721. Reason, J. (1999. Managing The Risks Of Organisational Accidents. Ashgate: USA. Reidel, D. (1982) Risk analysis of Six Potentially Hazardous Industrial Objects in the Rijnmond Area: A Pilot Study, A report to the Rijnmond Public Authority, Dordrecht ("The COVO Study". Senders, J.W. and Moray, N.P. (1991. Human Errors: Cause, Prediction, and Reduction. Hillsdale, New Jersey: Lawrence Erlbaum. Shepherd, A. (2001. Hierarchical Task Analysis. London: Taylor and Francis. A well-written and illustrated guide to HTA including methodology and application to design,teams and jobs, information and skill, training, support documentation and human resource management. Shorrock, S.T. and Hughes, G.J. (2001. Let's get real: How to assess human error in practice. IBC seminar on human error techniques, October 2001, London. Shorrock, S.T., Kirwan, B., MacKendrick, H. and Kennedy, R. (2001. Assessing human error in Air Traffic Management systems design: Methodological issues. Le Travail Humain, 64 (3), 269-289. Siegel, S. (1956. Nonparametric Statistics for the Behavioral Sciences. McGraw-Hill Book Company, Inc., New York. Taylor-Adams, S.T., and Kirwan, B. Human Reliability Data Requirements. International Journal of Quality & Reliability Management, 12, 1 24-46, 1995. Tong, D. & Canter, D. (1985) The decision to evacuate: A study of the motivations which contribute to evacuation in the event of fire Fire Safety Journal, 9, 257-265.

©OGP

58

RADD – Human factors in QRA

US National Institute for Occupational Safety and Health (1977) Criteria for a recommended standard occupational exposure to Hydrogen Sulphide, DHEW (NIOSH) Publication Number 77-158. Waagenaar, W.A. and Reason, J.T. (1990. Types and Tokens in Accident Causation. Waters, T. (1988. Human Factors reliability benchmark exercise, report of the SRD participation. In B.A. Sayers (Ed.), Human Factors and Decision Making: Their Influence on Safety and Reliability. London: Elsevier Applied Science, pp. 87-109. Whittingham, B. (1993) Human Factors in QRA - Data and Methodology. pp. 93-118 in proceedings of the E&P Forum Workshop on Data in Oil and Gas Quantitative Risk Assessments, December 1993, Report no. 11.7/205 Jan 1994. Wickens, C. D. et al (1998. An Introduction to Human Factors Engineering. Longman: New York. Wickens, C.D. (1992. Engineering Psychology and Human Performance (Second Edition. New York: Harper Collins. Contains chapter on attention, time-sharing and workload. Williams, J.C. (1986. HEART - a proposed method for assessing and reducing human error. In Ninth Advances in Reliability Technology Symposium, University of Bradford. Williams, J.C. (1992. Toward an improved evaluation tool for users of HEART. Proceedings of the International Conference on Hazard Identification, Risk Analysis, Human Factors and Human Reliability in Process Safety, Orlando, February, Chemical Centre for Process Studies (CCPS. Wilson, J.R & Corlett, N.E. (1999. (2nd Ed.) Evaluation Of Human Work. Taylor & Francis: London. Wilson, J.R. and Corlett, E.N. (1995) (Eds. Evaluation of Human Work. London: Taylor and Francis. A classic guide to Human Factors methodology. Highly comprehensive, covering all aspects of Human Factors assessment methods. Includes a chapter on Task Analysis by Stammers and Shepherd. Wong, S. et al., Risk sensitivity to human error in the LaSalle PRA, NUREG CR/-5527, U.S. Nuclear Regulatory Commission, Washington, DC., 1990 Yant, W.P., 1930. Hydrogen Sulphide in Industry: Occurrence, Effects and Treatment in, American Journal of Public Health, 20, p 598.

59

©OGP

Risk Assessment Data Directory Report No. 434 – 6.1 March 2010

Ignition probabilities International Association of Oil & Gas Producers

RADD – Ignition probabilities

contents 1.0

Introduction ........................................................................ 1

2.0 2.1 2.2

Summary of Recommended Data ......................................... 1 Ignition Probability Curves ......................................................................... 1 Blowout Ignition Probabilities .................................................................. 16

3.0 3.1 3.2

Guidance on use of data .................................................... 17 General Validity.......................................................................................... 17 Alternative Approaches ............................................................................ 17

3.2.1 3.2.2

Releases addressed by datasheets in Section 2.0 ............................................ 17 Other releases ....................................................................................................... 20

3.3

Uncertainties .............................................................................................. 20

4.0

Review of data sources ...................................................... 20

5.0

Recommended data sources for further information ........... 22

6.0

References ......................................................................... 22

©OGP

1

RADD – Ignition probabilities

Abbreviations FPSO LPG NAP NUI QRA UKOOA

2

Floating Production Storage and Offloading (Installation) Liquefied Petroleum Gas Normal Atmospheric Pressure Normally Unmanned Installation Quantitative Risk Assessment United Kingdom Offshore Operators Association

©OGP

RADD – Ignition probabilities

1.0

Introduction

The data presented in section 2 provide estimates of the probabilities of hydrocarbon releases igniting to result in an explosion and/or a sustained fire. These data may be applied to any on the leak types described in the Process Release Frequencies datasheet1. The values presented relate to “total” ignition probability, which can be considered as the sum of the probabilities of immediate ignition and delayed ignition. Immediate ignition can be considered as the situation where the fluid ignites immediately on release through auto-ignition or because the accident which causes the release also provided an ignition source. Delayed ignition is the result of the build-up of a flammable vapour cloud which is ignited by a source remote from the release point. It is assumed to result in flash fires or explosions, and also to burn back to the source of the leak resulting in a jet fire and/or a pool fire. These probabilities are considered appropriate for use in QRA studies where a relatively coarse assessment is acceptable. Section 3.2 refers to a more detailed approach for QRAs where this is considered to be required.

2.0

Summary of Recommended Data

2.1

Ignition Probability Curves

Data presented in this section come in the form of 28 mathematical functions drawn from the UKOOA look-up correlations (see section 4.0) which relate ignition probabilities in air2 to release rates for typical scenarios both onshore and offshore. The various scenarios are summarised in Table 2.1,

1

With the exception of “zero pressure” releases, where the limited inventory and hence cloud size would result in a lower ignition probability than would be predicted using this approach. 2 Ignition probabilities in other atmospheres, e.g. oxygen enriched or chlorine, are outside the scope of this datasheet.

©OGP

1

RADD – Ignition probabilities

Table 2.2 and Table 2.3. The functions themselves are given in both tabular and graphical form in the data sheets which follow. The curves of ignition probability vs. release rate comprise between two and four sections, each a straight line when plotted on log-log axes. These curves represent “total” ignition probability. The method assumes that the immediate ignition probability is 0.001 and is independent of the release rate. As a result, all the curves start at a value of 0.001 relating to a release rate of 0.1 kg/s. Users of the data may wish to adopt this value and to obtain delayed ignition probabilities by subtracting 0.001 from the total ignition probability, e.g. an ignition probability value of 0.004 obtained from the look-up correlations can be considered as an immediate ignition probability of 0.001 and a delayed ignition probability of 0.003.

2

©OGP

RADD – Ignition probabilities

Table 2.1 Onshore Ignition Scenarios Scenario No. 1 2 3

4 5 6 7

8 9 10

Look-up Release Type

Application

Pipe Liquid Industrial (Liquid Releases from onshore pipeline in industrial area) Pipe Liquid Rural (Liquid Releases from onshore pipeline in industrial area) Pipe Gas LPG Industrial (Gas or LPG release from onshore pipeline in an industrial area) Pipe Gas LPG Rural (Gas or LPG release from onshore pipeline in a rural area) Small Plant Gas LPG (Gas or LPG release from small onshore plant) Small Plant Liquid (Liquid release from small onshore plant) Small Plant Liquid Bund Rural (Liquid release from small onshore plant where the spill is bunded) Large Plant Gas LPG (Gas or LPG release from large onshore plant) Large Plant Liquid (Liquid release from large onshore plant) Large Plant Liquid Bund Rural (Liquid Released from large onshore plant where spill is bunded)

Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from onshore cross-country pipelines running through industrial or urban areas. Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from onshore cross-country pipelines running through rural areas. Releases of flammable gases, vapour or liquids significantly above their normal (Normal Atmospheric Pressure (NAP)) boiling point from onshore cross-country pipelines running through industrial or urban areas. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from onshore cross-country pipelines running through rural areas. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2). Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2) and which are not bunded or otherwise contained. Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from small onshore plants (plant area up to 1200 m2, site area up to 35,000 m2) and where the liquid releases from the plant area are suitably bunded or otherwise contained. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000 m2). Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000 m2) and which are not bunded or otherwise contained. Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from large onshore outdoor plants (plant area above 1200 m2, site area above 35,000 m2) and where the liquid releases from the plant area are suitably bunded or otherwise contained.

©OGP

3

RADD – Ignition probabilities Scenario No. 11

12

Look-up Release Type

Application

Large Plant Congested Gas LPG (Gas or LPG released from a large confined or congested onshore plant) Tank Liquid 300m x 300m Bund (Liquid release from a large confined or congested onshore plant)

Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from large onshore plants (plant area above 1200 m2, site area above 35,000 m2), where the plant is partially walled/roofed or within a shelter or very congested.

13

Tank Liquid 100m x 100m Bund (Liquid release from onshore tank farm where spill is limited by small or medium sized bund)

14

Tank Gas LPG Plant (gas or LPG release from onshore tank farm within the plant)

15

Tank Gas LPG Storage Industrial (Gas or LPG released from onshore tank farm sited adjacent to a plant or away from the plant in an industrial area) Tank Gas LPG Storage Only Rural (Gas or LPG released from onshore tank farm sited adjacent to a plant or away from the plant in an industrial area)

16

Releases flammable liquids that do not have any significant flash fraction (10% or less) if released from very large onshore outdoor storage area 'tank farm' (e.g. spill in a large multitank bund over 25,000 m2 area). See curve No. 30 “Tank Liquid – diesel, fuel oil’ if liquids are stored at ambient conditions below their flash point. Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from onshore outdoor storage area 'tank farm' (e.g. spill in a large tank bund containing four or fewer tanks, or any other bund less than 25,000 m2 area). See curve No. 30 “Tank Liquid – diesel, fuel oil’ if liquids are stored at ambient conditions below their flash point. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from onshore outdoor storage tanks located in a 'tank farm' entirely surrounded by plants. For tank farms adjacent to plants use curve No. 15 “Tank Gas LPG Storage Industrial” or Curve No. 16 “Tank Gas LPG Storage Only Rural” look-up correlations. Releases from process vessels or tanks inside plant areas should be treated as plant releases. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from onshore outdoor storage tanks located in a 'tank farm' adjacent to plants or situated away from plants in an industrial or urban area.

Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from onshore outdoor storage tanks located in a 'tank farm' adjacent to plants or situated away from plants in a rural area.

Source: Energy Institute [1]

4

©OGP

RADD – Ignition probabilities

Table 2.2 Offshore Ignition Scenarios Scenario No. 17 18 19

20

Look-up Release Type Offshore Process Liquid (Liquid release from offshore process module) Offshore Process Liquid NUI (Liquid release from offshore process area on NUI) Offshore Process Gas Open Deck NUI (Gas release from offshore process open deck area on NUI) Offshore Process Gas Typical (Gas release from typical offshore process module)

21

Offshore Process Gas Large Module (gas release from typical offshore process module)

22

Offshore Process Gas Congested or Mechanical Vented Module (Gas released from a mechanically ventilated or very congested offshore process module) Offshore Riser (Gas release from typical offshore riser in air gap)

23

Application Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from within offshore process modules. Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from within offshore process modules or decks on NUIs. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from an offshore process weather deck/ open deck on NUIs. Can also be used for open/uncongested weather decks with limited process equipment on larger attended integrated platforms. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from within offshore process modules or decks on integrated deck / conventional installations). Process modules include separation, compression, pumps, condensate handling, power generation, etc. If the module is mechanically ventilated or very congested – see curve No. 22 “Offshore Process Gas Congested or Mechanical Vented Module”. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from within large offshore process modules or decks on integrated deck / conventional installations (module greater than 1000 m2 floor area). Process modules include separation, compression, pumps, condensate handling, power generation, etc. If the module is mechanically ventilated or very congested – see curve No. 22 'Offshore Process Gas Congested or Mechanical Vented Module'. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from within offshore process modules or decks on integrated deck / conventional installations: applies where the module is enclosed and has a mechanical ventilation system or is very congested (volume blockage ratio => 0.14 and less than 25% of area of the end walls open for natural ventilation) Releases from offshore installation risers in the air gap area where there is little chance of the release entering process areas on the installation (e.g. solid decks, wind walls). Applies to partial flashing oil or gas releases. May also be used for blowouts with well positioned diverters directing any release away from the installation (see also curve No. 27 “Offshore Engulf – blowout riser”).

©OGP

5

RADD – Ignition probabilities Scenario No. 24

25

26

27

Look-up Release Type Offshore FPSO Gas (Gas release from offshore FPSO process module) Offshore FPSO Gas Wall (Gas release from offshore FPSO process module behind a transverse solid wall) Offshore FPSO Liquid (Liquid release from typical offshore FPSO process module) Offshore Engulf – blowout – riser (Major release which can engulf an entire offshore installation)

Application Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from within offshore process modules or decks on FPSOs. See curve No. 25 “offshore FPSO Gas Wall” if the release is from an area downwind of a transverse wall across the FPSO deck. Releases of flammable gases, vapour or liquids significantly above their normal (NAP) boiling point from within offshore process modules or decks on FPSOs. This correlation applies if the release is from an area downwind of a transverse wall across the FPSO deck. Releases of flammable liquids that do not have any significant flash fraction (10% or less) if released from within offshore process modules or decks on FPSOs Releases from drilling or well working blowouts or riser failures under open grated deck areas where the release could engulf the entire installation and reach into platform areas: applies to partial flashing oil or gas releases. (see also curve No. 23 “Offshore Riser” for riser releases and blowouts with divertors)

Source: Energy Institute [1]

Note. Curve Nos. 28 and 29 related to Cox, Lees and Ang formulation which were included in the document for comparison

Table 2.3 Special (Derived) Ignition Scenarios Scenario No. 30

Look-up Release Type

Application

Tank Liquid – diesel fuel oil (Liquid Release from onshore tank farm of liquids below their flash point, e.g. diesel or fuel oil)

Releases of combustible liquids stored at ambient pressure and at temperatures below their flash point (e.g. most gas, oil, diesel and fuel oil storage tanks) from onshore outdoor storage area “tank farm”. This look-up correlation can be applied to releases from tanks and low pressure transfer lines or pumps in the tank farm/ storage area. However, it should not be used for high-pressure systems (over a few barg): in these situations use curve No. 12 “Tank Liquid 300m x 300m Bund” or curve No. 13 “Tank Liquid 100 x 100m Bund”

Source: Energy Institute [1]

6

©OGP

RADD – Ignition probabilities

Data Sheet 1: Scenarios 1 – 4

©OGP

7

RADD – Ignition probabilities

Data Sheet 2: Scenarios 5 – 7

8

©OGP

RADD – Ignition probabilities

Data Sheet 3: Scenarios 8 – 11

©OGP

9

RADD – Ignition probabilities

Data Sheet 4: Scenarios 12, 13 & 30

10

©OGP

RADD – Ignition probabilities

Data Sheet 5: Scenarios 14 – 16

©OGP

11

RADD – Ignition probabilities

Data Sheet 6: Scenarios 17 & 18

12

©OGP

RADD – Ignition probabilities

Data Sheet 7: Scenarios 19 – 22

©OGP

13

RADD – Ignition probabilities

Data Sheet 8: Scenarios 24 – 26

14

©OGP

RADD – Ignition probabilities

Data Sheet 9: Scenarios 23 & 27

©OGP

15

RADD – Ignition probabilities

Notes: 1. A flammable substance above its auto-ignition temperature is likely to ignite on release and should be modelled as having an ignition probability of one. 2. Very reactive substances are unlikely to found in oil and gas processing operations but if present it is suggested that the values given in the look-up correlations are doubled, subject to a maximum of 1. Such substances include hydrogen, acetylene, ethylene oxide and carbon disulphide. 3. High flash point (>55°C) liquids stored at or near ambient conditions are significantly less likely to ignite than suggested in the look-up correlations. It is suggested that an ignition probability from the look-up correlations is multiplied by a factor of 0.1 subject to a minimum of 0.001 and taking account of the 0.001 immediate ignition probability. 4. For liquids with flash fractions above 10% it is suggested that the ignition probability is estimated by combining the relevant liquid ignition probability with a suitable gas/LPG ignition probability. The appropriate release rates should be obtained from the flash fraction, e.g. a 10 kg/s release with a 20% flash fraction should give rise to an equivalent 2 kg/s gas release and 8 kg/s liquid release. The two probabilities can be combined using the following equation;

Alternatively the higher of the two ignition probabilities can be used on the basis that the areas covered by the liquid and gas are likely to have considerable overlap. 5. Since the correlations are based on typical combinations of ignition sources, it follows that they should not be used in situations where particularly strong sources such as fired heaters are present. In this case the full UKOOA ignition model is more appropriate.

2.2

Blowout Ignition Probabilities

An alternative to the blowout ignition probabilities given by the UKOOA look-up correlations can be obtained from Scandpower’s interpretation of the blowout data provided by SINTEF 2. This is given in Table 2.4. The most significant category is that for deep blowouts which indicates an early ignition probability of 0.09. For the purposes of QRA studies this can be taken as occurring immediately on release. The report also gives a delayed ignition probability of 0.16 although all of these are taken to occur more than one hour after the start of the release. Conservatively, this could be taken as occurring shortly after the initial release and result in an explosion. Table 2.4 Ignition Probabilities for Blowouts and W ell Releases on Platform s

16

Release Type

Early ignition (< 5 min)

Shallow Gas Blowout Deep Blowout Deep Well Release

0.07 0.09 0.03

©OGP

Delayed ignition (5 – 60 min) 0.11 -

Very Delayed ignition (> 60 min) 0.07 0.16 -

RADD – Ignition probabilities

3.0

Guidance on use of data

3.1

General Validity

The correlations are considered to provide an acceptable approach for use in typical QRA studies. For more detailed analysis it is recommended that the full spreadsheet UKOOA ignition model is used so that the specific circumstances with regard to layout and ignition sources can be more accurately represented. The correlations were developed for UKOOA member companies with the intention of providing representative probabilities for installations operating in UK waters. They may be applied to the analysis of hydrocarbon releases in other regions which comply with recognised industry good practice, as it is applied in the UKCS. The forward to the Energy Institute report states that the model and look-up correlations “are not suited to the ignition probability assessment of refrigerated liquefied gases, vapourising liquid pools, sub-sonic gas releases, or non-momentum driven releases, such as those following catastrophic storage vessel failure.” Despite this note, flashing liquid releases are covered by a number of the correlations and analysts may further modify them by combining them with a gas or LPG ignition probability in suitable proportions as suggested in note 4 of section 2.1. Atmospheric storage tanks are dealt with in the Storage Incident Frequencies data sheet. Low momentum and sub-sonic gas releases are uncommon in process systems. An approach to the scenarios for which the correlations are not valid is suggested in Section 3.2.2.

3.2

Alternative Approaches

3.2.1

Releases addressed by datasheets in Section 2.0

The initial task for the analyst is to determine which of the scenarios given in Table 2.1 to

©OGP

17

RADD – Ignition probabilities

Table 2.2 and Table 2.3 best matches the scenario under consideration. There may be situations where the scenario under consideration lies between two of the described scenarios, in which case the analysts may attempt to interpolate between two curves. The data presented in the tables in Section 2.0 can be used in three ways: 1. Estimate from the graphs 2. Obtain probability based on the tabulated values 3. Use values in Table 3.1 to calculate the probability. Note that, in interpolating between the data points, it is necessary to take logarithms of the release rate and probabilities, interpolate between these to find the logarithm of the required probability and then obtain the value itself, i.e.:

where Pign

is the required ignition probability corresponding to release rate Q is the ignition probability at a release rate of Qlower (the lower bound of the relevant curve section), and is the ignition probability at a release rate of Qupper (the upper bound of the relevant curve section)

The third of these options is the recommended approach and the analyst may find it convenient to construct a spreadsheet or some other computer programme to carry this out. The data used to generate the lines on the graphs in the datasheets (Section 2.1) are shown in Table 3.1. This has been derived from Table 2.9 in the Institute of Energy report 1, which provides further explanation on the derivation of the lines. This specifies the release rates and ignition probabilities relating to each of the points bounding the segments as indicated in Figure 3.1. Some information on the timing of ignitions is also available in 1. Figure 3.1 Typical Ignition Probability Curve

18

©OGP

RADD – Ignition probabilities

A more accurate assessment may be obtained by the use of the full UKOOA ignition model which is described in 1. This has been implemented in a spreadsheet tool which is made available on a CD which accompanies the report. This allows the user to input specific data relating to release conditions, platform layout and ignition sources. However, this requires more effort on the part of the analyst and the availability of more installation specific data compared with the relative ease with which the look-up functions can be used.

©OGP

19

RADD – Ignition probabilities

Table 3.1 Data for Look-up Correlations Scenario No.

Type

1 2 3 4 5 6 7 8 9 10

Pipe Liquid Industrial Pipe Liquid Rural Pipe Gas LPG Industrial Pipe Gas LPG Rural Small Plant Gas LPG Small Plant Liquid Small Plant Liquid Bund Rural Large Plant Gas LPG Large Plant Liquid Large Plant Liquid Bund Rural Large Plant Congested Gas LPG Tank Liquid 300x300 Bund Tank Liquid 100x100 Bund Tank Gas LPG Plant Tank Gas LPG Storage Only Industrial Tank Gas LPG Storage Only Rural Offshore Process Liquid Offshore Process Liquid NUI Offshore Process Gas Open Deck NUI Offshore Process Gas Typical Offshore Process Gas Large Module Offshore Process Gas Congested or Mechanically Vented Module Offshore Riser Offshore FPSO Gas Offshore FPSO Gas Wall Offshore FPSO Liquid Offshore Engulf – Blowout Riser

11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 30 20

Tank Liquid - Diesel and Fuel Oil

Point 1 Release Probability rate 0.1 0.001 0.1 0.001 0.1 0.001 0.1 0.001 0.1 0.001 0.1 0.001 0.1 0.001 0.1 0.001 0.1 0.001 0.1 0.001

Point 2 Release Probability rate 70.00 0.07 0.30 0.00 1000.01 1.00 10.00 0.00 1.00 0.00 1.00 0.00 1.00 0.00 1.00 0.00 1.00 0.00 1.00 0.00

Point 3 Release Probability rate 70.00

0.01

23408.55 3.00 100.00 8.05 260.00 109.99 42.49

1.00 0.01 0.10 0.01 0.65 0.13 0.05

Point 4 Release Probability rate

498.99

0.60

0.1

0.001

1.00

0.00

70.00

0.43

325.03

0.70

0.1 0.1 0.1

0.001 0.001 0.001

1.00 1.00 1.00

0.00 0.00 0.00

7.00 7.00 102.84

0.00 0.00 1.00

519.62 49.03

0.12 0.02

0.1

0.001

1.00

0.00

100.00

0.23

988.11

1.00

0.1

0.001

1.00

0.00

10.00

0.02

52551.35

0.50

0.1 0.1

0.001 0.001

100.00 24.73

0.02 0.01

0.1

0.001

1.00

0.00

31.42

0.03

0.1

0.001

3.00

0.01

37.01

0.04

0.1

0.001

5.00

0.03

30.00

0.05

0.1

0.001

1.00

0.01

92.63

0.04

0.1 0.1 0.1 0.1

0.001 0.001 0.001 0.001

38.27 1.00 0.30 100.00

0.03 0.00 0.00 0.03

50.00 10.00

0.15 0.15

0.1

0.001

100.00

0.10

0.1

0.001

1.00

0.00

7.00

0.00

25.55

0.00

©OGP

RADD – Ignition probabilities

3.2.2

Other releases

As noted in Section 3.1, the UKOOA ignition model cannot be considered valid for all types of release. In particular, it does not refrigerated releases that form evaporating liquid pools. Analysis of these and the other scenarios referred to there may require a more fundamental treatment by calculating likely cloud sizes for the given release, material and weather conditions and estimating the number and strength of ignition sources which the flammable part of the cloud may reach. There is no generally recognized method for determining ignition source strength for use in QRAs. Some values are given in the “Purple Book” [3] but these are estimates based on engineering judgment and do not have any more scientific basis.

3.3

Uncertainties

The assessment of ignition probability is subject to a large degree of uncertainty. The spreadsheet model produced under phase I of the joint industry project is itself subject to uncertainties in the analytical approach taken and in the data used. The adoption of the lookup correlations based on this model introduces more uncertainties because a compromise has to be made in selecting the most appropriate curve and these curves themselves are approximations to the curves produced by the model itself. Ignition probabilities are influenced by design layout, the number and separation of ignition sources, the quality of maintenance of equipment, and thereby the control of ignition sources. Despite these uncertainties, the approach is considered to be an advance on other formulations which relate ignition probability to release rate only with no regard for the presence of ignition sources, the nature of the fluids or the layout of the plant.

4.0

Review of data sources

The data presented in Section 2 are largely a reproduction of data from the Energy Institute Research Report [1], published on behalf of the joint industry project sponsors UKOOA (Now Oil and Gas UK), the HSE and the Energy Institute. The report reviews existing models and develops a new model which could be applied to both onshore and offshore scenarios. The work was undertaken in two phases. The first phase involved developing a model for assigning ignition probabilities in QRA studies and to further the understanding of scenario specific ignition probabilities. The work was undertaken by AEA Technology (now ESR Technology) and co-ordinated by a joint industry steering group drawn from UKOOA member representatives, the HSE and consultants working in the field of onshore and offshore QRA. The report summarised the current status of knowledge and research in the field of ignition probability estimation in support of QRA. It evaluated this, together with the usefulness of the UK HSE’s hydrocarbon release database as a basis to develop an improved ignition model for use in QRA. The end result is a spreadsheet model for estimating the ignition probability of process leaks offshore and also attempts to include the capability to assess the ignition probability of most typical onshore hydrocarbon leak scenarios. The spreadsheet attempts to model the ignition

©OGP

21

RADD – Ignition probabilities

probability by considering the size of the gas cloud which would be formed by the release and taking into account the number and type of ignition sources which the cloud, at sufficient concentration, might reach. As a result of the complexity of the model, users are required to obtain and enter a significant amount of data relating to the platform configuration and the distribution of ignition sources. Having completed the work to establish a model, a second phase was commissioned to consider representative scenarios which would generate look-up correlations which could be used in QRA studies without the need for the user to gather the data required for the full model. The following summarises the release types considered. •

Gas releases

•

LPG (flashing liquefied gas) releases

•

Pressurised liquid oil releases – leading to a spray release with flashing/ evaporation/ aerosol formation

•

Low pressure liquid oil releases – leading to a spreading pool only (no aerosol formation or flashing)

•

Release rates from 0.1 to 1000 kg/s – (graphs shown in the data sheets are extended to 10000 kg/s where the probability function does not reach a maximum below 1000 kg/s)

The configurations considered are given in Table 2.1 to Table 2.3. A large number of analyses were carried out to produce graphs of ignition probability against release rate. Figure 4.1 shows a typical set of curves. In the final stage of the process, groups of similar curves were considered and grouped into the scenarios listed in Table 2.1 to Table 2.3. These scenarios were then examined and a representative curve assigned to them. These curves consist of between two and four segments each of which appears as a straight line when plotted on logarithmic axes. It is these curves which are depicted in the data sheets. Figure 4.1 Exam ple of Ignition Probability Curve Calculated by UKOOA ignition m odel

Source: Energy Institute [1]

22

©OGP

RADD – Ignition probabilities

Prior to the introduction of the UKOOA ignition model approach outlined above, the formulation attributed to Cox, Lees and Ang 4 was widely used. This gained acceptance largely because of the proportion of analysts using it rather than because of the rigour of the theory underlying it. Ignition probabilities predicted by this method were in excess of what was found to occur in practice and this was partly responsible for instigating the work which resulted in the UKOOA ignition model. References in this report to “UKOOA (spreadsheet) model” and “UKOOA look-up correlations” relate respectively to the output from the two phases of the project [1].

5.0

Recommended data sources for further information

For further information, on the ignition probability curves presented in this document, the Energy Institute report 1 should be consulted.

6.0

References

1. Ignition Probability Review, Model Development and Look-Up Correlations, Research Report published by the Energy Institute, January 2006. ISBN 978 0 85293 454 8 2. Scandpower Risk Management AS 2006. Blowout and Well Release Frequencies – Based on SINTEF Offshore Blowout Database, 2006, Report No. 90.005.001/R2. 3. Guidelines for quantitative risk assessment (Purple book), Part 1, Establishment, CPR18 E, Committee for the Prevention of Disasters (CPR), National Institute of Public Health and Environment (RIVM), Ministry of Transport, Public Works & Water Assessment Management, AVIV Adviserend Ingenieurs Save Ingenieurs (Adviesbureau), 1999. 4. Cox, Lees and Ang, 1991. Classification of Hazardous Locations, Rugby: Institution of Chemical Engineers, ISBN 0 85295 258 9.

©OGP

23

Risk Assessment Data Directory Report No. 434 – 7 March 2010

Consequence modelling International Association of Oil & Gas Producers

RADD – Consequence modelling

contents 1.0

Scope and Definitions ........................................................... 1

2.0 2.1

Summary of Recommended Approaches ................................ 1 Release modelling .......................................................................................... 3

2.1.1 2.1.2 2.1.3

Simple approaches to release modelling................................................................. 4 Software for release modelling ................................................................................. 6 Modelling Releases from Buried Pipelines.............................................................. 7

2.2

Dispersion and ventilation modelling ........................................................... 7

2.2.1 2.2.2 2.2.3

Simple approaches to dispersion modelling........................................................... 9 Software for dispersion modelling ......................................................................... 11 CFD for ventilation and dispersion modelling....................................................... 12

2.3

Fire and thermal radiation modelling.......................................................... 13

2.3.1 2.3.2 2.3.3

Simple approaches to fire and thermal radiation modelling................................ 14 Software for fire and thermal radiation modelling ................................................ 20 CFD for fire and thermal radiation modelling ........................................................ 20

2.4

Explosion modelling..................................................................................... 22

2.4.1 2.4.2 2.4.3

Simple approaches to explosion modelling .......................................................... 23 Software for explosion modelling........................................................................... 23 CFD for explosion modelling .................................................................................. 24

2.5

Smoke and gas ingress modelling.............................................................. 24

2.5.1 2.5.2 2.5.3

Simple approaches to smoke and gas ingress modelling ................................... 25 Software for smoke and gas ingress modelling.................................................... 26 CFD for smoke and gas ingress modelling ........................................................... 27

2.6

Toxicity modelling ........................................................................................ 27

2.6.1 2.6.2 2.6.3

Simple approaches to toxicity modelling .............................................................. 29 Software for toxicity modelling............................................................................... 29 CFD for toxicity modelling....................................................................................... 29

3.0 3.1 3.2 3.3 3.4

Guidance on use of approaches ........................................... 29 General validity ............................................................................................. 29 Uncertainties ................................................................................................. 30 Choosing the right approach for consequence modelling ....................... 30 Geometry modelling for CFD ....................................................................... 31

4.0

Review of data sources ....................................................... 32

5.0

Recommended data sources for further information ............ 32

6.0 6.1 6.2

References .......................................................................... 32 References for Sections ‎2.0 to ‎4.0 .............................................................. 32 References for other data sources.............................................................. 34

©OGP

RADD – Consequence modelling

Abbreviations: BLEVE CFD CHRIS CSTR CV DAL DNV EU FV HSE HVAC IDLH JIP LDx LFL LPG MSDS PDR QRA SLOD SLOT SVP TNO Onderzoek TR UVCE VCE

Boiling Liquid Expanding Vapour Explosion Computational Fluid Dynamics Chemical Hazards Reference Information System Continuous Stirred Tank Reactor Control Volume Design Accidental Load Det Norske Veritas European Union Finite Volume (UK) Health and Safety Executive Heating, Ventilation and Air Conditioning Immediate Danger to Life and Health Joint Industry Project Lethal Dose resulting in fatalities to x% of population Lower Flammable Limit (also known as Lower Explosive Limit, LEL) Liquefied Petroleum Gas Material Safety Data Sheet Porosity, Distributed Resistance Quantitative Risk Assessment (sometimes Analysis) Significant Likelihood of Death Specified Level Of Toxicity Saturated Vapour Pressure Nederlandse Organisatie voor Toegepast Natuurwetenschappelijk (Netherlands Organization for Applied Scientific Research) Temporary Refuge Unconfined Vapour Cloud Explosion Vapour Cloud Explosion

©OGP

RADD – Consequence modelling

1.0

Scope and Definitions

Consequence modelling refers to the calculation or estimation of numerical values (or graphical representations of these) that describe the credible physical outcomes of loss of containment scenarios involving flammable, explosive and toxic materials with respect to their potential impact on people, assets, or safety functions. This datasheet presents (Section 2.0) recommended approaches to consequence modelling for accidental releases of hazardous materials, with the potential to cause harm to people, damage to assets and impairment of safety functions, from offshore and onshore installations. Consideration of environmental impacts is excluded, although the recommended approaches to release modelling (in particular for liquids) may be applied to estimate potential quantities of hydrocarbon spilt. This datasheet is not intended to be a textbook of consequence modelling theory but rather to indicate the consequence phenomena that need to be considered and to provide guidance on modelling that is fit for purpose.

2.0

Summary of Recommended Approaches

This section addresses the following consequences of a loss of containment incident: 1. Release (discharge) 2. Dispersion in air and water 3. Fire and thermal radiation 4. Explosion 5. Smoke and gas ingress 6. Toxicity Figure 2.1 illustrates and develops the relationship between many of these. For each topic, guidance is given on some or all of the following possible approaches: •

Simple correlations or formulae

•

General purpose consequence modelling software (see below)

•

CFD (Computational Fluid Dynamics – see below)

Whichever approach is adopted, it should be used with an understanding of its range of validity, its limitations, the input data required, the valid results that can be obtained, the results’ sensitivity to the different input data, and how the results can be verified.

©OGP

1

RADD – Consequence modelling

Figure 2.1 Consequence Phenom ena and their Interrelationship

General Purpose Consequence Modelling Software The main commercial general purpose consequence modelling packages are: •

CANARY, from Quest (http://www.questconsult.com/canary.html)

•

EFFECTS, from TNO (www.tno.nl/content.cfm?context=markten&content=product&laag1=186&laag2=267 &item_id=739)

•

PHAST, from DNV (http://www.dnv.com/services/software/products/safeti/SafetiHazardAnalysis/index.a sp)

•

TRACE, from Safer Systems (www.safersystem.com)

These model most of the consequences set out above apart from smoke. However, they are designed for onshore studies and not all of the models included will be appropriate for offshore use, in particular in enclosed modules. The sections below give guidance on the appropriate use of these models. In addition, there are freeware packages that can be downloaded for the internet but these do not come with any training or support, or with any guarantee of code quality; 2

©OGP

RADD – Consequence modelling

the commercial packages listed above do include these and come from reputable organizations with quality management systems. In addition, freeware “calculators” may be found for specific consequences (e.g. BLEVE) but these suffer the same disadvantages listed above for general consequence modelling. Com putational Fluid Dynam ics Computational Fluid Dynamics (CFD) can be used to obtain numerical solutions for ventilation, dispersion and explosion problems for both offshore platforms and onshore plants. CFD simulations are becoming increasingly common as the computing power of standard desktop computers grows. The NORSOK standard Z-013 [21] specifies use of CFD in its probabilistic approach to explosion risk assessment. The objective of the probabilistic assessment is to generate realistic (representative) overpressures for an area based on probabilistic arguments. Ventilation, gas leaks, dispersion as well as gas explosions are considered by establishing probable explosion scenarios, performing explosion simulations and establishing probability of exceedance curves. The application of CFD for gas explosion studies is common for offshore platforms and is increasingly used onshore in cases where the explosion risk is significant and a better description of the physics is required in order to give a more robust estimate of the risk. CFD simulations essentially solve the conservation equations for mass, momentum and enthalpy in addition to the equations for concentration and flammable gas effects. The equations are generally closed using the κ−ε turbulence model. Most of the commercially available CFD packages (see below) are based on the Finite Volume (FV) method which uses an integral form of the conservation equations. Essentially, the solution domain is subdivided into a number of control volumes (CV) at the centroid of which lies a computational node where the variable values are calculated. The conservation equations are applied to each CV and interpolation is used to express variable values at the CV surface in terms of the centre values. The most widely used commercially available CFD packages are: •

AutoReaGas, from Century Dynamics (http://www.ansys.com/Products/autoreagas.asp)

•

CFX, from ANSYS, Inc. (http://www.ansys.com/products/cfx.asp)

•

FLUENT, now also from ANSYS, Inc. (http://www.fluent.com/)

•

EXSIM, from EXSIM Consultants AS (http://www.exsim-consultants.com/)

•

FLACS, from GexCon (http://www.gexcon.com/index.php?src=flacs/overview.html)

•

Kameleon FireEx, from ComputIT (http://www.computit.no/)

2.1

Release modelling

Release modelling – also called discharge or source term modelling – is mainly used to determine the rate at which a fluid is released to the environment in a loss of containment incident, together with the associated physical properties (e.g. temperature, momentum). A simple approach is to calculate the initial rate and to assume that this is constant over time. This is often used for studies of onshore facilities, especially where the offsite risk is the motivation for the study.

©OGP

3

RADD – Consequence modelling

A more sophisticated approach is to model the time dependence of the release rate. This is often used for studies of offshore facilities, where the time dependence has a significant impact on the likelihood, in particular, of the initial event escalating. The modelling required is more complex but avoids certain issues that arise when initial rate modelling is used: •

Initial rate modelling can lead to over-prediction of the flammable/explosive mass in a vapour cloud

•

Initial rate modelling can lead to over-prediction of the size of a jet fire over time but under-predict its duration or the time for which it exceeds a critical length (e.g. to other equipment)

•

Initial rate modelling can lead to over-prediction of the impact of toxic gas or smoke effects

In general, time dependence should be explicitly modelled in offshore studies, where the impacts over relatively short distances (tens of metres) and over time periods up to the required endurance times of the TR (Temporary Refuge) and other safety functions, which may be of the order of 1 hour, are of concern. Time dependence is less often modelled in onshore studies, where the impacts over relatively long distances (hundreds of metres to a few kilometres) and over time periods up to that required for effective emergency action to commence. An exception to this is the modelling of cross-country pipeline ruptures, for which time dependence may be important. 2.1.1

Simple approaches to release modelling

Where gas or non-flashing liquid would be released from an orifice, simple formulae exist to calculate the initial rate, in particular Bernoulli’s equation for liquids (strictly, incompressible fluids). Some example release rates are shown in Figure 2.2, Figure 2.3 and Figure 2.4 for selected representative materials. These were obtained using DNV’s PHAST software. Equations for modelling time-varying releases of gas, including blowdown, are given in the CMPT Guide to quantitative risk assessment for offshore installations [1]. This also includes a simple method for calculating the flash fraction of a liquid such as unstabilized crude. Modelling releases from ruptured pipelines is rather more complex as the pipeline pressure decreases away from the release point over time and so the flow rate decreases with time, especially for gases. It is therefore normal to use software tools for discharge modelling.

4

©OGP

RADD – Consequence modelling

Figure 2.2 Release Rates for Natural Gas at 20°C

Figure 2.3 Release Rates for Propane at 20°C

Note: at 1 barg and 5 barg the releases are vapour; at higher pressures they are two-phase.

©OGP

5

RADD – Consequence modelling

Figure 2.4 Release Rates for Kerosene-type Liquid at 20°C (density = 714 kg/m 3 )

2.1.2

Software for release modelling

There is a range of software tools available that include release modelling. As with all software, its range of validity and limitations need to be understood. For example, the thermodynamics of mixtures may be modelled by an “average” equivalent pure component. However, as computer power increases, this limitation is increasingly being eliminated in favour of full multicomponent thermodynamics. Software can model some or all of the following: •

Time-dependent releases, including inflow, isolation and blowdown

•

Flashing liquid releases −

Releases that flash in the atmosphere as they are released

−

Releases from vessels containing liquid that flashes as the pressure decreases

•

Releases from vessels of different shapes and orientations

•

Releases from long pipelines

These models are generally appropriate for use onshore and offshore. When the fluid after release is two-phase, the modelling needs to predict the liquid droplet size so that the amount of liquid that rains out (falls to the ground or water surface) can be calculated as part of the dispersion modelling (Section 2.2). SPT Group’s OLGA software (http://www.sptgroup.com/products/olga) can be used to model time dependent releases from pipeline networks and includes multiphase flow capability. It should be noted that a release from a high pressure reservoir will normally be quite complex with sonic flow, expansion and compression shocks. In safety studies, this

6

©OGP

RADD – Consequence modelling

complex outflow is often not calculated and the boundary conditions for the jet are given at surrounding pressure. Both the specified momentum and the temperature (density) of this jet may be important for the dispersion simulation and thereby the resulting gas cloud size. Often this boundary condition is specified as pure gas at sonic velocity at surrounding pressure or lower. This is not conserving momentum and should not be used when momentum is important for dispersion. 2.1.3

Modelling Releases from Buried Pipelines

Following a full bore rupture there will be flow from both sides of the break. The consequences of a full bore rupture of a buried pipeline can be modelled as follows: 1. Initial high flow rate: consider immediate ignition as a fireball, using mass released up to the time when this mass equals the fireball mass giving the same fireball duration. 2. Ensuing lower flow rate(s): model dispersion and delayed ignition with low momentum (velocity) as the flows from both sides of the break are likely to interact. The following figure illustrates a possible simplification into quadrants of release directions for a leak from a buried pipeline. The text beside suggests an approach to modelling these for medium and large leaks, based on these having sufficient force to throw out the overburden (and even concrete slabs, if placed on top). 1. Vertical release. Model as vertical release (upwards) without modification of normal discharge modelling output, i.e. full discharge velocity. 2, 3. Horizontal release. Model at angle of 45° upwards with velocity of 70 m/s. 4. Downward release. Model as vertical release (upwards) with low (e.g. 5 m/s) velocity to reflect loss of momentum on impact with ground beneath.

For small horizontal or downward leaks, the force exerted by the flow is unlikely to throw out the overburden, hence the flow will only slowly percolate to the surface. The following approach is suggested for all release directions: •

Calculate discharge rate as normal.

•

Remodel release with a very low pipeline pressure (1 barg for operating pressure >10 barg, 0.1 barg for operating pressure < 10 barg), to simulate diffusion through the soil, with the hole size modified to obtain the same discharge rate as above.

2.2

Dispersion and ventilation modelling

Dispersion modelling is used to determine how the fluid released spreads in the environment: usually air but also water1. •

Onshore, dispersion is usually modelled for releases into the open air

•

Offshore, modelling dispersion within an enclosed module is usually required; modelling underwater releases (e.g. pipeline and flowline failures) is often also needed.

1

Dispersion in soil is considered in environmental rather than safety risk studies and is outside the scope of this datasheet. ©OGP

7

RADD – Consequence modelling

When a release is in the open air, several mechanisms may cause it to disperse. These are illustrated in Figure 2.5. Not all releases go through all phases. A gas release on an offshore platform may go directly from turbulent jet to passvie dispersion. A release from a stack may be passive from the stack tip. The vapour in a release of refrigerated LPG will be dense from the start. Figure 2.5 Mechanism s of Atm ospheric Dispersion of Vapour

A vapour release inside an enclosed volume (a module of an offshore installation or a building onshore) will mix with the air flowing through the volume. On offshore facilities with enclosed modules, what is required for fire and explosion calculations is first of all the size of the flammable/explosive cloud within the module. Onshore, the vapour cloud may emerge from a vent or stack, already partially diluted, and then disperse in the environment. When the release is wholly or partially liquid, typically this will fall onto a solid surface or through a grated deck to the sea below; on a solid surface it will spread out to form a pool. At the same time, some of this liquid may vaporize, adding to any vapour in the initial release, and will disperse in the atmosphere, as illustrated in Figure 2.6. Dispersion modelling thus frequently has to be able to model all of these phenomena, in addition to addressing the different mechanisms of atmospheric dispersion. The

8

©OGP

RADD – Consequence modelling

relationship between many of these phenomena and mechanisms is illustrated in Figure 2.1. Figure 2.6 Pool Vaporisation

2.2.1

Simple approaches to dispersion modelling

Very little dispersion modelling can validly be done using simple formulae. That which can is as follows: 1. Passive (“Gaussian”) dispersion 2. Gas build-up in enclosed volumes −

Using a Continuous Stirred Tank Reactor (CSTR) model, when it is acceptable to assume a uniform concentration throughout the volume (e.g. as source term for a release from a vent or stack, or calculating toxic impact for people indoors)

−

To calculate the quantity of flammable gas, for explosion modelling (see Section 2.4)

3. Oil pool spreading 4. Gas releases subsea. The equations for passive dispersion, 1, can be found in standard texts on atmospheric dispersion. The equations for 2 (CSTR model) and 3 are given in [1]. Two simplified methods have been developed to calculate the quantity of flammable gas in an enclosed volume such as an offshore module (2). Section 4.2.3.1 of [2] presents a simple equation valid when the ventilation flow field is close to uniform. A workbook approach to estimating the flammable volume produced by a gas release [3, 4] has been developed as part of the JIP on Gas Build Up from High Pressure Natural Gas Releases in Naturally Ventilated Offshore Modules, sponsored by 10 operators and the UK HSE. For gas releases subsea (4), a common assumption is that the diameter of the plume at the sea surface is 20% of the water depth at the release point, regardless of the gas flow

©OGP

9

RADD – Consequence modelling

rate. This diameter together with the gas flow rate can then be used as input to a Gaussian plume model. Some example dispersion modelling results (distances to LFL) are given in Figure 2.7 and Figure 2.8. These were obtained using DNV’s PHAST software. Figure 2.7 Dispersion Distances to LFL for Vapour Releases at 20°C

Note: “F1.5” refers to F stability, 1.5 m/s wind speed; “D5” refers to D stability, 5 m/s wind speed.

10

©OGP

RADD – Consequence modelling

Figure 2.8 Dispersion Distances to LFL for Two-Phase Propane Releases at 20°C

Note: “F1.5” refers to F stability, 1.5 m/s wind speed; “D5” refers to D stability, 5 m/s wind speed. 2.2.2

Software for dispersion modelling

Atmospheric dispersion modelling software mainly divides into: •

“Box” models, which calculate vapour cloud dimensions and concentrations from bulk properties.

•

CFD models, which divide the “computational domain” representing the space through which the fluid disperses, into small volume elements where physical properties are calculated explicitly.

In general, plume models do not allow for the influence of terrain, assuming a flat, unobstructed surface. Plume models cannot model well the near field characteristics of dispersion within a congested or confined area such as an offshore module or the middle of a process unit. However, for “far field” (i.e. in open areas) dispersion and when numerous release cases need to be run, plume models are ideal. The software used needs to be selected with an understanding of the phenomena (identified in Section 2.2) likely to occur for the cases being modelled, to ensure that the software can adequately model them. For example: •

A Gaussian plume model would not be appropriate for a gas release under pressure, which will initially disperse as a turbulent jet (see Figure 2.5)

•

For releases of pressurised LPG, rain-out and re-evaporation may need to be modelled.

The results from dispersion modelling need to be examined to ensure they are sensible, i.e. that they match expectations about their behaviour.

©OGP

11

RADD – Consequence modelling

FLOWSTAR, a model developed by CERC (www.cerc.co.uk/software/flowstar.htm) for calculating profiles of the mean airflow and turbulence in the atmospheric boundary layer, can calculate plume trajectory and spread in complex terrain and over variable surface roughness. It is limited to passive dispersion (i.e. it cannot be used when fluid momentum or density is significant) but its ability to model air flow over hilly terrain may be useful. It is part of the widely accepted ADMS (Atmospheric Dispersion Modelling System) suite of programs for air pollution modelling. Other software packages such as CALPUFF and INPUFF are available, which are especially suitable for mid- and far-field applications and for long (> 1 hour duration) releases, however potential users should be aware of their limitations. HGSYSTEM (www.hgsystem.com) is also well known as a freely available set of DOS-based dispersion models. 2.2.3

CFD for ventilation and dispersion modelling

CFD’s main application in dispersion modelling for QRA is in explosion analysis, of which ventilation and dispersion simulations are an important part. In explosion analysis for offshore installations, the objective of the ventilation simulations is to generate a ventilation distribution in terms of rate, direction and probability. Based on this information, representative wind conditions are selected for the dispersion simulations. The NORSOK Z-013 standard [21] recommends that at least 8 wind directions are considered for the ventilation simulations. Only one wind speed is necessary as it is generally assumed that the ventilation rate for a wind direction is proportional to the wind speed so that ventilation rates can be linearly scaled with wind speeds. Also, the number of simulations may be reduced from symmetry considerations. The objective of the dispersion simulations in explosion analysis is to identify credible size, concentration and location of gas clouds and establish how the flammable gas clouds varies with the hazardous leak location, external wind speed and direction and leak direction. Those representative gas clouds are subsequently used in the explosion studies. Generally, the number of parameters that can be varied is high (leak locations/rates/directions, wind conditions) and it is unrealistic to simulate all possible combinations so that a selection must be made. The NORSOK probabilistic approach [21] recommends that at least 3 leak points with 6 jet directions and 1 diffuse leak should be evaluated. At least one of the scenarios needs to consider leak orientation against prevailing ventilation direction. It is, however, possible to reduce the number of dispersion simulations based on symmetry considerations and the physics of the problem. Additionally, not all the identified scenarios (after consideration of symmetry and engineering judgement) need to be simulated. The ‘frozen cloud’ concept can be used to estimate the results of the scenarios not simulated. This is an assumption that gas concentration scales with the leak rate and the inverse of the ventilation. The results from the scenarios not simulated can then be obtained by altering the gas concentration field in all control volumes by a constant factor. It is expected [26] that this assumption will be reasonable in a ventilation dominated region (as opposed to a fuel dominated region).

12

©OGP

RADD – Consequence modelling

Although the NORSOK approach is for offshore installations, a similar approach can be applied to explosion analysis for onshore installations. CFD modelling of ventilation and dispersion is also useful for evaluating optimal geometry layout and location of gas detectors [22,23]. CFD has also found some application in modelling dispersion in complex topography (e.g. along a pipeline route), although it is not cost-effective to use it routinely to model explicitly all scenarios typically represented in a QRA.

2.3

Fire and thermal radiation modelling

Fire modelling is typically used to calculate the flame dimensions for 2 purposes: •

As input to a thermal radiation model

•

To determine whether a flame can reach a target for escalation (e.g. other equipment)

It is important to understand the type of fire that can occur: •

Flash fire – an ignited vapour plume, whose dimensions are typically determined directly from the dispersion modelling as the distance to LFL

•

Jet fire – an intense, highly directional fire resulting from ignition of a vapour or two-phase release with significant momentum

•

Pool fire – from an ignited liquid pool2 or sea surface gas pool resulting from a subsea gas release (e.g. from a pipeline or wellhead) Offshore installations often have grated decks, so a liquid spill will fall through the grating onto the sea surface. If ignited, the resulting sea fire may engulf one or more legs of the installation as well as risers and conductors.

•

Boilover – when a full surface fire occurs in an oil storage tank, heat will slowly conduct downwards to any layer of water in the bottom of the tank; this will then vaporise and the resulting expansion will hurl boiling oil upwards out of the tank.

•

Fireball/BLEVE Strictly, a BLEVE (Boiling Liquid Expanding Vapour Explosion) is simply explosively expanding vapour or two-phase fluid. A BLEVE results from a “hot rupture” of a vessel typically containing hydrocarbons such as LPG3, stored and maintained as a liquid under pressure, due to an impinging or engulfing fire. A flammable material will be ignited immediately upon rupture by the impinging/engulfing fire and will burn as a fireball. A fireball would also result from immediate ignition of a release resulting from cold catastrophic rupture of a pressurised vessel. The initial phase of a gas pipeline rupture should also be modelled as a fireball.

•

Crater Fire – from ignition of a release from a buried pipeline. For vertical and horizontal releases (see Section 2.1.3), the corresponding jet fire can be modelled. For downward releases, the hole size corresponding to the low release velocity can be taken as the diameter of a gas pool burning as a pool fire.

2

Note that it is not the liquid that burns but rather the vapour above it. The heat of the flame vaporises the liquid beneath to provide the fuel supply. 3 BLEVEs of hydrocarbons up to butane or perhaps pentane are credible. A BLEVE of a vessel containing a toxic material such as chlorine stored as a liquid under pressure is also credible and should be considered if relevant. BLEVEs of heavier hydrocarbons such as crude oil or petroleum do not occur. ©OGP

13

RADD – Consequence modelling

An appropriate model for the type of fire that could result from ignition of the release being considered can be selected. This will also depend on the time/location of ignition: for example, for a high momentum vapour release, ignition close to the source will result in a jet fire; ignition at a point away from the source will result in a flash fire or explosion (see Section 2.4), which may also burn back to a jet fire. Whatever model is selected, the following parameters of the flame have to be calculated: •

Flame dimensions

•

Surface emissive power (not for a flash fire)

•

Fireball only: duration (and possibly lift-off)

2.3.1

Simple approaches to fire and thermal radiation modelling

Some simple models for calculating flame dimensions are given in the sub-sections below. Calculation of thermal radiation received by a target (e.g. a person) is not straightforward, although an approximation can be used for a fireball due to its spherical symmetry (see Section 0), and is best done using software. The simple flame size models below are therefore best used either when only the flame dimensions are required or to provide direct input to a flame radiation model. 2.3.1.1 Jet Fire A simple correlation for the length L (m) of a jet flame due to Wertenbach [5]: L = 18.5 Q0.41

[Q = mass release rate (kg/s)]

A generalised formula for different fuel types is [6]: L = 0.00326 (Q Hc)0.478

[Hc = heat of combustion (J/kg)]

Based on calculations using the Chamberlain model [7], the following rough relationships for distance along the flame axis to various thermal radiation levels have been calculated: •

37.5 kW/m2:

13.37 Q0.447

•

12.5 kW/m2:

16.15 Q0.447

•

5.0 kW/m2:

19.50 Q0.447

Some example jet fire thermal radiation results for horizontal releases are presented in Figure 2.9 and Figure 2.10. These were obtained using DNV’s PHAST software, which used the Chamberlain model [7].

14

©OGP

RADD – Consequence modelling

Figure 2.9 Jet Fire Therm al Radiation Distances at Ground Level for Propane Releases at 1 m Elevation

Figure 2.10 Jet Fire Therm al Radiation Distances at Ground Level for Releases at 10 m Elevation

©OGP

15

RADD – Consequence modelling

2.3.1.2 Pool Fire The diameter of an equilibrium pool fire (i.e. where all the fuel is being consumed as it is released) is easily calculated by equating the mass release rate over the pool surface with the burning rate. Burning rates for typical materials are given in Table 2.1. The pool diameter D (m) is given by:

(assuming constant thickness of the pool) Table 2.1 M ass Burning Rates for Selected Materials (29] unless indicated) M aterial Gasoline Kerosene Crude oil Hexane1 Butane LNG LPG

Mass Burning Rate (kg/m 2 s) 0.05 0.06 0.05 0.08 0.08 0.14 on land [30] 0.24 on water [30] 0.11 on land 0.22 on water

Burning velocity (m m /s) 0.07 0.07 0.07 0.11 0.13 0.242 0.422 0.21 0.42

Notes

1. Condensate may be taken as similar to hexane. 2. Calculated from mass burning rate using typical density of 450 kg/m3 Note that a pool fire’s size may be constrained by a bund (dike) or drainage, and also that process areas are often constructed with the floor sloping towards a drain. In both cases, the resulting pool will not be circular. For modelling thermal radiation from the fire, most models assume the pool is circular with the diameter of the fire corresponding to the surface area of the pool. The flame length and tilt angle of a pool fire can be simply calculated using the Thomas correlation [8]. Other models are referred to in [1]. Some example pool fire thermal radiation results are presented in Figure 2.11 and Figure 2.12. These were obtained using DNV’s PHAST software.

16

©OGP

RADD – Consequence modelling

Figure 2.11 Liquid Propane Pool Fire Therm al Radiation Distances at Ground Level

Figure 2.12 Kerosene-type Liquid Pool Fire Therm al Radiation Distances at Ground Level

2

Note: The shape of the curves for 12.5 kW/m is explained by the decreasing flame surface emissive power with increasing pool diameter.

©OGP

17

RADD – Consequence modelling

2.3.1.3 Boilover Boilover can be modelled as a pool fire with: •

Diameter equal to the tank diameter

•

A height of 5 times the tank diameter

•

Flame thermal emissive power = 150 kW/m2

However, a boilover also results in considerable rainout of burning hydrocarbon liquid over a wide area, posing additional risk to people; this may also ignite hydrocarbon vapours above neighbouring tanks. 2.3.1.4 Compartment Fire For a fire inside an enclosed volume such as an offshore module, the fire size and properties (in particular, smoke toxicity) depend on two factors: •

Whether the fire is large enough to impinge on a wall or ceiling

•

Whether the fire is fuel- or ventilation-controlled4.

Figure 2.13 shows a procedure to determine the model required for a gas or 2-phase release. A similar approach can be taken for a liquid release. Lees [9, pp16/286ff] suggests possible approaches and other models for compartment fires. Although written as applying to fires inside buildings, the text can also be applied offshore.

4

In the former case there is an adequate supply of air to ensure complete combustion of the fuel; in the latter case the ventilation is limited and the fuel is not fully combusted. 18

©OGP

RADD – Consequence modelling

Figure 2.13 Procedure for Fire Model Selection (Gas or 2-phase Release)

Note: in a highly confined volume with limited ventilation (e.g. a platform leg), even a small fire may be ventilation controlled.

2.3.1.5 Fireball/BLEVE Several models for fireball duration and diameter have been developed. Most are simple correlations between these quantities and fireball mass5. One model is due to Prugh [10]: Diameter, D (m): D = 6.48 M0.325 Duration, td (s): td = 0.825 M

[M = fireball mass (kg)]

0.26

Height of fireball centre, h (m): h = 0.75 D Surface emissive power, q (kW/m2): [P < 6 MPa; P is vapour pressure (MPa) at which failure occurs.]

5

When the release is two-phase, the fireball may not consume all the liquid. One possible assumption is that the fireball mass is calculated assuming 3 × the adiabatic flash fraction at the burst pressure, constraining this to be ≤ 1.0. ©OGP

19

RADD – Consequence modelling

Radiation received, I (kW/m2): I = q F τ F = view factor: τ

2.3.2

[x = distance (m) along ground] =

transmissivity:

Software for fire and thermal radiation modelling

The software packages listed in Section 2.0 model the fire types listed in Section 2.3, apart from compartment fires. They will model the flame dimensions and orientation, and thence the thermal radiation received. For a compartment fire, if the fire inside the module is a diffusive fire smaller in volume than the module, it can be modelled as a pool fire with the dimensions suggested in Section 2.3.1.4; the surface emissive power can be taken to be the same as that of the unimpinged jet fire. 2.3.3

CFD for fire and thermal radiation modelling

CFD models can be used to determine the fire loading on critical areas on both offshore structures and onshore plants. The Oil and Gas UK guidance [24] provides a state-ofthe-art review of CFD fire modelling. In particular, it is stated that although CFD models provide a more realistic representation of the flow physics, there are uncertainties associated with modelling turbulent flow and combustion as well as in definition of fire source and ambient conditions. Commonly used software for fire modelling include Kameleon FireEx and CFX. Kameleon FireEx is typically used for fire modelling on offshore platforms and onshore plants; CFX is more commonly for low geometry scenarios, e.g. fire and smoke modelling in tunnels. For CFD fire modelling, it may be best to reduce the size of the problem by modelling only a subset of the installation. Otherwise, the run times for the analyses would be very long. The procedure for running the fire analyses can be summarised in the following steps: 1. Define leak size and select realistic leak locations; 2. Select leak directions. Typically, the analyses are run for up to 6 leak directions; 3. Run the fire simulations for different leak rates for each leak location and direction until steady state conditions are reached. Huser [25] describes a probabilistic procedure for the design of process against fires using CFD modelling. The probabilistic assessment provides a Dimensioning Accidental Load (DAL) fire that is used for design of the structure and allows for the development of a consistent methodology (similar to explosion approach) for calculating fire loads. The methodology is illustrated in Figure 2.14.

20

©OGP

RADD – Consequence modelling

Figure 2.14 Probabilistic Procedure for Establishing Dim ensioning Accidental Load (DAL) Fire and Mitigating Measures (from [25])

[25] has shown that for CFD simulations of jet fires the following parameters are important (i.e. resulting in more than 20% variation in the heat loads when all other parameters are kept constant): •

Initial leak rate and leak profile

•

Leak and fire location

©OGP

21

RADD – Consequence modelling •

Jet direction

•

Dynamic development of fire

•

Geometry layout and

•

Deluge

The probabilistic approach can be used to generate a fire exceedance curve from which the DAL fire can be obtained.

2.4

Explosion modelling

For QRA and associated studies, explosions are usually taken to mean vapour cloud explosions (VCEs). However, other types of explosion are possible (see Figure 2.1): •

Condensed phase explosions

•

Dust explosions

•

Runaway reactions

In addition, BLEVEs and vessel bursts generate overpressures that may be significant. However, this section focuses on VCEs. Huge advances in understanding and modelling of VCEs have been made in the last decade since the Spadeadam tests. For offshore, the NORSOK standard Z-013 [11] has established a comprehensive but computationally demanding approach to explosion modelling, requiring use of an advanced CFD tool. Whilst originally developed specifically for platforms in Norwegian waters, this approach is being adopted in other areas of the North Sea. Although CFD models cannot yet be incorporated directly within (offshore) QRAs, output from QRA is increasingly expected to be used in them. Onshore, CFD is less well established in QRA whilst the application of simpler models available in general purpose software is becoming more sophisticated and considered fit for purpose. However, where design or layout decisions may critically depend on explosion risks, use of CFD for specific scenarios would give additional robustness to, and confidence in, the results. Another issue where CFD would assist is where terrain effects are important, for example if a facility is built on a slope or at the foot of a hill: in this case dispersion would be significantly modified compared with that which would result over flat ground. The recent advances in understand of explosions referred to above mean that the previous classification of VCEs as unconfined, semi-confined or confined can now be considered over-simplistic. It would be better to talk about degrees of confinement and congestion6. TNO’s Multi-Energy model [12], discussed further in Section 2.4.2, allows for 10 levels of confinement/congestion, ranging from the equivalent of a UVCE (Unconfined Vapour Cloud Explosion) through to highly confined/ congested volumes such as can be found in a densely packed process area of an onshore plant. In this and similar models, some assessment or assumption needs to be made outside of the model as to the maximum overpressure. In CFD modelling, the distinction between levels of confinement/ congestion disappears since the geometry is defined and the software itself calculates the maximum overpressure.

6

Confinement should be thought of as a solid barrier preventing flame acceleration in a certain direction; congestion as a porous barrier, or set of discrete obstructions, inducing turbulence in the flow and modifying (increasing) flame acceleration in a certain direction. 22

©OGP

RADD – Consequence modelling

2.4.1

Simple approaches to explosion modelling

Historically, simple “TNT equivalence” models have been used for modelling explosion overpressures from unconfined VCEs (UVCE) onshore. However, these require the explosive mass to be calculated: as this is an output from dispersion modelling, manual calculation of explosion overpressures is not likely to be undertaken. Another old approach for onshore QRA [13] calculates the distance to specified levels of damage directly from the explosion energy by a simple correlation. Again, this requires the explosive mass to be calculated. 2.4.2

Software for explosion modelling

2.4.2.1 Onshore explosions General purpose consequence modelling software (see list in Section 2.0) includes either of both of two well established explosion models: the TNO Multi Energy model [12] and the Baker Strehlow or Baker Strehlow Tang model [14]. In the Multi Energy m odel, a vapour cloud is divided into the regions of congestion, or “blast sources”, they may enter and fill (or partially fill). Each of these blast sources is treated independently of the others. The material and the volume of the cloud within the blast source are used to calculate the explosion energy. A confined explosion strength is assigned to the blast source by the analyst: this strength corresponds one of 10 lines on a graph of peak side-on overpressure vs. scaled distance from the source. The 10 lines represent a range of maximum overpressures (at the source) ranging from 0.01 to 13 bar. Selecting the correct confined explosion strength for a given situation (e.g. a specific process unit on a refinery) is far from straightforward, although generally no. 7 or 8 is used for process units. Guidance [15] has been developed to assist this, although even with this it is strongly recommended to call upon experienced personnel to make the assessment. In the Baker Strehlow Tang model the analyst selects instead the material reactivity (high, medium, or low), flame expansion (number of directions in which the flame can expand), obstacle density (high, medium, or low), and ground reflection factor (1 for air burst, 2 for ground burst and hence ground reflection). This has two advantages over the Multi Energy model: •

Materials of different reactivities can be adequately represented

•

Selection of flame expansion and obstacle density is simpler

As in the Multi Energy model, the overpressure vs. scaled distance is a set of curves (in this case 11) that span the range of input selections. These models are appropriate for use in studies of onshore facilities including marine terminals. 2.4.2.2 Offshore explosions For offshore installations, non-CFD software has been used to estimate maximum overpressures in modules using relatively simplified methods that nevertheless take account of the broad features of module geometry. For example, DNV have used their programs COMEX and NVBANG in numerous studies, however these programs are not available commercially and are not recommended for non-specialists in explosion modelling. However, in offshore applications the maximum overpressure itself is usually not used directly in the risk calculations. Rather, it represents the worst case combination of module fill, release location and ignition location. In a real situation, this combination is ©OGP

23

RADD – Consequence modelling

unlikely to be achieved and a lower overpressure will be reached. Of direct concern is the likelihood of an explosion that will result in equipment escalation or breaching of the TR wall, for example. This requires a probabilistic approach to estimate the likelihood of any given explosion overpressure being exceeded at a specific location. This is the approach set out in the NORSOK standard Z-013 [11]. CFD modelling is used to model explosion overpressures for a number of scenarios. The results are then combined with leak frequencies, ignition data and wind probabilities in another software package (e.g. DNV’s EXPRESS) to develop overpressure exceedence probability curves for use in the QRA. The same approach can be used for more specific design problems, for example designing an ESD or deluge system to withstand the drag forces likely to result from an explosion. This approach requires considerable investment of effort to obtain useful and robust results. Previous, more simplified methods have the appearance of being less costly to achieve the same end. However, the initially more costly NORSOK approach [11] can be used to cost-optimise the design of a module for explosions, eliminating the need for excessive and hence costly conservatism (i.e. over-engineering). 2.4.3

CFD for explosion modelling

The representative gas clouds from the CFD dispersion analysis (see Section 2.2.3) can be ignited and explosion analysis carried out. The Oil and Gas UK guidance [24] reports that it is not recommended to use dispersed non-homogeneous and turbulent gas clouds in CFD explosion simulations due to the lack of testing/validation for this application. Instead, an equivalent quiescent stoichiometric gas cloud, that gives similar overpressures to the non-homogeneous and turbulent clouds, has to be calculated. As an example of how this can be done, the FLACS software automatically calculates a parameter (referred to as “Q5”) that converts the non-homogeneous cloud into an equivalent quiescent gas cloud. It should be noted that the duration of the equivalent gas cloud may be shorter than the non-homogeneous one resulting in a difference in the structural response. The explosion simulations should be carried out for various gas cloud sizes and shapes, gas cloud locations and ignition locations. For each gas cloud size, the gas cloud location and ignition location should be varied. In particular, it is important to locate the clouds close to critical and congested areas of equipment and piping. The ignition location will also have a strong impact on the explosion loads. Generally, the CFD analyses are run with two different locations namely ignition location at centre of cloud and at edge of cloud. Depending on the geometry and layout, edge ignition will sometimes produce the higher (than central ignition) explosion overpressures due to the increased flame distance. Results in terms of explosion overpressures can be output at monitor points at predefined locations and drag forces can be obtained for design of critical equipment and piping.

2.5

Smoke and gas ingress modelling

Modelling of smoke and gas ingress to the TR or living quarters usually forms part of an offshore QRA and could also be used in onshore studies. More generally, modelling of smoke generation and dispersion can be useful to determine the likelihood of escape routes being impaired or of people out-of-doors being overcome by smoke. Smoke and gas ingress modelling has up to 4 stages: Source Term → Dispersion → Ingress → Effects

24

©OGP

RADD – Consequence modelling

The source term comes from the release rate modelling (Section 2.1): directly for gas and from suitable ratios of (mass of smoke) / (mass of hydrocarbon released). Dispersion can be modelled as suggested in Section 2.2. Since smoke’s largest constituent is nitrogen (i.e. the unburnt part of the air involved in combustion), one approach used has been to model the smoke as hot, dense nitrogen, giving it a molecular weight and temperature equal to those estimated for the combustion gases. However, the high temperature invariably results in a rapidly rising smoke plume that doesn’t match experience. For example, photographs of smoke from the Piper Alpha disaster show the plume travelling almost horizontally. One possible reason is that the soot particles in the smoke increase the plume’s density. Hence this approach is not recommended for 3D results. However, it may be used to determine the smoke concentration at a given distance horizontally from the release point, assuming as a worst case that this is the centreline concentration. 2.5.1

Simple approaches to smoke and gas ingress modelling

The CMPT Guide to quantitative risk assessment for offshore installations [1] provides data and references on smoke generation, composition, dispersion, visibility reduction, ingress to TR and impact. A series of linked models has been used in offshore QRAs for BP and other operators: •

Smoke generation: −

Composition from [16]: see Table 2.2

−

Depends on fuel (light = gas, heavy = condensate/oil)

−

Depends on whether fire is fuel-controlled, ventilation-controlled or in between these. Table 2.2 Sm oke Com position Data Fire Area Type

Component

Fuel Type* Light Heavy a) Fuel Controlled Carbon Monoxide (ppm) 400 800 Carbon Dioxide (%) 10.9 11.8 Oxygen (%) 0 0 Smoke Temperature (°C) 1,000 1,000 Particulates (dB/m) 15 47 b) Ventilation Controlled Carbon Monoxide (ppm) 30,000 31,000 Carbon Dioxide (%) 8.2 9.2 Oxygen (%) 0 0 Smoke Temperature (°C) 600 600 Particulates (dB/m) 29 70 * The light composition is used for gas jet fires. The heavy composition is used for condensate fires.

Dispersion: based on a dilution factor, which is a function of fuel burn rate and of distance from source (does not take into account wind speed or the presence of barriers). •

Figure 2.15 shows dilution factors, based on calculations using FLACS [17], for different release rates.

•

Smoke Ingress:

©OGP

25

RADD – Consequence modelling −

CO and CO2 build-up in the module are calculated using a CSTR model, taking as input the smoke concentration immediately outside the TR and the TR’s ventilation rate

−

The CO2 concentration calculation also includes exhaled CO2 from personnel inside

−

The internal temperature is also calculated based on heat generated by TR occupants Figure 2.15 Sm oke Dilution Factors

•

Smoke effects/toxicity −

Based on dose relationships given in [18]

−

Considers toxicity of CO; effects of CO2, lack of oxygen and high air temperature; visibility reduction

For gas ingress a set of dilution factors is used, equivalent to but different from those used for smoke. A CSTR model is used for gas ingress, and fatalities in the TR are assumed to occur if the gas concentration exceeds 60% of LFL. 2.5.2

Software for smoke and gas ingress modelling

For smoke dispersion in the open, general purpose consequence modelling software such as the packages listed in Section 2.0 is sometimes used. However, the validity of this approach and its superiority to the simple approach described in Section 2.5.1 are uncertain. For smoke and gas build-up within modules, multizone models such as COMIS can be used. Multizone modelling involves solving mass balance equations for the flow between different zones, thus allowing for partitioning due to smoke barriers, walls between rooms, etc. Multizone models were developed primarily to predict airflow in buildings, but they are also capable of predicting the transient transport of

26

©OGP

RADD – Consequence modelling

contaminants such as smoke. The method is applied by considering a building as being divided into a number of zones (typically rooms) that are physically separated from one another. As with the CSTR model, each zone is treated as fully mixed. The rate at which air flows between zones is governed by the pressure difference and the modelled connection (i.e. doors, ducts etc.) between the rooms. Multizone models have some of the characteristics of both CFD and the CSTR model; conceptually the approach lies between the two in terms of resolution and complexity. 2.5.3

CFD for smoke and gas ingress modelling

CFD modelling can be used to provide a detailed prediction of the smoke distribution in TR or living quarters. The effect of heat sources due to people and computing equipment can be included in the analysis. However, smoke modelling using CFD can be quite difficult due to the variability and uncertainty in the boundary conditions [26]. A recent article by O’Donnell et. al. [27] provides a comparison of different approaches to smoke modelling namely the CSTR model, a multizone model and a CFD model. CFX and Kameleon FireEx can be used to carry out detailed CFD smoke modelling. The smoke and gas dilution factors used in the models described in Section 2.5.1 were determined using FLACS, a CFD package. This or another CFD package could be used directly to model smoke dispersion from a source in the same way as described in Section 2.2.3 for gas dispersion modelling in general. However, the approach described in Section 2.5.1 has generally been accepted as fit for purpose in QRAs. CFD is more likely to be useful in design, for example in locating HVAC air intakes to minimise the likelihood of smoke ingress. Although best practice is to place them on the TR face away from potential smoke sources (i.e. fires), flow around bluff bodies results in zones of recirculation and hence of enhanced smoke concentration.

2.6

Toxicity modelling

The toxic effects of a material may be acute (resulting from accidental exposure to a high concentration over a short period of time) or chronic (resulting from continuous exposure to a lower concentration over a long period of time, as a result of routine emissions or a small, undetected leak). Different toxic materials have different physiological effects: they may inhibit respiration (causing asphyxiation) through inhalation, they may affect the central nervous system, they may be ingested or absorbed through the skin. For the purposes of this datasheet, the discussion is limited to acute effects and it is not necessary to consider the nature of the physiological effects. The discussion addresses toxicity on the basis of dose-response relationships (see below). Offshore, besides smoke (as discussed in Section 2.5), toxic modelling is usually limited to the effects of sour gas, i.e. H2S. Onshore, besides H2S (in onshore hydrocarbon production, transport and processing), other toxic materials are potentially of concern. Toxic consequences are invariably bound up with toxic effects: that is, a model for toxicity is a model for lethality or lesser effects. Toxicity data is typically encountered in two forms when required for QRA: specified concentrations such as the IDLH (Immediate Danger to Life and Health), or concentration-lethality levels for different species such as rats. Such data can be found in Material Safety Data Sheets (MSDS) or online reference sources such as CHRIS www.chrismanual.com.

©OGP

27

RADD – Consequence modelling

For QRA, a dose-response relationship is often used that relates the lethality to the dose received at a point. At its simplest, the dose is given by (concentration × time), assuming the concentration remains constant over time. However, for many materials, the effect of concentration is magnified and, for concentration C and exposure time t, the relevant dose A is given by:

Note that the exponent n is not necessarily an integer. In its regulatory work the UK HSE (e.g. 19] uses two values of A: •

SLOT (Specified Level Of Toxicity) Dangerous Toxic Load: the dose that results in highly susceptible people being killed and a substantial portion of the exposed population requiring medical attention and severe distress to the remainder exposed. It represents the dose that will result in the onset of fatality for an exposed population (commonly referred to as LD1 or LD1-5)

•

SLOD (Significant Likelihood Of Death): is defined as the dose to typically result in 50% fatality (LD50) of an exposed population and is the value typically used for group risk of death calculation onshore.

Values of the SLOT and SLOD for selected materials are given in Table 2.3. As can be seen in the final column, values of “n” for these materials range from 1 to 4. Table 2.3 SLOT & SLOD Values for Selected Materials Substance Ammonia

SLOT 8 3.78 × 10

Carbon monoxide

40125

Chlorine Hydrogen sulphide

1.08 × 10 12 2.0 × 10

Sulphur dioxide

4.66 × 10

Hydrogen fluoride Oxides of nitrogen

SLOD 9 1.09 × 10

“n” 2

57000

1

5

4.84 × 10 13 1.5 × 10

5

2 4

6

7.45 × 10

7

2

41000 5 6.24 × 10

1 2

12000 96000

Note: these values are based on concentration in ppm, time in minutes.

As stated above, the LD50 is often used in risk calculations. The HSE’s approach allows for calculation of the LD50 for any exposure duration. The most sophisticated approach to determining toxicity adopts the same approach to calculating the dose but allows the lethality to be calculated for any given concentration and duration of exposure. This is the “probit”. A probit value Pr is calculated (for a constant release rate and hence concentration7) as:

where “a”, “b” and “n” are all material specific constants (“n” is the same as above). These constants have been published for many commonly encountered materials in a number of sources [e.g. 9,20]. A table relating lethalities to probits can be found in many places e.g. [9].

7

n

For a time varying release rate and hence concentration, the (C t) can be replaced by an integral over time. 28

©OGP

RADD – Consequence modelling

2.6.1

Simple approaches to toxicity modelling

The toxic dose should always be calculated using the relationship discussed in the text preceding this sub-section. It therefore requires results from dispersion modelling (Section 2.2) together with the exposure time. Calculation of the LD50 using the HSE approach described in the text preceding this sub-section is recommended as the best simple approach and will be sufficient for many purposes. 2.6.2

Software for toxicity modelling

The software listed in Section 2.0 will calculate probits for toxic materials and thence the lethality level as a function of distance from the release point or as contours of different lethalities overlaid on a plan or map. In this way the lethality at any point can be determined for a given wind direction. 2.6.3

CFD for toxicity modelling

CFD will provide as output the concentration at any point. This could be used together with a SLOT/SLOD value or probit to calculate lethality at that point. Contour plots of toxic lethality are not available from CFD software but could probably be generated from tabular output.

3.0

Guidance on use of approaches

3.1

General validity

The approaches described in Section 2.0 are based on published sources that are widely known and accepted. All modelling of physical phenomena is imperfect. Any use of software must be within the limitations set out for the software, and even then the analyst must carry out a reality check on the results. For example: a jet fire model applied to a large, high pressure gas release will predict a jet flame several hundreds of metres long; the analyst must consider whether this is credible, or whether the flame will impinge on an obstruction within this distance. Depending on the application, a simple model may be fit for purpose, or detailed modelling (e.g. using CFD) may be required. Whilst it may be considered desirable to use CFD as much as possible, the resources (time, trained personnel, and budget) required to use it effectively are rarely available; hence it is usually used to address specific problems or to provide results for a limited set of scenarios that can be applied or extrapolated to all the scenarios being modelled in a QRA. In the early stages of design, the detailed design information required for CFD to give accurate predictions of overpressures is not available and hence decisions based on CFD results may result in under-design for the potential overpressures.

©OGP

29

RADD – Consequence modelling

3.2

Uncertainties

All modelling suffers from uncertainties. For a given set of input (initial) conditions, it is unlikely exactly to match the physical outcome that would result in reality from the same initial conditions. Indeed, numerous physical realisations of the same release would give different results, whereas consequence modelling software gives the same result each time8. Sources of uncertainty in consequence modelling for QRA include the following: •

A QRA only models a limited range of cases, so the conditions of an actual release are unlikely to match exactly any of the cases modelled in a QRA

•

Ambient conditions (wind speed, wind direction) do not stay constant over the duration of a release as is modelled

•

Box models for dispersion, and models of equivalent complexity for other phenomena, cannot deal with solid or porous barriers (buildings, process units, bund walls, etc.)

•

CFD cannot model sub grid scale turbulence (see Section 0)

3.3

Choosing the right approach for consequence modelling

As set out in Section 2.0, whilst simple models are available for some consequences, and a range of numerical results for some consequences are given there, some consequence modelling requires the use of either general purpose or CFD software. To decide which is the best approach it is necessary to decide: •

What is the scope of the study?

•

What is the required depth of the study?

•

How many release scenarios will be modelled?

•

Who will carry out the study?

•

Will the analysis need to be updated in the future, or the results interrogated? If so, who will do this?

If the scope is a full, detailed QRA, then most or all of the 6 steps described in Section 2.0 will need to be undertaken. This means that the output from one step of the analysis will become the input to the next step, and it is important to make the links between the steps as straightforward and robust as possible. This in turn suggests that general purpose consequence modelling software where the transitions from one model to the next are automated is preferable to using a mixture of models from different sources (perhaps with some implemented in spreadsheets, others coded). However, in this case the automated transitions may be “black box”-like and so the analyst needs to understand fully how these work to ensure that the results represent physical reality. (For example, that a modelled jet fire is a credible outcome.) If a coarse QRA of a simple installation is to be undertaken, a simpler approach may be acceptable. This could use the correlations given or referred to in Section 2.0, or the consequence results presented in that section.

8

Monte Carlo modelling could be used to vary slightly the input parameters but this does not appear to be done routinely. Another type of dispersion modelling, “random walk modelling”, likewise does not appear to be used for QRA. 30

©OGP

RADD – Consequence modelling

For a QRA of an offshore installation with enclosed modules, use of CFD for explosion modelling is now routinely used. For a new installation, it will almost certainly have to be used in order to design for explosions. For an existing installation, explosion modelling predating the Blast and Fire Engineering for Topside Structures JIP will probably have been revised using CFD. Thus it is likely that the necessary CFD modelling will have been done, or at least that the geometry model has been built and it will be relatively straightforward to obtain any additional results required. For QRAs of onshore installations, use of the TNO Multi Energy Model or the Baker Strehlow Tang model (see Section 2.4.2.1) is strongly recommended over use of earlier VCE models. For problems of a more limited nature, in particular decisions about significant investment in relation to fire or explosion and especially in relation to offshore structures, it is advisable to use CFD in order to maximise the robustness of the analysis and the confidence in the results. CFD modelling requires considerable experience and expertise to use effectively. It is rare for a risk analyst skilled in all aspects of QRA to possess the required degree of specialist expertise. CFD analysis should therefore be assigned or contracted to personnel with the required expertise.

3.4

Geometry modelling for CFD

Generally, the numerical grid in CFD models is not fine enough to resolve the smaller items of equipment and pipe work which are responsible for a large part of the turbulence generated during an explosion. Most of the software (FLACS, EXSIM, AutoReaGas) uses a so-called distributed porosity concept (Porosity, Distributed Resistance (PDR) model) to account for the objects which cannot be represented by the grid. The porosity model is used to calculate the turbulence source terms due to those small items and the flame speed enhancement arising from flame folding in the sub grid wake. Explosion relief panels and yielding walls can also be represented by modifying the porosity in the region where they occur. It is important that all the geometric details are properly represented in a CFD model due to their importance in pressure build-up. The particular areas where gas explosion analyses are carried out must be modelled with a high degree of accuracy. In the early design stages, no detailed description of the geometry exists and this may pose a problem with regard overpressure prediction. There are two ways in which this problem can be circumvented namely by applying a factor for equipment growth to account and by adding anticipated congestion to obtain final expected object density and distribution. The Oil and Gas UK guidance [24] reports on a detailed investigation of a typical North Sea integrated deck platform which showed that, for good prediction of overpressures, definition of all major equipment, boundaries (decks, TR), all piping with diameters > 0.2 m, and primary/ secondary structures with cross-section dimensions > 0.13 m is required. In addition, it is important to define the CFD grid to extend quite a large distance from the area of interest to avoid too strong influence from open boundaries.

©OGP

31

RADD – Consequence modelling

4.0

Review of data sources

Key general sources for suitable consequence modelling methods are the Guide to quantitative risk assessment for offshore installations [1] and Lees’ Loss Prevention in the Process Industries [9]. These have been supplemented by more specific published papers and books as listed in Section 6.1: all of these are believed to have found wide acceptance in the QRA community including with regulatory authorities. The general purpose software packages listed in Section 2.0 are all commercially available. Validation data for them, if required, should be sought from the software providers. The EU SMEDIS project [28] in particular has compared the leading dispersion models with results from experimental measurements. The basis of the suggested approach to modelling releases from buried pipelines (Section 2.1.3) is confidential work carried out by DNV on behalf of clients (personal communication). No published methodology has been found. The basis of the suggested approach to modelling boilover (Section 2.3.1.3) is the Dyfed Fire Brigade video of the Amoco Milford Haven refinery tank fire. The flames from the boilover reached a height of 3000 feet, or about 10 times the tank diameter; however, they were not continuous or constant to this height over a typical period of interest, and were partly obscured by smoke. Hence a height of 5 times tank diameter appears reasonable. For explosion modelling, FLACS and AutoReaGas have been extensively validated against experimental data, in particular from the Phase 2 and Phase 3 JIP Blast and Fire Engineering for Topside Structures experiments carried out at Spadeadam and elsewhere. FLACS is also currently being validated for hydrogen as part of the EU HySafe programme. Details of FLACS and AutoReaGas validation are available on their respective websites (see Section 2.0).

5.0

Recommended data sources for further information

For further information, the data sources referenced in Sections 2.0 to 4.0 should be consulted. Some additional references are given in Section 6.2. On the subject of subsea releases, two major reports 32], [33] were published in 2007 and 2008 and should be consulted if detailed information is required (i.e. if subsea releases appear to pose a significant risk).

6.0

References

6.1

References for Sections 2.0 to 4.0

1. Spouge, J, 1999. A guide to quantitative risk assessment for offshore installations, CMPT publication no. 99/100, ISBN 978-1-870553-36-0 / 1 870553 36 5. Now available from the Energy Institute www.energyinst.org.uk. 2. Czujko, J (ed.), 2001. Design of Offshore Facilities to Resist Gas Explosion Hazard Engineering Handbook, Sandvika: CorrOcean ASA. 3. BP Amoco, CERC and BG Technology, 2000. Workbook on Gas Accumulation in a Confined and Congested Area, Joint Industry Project Gas Build Up from High Pressure Natural Gas Releases in Naturally Ventilated Offshore Modules. [Believed to be available only to sponsors but summarised in the following reference.] 4. Cleaver, R P and Britter, R E, 2001. A Workbook Approach to Estimating the Flammable Volume Produced by a Gas Cloud, Paper R416, FABIG Newsletter: Issue 30, 5-7.

32

©OGP

RADD – Consequence modelling

5. Wertenbach, H G, 1971. Spread of Flames on Cylindrical Tanks for Hydrocarbon Fluids, Gas and Erdgas 112. 6. API, 1982. Guide for Pressure Relieving and Depressuring Systems, American Petroleum Institute, Recommended Practice RP 521, 2nd ed. 7. Chamberlain, G A, 1987. Developments in Design Methods for Predicting Thermal Radiation from Flares, Chem Eng Res Des 65. 8. Thomas, P H, 1963. The Size of Flames from Natural Fires, 9th Intl. Combustion Symposium, Combs Inst. Pittsburgh, PA, pp.844-859. 9. 2005. Lees’ Loss Prevention in the Process Industries, 3rd. ed., Mannan, S, ed., Oxford: Elsevier Butterworth – Heinemann. 10. Prugh, R W, 1994. Quantitative evaluation of fireball hazards, Process Safety Progress 13(2), 83-91. 11. Procedure for probabilistic explosion simulation, NORSOK Standard Z-013 Rev.2 Annex G. 12. TNO 1997. Methods for the calculation of physical effects due to releases of hazardous materials (liquids and gases) [the “Yellow Book”], eds: van den Bosch, C J H and Weterings, R A P M, Chapter 5: Vapor Cloud Explosions, Mercx, W P M and van den Berg, A C. 13. TNO 1979. Methods for the Calculation of the Physical Effects of the Escape of Dangerous Material, [the “Yellow Book”], Chapter 4: Vapour Cloud Explosions, Wiekema, B J. 14. Tang, M J, and Baker, Q A, 1999. A New Set of Blast Curves from Vapour Cloud Explosion, Proc. Safety Progress 18(4), 235-240. 15. Mercx, W P M et al., 1998. Application of correlations to quantify the source strength of vapour cloud explosions in realistic situations. Final report for the project: ‘GAMES’, HSE and TNO, http://www.hse.gov.uk/research/crr_pdf/2001/crr01318.pdf. 16. SINTEF 1992. Handbook for Fire Calculations and Fire Risk Assessment in the Process Industry. 17. FLACS, V8 (version 8), 2003, see www.gexcon.com. 18. Purser, D, 1992. Toxic Effects of Fire Cases, Conf. on Offshore Fire and Smoke Hazards, Aberdeen. 19. HSE 2006. Indicative Human Vulnerability to the Hazardous Agents Present Offshore for Application in Risk Assessment Of Major Accidents, SPC/Tech/OSD/30. http://www.hse.gov.uk/foi/internalops/hid/spc/spctosd30.pdf. 20. CPD 1992. Methods for the determination of possible damage to people and objects resulting from releases of hazardous materials [the”Green Book”], Committee for the Prevention of Disasters caused by Dangerous Substances / TNO, The Hague: Directorate-General of Labour of the Ministry of Social Affairs and Employment. 21. Norwegian Technology Centre, 2001. Risk and Emergency preparedness analysis, NORSOK Z-013, http://www.standard.no/imaker.exe?id=1503.# 22. Huser, A., Oliveira, L F, Rasmussen, O, and Dries, J V D, 2002. Explosion risks in large and widespread process areas, ERA Conference, November. 23. Huser, A, Oliveira, L F, and Dalheim, J, 2004. Cost optimisations of gas detector systems, Proc. OMAE04, 23rd International Conference on Offshore Mechanics and Arctic Engineering, June.

©OGP

33

RADD – Consequence modelling

24. Oil and Gas UK & HSE, 2007. Fire and Explosion Guidance, publication no. EHS24. Available from Oil and Gas UK http://www.ukooa.co.uk/ukooa/. 25. Huser, A, 2006. Probabilistic procedure for design of process areas against fires, FABIG Newsletter 44. Available from FABIG www.fabig.com. 26. Talberg, O, Hansen, O R, Bakke, J R, and Wingerden, K. Application of a CFD-based probabilistic explosion risk assessment to a gas-handling plant, conference paper available from CMR-Gexcon http://www.gexcon.com/download/ERA_00-Paper.pdf. 27. O’Donnell, K, Deevy, M, and Garrard, A, 2007. Assessment of mathematical models for prediction of smoke ingress and movement in offshore installations, FABIG Newsletter 48. Available from FABIG www.fabig.com. 28. Daish, N C, Britter, R E, Linden, P F, Jagger, S F, and Carissimo, B, 1999. Scientific Model Evaluation techniques applied to dense gas dispersion models in complex situations, Intl Conf. on Modelling the Consequences of Accidental Releases of Hazardous Materials, CCPS, San Francisco, California, September 28 – October 1. 29. Mudan, K S, and Croce, P A, 1988. Fire Hazard Calculations for Large Open Hydrocarbon Fires, Fire Protection Engineering, Section 2 Chapter 4, Society of Fire Protection Engineers, National Fire Protection Association. 30. Cleaver P, & Johnson, M, 2004. LNG Behaviour, Fire and Blast Issues related to LNG, FABIG Technical Review Meeting, London & Aberdeen, October 6 – 7.

6.2

References for other data sources

31. CCPS 1994. Guidelines for Evaluating the Characteristics of Vapour Cloud Explosions, Flash Fires and BLEVES, New York: American Institute of Chemical Engineers. 32. Fanneløp, T K, and Bettelini, M, 2007. Very Large Deep-Set Bubble Plumes From Broken Gas Pipelines, Report No. 6201, Project No. 99B43, Petroleum Safety Authority Norway. 33. Tveit, O J, and Huser, A, 2008. Risiko knyttet til gassutslipp under vann. Videreføring 2007, Spredning over havet, Petroleum Safety Authority Norway.

34

©OGP

Risk Assessment Data Directory Report No. 434 – 8 March 2010

Mechanical lifting failures International Association of Oil & Gas Producers

RADD – Mechanical lifting failures

Contents: 1.0 1.1 1.2

Introduction .......................................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0

Summary of Recommended Data ............................................ 1

3.0 3.1 3.2 3.3 3.4 3.5

Guidance on use of data ........................................................ 3 General validity ............................................................................................... 3 Uncertainties ................................................................................................... 3 Use of the Data................................................................................................ 4 Consequence Analysis of Objects Dropped Into the Sea........................... 4 Kinetic energy ................................................................................................. 6

4.0

Review of data sources ......................................................... 7

5.0

References ............................................................................ 8

©OGP

RADD – Mechanical lifting failures

Abbreviations: BOP DNV HSE QRA UKCS WOAD

Blowout Preventer Det Norske Veritas (UK) Health and Safety Executive Quantitative Risk Assessment (sometimes Analysis) United Kingdom Continental Shelf World Offshore Accident Databank

©OGP

RADD – Mechanical lifting failures

1.0

Introduction

1.1

Application

This datasheet presents information on the frequency of dropped objects resulting from the failure of lifting devices on offshore installations. Specifically it includes dropped load frequencies for the following types of lifting equipment: 1. Main cranes 2. Drilling derrick 3. Other devices The data are derived from offshore operating experience in the UKCS over the period 1980 to 1999. The data are intended to be applied in quantifying the risks from lifting operations worldwide. Consideration should be given to factoring the data up or down where there is reasonable justification that the management of lifting operations is significantly poorer or safer that UKCS operations.

1.2

Definitions

•

Dropped loads

Refers to loads (objects) either unintentionally released from a lifting device or else swinging and impacting some part of the installation structure (or vessel, if the lift is to/from a vessel).

•

Lifting devices

Main crane, derrick main hoisting assembly, and other lifting devices (see below).

•

Other lifting devices

BOP cranes, gantry cranes, tuggers, and a range of portable devices, e.g winches, sling blocks, wirelines.

•

Mobile Installations

The data for mobile installations are gathered almost entirely from experience in the operation of mobile offshore drilling units (MODUs). These include semi-submersibles, jackups, and drill ships.

•

Fixed Installations

The data for fixed installations are gathered from a range of types of production installation ranging from integrated platforms to wellhead platforms. The data also include experience from FPSOs (floating production, storage and offloading vessels) and FSUs (floating storage units).

“Main cranes” and “drilling derrick” referred to in Section 1.0 are considered self explanatory.

2.0

Summary of Recommended Data

Dropped object probabilities per lift on offshore installations are tabulated below for mobile installations and fixed installations, for different load weights and by lifting device (main crane, drilling derrick, or other device). The data represent the probability of a dropped object per lift. Estimation of the dropped object frequency combines the probability of a dropped object per lift with the number of lifts carried out (for example, per year if the annual risk is required). Note that, for drops from the main crane, in general the frequency in the Total column is not the sum of the Installation, Sea and Vessel drop frequencies in the same row because not all main crane lifts are between vessel and installation (some are across ©OGP

1

RADD – Mechanical lifting failures

the installation). Each frequency in the Total column is calculated from the total number of lifts, whereas the Sea and Vessel frequencies are calculated from the number of external lifts (between installation and vessel) only. Of the reported events on which the probabilities tabulated below are based, 10% of dropped objects on mobile installations and 20% of dropped objects on fixed installations resulted in all or part of the lifting device falling (see Section 1.2 above for the definition of “lifting device”). Dropped Object Probabilities for Mobile Units (per lift) Load Weight 100 te

All

Total

2

Lifting device

Installatio n

Drop Onto: Sea

Total Vessel

Main crane

3.2 × 10

-5

8.8 × 10

-6

1.1 × 10

-5

4.1 × 10

-5

Drilling Derrick Other Device

1.7 × 10

-5

7.3 × 10

-7

6.1 × 10

-8

1.8 × 10

-5

8.6 × 10

-5

1.1 × 10

-5

9.7 × 10

-5

Main crane

3.1 × 10

-6

2.0 × 10

-6

5.4 × 10

-6

Drilling Derrick

3.6 × 10

-6

4.6 × 10

-7

0*

4.0 × 10

-6

Other Device

7.6 × 10

-6

2.9 × 10

-6

0*

1.1 × 10

-5

Main crane

1.2 × 10

-5

7.1 × 10

-6

2.0 × 10

-5

Drilling Derrick

1.8 × 10

-6

0*

0*

1.8 × 10

-6

Other Device

1.9 × 10

-6

0*

0*

1.9 × 10

-6

Main crane

2.8 × 10

-4

0*

0*

2.8 × 10

-4

Drilling Derrick Other Device

4.7 × 10

-3

1.4 × 10

-3

0*

6.1 × 10

-3

4.9 × 10

-4

2.4 × 10

-4

0*

7.3 × 10

-4

Main crane

8.5 × 10

-6

3.3 × 10

-6

4.6 × 10

-6

1.2 × 10

-5

Drilling Derrick

1.1 × 10

-5

6.7 × 10

-7

3.0 × 10

-8

1.1 × 10

-5

Other Device

4.5 × 10

-5

6.5 × 10

-6

5.2 × 10

-5

All

1.2 × 10

-5

1.4 × 10

-6

1.4 × 10

-5

©OGP

0* 3.0 × 10

9.5 × 10

-6

-6

0* 9.4 × 10

-7

RADD – Mechanical lifting failures

Dropped Object Probabilities for Fixed Installations (per lift) Load Weight 100 te

Lifting device

Drop Onto: Installatio n

Total •

Vessel

Main crane

3.8 × 10

-5

6.9 × 10

-6

1.1 × 10

-5

4.5 × 10

-5

Drilling Derrick

1.7 × 10

-5

1.2 × 10

-7

1.2 × 10

-7

1.7 × 10

-5

Other Device

1.0 × 10

-4

4.2 × 10

-6

6.1 × 10

-7

1.0 × 10

-4

Main crane

4.7 × 10

-6

1.7 × 10

-6

5.1 × 10

-6

7.9 × 10

-6

Drilling Derrick Other Device

2.7 × 10

-6

1.5 × 10

-7

2.9 × 10

-6

1.4 × 10

-5

Main crane

1.0 × 10

-5

Drilling Derrick

1.2 × 10

-6

0*

Other Device

2.6 × 10

-5

Main crane

9.3 × 10

-5

Drilling Derrick All

Sea

Total

0*

0* 7.4 × 10

-7

1.5 × 10

-5

1.6 × 10

-5

2.0 × 10

-5

0*

1.2 × 10

-6

0*

0*

2.6 × 10

-5

0*

0*

9.3 × 10

-5

0*

0*

0

0*

0*

6.1 × 10

-4

0* 6.2 × 10

-6

Other Device

6.1 × 10

-4

Main crane

1.0 × 10

-5

2.8 × 10

-6

6.4 × 10

-6

1.5 × 10

-5

Drilling Derrick Other Device

9.6 × 10

-6

1.2 × 10

-7

6.1 × 10

-8

9.7 × 10

-6

5.7 × 10

-5

2.0 × 10

-6

5.8 × 10

-7

6.0 × 10

-5

All

1.4 × 10

-5

8.8 × 10

-7

1.6 × 10

-6

1.6 × 10

-5

In both of the above tables, either there are no recorded incidents, or the incident is not credible. If the analyst believes it is credible, then a suitable frequency could be obtained by pro rating a non-zero frequency, e.g. using the “All” frequencies.

3.0

Guidance on use of data

3.1

General validity

The frequencies given are based on analysis of offshore lifting operations on the UK continental shelf (see Section 4.0). They may be applied to lifting operations in other offshore regions which comply with recognised industry good practice, as it is applied in the UKCS. The data for dropped objects from derricks may be applied to onshore drilling operations where these are similar to offshore drilling activities and equipment. The data for dropped objects from main cranes and other lifting devices are not applicable to onshore lifting operations because the equipment used is unlikely to be similar to that used offshore.

3.2

Uncertainties

Sources of uncertainties in the data include statistical variation and the similarity between the operations and equipment under analysis and those represented by the database.

©OGP

3

RADD – Mechanical lifting failures

The calculated frequencies are derived from 1637 dropped object events in a total experience of 3063 installation-years. This implies a total of about 111 million lifting operations. For fixed platforms there were 690 dropped objects in 1857 platform years, for mobile installations 947 events in 1206 installation-years experience. Therefore the statistical uncertainty in the overall frequencies is relatively small. Some of the specific risks are calculated from the experience of a small number of representative dropped object accidents and correspondingly the uncertainty in the risk will be more significant. The risks with the higher uncertainty are those with the lower likelihoods shown in Section 2.0. The data in the database reflect lifting equipment in operation in the UKCS. While there is a degree of variation in the equipment used in the UKCS, it is similar in that the vast majority is maintained and operated in accordance with international certification and UK legal requirements. Competence requirements for operations and maintenance personnel are generally enforced, and all operations are conducted in accordance with documented procedures reflecting good industry practice. Where operations outside the UK can be assumed to follow a similar standard of operation and maintenance, it is reasonable to assume the data are valid for assessment of the dropped object risks.

3.3

Use of the Data

The dropped object probability values are an input to QRA and are used to calculate the frequency of the initiating event for dropped object risks. The consequence of dropped objects depends on the impact energy and the people, equipment and structures impacted by the objects dropped. For an object falling through air, the impact energy is calculated as the product of the mass of the object, the height and acceleration due to gravity (≈ 10 m/s2). Generally, people struck by falling objects can be assumed to be fatally injured, and objects striking hydrocarbon equipment will cause a hydrocarbon release. Damage to structures or other equipment struck by dropped objects may require a specific assessment of the resistance of the object impacted and/or the potential for a release from live equipment struck. However, incidents involving hydrocarbon releases are already included in the hydrocarbon release frequencies, so such an assessment is only recommended where the analyst identifies a particular vulnerability to dropped objects, or a stand-alone dropped objects study is being carried out. When using dropped object risks in a total risk assessment for a facility, the risks to people from dropped objects may also be included in the statistical data on occupational accidents. Where this is the case, it is appropriate to disregard the calculated dropped object risk for immediate fatalities. In the event of a dropped object, the lifting equipment will be out of service until the incident can be investigated and any repair can be implemented. An operational risk assessment should take account of this. Even for minor dropped objects with no apparent damage, equipment downtime will be of the order of several days. In the event of a fatality or major equipment damage, the equipment is likely to be out of service for several weeks.

3.4

Consequence Analysis of Objects Dropped Into the Sea

The calculation of the consequences of objects dropped into the sea is more complex. For heavy lifts (e.g. BOP or xmas tree) over the sea it is standard practice that these are not carried out over vulnerable subsea equipment. Thus care is required in assessing

4

©OGP

RADD – Mechanical lifting failures

whether a dropped BOP or other heavy load can cause damage to subsea equipment or if the precautions carried out are adequate. For other lifts, the following approach can be followed to calculate locations at risk from dropped object impact. Heavy, dense objects (such as BOPs) can be assumed to fall vertically and will damage any infrastructure immediately beneath the drop site. Some other objects, such as pipe sections and scaffolding poles, may travel a significant horizontal distance through the water as they descend. The following model is taken from a DNV Recommended Practice [4]. The analysis assumes that the excursion made by a dropped object can be represented by a normal distribution:

where x is the horizontal excursion and δ the standard deviation. The standard deviation is sensitive to the weight and shape of the object, and the water depth (d). The derivation of δ is given by: Here α is the spread in the descent angle given in Table 3.1. Table 3.1 Calculation of Descent Angles Case

Object Shape Description

Weight (tonnes)

1 2

Flat/long shaped

3 4 5

Box/round shaped

6 7

Box/round shaped

Descent Angle Spread (deg)

8

5

8

3

>> 8

2

The probability that the object lands within a horizontal distance, r, of the drop point is given by the equation:

When considering object excursion in deep water the spreading of long/flat objects, cases no. 1 to 3, will increase down to a depth of approximately 180 m. Below this depth spreading does not increase significantly and may conservatively be set to be vertical. For a riser, any vertical sections will complicate the hit calculations. One way of calculating the probability of hit to a riser is to: 1. Split the riser into different sections (normally into vertical section(s) and horizontal section(s)), and 2. Calculate the hit probability of these sections at the respective water depths. The final probability is then found as the sum of all the probabilities for the different sections. The effect of currents will become more pronounced in deep water. The time for an object to hit the seabed will increase as the depth increases. This means that any

©OGP

5

RADD – Mechanical lifting failures

current may increase the excursion (in one direction). At 1000 m depth the excursion is found to increase 10 to 25 metres for an average current velocity of 0.25 m/s and up to 200 m for a current of 1.0 m/s. The effect of currents may be included if one dominant current direction can be identified. This may be applicable for rig operations for shorter periods, for example during drilling, completion and intervention/construction above subsea wells. However, for a dropped object assessment on a fixed platform, seasonal changes in current directions may be difficult to incorporate. When establishing a "safe distance" away from activities the effect of currents should be included. A conservative object excursion should be determined, including consideration of the drift of the objects before sinking, uncertainties in the navigation of anchor handling vessel, etc.

3.5

Kinetic energy

A dropped object from a crane and hitting the topsides will have a kinetic (impact) energy Ek given by: Ek = m.g.h where: Ek m g h

= kinetic energy at impact (J) = mass of the object (kg) = gravitation acceleration (9.81 m/s2) = height from release point to point of impact (m)

The maximum impact force depends on the object itself and the orientation when hitting, and can be found from structural collapse calculations. The impact resistance of structures can be found from deterministic structural strength calculations. The kinetic energy of a dropped object on subsea installations depends on the velocity through the water, the shape of the object and the mass in water. After approximately 50 - 100 metres, a sinking object will usually have reached its terminal velocity. The terminal velocity is found when the object is in balance with respect to gravitation forces, displaced volume and flow resistance. When the object has reached this balance, it falls with a constant velocity, its terminal velocity. This can be expressed by the following equation:

where: m g V ρwater CD A vT

= mass of the object (kg) = gravitation acceleration (9.81 m/s2) = volume of the object (the volume of the displaced water) (m3) = density of water (typically 1025 kg/m3 for the North Sea) = drag coefficient of the object = projected area of the object in the flow-direction (m2) = terminal velocity through the water (m/s)

The kinetic energy of the object, ET, at the terminal velocity is:

Combining these to equations gives the following expression for the terminal energy:

6

©OGP

RADD – Mechanical lifting failures

In addition to the terminal energy, the kinetic energy that is effective in an impact, EE, includes the energy of added hydrodynamic mass, EA. The added mass may become significant for large volume objects such as containers. The effective impact energy becomes:

where ma is the added mass (kg). Tubulars are assumed to be waterfilled unless it is documented that the closure is sufficiently effective during the initial impact with the surface, and that it will continue to stay close in the sea. Intact, sealed containers may not sink at all. The drag and added mass coefficients are dependent of the geometry of the object. The drag coefficients will affect the objects terminal velocity, while the added mass only has influence as the object hit something and is brought to a stop. Table 3.2 gives typical values of these coefficients. Table 3.2 Drag and Added Mass Coefficients Object Case (as Table 3.1) 1,2,3 4,5,6,7 All

Description Slender shape Box shaped Misc. shapes (spherical to complex)

Cd

Cm

0.7 - 1.5 1.2 - 1.3 0.6 - 2.0

0.1 - 1.0 0.6 - 1.5 1.0 - 2.0

It is recommended that a value of 1.0 is initially used for Cd, after which the effect of a revised drag coefficient should be evaluated. Small equipment items (fittings, scaffolding clamps, etc.) are unlikely to do any damage to subsea equipment if they fall into the sea.

4.0

Review of data sources

The recommended probabilities of dropped objects presented in Section 2.0 have been calculated by combining recorded incidents of dropped objects from the WOAD [1] and the UK HSE’s ORION databases with data on the number of lifts carried out. The incidents have been analysed by DNV and full reports are available in HSE research reports [2] and [3]. The numbers of lifts per year for mobile installations (Table 4.1) are based on observed data collected for DNV by a drilling contractor. The number of lifts per year on fixed installations (Table 4.2) are estimated by interpretation of the data on mobile installations combined with reasonable assumptions and consequently should be treated with more caution. The numbers of “installation years” represented by the ORION and WOAD data are provided by the HSE from primary records. The experience data for mobile installations were collected over the period 1980 to 1998; those for fixed installations were collected over the period 1991 to 1999. Of the main crane lifts, 46% were to or from a supply vessel and 54% were across the installation. Of the lifts to and from supply vessels, 75% were of containers, baskets and tanks; the remainder were casing, drillpipe, collars, etc.

©OGP

7

RADD – Mechanical lifting failures

Table 4.1 Observed Frequencies of Lifting Operations on Mobile Installations Lifting Device Main Crane Drilling Derrick Other Lifting Device Total

Lifts per Year 24,480 28,670 3,650 56,800

Table 4.2 Calculated Frequencies of Lifts using Main Crane on Fixed Installations (per year) Type of installation Fixed (no drilling) Fixed (drilling for 6 months / year) Wellhead platform

Lifts to / from Vessels 5520 8400

Internal Lifts

552

867

8,674 10,937

The UK HSE has also published accident data for more recent period up to and including 2004/2005 [5, 6. 7] These data have not been subjected to the same detailed statistical analysis as the data presented in this report and for this reason the more recent experience is not included here. However a review of the data over the period 1980 to 2005 shows that although there is considerable variation from year to year, the average frequency of dropped objects per installation-year remains approximately constant. This is consistent with the observation that the technology and lifting procedures used on offshore installations have not changed to any great extent over the period the data were collected.

5.0

References

1. DNV, 2006. WOAD, Worldwide Offshore Accident Databank, version 5.0.1. 2. DNV, 1999. Accident statistics for mobile offshore units on the UK continental shelf in 1980-98, HSE Offshore Technology Report OTO 2000/091 / DNV Report No. 99-2490. 3. DNV, 2002. Accident statistics for fixed offshore units on the UK Continental Shelf 19911999, HSE Offshore Technology Report OTO 2002/012. 4. DNV, 2002. Risk Assessment of Pipeline Protection, Recommended Practice No. DNVRP-F107 (amended). 5. HSE, 2006. Offshore Injury, Ill Health and Incident Statistics 2004/2005 (provisional data), HID Statistical Report HSR 2005 001. 6. HSE, 2005. Accident statistics for Floating Offshore Units on the UK Continental Shelf 1980-2003, Research Report 353, prepared by Det Norske Veritas for the Health and Safety Executive. 7. HSE, 2005. Accident statistics for Fixed Offshore Units on the UK Continental Shelf 1980 – 2003, Research Report 349, prepared by Det Norske Veritas for the Health and Safety Executive.

8

©OGP

Risk Assessment Data Directory Report No. 434 – 9 March 2010

Land transport accident statistics International Association of Oil & Gas Producers

RADD – Land transport accident statistics

contents 1.0

Scope and Application ........................................................... 1

2.0 2.1 2.2

Summary of Recommended Data ............................................ 1 Road and rail users......................................................................................... 1 Dangerous Goods Transport ......................................................................... 4

3.0 3.1 3.2

Guidance on use of data ........................................................ 5 General validity ............................................................................................... 5 Uncertainties ................................................................................................... 5

3.2.1 3.2.2

Road and Rail User Casualty Frequencies .............................................................. 5 DG Transport .............................................................................................................. 5

3.3

Application of frequencies to specific locations ......................................... 5

3.3.1 3.3.2

Road and Rail Transport............................................................................................ 6 Dangerous Goods Transport .................................................................................... 6

4.0 4.1

Review of data sources ......................................................... 7 Basis of data presented ................................................................................. 7

4.1.1 4.1.2 4.1.3

Road Transport........................................................................................................... 7 Rail Transport ............................................................................................................. 8 Dangerous Goods Transport .................................................................................. 10

4.2

Other data sources ....................................................................................... 10

4.2.1 4.2.2 4.2.3

Road Transport......................................................................................................... 10 Rail Transport ........................................................................................................... 11 Dangerous Goods Transport .................................................................................. 11

5.0

Recommended data sources for further information ............ 12

6.0

References .......................................................................... 12

©OGP

RADD – Land transport accident statistics

Abbreviations: ACDS BLEVE DfT DG DNV ECMT E&P ERA EU FEMA FRA GB HGV IRF KSI LGV LPG mm OECD OG&P ORR QRA RSSB UIC UK US(A) (V) km

Advisory Committee on Dangerous Substances Boiling Liquid Expanding Vapour Explosion Department for Transport Dangerous Goods Det Norske Veritas European Conference of Ministers of Transport Exploration and Production European Railway Agency European Union Federal Emergency Management Agency Federal Railroad Administration Great Britain Heavy Goods Vehicle International Road Federation Killed or Seriously Injured Light Goods Vehicle Liquefied Petroleum Gas millimetre Organisation for Economic Co-operation and Development Oil and Gas Producers Office of Rail Regulation Quantitative Risk Assessment Rail Safety and Standards Board International Union of Railways United Kingdom United States (of America) (Vehicle) kilometre

©OGP

RADD – Land transport accident statistics

1.0

Scope and Application

This datasheet provides information on land transport accident statistics for use in Quantitative Risk Assessment (QRA). The datasheet includes guidelines for the use of the recommended data and a review of the sources of the data. Most of the data concern motor vehicles and rail transport, although some data for cyclists are also presented. Data excludes pedestrians; if this is needed local data will need to be examined. The data in this sheet are intended for two main uses: •

Assessing the risk of transporting personnel; data relating to the frequency of fatalities and serious injuries to road and rail users are presented.

•

Assessing the risks of transporting Dangerous Goods (DG); data on the frequency of releases of hazardous materials from rail and road tankers are presented.

In the sections below the following definitions are used: •

Seriously Injured: Any person not killed, but who sustained an injury as result of an accident, normally needing medical treatment.

•

Killed: Any person killed immediately or dying within 30 days as a result of an accident.

•

Road Injury Accident: Any accident involving at least one road vehicle in motion on a public road or private road to which the public has right of access, resulting in at least one injured or killed person.

2.0

Summary of Recommended Data

It is best to try and obtain local data where possible. In the absence of local data the following data can be used.

2.1

Road and rail users

The recommended frequencies and associated data are presented as follows: •

Road user (Table 2.1, Table 2.2, and Table 2.3)

•

Rail user (Table 2.4)

©OGP

1

RADD – Land transport accident statistics

Table 2.1 Road Accident Fatality and Injury Rates, Selected Countries, All Vehicles All Rates in deaths or injuries per 10 9 vehicle kilom etres Country

Year

Traffic Volume 9 10 vehicle kilometres

Frequency of Accidents Resulting in Injury 9 per 10 vehicle kilometres

Injury Rate 9 per 10 vehicle kilometres

Fatality Rate 9 per 10 vehicle kilometres

Europe Austria 2004 47.8 892.0 1168.0 18.4 Belgium 2004 93.5 520.5 673.7 12.4 Denmark 2005 45.5 118.9 144.7 7.3 Estonia 2005 8.1 288.1 366.6 20.8 Finland 2005 51.6 136.0 174.0 7.3 France 2005 547.6 154.3 197.2 9.7 Latvia 2005 10.2 439.2 550.7 43.5 Lithuania 2005 8.5 796.1 995.4 90.7 Romania 2004 67.9 101.1 82.4 35.6 Slovenia 2005 11.1 928.4 1289.1 23.2 Sweden 2005 73.8 245.3 358.7 6.0 Switzerland 2005 59.9 362.6 446.9 6.8 Turkey 2005 61.1 8732.2 2520.8 74.0 United Kingdom 2005 493.5 402.7 549.2 6.5 Africa Egypt, Arab Rep. 2004 28.7 72.5 264.9 46.0 Ghana 2001 15.3 1022.9 472.5* 81.1 Senegal 2000 4.0 1497.9 1114.6* 161.0 South Africa 2005 123.4 1067.9 1597.5 116.0 America Colombia 2004 15.6 14696.9 351.6 Mexico 2005 91.0 323.9 354.7 51.8 United States 2005 4794.3 386.8 563.0 9.1 Asia/ Middle East Armenia 2005 0.4 2978.4 4027.2 703.7 Bahrain 2002 5.3 308.9 540.0 15.2 China, HK 2005 10.8 1392.8 1763.3 14.0 Israel 2005 41.1 413.5 863.5 10.9 Japan 2004 781.7 1218.1 10.9 Korea, Rep. 2005 314.9 680.1 1086.8 20.2 Kyrgyz Republic 2005 10.2 365.4 449.3 87.8 Mongolia 2002 2.3 2897.3 2148.8* 178.8 Singapore 2005 13.8 486.6 596.8 12.6 Ukraine 2005 14.0 3319.7 3999.1 516.3 Oceania New Zealand 2005 40.6 266.1 355.8 9.9 * These appear to be incorrect values as the injury rate should be higher than the injury accident rate in the previous column.

2

©OGP

RADD – Land transport accident statistics

Table 2.2 Recom m ended Road Accident Fatality/Injury Rates: Rates by Road Class, Road User Type, Injury Severity All Rates in deaths or injuries per 10 9 vehicle kilom etres Road User

Pedal Cycle Motor Cycle Car Bus or Coach LGV HGV All Vehicles

Urban roads

Rural Roads

Motorways

All Roads

Death

Seriou s Injury

Death

Seriou s Injury

Death

Seriou s Injury

Death

Seriou s Injury

24 65 2 4 11 11 3

490 1220 28 110 6 11 51

58 200 7 3 1 2 8

520 1220 44 29 11 17 52

51 2 41 1 1 2

300 9 11 5 7 10

32 120 4 4 1 1 5

500 1140 31 75 8 12 44

In some circumstances a QRA may require road user casualty rates in different units which take more account of the specific numbers of passengers being transported. Thus Table 2.3 presents recommended road user casualty rates per billion passenger kilometres. Table 2.3 Recom m ended Road Accident Fatality/Injury Rates: Rates by Road User Type, Injury Severity All Rates in deaths or injuries per 10 9 passenger kilom etres Road User Pedal Cycle Motor Cycle Car Bus or Coach LGV/ HGV

Death 36 111 2.7 0.3

KSI* 684 1360 31 11

0.9

11

* KSI = Killed or Seriously Injured

The values in Tables 2.2 and 2.3 are based on UK data and considered representative of developed countries with good road safety records. The values from Table 2.1 can be used to generate appropriate modification factors for the rates in Tables 2.2 and 2.3 when applied in different countries. Clearly in any specific situation there will be a number of factors which will influence accident rates such as driver experience, age, etc. No data has been found which could represent these influences explicitly. Table 2.4 Recom m ended Rail Accident Fatality/Injury Rates All Rates in deaths or injuries per billion passenger kilom etres Vehicle Type Rail

1

Death 0.4

Injury 15

See footnote 3 on page 7 for explanation of data derivation ©OGP

3

RADD – Land transport accident statistics

These rail accident data are considered representative of developed countries. In less developed parts of the world the accident rates may be larger, but no data sources have been found to enable them to be quantified.

2.2

Dangerous Goods Transport

The data below refers to releases while in transit, not during loading or unloading. Table 2.5 Recom m ended Rail Tanker Release Frequencies TANKER TYPE

TANK SHELL PUNCTURE (per loaded tank wagon km)

EQUIPMENT LEAK (per loaded tank wagon hour)

-8

-10 8.3 × 10

-9

1.3 × 10

-9

-10

3.1 × 10

-9

Motor spirit LPG

6.3 × 10 -9 2.5 × 10

Ammonia

2.5 × 10

Chlorine

9.0 × 10

90% of the punctures are taken to be 50 mm diameter holes, the remaining 10% catastrophic ruptures. The lower chlorine release frequencies are due to higher level of engineering controls, and possibly safer procedural controls related to handling and route management. Data on the causal breakdown of the release frequencies is not available; both internal causes and causes external to the tanker are reflected in the overall frequencies. Table 2.6 Recom m ended Flam m able Liquid Road Tanker Release Frequencies SPILL SIZE

RELEASE FREQUENCY (per loaded vehicle km)

5 - 15 kg 15 - 150 kg 150 - 1500 kg > 1500 kg TOTAL

6.0 × 10 -8 2.6 × 10 -9 7.0 × 10 -8 2.1 × 10 -8 6.0 × 10

-9

Table 2.7 Recom m ended LPG Road Tanker Release Frequencies (not cylinders) FAILURE CASE

RELEASE FREQUENCY (per loaded vehicle km)

BLEVE Cold rupture* Large* liquid space leak Large* vapour space leak

-12

2.7 × 10 -9 2.6 × 10 -8 1.8 × 10 -9 2.1 × 10

* Rupture modelled as instantaneous release and large leak modelled as 50 mm diameter hole

4

©OGP

RADD – Land transport accident statistics

3.0

Guidance on use of data

3.1

General validity

If transport risk is a relatively small contribution to an overall risk study, the data above may be sufficient. However, if transport risk is the object of the study, local data become very important. As discussed below in Section 3.3, it is strongly recommended that local data sources on accidents and transport risk are obtained. This is because there can be large local variations. In recommending the data in Tables 2.5 to 2.7 on DG transport, there is an implicit assumption that tanker equipment is built to recognised international standards and operated in line with relevant national DG regulations.

3.2

Uncertainties

3.2.1

Road and Rail User Casualty Frequencies

Due to the relatively large number of road traffic casualties (see Table 4.1 below), the statistical uncertainties associated with the values in Table 2.2 and Table 2.3 are small compared to the variations between countries. In contrast, national statistics for rail passenger fatalities are generally very low. However, low frequency but high consequence events can have a very large effect on average passenger risk levels. Thus it is important to consider data over a reasonably long time period. The data from Table 2.4 are based on British data 1996-2005 which includes a number of major rail accidents; thus it is considered to be representative with respect to such events. Uncertainties for road and rail user casualty rates will be dominated by local variations. Even within geographically close countries, such as within the EU, variations can be large (see Section 4.0). A further source of transport uncertainty arises from use of frequency units (e.g. per vehicle km or per passenger km). The relative risk of various transport modes can be highly dependent on the frequency units adopted. Thus, it is recommended that any conclusions are tested for their sensitivity to units (see Table 2.2 and Table 2.3). 3.2.2

DG Transport

The frequency of releases of hazardous material during transport is much lower than the frequency of road traffic accidents. Hence the statistical uncertainty will be larger, similar to typical major hazard QRA uncertainties. In addition, these frequencies will be influenced by local variations in road and rail accident rates. Thus, local data should be obtained wherever practicable.

3.3

Application of frequencies to specific locations

This datasheet contains global data plus more detailed national data. When using these data, it should be realised that they may not be directly applicable to the specific location under study. It is therefore strongly recommended that local data sources on accidents and transport risk from governmental or other national or regional institutions are obtained before using the data given in this sheet. Should these local data not be accessible, or their reliability/applicability be uncertain, then the data in this data sheet could be used after factoring for local circumstances.

©OGP

5

RADD – Land transport accident statistics

However, data which have been adjusted to allow for local circumstances should always be used with caution. 3.3.1

Road and Rail Transport

In assessing the risks of personnel transport the following steps are recommended: 1. Obtain local data if practicable. 2. If not, use the data in Tables 2.1 to 2.4. For road risks the casualty frequencies can be adjusted for location using the factors suggested in Section 2.0 and presented in more detail in Section 4.0 below. Some location specific data for rail are also presented in Section 4.0, but it is unclear if the variations are real or are a feature of definitions and reporting criteria. 3. Analyse the proposed personnel journey patterns in terms of vehicle types, road types, vehicle kilometres and/ or passenger kilometres (for rail only passenger kilometres are required). 4. Multiply the frequencies from steps 1 or 2 with the journey pattern data in step 3 to obtain overall personnel transport risks. Conduct sensitivity tests using the different units in Table 2.2 and Table 2.3 (if relevant) and alternative data sources discussed in section 4.02. Example: estimate the fatality rate per year for an operation involving 30 personnel being transported 4 times a month by bus/ coach along 300km of m otorway grade road in North Africa. Assuming local data specific to this type of operation are not available steps 2 to 4 are illustrated below. •

From Table 2.2 for bus/coach the fatality rate is 4 × 10-9 per vehicle-km. This is based on UK data. From Table 2.1 the overall fatality rates in Egypt are 7.1 times greater than UK. This is taken as an appropriate multiplication factor. Thus the fatality rate is 28.4 × 10-9 per vehicle-km.

•

Based on the example information above the number of vehicle-kms per year is 300 × 4 × 12 = 14,400.

•

Thus the annual predicted fatality rate would be 28.4 × 10-9 × 14,400 = 4.1 × 10-4. Using the data from Table 2.3 which gives a fatality rate per passenger-km gives a fatality rate per year of 9.2 × 10-4.

3.3.2

Dangerous Goods Transport

In assessing the recommended:

DG

transport

release

frequencies

the

following

steps

are

1. Obtain local data if practicable. 2. If not, use the data in Tables 2.5 to 2.7 and adjust the release frequencies for location using fault tree analysis, expert judgements (e.g. based on relative transport accident rates), or other appropriate methods. 3. Analyse the proposed DG transport patterns in terms of transport mode (rail/ road), wagon/ vehicle kilometres, loaded tanker hours, etc.

2

While there is uncertainty concerning the location variations in the rail data, as noted above, the location specific data may be used in sensitivity testing. 6

©OGP

RADD – Land transport accident statistics

4. Multiply the frequencies from steps 1 or 2 with the DG transport data in step 3 to obtain overall release frequencies. Example: Estimate the frequency per year of large vapour space leaks in an LPG operation that involves 5 tankers operating each 7 times a week on a 200km route fully loaded. Assuming local data specific to this type of operation are not available steps 2 to 4 are illustrated below. •

From Table 2.7 the large vapour space leak frequency is 2.1 × 10-9 per loaded vehicle-km. Assume that expert judgement concludes that this frequency is appropriate.

•

Based on the example information above the number of loaded vehicle-kms per year is 5 × 7 × 52 × 200 = 364,000.

•

Thus the estimated annual leak frequency is 2.1 × 10-9 × 364,000 = 7.6 × 10-4.

4.0

Review of data sources

4.1

Basis of data presented

4.1.1

Road Transport

Table 2.1 is based on the International Road Federation’s (IRF) 2007 report [10]. For all countries except Turkey, the most recent year’s data presented in this report is taken as representative and presented in Table 2.1 (2005 data for Turkey appears to have an error in the injury rate). This report also provides accident rates per 100,000 head of population for a wider range of countries. The data in this table can be compared for trends to the data in the previous Technical Note for E&P Forum which used the IRF’s 1994 report [3]. Table 2.2 and Table 2.3 are based on British data from the Department for Transport’s 2006 report [1]3. Table 4.1 shows the number of fatalities per vehicle type for 2006 on which the casualty rates are based. Table 4.1 GB Num bers of Fatalities 2006: Num bers by Road User Type & Severity Road User Pedal Cycle Motor Cycle Car Bus or Coach LGV HGV All vehicles

Death 153 634 2580 122 280 419 3172

KSI* 2568 6992 26713 1260 2322 2119 31845

* KSI = Killed or Seriously Injured

[1] also provides a much greater range of data including trends over time, accident rates as a function of age, gender, alcohol levels etc. One of the E&P Forum (as was) member companies collected statistical data in the 1990s from which accident rates for desert driving conditions can be calculated. This 3

In Table 2.1 in 2006 there were no fatalities on urban roads for LGVs and HGVs and no fatalities on motorways for bus/ coach. For these cells of the table, the recommended fatality rates have been set to the “All Roads” value. In Table 2.2 the rates are based on 1996-2005 data; as no separate value for HGV is given in Ref. [1] it has been set at the LGV value. ©OGP

7

RADD – Land transport accident statistics

data covers a period between 1992 and 1994. The derived desert driving accident and fatality rates are shown in Table 4.2 below and relate to company and contractor work related accidents. Table 4.2 Desert Driving Accident and Fatality Rates Year

Road Traffic (108 V km)

Road Traffic Accidents

Injuries

Fatalities

1992

0.79

137

56

4

Fatality Rate (per 108 V km) 5.1

1993

0.89

135

42

2

2.3

1994

0.86

111

26

0

0.0

The downward trend in the fatality rate was considered to be the result of improved induction training, the fitting of roll-over bars and speed governors to all LGVs and the near 100% usage of seat-belts. This needs to be taken into account when applying the rates for desert driving at other locations. Deriving an average over the 3 years of 2.4 fatalities per 108 vehicle kilometres, this is approximately 5 times higher than the average all-vehicle GB fatality rate. 4.1.2

Rail Transport

Table 2.4 is based on British data from 1996 to 2005 [1]. In analysing rail casualty data, care needs to be taken to distinguish casualties caused in train incidents, non-train incidents and vandalism/ suicide. Overall fatality numbers are dominated by the latter category. In addition, statistics may include passengers, staff and “others” (third parties who were neither passengers nor staff, but who were killed or injured due to rail related activity). Also there is the need to allow for low frequency but high consequence events which are characteristic of rail operations. A national railway may experience several years of very few fatalities and then have one event which kills many tens of people. It is often difficult to determine what has been included in summary statistics. Table 2.4 above is a subset of DfT data comparing various transport modes. It is averaged over 10 years and therefore takes account of low frequency/ high consequence events (e.g. Ladbroke Grove, where there were 31 fatalities). The casualty rates relate just to train passengers, but from all accident causes not only train accidents such as collisions, derailments, fires etc. Further details of UK rail accident rates are provided in the UK Office of Rail Regulation Annual reports [4]. These split out incidents involving passengers, staff and members of the public, and provide train incident rates, as well as other accident categories such as trespass and vandalism. The GB data is considered representative of average EU data. Figure 4.1 below is taken from the RSSB strategic plan [5] and compares UK passenger fatality rates against the 25 EU countries’ averages. The UK values are shown to be consistent with the EU values except in years when there are major UK disasters. If the major disasters were to be averaged over a few years, there would be an even closer match. In recent years the European Railway Agency has begun to collect statistics from all the European countries. The 2004-2005 Rail Statistics are summarised in Figure 4.2 below [6]. These data would appear to indicate significant differences between EU countries. However, there is a need to be cautious. The variation could be because of inconsistent reporting criteria or it could reflect low frequency/ high consequence events affecting a 8

©OGP

RADD – Land transport accident statistics

few countries in the time period 2004-2005. Given this uncertainty no potential modification factors are suggested in this datasheet. Figure 4.1 Com parison between GB and EU Average Rail Fatality Rate [5]

Figure 4.2 EU States Rail Fatality Rate [6]

©OGP

9

RADD – Land transport accident statistics

US data from the Federal Railroad Administration [7] for 2006 indicates 2 passenger fatalities in 16,211,393,401 passenger miles = 0.08 fatalities per billion passenger km. This is also consistent with UK data for 2004-2005. 4.1.3

Dangerous Goods Transport

Tables 2.5 to 2.7 present a selection of available data suitable for use only where transport risks form a small contribution to a process QRA. They should not be used for transport QRA without detailed consideration of the applicability of the data. In particular local variations in transport accident rates should be analysed. 4.1.3.1 Rail Tankers The Advisory Committee on Dangerous Substances (ACDS) of the UK Health & Safety Commission produced a report in 1991 [8] which provides a detailed QRA of road and rail transport of motor spirit, LPG, ammonia and chlorine in Great Britain, including puncture frequencies based on modified UK experience and equipment leak frequencies based on fault tree analysis. [8] estimated frequencies of tank shell punctures and equipment leaks from tank wagons carrying dangerous goods, based on modified UK data (Table 2.5). The punctures are taken to be 50 mm diameter holes (90%) or catastrophic ruptures (10%). 4.1.3.2 Liquid Tankers The best available estimate of leak frequencies from tankers carrying non-pressurised liquids is also given by [8], based on spills from UK motor spirit tankers (Table 2.6). 4.1.3.3 LPG Road Tanker Leak Frequencies A DNV Technica report [9] compared various sources of leak frequency data for LPG road tankers, and developed a fault tree model to take account of the main influences. Table 2.7 gives the failure case frequencies for a tanker with passive fire protection, based on Hong Kong road traffic accident rates.

4.2

Other data sources

4.2.1

Road Transport

The International Road Federation in Geneva collects world road statistics including data on road accidents from a large number of countries [10]. The data include the annual number of accidents, annual number of injured and killed people as well as the number of injury accidents, persons injured or killed per 100 million vehicle kilometres (108 V km). The Organisation for Economic Co-operation and Development (OECD) maintains road safety statistics [2]. It presents international fatality information for different road types. The OECD website [2] also presents injury rates and fatalities per 100,000 of the population. The European Conference of Ministers of Transport [11] gives death rates and casualty rates per capita and per vehicle for European countries and Australia, Canada, Japan, Russia and USA. However, it does not have any estimates of vehicle-km. Davies & Lees [12] give a variety of accident statistics for heavy goods vehicles, drawn mainly from national accident statistics.

10

©OGP

RADD – Land transport accident statistics

Koornstra [24] presents a passenger transport model which includes road transport risk. Reference risks are first determined based on data from the original 15 EU countries. Multiplication factors are then developed relating road fatality risks to the Gross National Income per person (GNI/p) and plotted on a graph with a fitted function. Corrections are made for estimated underreporting. The report notes a rather wide scatter of fatality rates for individual countries about the curve. For certain countries there is a difference between the predicted and reliably established risks (where country specific data exists). Thus the report proposes an additional multiplication factor where there are strong indications that a country is relatively less safe or relatively safer than other countries with a comparable GNI/p level. Finally a multiplication factor for road type proportions is proposed based on the variation in risk that is seen on different road types. In principle this method can estimate road transport risks for any country in the world and could be useful when country specific data is not available. The reference risks are consistent with those presented in this report. 4.2.2

Rail Transport

A Statistical Analysis of Fatal Collisions and Derailments of Passenger Trains on British Railways [13] provides a detailed analysis of the comparative safety of different designs of passenger carriage on British Railways, including accidents per passenger mile and fatalities per accident. Frequency of Railway Accidents in the German Federal Railways Network: Goods Traffic and Shunting Operations [14] provides a detailed analysis of accident frequencies and involvement probabilities for wagons in goods trains in Germany. Light Rail Accidents in Europe and North America [15] has a detailed comparison of accident frequencies on light rail systems in different countries. The report by Koornstra [24] also includes rail transport risk. Reference risks are determined based on data from the original 15 EU countries. Multiplication factors are again developed relating rail fatality risks to the Gross National Income per person (GNI/p). However there is less country data than for road fatalities on which to base these multiplication factors. Thus, as with road, the report proposes using an additional multiplication factor where there are strong indications that a country is relatively less safe or relatively safer than other countries with a comparable GNI/p level. Further international information on rail transport safety is available from International Union of Railways (UIC) at http://www.uic.asso.fr/. 4.2.3

Dangerous Goods Transport

There are a large number of other data sources with information relevant to DG transport, but generally they are older or less generally applicable than the values given in Section 2.0. The Federal Emergency Management Agency (FEMA) [16] provides information for explosive, flammable and otherwise dangerous chemicals. It presents failure rates which originate from several sources. The age of the background data and the individual sources may no longer reflect the reliability of transport vehicles on the roads and railways today because of stricter safety regulations for both vehicles and materials transportation. The individual sources contain information about accident rates for trucks used in the petroleum industry and for transporting bulk hazardous materials ([17] to [23]).

©OGP

11

RADD – Land transport accident statistics

5.0

Recommended data sources for further information

For further information, the data sources used to develop the release frequencies presented in Section 2.0 and discussed in Sections 3.0 and 4.0 should be consulted. The references used for the recommended data in Section 2.0 are shown in bold in Section 6.0.

6.0 [1] [2] [3] [4] [5] [6]

[7] [8] [9]

[10] [11] [12] [13] [14] [15] [16] [17] [18] [19]

12

References Departm ent for Transport 2006. Road Casualties Great Britain 2006 http://www.dft.gov.uk/162259/162469/221412/221549/227755/rcgb2006v1.pdf OECD, International Traffic Safety Data and Analysis Group http://cemt.org/IRTAD/IRTADPublic/we2.html International Road Federation (IRF) 1994. World Road Statistics 1980-1993 Office of Rail Regulation (ORR) 2006. Annual Report on Railway Safety 2005. http://www.rail-reg.gov.uk/upload/pdf/296.pdf UK Rail Safety and Standards Board (RSSB) 2007. The Railway Strategic Safety Plan 2008-2010. European Railway Agency (ERA) 2006. A Summary of 2004-2005 EU Statistics on Railway Safety. http://www.era.europa.eu/public/Documents/Safety/Safety_Performance/0705%20ERA-Report2.pdf US Federal Railroad Administration website: http://safetydata.fra.dot.gov/OfficeofSafety/ ACDS 1991. M ajor Hazard Aspects of the Transport of Dangerous Substances, Advisory Com m ittee on Dangerous Substances, Health & Safety Com m ission, HMSO. DNV Technica 1996. Quantitative Risk Assessment of the Transport of LPG and Naphtha in Hong Kong - Methodology Report, Report for Electrical & Mechanical Services Departm ent, Hong Kong Governm ent, Project C6124. International Road Federation 2007. The IRF W orld Road Statistics 2007, Data 2000-2005. ECMT 1998. Statistical Report on Road Accidents 1993/1994, European Conference of Ministers of Transport, OECD, Paris. Davies, P.A. & Lees, F.P. 1992. The Assessment of Major Hazards: The Road Transport Environment for Conveyance of Hazardous Materials in Great Britain, J. Haz. Mat., 32, 41-79. Evans, A.W. 1997. A Statistical Analysis of Fatal Collisions and Derailments of Passenger Trains on British Railways: 1967-1996, Proc. Inst. Mech. Eng., 211 Part F. Fett, H-J & Lange, F 1992. Frequency of Railway Accidents in the German Federal Railways. Walmsley, D.A. 1992. Light Rail Accidents in Europe and North America, Research Report 335, Transport & Road Research Laboratory, Crowthorne, UK Federal Emergency Management Agency. Handbook of Chemical Hazard Analysis Procedures, available from Federal Emergency Management Agency, Publications Office, 500 C Street, SW, Washington, DC 20472 American Petroleum Institute 1983. Summary of Motor Vehicle Accidents in the Petroleum Industry for 1982. Dennis, A.W. et al. 1978 Severities of Transportation Accidents Involving Large Packages, Sandia Laboratories, NTIS SAND-77-0001. Rhoads, R.E. et al. 1978 An Assessment of the Risk of Transporting Gasoline by Truck, prepared by Pacific Northwest Laboratory for the U.S. Department of Energy, PNL2133.

©OGP

RADD – Land transport accident statistics

[20] Smith, R.N. and E.L. Wilmot 1982. Truck Accident and Fatality Rates Calculated from California Highway Accident Statistics for 1980 and 1981, prepared by Sandia National Laboratories for the U.S. Department of Energy, SAND-82-7066. [21] National Safety Council. 1988 Accident Facts. [22] Ichniowski T. 1984 New Measures to Bolster Safety in Transportation, Chemical Engineering, pp. 35-39. [23] Urbanek, G.L. and E.J. Barber 1980. Development of Criteria to Designate Routes for Transporting Hazardous Materials, prepared by Peat, Marwick, Mitchell and Co. for the Federal Highway Administration, NTIS PB81-164725. [24] Koornstra, M.J. 2008. A Model for the Determination of the Safest Mode of Passenger Transport between Locations in any Region of the World. Report for Shell International Exploration and Production B.V.

©OGP

13

Risk Assessment Data Directory Report No. 434 – 10 March 2010

Water transport accident statistics International Association of Oil & Gas Producers

RADD – Water transport accident statistics

contents 1.0 1.1 1.2 1.3

Scope and Application ........................................................... 1 Scope ............................................................................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0 2.1 2.2 2.3

Summary of Recommended Data ............................................ 2 Personnel Risk ................................................................................................ 3 Vessel Accident Frequencies ........................................................................ 3 Oil Spill Frequencies ...................................................................................... 4

3.0 3.1 3.2 3.3

Guidance on use of data ........................................................ 5 General validity ............................................................................................... 5 Uncertainties ................................................................................................... 5 Application of frequencies to specific locations ......................................... 5

3.3.1 3.3.2

Personnel Risk ........................................................................................................... 6 Ship Accidents and Oil Spill Frequencies ............................................................... 6

4.0 4.1

Review of data sources ......................................................... 6 Basis of data presented ................................................................................. 6

4.1.1 4.1.2 4.1.3

Personnel Transport .................................................................................................. 6 Vessel Incidents and Accidents.............................................................................. 10 Oil Spills .................................................................................................................... 12

4.2

Other data sources ....................................................................................... 13

4.2.1 4.2.2 4.2.3 4.2.4

Personnel Transport ................................................................................................ 13 Vessel Casualties ..................................................................................................... 15 Oil Spills .................................................................................................................... 15 Dangerous Goods Transport .................................................................................. 15

5.0

Recommended data sources for further information ............ 16

6.0

References .......................................................................... 16

©OGP

RADD – Water transport accident statistics

Abbreviations: ACDS BSP CALM DNV E&P ERRV FAR GB GT IR LMIS MBC MSMS NPC OGP P&I QRA SAFECO SMS SPM SSB UK(CS) USCG

Advisory Committee on Dangerous Substances Brunei Shell Petroleum Catenary Anchor Leg Mooring Det Norske Veritas Exploration and Production Emergency Response & Rescue Vessel Fatal Accident Rate Great Britain Gross Tonnage Individual Risk Lloyd’s Maritime Information Services Marine Breakaway Coupling Marine Safety Management System National Ports Council Oil and Gas Producers Protection & Indemnity Quantitative Risk Assessment Safety of Shipping in Coastal Waters Safety Management System Singe Point Mooring Sarawak Shell Berhad United Kingdom (Continental Shelf) United States Coast Guard

©OGP

RADD – Water transport accident statistics

1.0

Scope and Application

1.1

Scope

This datasheet provides information on water transport accident statistics for use in Quantitative Risk Assessment (QRA). The data sheet includes guidelines for the use of recommended data and a review of the sources of the data. The data in this sheet are intended for three main uses: •

Assessing the risk of personnel on board vessels;

•

Assessing the frequencies of vessel/ship accidents;

•

Assessing the frequencies of oil spills.

Relevant personnel are crew boat passengers being transported to offshore facilities and crew who work on vessels. The main focus in terms of vessel types is on supply vessels, stand-by vessels (now commonly known within the UK as Emergency Response & Rescue Vessels (ERRV)), crew vessels, anchor handling vessels, diving support vessels and tankers. Drilling rigs, flotels, and production and storage vessels are not included.

1.2

Application

This datasheet contains global data plus more detailed regional/national data where relevant or where available. When using these data, it should be noted that they may not be directly applicable to the specific location under study. Guidance on using location specific data is given in Section 3.3. The data presented are applicable to activities in support of operations within exploration for and production of hydrocarbons.

1.3

Definitions

The primary source of ship accident data is the ship casualty database maintained by Lloyd’s Maritime Information Services (LMIS). Loss frequencies can be obtained by combining with fleet data from the Lloyd’s Register annual World Fleet Statistics [1]. These sources cover all self-propelled sea-going merchant ships over 100 GT. Accidents to the ship are defined in terms of the following severity categories: •

Incidents

Any event reported to LMIS and included in the database. This is usually because the event may involve some cost to the shipowner and may lead to an insurance claim. In this analysis, the term “incident” is taken to include serious casualties, while the term “non-serious incident” excludes serious casualties. Incidents are only recorded in the LMIS database for tankers and passenger ships.

•

Serious casualties

Incidents involving total loss (see below); breakdown resulting in the ship being towed or requiring assistance from ashore; flooding of any compartment; or structural, mechanical or electrical damage requiring repairs before the ship can continue trading. ©OGP

1

RADD – Water transport accident statistics

•

Total loss

Where the ship ceases to exist after a casualty, either due to it being irrecoverable (actual total loss) or due to it being subsequently broken up (constructive total loss). The latter occurs when the cost of repair would exceed the insured value of the ship.

Incidents in the LMIS database are categorised according to the following codes: •

Collision

Striking or being struck by another ship, whether under way, anchored or moored. This excludes striking underwater wrecks.

•

Contact

Striking or being struck by an external object, but not another ship or the sea bottom. It includes striking offshore rigs/platforms, whether under tow or fixed.

•

Foundered

Sinking due to rough weather, leaks, breaking in two etc, but not due to other categories such as collision etc.

•

Fire/explosion

Where the fire/explosion is the first event reported, or where fire/explosion results from hull/machinery damage. In other words, it includes fires due to engine damage, but not fires due to collision etc.

•

Hull/m achinery dam age Where the hull/machinery damage is not due to other categories such as collision etc. Also termed “Structural failure” in sections below.

•

W ar loss/dam age

Includes damage from all hostile acts.

•

W recked/stranded

Striking the sea bottom, shore or underwater wrecks. Also termed “Grounding” in sections below.

•

Miscellaneous

Events not classified due to lack of information or not included above, e.g. oil spill, flooding.

Personnel risks are presented as Fatal Accident Rates (FAR), defined as fatalities per 108 exposed hours.

2.0

Summary of Recommended Data

The recommended frequencies and associated data are presented as follows: •

Personnel Risk (Section 2.1) – relevant personnel are crew boat passengers being transported to offshore facilities and crew who work on vessels.

•

Vessel Accident Frequencies (Section 2.2)

•

Oil Spill Frequencies from tankers and during transfer operations (Section 2.3)

2

©OGP

RADD – Water transport accident statistics

2.1

Personnel Risk

The recommended FAR for marine personnel (boat crew) is 3. Where crew boats are used to transport other personnel to and from offshore facilities, the risk to these offshore personnel can be expressed as follows: FAR (fatalities per 108 exposed hours) = 30 + 26/Transit time per journey (hours). Section 3.3.1 illustrates the use of this FAR format1. These fatality rates for offshore personnel could be up to three times higher in certain parts of the world. For seafarers not directly connected to the offshore industry the fatality rates in some parts of the world could be a factor of up to 40 higher than the FAR of 3.

2.2

Vessel Accident Frequencies Table 2.1 Vessel Accident Frequencies (per ship year) Vessel/Accident Type All Sea-Going merchant ships > 100 GT Oil Tankers Tanker fire/explosion

Total Loss per ship year -3 3.0 × 10

Serious Casualty per ship year -3 9.3 × 10

-3

1.9 × 10 -4 7.2 × 10

-2

1.1 × 10 -3 2.6 × 10

Table 2.2 Causal Breakdowns for Total Losses Accident Type

% of Total Losses

Foundered Missing Fire/Explosion Collision Wrecked/Stranded Contact Other TOTAL

1.

48 1 14 12 18 2 5 100

1

It is important to note that this equation comprises 2 elements: one for the actual transit (30) + one for embarking and disembarking (26/Transit time). The first of these is 8 proportional to the transit time per journey; as the FAR is defined to be per 10 exposed hours, it is constant. The second is proportional to the number of journeys made, which is 8 inversely proportional to transit time for a fixed total time exposure (i.e. 10 hours). ©OGP

3

RADD – Water transport accident statistics

2.3

Oil Spill Frequencies Table 2.3 Oil Tanker Oil Spill Frequencies

ACCIDENT TYPE

Collision Contact Fire/explosion War Loss Structural failure Transfer spill Unauthorised discharge Grounding TOTAL

OIL SPILL FREQUENCY (spills per ship year) -3 1.5 × 10 -4 7.2 × 10 -4 5.1 × 10 -5 5.1 × 10 -3 1.3 × 10 -3 1.7 × 10 -4 5.1 × 10 -4 5.6 × 10 -3 6.9 × 10

OIL SPILL RATE (tonnes per ship year)

AVERAGE OIL SPILL SIZE (tonnes)

4.49 0.11 1.52 0.001 5.68 0.23 0.21 5.20 17.43

2922 148 2973 27 4435 133 408 9227 2522

Table 2.4 Offshore Crude Loading Spills (non-CALM system s) SPILL SOURCE Storage on platform Pipeline to loading facility Loading buoy or facility Transfer hose and coupler Tanker TOTAL

MEAN SIZE (barrels) 121 19 946 78 4 237

SIZE RANGE (barrels) 0.1 to 4000 2 NA 0.25 to 9400 0.5 to 500 2 to 5 0.1 to 9400

FREQUENCY (spills per cargo) -2 1.1 × 10 -4 3.0 × 10 -3 3.0 × 10 -3 4.1 × 10 -4 6.0 × 10 -2 1.9 × 10

The following frequencies are given for pollution events during loading at Single Point Moorings (SPM; all categories including CALM included) in relation to Marine Breakaway Couplings (MBC): •

1 event (tanker breakout or surge event) every 3,518 operating days without MBC

•

1 event every 5,621 operating days with MBC

•

Spill quantity with MBC fitted is 1/35 that without MBC

Note that ‘operating days’ refers to the number of days a tanker occupies the SPM. Typically a shuttle tanker loading operation lasts less than 24 hours; it is suggested that operating days be used as a surrogate for number of cargoes loaded.

2

4

Only one event, hence no range ©OGP

RADD – Water transport accident statistics

3.0

Guidance on use of data

3.1

General validity

If transport risk is a relatively small contribution to an overall risk study, the data above may be sufficient. However, if transport risk is the object of the study, local data become very important. It is strongly recommended that local data sources on accidents and transport risk are obtained. This is because there can be large local variations.

3.2

Uncertainties

With respect to the personnel risk values in Section 2.1, the main uncertainties are associated with estimating the exposed populations for each type of worker. These population uncertainties could lead to a factor of 2 in the uncertainty in the frequency estimates. Other factors which are relevant are the uncertainty in trends with time, the differences between different types of vessel (e.g. supply, standby, anchor handling etc.) and the uncertainties due to different locations around the world. Concerning vessel accident frequencies in Section 2.2, there are uncertainties over when a vessel loss is defined as a total loss. Statistics dealing with total loss of vessels may give lower figures for the latest years due to the fact that not all vessels will be written off immediately after an accident. In some cases, the vessel may be categorised as ‘out of service’, and after some time a decision to write it off or bring it back in service will be made. There is a lack of consistency as to the year the vessel may be written off; i.e. the year when the accident took place or the year when the decision was made. In some cases the source may change the rules as to which year the vessel will be classified as total loss without correcting the previous data. Attempts have been made to take account of this in the analysis below. The total population with regard to vessels is also difficult to assess. Most statistics available have been collected and registered with regard to the flag, and not the region where the vessels were sailing or where the accident took place. Worldwide frequencies have been used to overcome these problems. Oil spills not resulting from ship damage (e.g. transfer spills) are not covered comprehensively in the LMIS database. Reporting of oil spills could be variable especially for smaller spills. North Sea data which are considered better reported than world averages have been used to try and reduce reporting uncertainty on transfer spills.

3.3

Application of frequencies to specific locations

This datasheet contains global data plus more detailed regional data where relevant. When using these data, it should be realised that they may not be directly applicable to the specific location under study. It is therefore strongly recommended that local data sources on accidents and transport risk from governmental or other national or regional institutions are obtained before using the data given in this sheet. Should these local data not be accessible, or their reliability/applicability be uncertain, then the data in this data sheet could be used after factoring for local circumstances. However, data which have been adjusted to allow for local circumstances should always be used with caution: the assumptions made are likely to be judgemental and hence may reduce the reliability of the adjusted data vis–à-vis reality. Each assumption shall be clearly documented so that an audit trail is maintained.

©OGP

5

RADD – Water transport accident statistics

3.3.1

Personnel Risk

The Boat Crew FAR in Section 2.1 can be used in just the same way as all the other FAR data in these OGP datasheets. The FAR equation for transferring other personnel by crew boats in Section 2.1 can be understood through the following example. Assume a transit time of 1.5 hours. The FAR from Section 2.1 can be used to generate an individual risk per journey as follows: IR per journey = FAR × 10-8 × Transit time per journey (hours) = (30 + 26/1.5) ×10-8 × 1.5 = 7.1×10-7 Hence the expression for IR per journey can be generalised to: IR per journey = 2.6 x 10-7 + 3.0 × 10-7 × Transit time (hours) For the example journey above, with a transit time of 1.5 hours the individual risk is again 7.1 × 10-7 per journey. Location adjustments can make use of worldwide FAR data shown in Table 4.3 below. The data presented below in Section 4.1.1.2 are not sufficient to distinguish between transfers from shore to shore, shore to offshore and offshore to offshore. 3.3.2

Ship Accidents and Oil Spill Frequencies

The accident and spill rates in Sections 2.2 and 2.3 can be applied directly in generic risk assessments. Ship accident rates could however be dependent on factors such as location/ route, flag, ship operator SMS. If a detailed marine QRA is being undertaken the data would need to be reviewed for local relevance.

4.0

Review of data sources

4.1

Basis of data presented

4.1.1

Personnel Transport

4.1.1.1 Marine Personnel Associated with Offshore Industry Table 4.1 presents an analysis of fatalities on vessels operating on the UKCS [2]. Table 4.1 Location of Fatal Marine Related Accidents on UKCS, 1977-96 Location Single point mooring Barge Diving support vessel Supply vessel Stand-by vessel / ERRV Anchor handling vessel

6

Events 2 5 9 13 3 3

©OGP

Fatalities 4 5 10 14 4 3

RADD – Water transport accident statistics

Based on these numbers of fatalities and estimates of offshore workforce together with a consideration of trends with time, [2] made an estimate of an FAR of 3 for boat crew working on the UKCS. Note that there is significant uncertainty on the percentage of the workforce in the various occupations and hence this FAR is probably +/- a factor of 2. There was insufficient exposure data in [2] to distinguish between crew in the different locations in Table 4.1. 4.1.1.2 Crew Boat Transfers The only data available on experience with crew boats is for Brunei Shell Petroleum (BSP) and Sarawak Shell Berhad (SSB) in Malaysia [3]. Operator 1 (Asia Pacific region) Experience

Operator’s crew boat experience during 1971-91 has been estimated as: 40,000 boat hours in transit 88,000 boat stages There were on average 7.3 passengers on each boat stage, giving passenger experience of: 292,000 passenger hours in transit 644,000 passenger transfer stages Here, a stage consists of an embarkation and a disembarkation. In this period there have been no fatalities on crew boats at all. Recent information indicates that between 1991 and 2008 there have also been no fatalities. Operator 2 (Asia Pacific region) Experience

Operator’s crew boat experience prior to 1991 amounted to at least: 2,000,000 passenger hours 2,000,000 passenger transfer stages As with Operator 1, Operator 2 had no fatalities associated with crew boats in that period. Recent information indicates that between 1991 and 2008 Operator 2 experienced one crew member fatality but no passenger fatalities. Given the limited size of these datasets they have been combined. Crew Boat Accident Frequencies

Where no accidents have occurred, the frequency may be estimated using statistical techniques based on the Poisson distribution. The most likely frequency is equivalent to assuming that 0.7 accidents have occurred to date, i.e. that the operation is 70% of the way to its first accident. The confidence interval on this value is of course very wide. Since accidents in transit (such as the boat sinking) arise from different mechanisms than accidents in transfer (such as crew members being crushed while transferring), it may be appropriate to assume that both parts of the operation are independent and 70% of the way to an accident. This is pessimistic (for crew boats) and requires careful sensitivity-testing.

©OGP

7

RADD – Water transport accident statistics

The above approaches yield accident frequency estimates for crew boats as given in Table 4.2 based on prior 1991 data. The 90% confidence intervals are also shown. The recent information indicates a further 17 years of operations by Operators 1 and 2 (referred to above) with no passenger fatalities. Thus as a sensitivity test one could half the values given below assuming that the marine operations have maintained their pre-1991 volume. Such a test would be within the 90% confidence band below. However, given that a significant event could cause multiple passenger fatalities it is recommended to maintain the values below as cautious best-estimates. Table 4.2 Crew Boat Accident Frequencies (1971-1991) Fatalities in Transit (Per Passenger Hour)

Fatalities in Transfer (Per Passenger Transfer Stage)

Lower 5% value

2.2 × 10

-8

1.9 × 10

-8

Best estimate

3.0 × 10

-7

2.6 × 10

-7

Upper 5% value

1.3 × 10

-6

1.1 × 10

-6

4.1.1.3 Other Seafarers [4] provides fatality rates for seafarers on UK merchant vessels and compares these to other merchant fleets. For 1996-2005 there were 32 fatalities in accidents on UK vessels: •

23 personal occupational accidents while on duty

•

8 off duty personal accidents

•

1 in a shipping accident (an explosion)

These numbers exclude deaths due to disease, suicide and unexplained events (e.g. disappeared overboard). The 32 fatalities equate to a rate of 11 fatalities per 100,000 seafarer-years (see Table 4.3 under UK 1996-2005). Assuming an average of 4000 hours onboard a vessel per seafarer year this equates to a FAR of 3. Table 4.3 indicates that this value is near the bottom of the range of surveyed fleets; values up to a factor 40 higher would be appropriate for other parts of the world.

8

©OGP

RADD – Water transport accident statistics

Table 4.3 Seafarer Fatal Accident Rates (from [4]) Merchant Fleet India Hong Kong Singapore Greece West Germany Norway Poland Singapore West Germany Denmark Poland Poland (2 main companies) Poland UK seafarers in non-UK fleets Belgium Denmark Japan Hong Kong UK Hong Kong Isle of Man Netherlands Germany UK Sweden Canada France India Spain Sweden UK Australia Sweden

Time Period

No. of deaths from accidents 282 68 101 339 820 156 49 98 72 52 35 412 63 3 63 121 44 407 36 33 15 35 100 27 16 6 26 7 19 32 3 9

1990-1996 1990-1995 1984-1989 1990-1994 1960-1972 1990-1994 1985-1994 1990-1995 1974-1976 1996-2005 1996-2005 1990-1995 1960-1999 1986-1995 1996-2005 1986-1993 1990-1994 2000-2005 1976-1985 1980-1989 1988-2005 1990-1994 1990-1994 1986-1995 1984-1988 1996-2005 1990-2004 1996-2005 1990-1994 1996-2005 1996-2005 1990-1994 1990-1994

Fatal Accident rate (per 100,000 seafareryears) 426 253 162 162 148 102 100 99 92 90 84 80 72 66 63 62 58 56 53 48 44 39 39 39 37 22 20 18 16 13 11 10 10

4.1.1.4 Effect of Location Overall FARs in exploration and production for oil & gas world-wide have been produced by OGP [5], The ratios of offshore FARs in the different areas are considered to be a suitable basis for modifying the fatality rates for marine personnel associated with the offshore industry above. Table 4.4 has the relevant values from the “Occupational Risk” datasheet. For other seafarers the values in Table 4.3 can be used.

©OGP

9

RADD – Water transport accident statistics

Table 4.4 FAR Multiplication Factors Offshore for Different Regions Personne l

Africa

Asia/ Australasia

Europ e

FSU

Middle East

North America

South Americ a

All

1.22

0.56

1.05

0.69

0.82

1.52

0.92

Company

1.00

0.72

2.94

0.00

0.00

0.47

0.00

Contract or

1.17

0.53

0.88

0.68

0.84

1.86

1.10

4.1.2

Vessel Incidents and Accidents

The most readily available analysis of accidents is in the Lloyd’s Register annual World Casualty Statistics. This gives the total losses in the current year and several previous years. Loss frequencies can be obtained by combining with fleet data from the Lloyd’s Register annual World Fleet Statistics. These sources cover all selfpropelled sea-going merchant ships over 100 GT. Figure 4.1 shows the total loss frequency for all ships over 100 GT world-wide between 1974 and 1998. It shows a generally declining trend. Some of the fluctuations can be attributed to the Iran-Iraq War (1980-88, with particular effects on shipping in 1982) and the Gulf War in Kuwait in 1991. Based on this graph and allowing for the under-reporting effect of the last two years a total loss frequency of 3.0 × 10-3 per ship year has been estimated; this is the recommended value given in Section 2.2. Data for 1999 and 2000 gives total loss rates of 1.5 × 10-3 and 1.9 × 10-3 per ship year respectively. This indicates a potentially reducing loss rate with time which could be used as a sensitivity test. Figure 4.1 Trend in Total Loss Frequency for All Ships

10

©OGP

RADD – Water transport accident statistics

LMIS also provides information related to specific ship types. Based on the worldwide LMIS database from 1992-1997 [6] made an estimate for oil tankers of a total loss frequency of 1.9 × 10-3 per ship year. Of this fire/ explosion caused total losses with a frequency of 7.2 × 10-4 per ship year. The serious casualty rates in Section 2.0 also come from this source. In terms of the impact of fleet on these rates, Table 4.6 (from [4]) can be used to derive modification factors. Fatal casualty rates per ship year can be derived for each of the fleets in Table 4.6. The maximum rate is 3.0 per 1000 ship years for Cambodia and 0.1 per 1000 ship years for UK and The Netherlands. The average rate is 0.8 per 1000 ship years. Thus a modification range of a factor of 4 above the world average and a factor of 8 lower than the world average is judged reasonable. The effect of ship age is illustrated in Figure 4.2 below for oil tankers [6]. The effects are expressed as the ratio of the frequency for specific age groups to the average frequency for the whole fleet. The graph plots these ratios on a base of ship age, using the mid-point of each group, and plotting the ratio for the 25+ age group at 27.5 years. This shows the pattern of low frequencies early in the ship’s life, rising in midlife and declining for older ships. This reduction for older ships is attributed to a higher fraction of older ships being laid-up or used for storage, and hence being less exposed to hazards. Figure 4.2 Effect of Oil Tanker Age on Accident Frequencies

[6] also reviewed the impact of size on oil tanker accident rates, but did not find a significant effect.

©OGP

11

RADD – Water transport accident statistics

4.1.3

Oil Spills

4.1.3.1 Tankers The oil spill data in Table 2.3 is based on a database of worldwide oil spills for 199294. They are assumed to refer to spills over 1 tonne, but it is likely that the spill frequency is under-estimated for smaller spill sizes. Figure 4.3 shows a frequency size curve for the spills based on 1992-97 data. Figure 4.3 Frequency Size Curve for Oil Spills from Oil Tankers (19921997)

4.1.3.2 Offshore Loading Release or spill into the sea from vessels engaged in the offshore activities may have as its source spills during oil lifting/loading, accidental discharges overboard or ruptured tanks. Most reporting systems of accidental release or spill into the sea have few details of the unit involved or the cause of the accident. No reliable data has been found on accidental discharges or ruptured tanks. However, one study [7] on lifting/loading has been identified. It is based on UK offshore loading from 1975-93. It was noted that pollution incidents associated with lifting should be grouped according to the lifting system; and the study mainly covers non-CALM (Catenary Anchor Leg Mooring) systems, as the CALM system was a first generation system and have been phased out. This data forms the basis for Table 2.4. More recent data have been published by OCIMF 15. In 2006 OCIMF conducted a survey of member companies operating offshore terminals to collect information on MBC operating experience. The information given in Section 2.3 is based on survey returns from 9 operating companies representing 125,561 tanker/SPM operating days.

12

©OGP

RADD – Water transport accident statistics

4.2

Other data sources

4.2.1

Personnel Transport

Passenger casualty data from the Department for Transport’s 2006 report [8] for UK registered merchant vessels gives a fatality rate of 0.3 per billion passenger kilometres and Killed or Seriously Injured (KSI) of 43 per billion passenger kilometres. This is based on 1996-2005 averages. It could be used as a sensitivity test for crew boat passenger transport. The Department for Transport’s website (www.dft.gov.uk) contains a table from its Marine Accident Investigation Board showing the number of injuries from 1991 to 2004 on UK flagged vessels recorded by the Marine Accident Investigation Board as "Associated with Offshore Industry". This is shown in Table 4.5. As above there is a problem with exposed population; no data is given that would enable FARs or injury rates to be estimated. [4] also contains data about seafarer fatalities arising only from shipping casualties, i.e. not including personal accidents, from merchant fleets around the world. These are shown in Table 4.6. Table 4.5 Injuries on UK flagged vessels Associated with Offshore Industry (1991-2004) Injury Type Amputation of hand/ fingers/ toe Bruising Burns/ scalds – other Chemical poisoning/ burns from contract or inhalation Concussion/ unconsciousness due to head injury Crush injury Cuts/ wound/ lacerations Death - confirmed Dislocations Eye injuries Fracture – of the skull/ spine/ pelvis/major bone in arm or leg Fracture – other Hypothermia – body temperature too cold Other Strains – other strains/ sprains/ torn muscles/ ligaments Strains – strained back Unknown Total

Total Number of Injuries 5 49 3 4 7 32 51 6 10 5 31 60 4 27 40 40 38 412

Koornstra [14] presents a passenger transport model which includes maritime transport risk. Reference risks for ferries and cargo/ passenger ships are first determined based on data from ships using European waters. Reference risks for hopper and supply boats are based on assumptions about how they compare to ferries and cargo/ passenger ships. Multiplication factors are then developed relating maritime fatality risks to the Gross National Income per person (GNI/p). The report proposes using an additional multiplication factor where there are strong indications that a trip by a particular ship in a specific region is relatively less safe or relatively safer than comparable ships in other countries with a comparable GNI/p level.

©OGP

13

RADD – Water transport accident statistics

Table 4.6 Fatalities Arising From Ship Casualties (from [4]) Merchant Fleet

Cambodia Taiwan Cyprus South Korea Syria St Vincent Belize India Indonesia Panama Honduras PR China DIS (Denmark) Malta Malaysia Singapore Thailand Turkey Antigua & Barbuda Hong Kong Ukraine Greece Isle of Man Vietnam Norway Bahamas Liberia Marshall Islands Philippines Azerbaijan Romania UAE Vanuata Norway Russia France Italy Egypt Iran USA Spain Japan Canada Germany Netherlands UK

14

No. of deaths from shipping casualties (1996-2005)

(Corresponding no. of shipping casualties)

No. of cargo ships in 2000

76 54 154 116 22 105 98 61 143 393 61 175 31 89 40 68 19 38 27 16 20 34 7 19 18 34 44 8 30 6 5 7 5 10 36 4 11 4 4 18 2 28 2 3 3 0

(10) (4) (19) (16) (5) (21) (21) (6) (16) (62) (14) (18) (7) (18) (3) (11) (4) (13) (4) (5) (5) (11) (2) (6) (5) (11) (10) (3) (7) (1) (3) (1) (2) (4) (10) (1) (5) (2) (1) (8) (2) (13) (1) (3) (1) (0)

335 370 1373 1123 219 1147 1107 745 1924 5713 899 2604 491 1452 768 1677 489 1047 756 448 582 1055 218 616 604 1157 1523 291 1093 228 219 337 248 648 2417 280 897 353 369 2412 334 5689 145 708 903 811

©OGP

Mortality rate from shipping casualties per 1,000 shipyears (19962005) 22.7 14.6 11.2 10.3 10.0 9.2 8.9 8.2 7.4 6.9 6.8 6.7 6.3 6.1 5.2 4.1 3.9 3.6 3.6 3.6 3.4 3.2 3.2 3.1 3.0 2.9 2.9 2.7 2.7 2.6 2.3 2.1 2.0 1.5 1.5 1.4 1.2 1.1 1.1 0.7 0.6 0.5 0.5 0.4 0.3 0.0

RADD – Water transport accident statistics

4.2.2

Vessel Casualties

The Safety of Shipping in Coastal Waters (SAFECO) Project [9] provides an analysis of the LMIS database, giving frequencies of serious casualties for each major ship type, based on the period 1991-95. The UK Protection & Indemnity (P&I) Club produces a Major Claims Analysis, examining the causes of third-party claims over $100,000. A summary is on the P&I Club website www.ukpandi.com. It gives the number and value of claims, broken down by claim type, claim value, ship type, incident cause, ship age, flag etc. No population data is available. The Swedish Club website www.swedishclub.com includes a brief analysis of claims on hull & machinery and P&I insurance. It gives the number and average cost of claims, broken down by claim type. It also gives information on the number of vessels insured. 4.2.3

Oil Spills

The US Coast Guard maintains a Marine Safety Management System (MSMS) database of oil and chemical spills in US waters reported under the Federal Water Pollution Control Act. It includes spills into navigable inland waters and the sea up to 12 miles from the shore, and also spills threatening this area. It covers ships, pipelines and installations. It gives comprehensive coverage of spills since 1973, but also includes some earlier accidents. The USCG website www.uscg.mil/hq/g-m/nmc/response/stats/aa.htm gives summary statistics on the number and quantity of oil and chemicals spilled, broken down by spill size band, oil type, location, water body and source. The annual data mentions the largest individual incident in each year and its size. The database covers a wide variety of installations and marine environments. The summary statistics do not allow simultaneous breakdowns (say, for oil tankers in the Great Lakes), and no population data is available. As a result, no use is apparent for the internet data at present. USCG might give more useful results on request from the database itself. 4.2.4

Dangerous Goods Transport

The National Ports Council [10] analysed incidents in 10 UK ports, obtaining incident frequencies. The ports were categorised as river (e.g. Thames, Medway, Mersey, Tees), estuarine (Southampton, Harwich and Milford Haven) and open sea (Swansea only). The analysis included many minor incidents, including 33% that caused no appreciable damage and 54% slight damage such as minor dents or split harbour facing timbers. Hence only about 13% of the incidents would be comparable with the LMIS incident category. The Advisory Committee on Dangerous Substances (ACDS) of the UK Health & Safety Commission produced a report in 1991 [11] which incorporates a detailed QRA conducted by DNV Technica of risks to people ashore from tankers and liquefied gas carriers in ports, including frequency data based on LMIS and NPC. AEA Technology published an analysis of Incident Probabilities on Liquid Gas Ships [12] using data from the LMIS database for 1975-87. This gives means and confidence limits for incident frequencies broken down by gas carrier type, size and age, and by year and cause of the incident, and expressed as frequencies per ship year and per voyage. It covers all reported incidents, but also identifies serious casualties.

©OGP

15

RADD – Water transport accident statistics

AEA Technology published an analysis of Marine Incidents in Ports and Harbours in Great Britain [13] using data gathered directly from the ports for 1988-92. It gives incident frequencies broken down by port type, ship type, and by severity and cause of the incident, expressed as frequencies per ship visit.

5.0

Recommended data sources for further information

For further information, the data sources used to develop the frequencies presented in Section 2.0 and discussed in Section 4.0 should be consulted. The references used for the recommended data in Section 2.0 are shown in bold in Section 6.0.

6.0

References

1. Lloyd’s Register 2005: W orld Fleet Statistics 2004, Lloyds Register – Fairplay Lim ited, also corresponding annual reports for 1996-2003 data. 2. CMPT 1998: A Guide to Quantitative Risk Assessment of Offshore Installations, Centre for Marine and Petroleum Technology, London. 3. Spouge, J.R., Sm ith, E.J. & Lewis, K.J. 1994: Helicopters or Boats - Risk Managem ent Options for Transport Offshore, SPE Paper No 27277, Conference on Health, Safety & Environm ent in Oil & Gas Production, Society of Petroleum Engineers, Jakarta. 4. Roberts, S.E. & W illiam s, J. C. 2007: Update of Mortality for W orkers in the UK Merchant Shipping and Fishing Sectors, Report for the Maritim e and Coastguard Agency and the Departm ent for Transport, Research Project 578. 5. OGP, 2007. Safety perform ance indicators – 2006 data, Report No. 391. Also corresponding reports for 2001-2005 data. http://www.ogp.org.uk/Publications/index.asp 6. DNV 2001: Formal Safety Assessment of Tankers for Oil, Project C383184/4. 7. E&P Forum 1996: Quantitative Risk Assessment Datasheet Directory, E&P Forum Report No 11.8/250. 8. Department for Transport 2006: Road Casualties Great Britain 2006, http://www.dft.gov.uk/162259/162469/221412/221549/227755/rcgb2006v1.pdf. 9. DNV 1997, SAFECO, WP III.2, Statistical Analysis of Ship Accidents, Technical Report 97-2039. 10. NPC 1976: Analysis of Marine Incidents in Ports and Harbours, National Ports Council, London. 11. ACDS 1991: Major Hazard Aspects of the Transport of Dangerous Substances, Advisory Committee on Dangerous Substances, Health & Safety Commission, HMSO. 12. Borrill, E., Gould, J.H., Blything, K.W. & Lelland, A.N. 1994: Incident Probabilities on Liquid Gas Ships, AEA Report AEA/CS/HSE R1014. 13. Robinson, R.G.J. & Lelland, A.N. 1995: Marine Incidents in Ports and Harbours in Great Britain, 1988-1992, Report AEA/CS/HSE-R1051, AEA Technology. 14. Koornstra, M.J. 2008. A Model for the Determination of the Safest Mode of Passenger Transport between Locations in any Region of the World. Report for Shell International Exploration and Production B.V. 15. OCIMF 2008. Information Paper, Marine Breakaway Couplings, Oil Com panies International Marine Forum .

16

©OGP

Risk Assessment Data Directory Report No. 434 – 11.1 March 2010

Aviation transport accident statistics International Association of Oil & Gas Producers

RADD – Aviation transport accident statistics

contents 1.0 1.1 1.2 1.3

Scope and Application ........................................................... 1 Scope ............................................................................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0 2.1 2.2

Summary of Recommended Data ............................................ 2 Helicopter Transport....................................................................................... 2 Fixed Wing Aircraft Transport ....................................................................... 4

3.0 3.1 3.2 3.3

Guidance on use of data ........................................................ 6 General validity ............................................................................................... 6 Uncertainties ................................................................................................... 6 Application of frequencies to specific locations ......................................... 6

3.3.1 3.3.2

Helicopter Risk ........................................................................................................... 7 Fixed Wing Aircraft Risk............................................................................................ 8

4.0 4.1

Review of data sources ......................................................... 9 Basis of data presented ................................................................................. 9

4.1.1 4.1.2

Helicopter Transport .................................................................................................. 9 Fixed Wing Aircraft Transport................................................................................. 15

4.2

Other data sources ....................................................................................... 18

4.2.1 4.2.2

Helicopter Transport ................................................................................................ 18 Fixed Wing Aircraft Transport................................................................................. 18

5.0

Recommended data sources for further information ............ 18

6.0 6.1 6.2 6.3

References .......................................................................... 19 Helicopter References .................................................................................. 19 Fixed Wing Aircraft References................................................................... 19 Other References .......................................................................................... 20

Appendix I – Statistical Methods .................................................... 21

©OGP

RADD – Aviation transport accident statistics

Abbreviations: CAA DNV E&P FAR GoM ICAO IR MTOW NATS OGP POB PLL QRA SMS

(UK) Civil Aviation Authority Det Norske Veritas Exploration and Production Fatal Accident Rate Gulf of Mexico International Civil Aviation Organisation Individual Risk Maximum Take Off Weight National Air Traffic Services Oil and Gas Producers Personnel On Board Potential Loss of Life Quantitative Risk Assessment Safety Management System

TO/L UK(CS) WAAS

Take-Off and Landing United Kingdom (Continental Shelf) World Aircraft Accident Summary

©OGP

RADD – Aviation transport accident statistics

1.0

Scope and Application

1.1

Scope

This datasheet provides information on aviation transport accident statistics for use in Quantitative Risk Assessment (QRA). The data sheet includes guidelines for the use of recommended data and a review of the sources of the data. The data in this sheet are intended for two main uses: •

Assessing the risk of helicopter transport;

•

Assessing the risk of fixed wing transport.

1.2

Application

This datasheet contains global data plus more detailed regional/national data where relevant or where available. When using these data, it should be noted that they may not be directly applicable to the specific location under study. Guidance on using location specific data is given in Section 3.3.

1.3

Definitions

The data presented in Section 2.0 are for persons travelling by air during take-off, flight and landing. They exclude risks to persons on the ground: ground staff, flight/cabin crew and passengers boarding/leaving the air transport. Helicopter transport risks also exclude non transport activities such as search and rescue missions and winching. Transport risks to persons are presented as: •

Individual Risk (IR):

risk per year of fatality to a specific individual

•

Fatal Accident Rate (FAR):

risk of fatality per 108 exposed hours1

The following are used in the risk models presented in Sections 2.0 and 3.0: •

Probability of fatal accident

Probability that an accident results in at least one fatality

•

Probability of death in fatal accident Probability of death for one individual on board aircraft/helicopter involved in fatal accident

1

It should be noted that FARs are convenient for describing the risk in individual activities (e.g. working on the drill floor, flying in a helicopter). Unlike individual risks per year, they do not require any assumptions about what the individual does for the rest of the year. However, they may be misleading because they represent a rate of risk per unit time in the activity. FAR values for offshore workers are typically based on 26 weeks’ exposure per year (for a 2 weeks on, 2 weeks off rota pattern), equivalent to 4380 hours per person per year; the corresponding helicopter transport exposure is of the order of 30 hours per year. Hence, in contrast to individual risks per year, FARs cannot sensibly be added together. Whereas FAR values are in the range 144 to 815 for offshore transport (see Table 2.3), the total FAR in offshore activities may be only 10 to 20. Adding these values would give a misleading impression of the relative contribution of helicopter risk to the overall risk. Although it may still be a significant contributor to the total IR and PLL, it should be judged in the context of those measures, and the helicopter FAR value should not be added to the FAR values from other risks. However, it may be compared with FAR values for other modes of transport (e.g. fixed wing aircraft.) ©OGP

1

RADD – Aviation transport accident statistics

Data for the following helicopter activities are presented in Sections 2.1 and 4.1.1: •

Offshore (all offshore helicopter activity)

•

Seism ic (onshore seismic surveys)

•

Geophysical (onshore geophysical activity)

•

Pipeline (onshore pipeline surveys and support)

•

Other (all other onshore activity, e.g. crew changes, rig moves, non seismic external loads)

2.0

Summary of Recommended Data

The recommended frequencies and associated data are presented as follows: •

Helicopter Transport (Section 2.1)

•

Fixed Wing Aircraft Transport (Section 2.2)

2.1

Helicopter Transport

The following model is recommended. Individual risk (IR) per journey = In-flight IR + Take-off & landing (TO/L) IR In-flight IR =

Accident frequency in-flight (per hour) × Flight time (hours) × Probability of fatal accident × Probability of death in fatal accident

TO/L IR =

Accident frequency in TO/L (per flight stage) × No of flight stages per journey × Probability of fatal accident × Probability of death in fatal accident

Wherever possible, local (country/regional or air transport operator) data should be used (but see Section 3.3.1). Where these are not available, the frequencies and probabilities recommended for use in this model are set out in Table 2.1 (offshore transport) and Table 2.2 (other activities). The basis for the values in these tables is set out in Section 4.1.1. No trend over time can be identified in the 9 years’ data analysed.

2

©OGP

RADD – Aviation transport accident statistics

Table 2.1 Offshore Helicopter Transport Flight Accident Data for Risk Estim ation Model Region

Flight Phase

Frequency

North Sea

In-flight

8.5 × 10

Take-off & Landing In-flight

Gulf of Mexico

Rest of World

unit

Probability of Fatal Accident

-6

per flight hour

0.20

Probability of Death in Fatal Accident 0.85

4.3 × 10

-7

0.17

0.48

8.5 × 10

-6

per flight stage per flight hour

0.33

0.59

Take-off & Landing

2.7 × 10

-6

per flight stage

0.24

0.49

In-flight

8.5 × 10

-6

per flight hour

0.74

0.87

Take-off & Landing

2.7 × 10

-6

per flight stage

0.24

0.49

Table 2.2 Other Activities Helicopter Flight Accident Data for Risk Estim ation Model Activity

Flight Phase

Frequency

Seismic

In-flight

4.1 × 10

Geophysical

Take-off & Landing In-flight

Pipeline

Other

unit

Probability of Fatal Accident

-5

per flight hour

0.26

Probability of Death in Fatal Accident 0.54

1.8 × 10

-5

0.15

0.74

1.1 × 10

-5

per flight stage per flight hour

1.00

0.86

Take-off & Landing

8.8 × 10

-6

per flight stage

0.16

0.34

In-flight

6.3 × 10

-5

0.36

0.62

Take-off & Landing

2.6 × 10

-5

per flight hour per flight stage

0.25

0.47

In-flight

4.1 × 10

-5

0.26

1.00

Take-off & Landing

1.8 × 10

-5

per flight hour per flight stage

0.15

0.33

©OGP

3

RADD – Aviation transport accident statistics

Table 2.3 gives FAR values for helicopter transport. Table 2.3 Estim ated FAR Values for Helicopter Transport Activity Offshore Transport

Region North Sea

FAR 144

Gulf of Mexico Rest of World

2.2

454 815

All

509

Seismic Geophysical

All All

5268 4792

Pipeline

All

8883

Other All except Offshore Transport

All All

2487 3670

Fixed Wing Aircraft Transport

Table 2.4 presents basis accident, individual risk and FAR data. Table 2.4 Average W orldwide W estern Jet Data (excluding hostile attacks and personal accidents 1 ) Measure

Value

2

6.2 × 10

-7

Fatal accident frequency per flight hour

2

3.4 × 10

-7

Individual risk per person flight

4.1 × 10

-7

Individual risk per person flight hour

2.3 × 10

-7

Fatal accident frequency per flight

FAR

23

Notes

1. Such as ground crew fatal injuries, slips, trips and falls. 2. Defined as fatality within 30 days of the accident. Excludes fatal illnesses on board aircraft.

There appears to be a downward trend in accident frequencies of 4.5% a year [10]. Hence, as these values are based on 1990-2002 data (see Section 4.1.2), for 2008 a modification factor of 0.58 (4.5% decrease/year × 12 years since the mid-point of the dataset) could be used. A number of other factors could have an impact on the accident frequencies. The tables below address: • • • •

4

the type of accident considered (Table 2.5); the operating region/location (Table 2.6); the type of operation – scheduled, cargo etc. – (Table 2.7); and the type of aircraft used (Table 2.8).

©OGP

RADD – Aviation transport accident statistics

Table 2.5 M ultiplication Factors for Accident Frequencies Frequency Type

Modification Factor

Frequency of fatal accidents including hostile acts and personal accidents Frequency of ICAO defined accidents (i.e. involving substantial damage to the aircraft and/or serious/fatal injury to people) Frequency of hull loss (i.e. events where the aircraft is missing or damaged beyond economic repair)

1.15 3.53 1.37

Table 2.6 M ultiplication Factors for Operating Regions Operating Region (Operator Domicile) Western Europe, North America and Australasia Middle East and Asia (excluding China) Latin America Eastern Europe (including Russia), Africa and China

Modification Factor 0.36 1.8 2.4 3.9

Table 2.7 M ultiplication Factors for Types of Operation Operation Scheduled passenger (e.g. major airlines) Non-scheduled passenger (e.g. charter flights) Scheduled cargo (e.g. UPS, FedEx, DHL etc) Non-scheduled cargo

Modification Factor 0.83 2.1 2.0 5.3

Table 2.8 M ultiplication Factors for Types of Aircraft Aircraft Type First generation Western jets (e.g. B707, DC-8)* Second generation Western jets (e.g. B727, DC-9, F28)* Early widebody Western jets (e.g. B747, DC-10)* Current Western jets (e.g. B757/767/777, A330/340, F100)* Eastern built jets (e.g. Il76, Tu154) Executive jets (e.g. Citation, Gulfstream, Learjet) Early turboprops first delivered before 1970 (e.g. BAe 748, F27) Modern turboprops first delivered since 1970 (e.g. DH-8, F50) Piston-engine aircraft (e.g. Islander, Cessna 150, PA28)

Modification Factor 11.8 1.25 2.24 0.65 2 13 4 1.2 19

* See Section 4.1.2.4 for a full list of aircraft types covered by these definitions.

©OGP

5

RADD – Aviation transport accident statistics

3.0

Guidance on use of data

3.1

General validity

If transport risk is a relatively small contribution to an overall risk study, the data above may be sufficient. However, if transport risk is the object of the study or is believed to be significant, local data become very important. It is strongly recommended that local data sources on accidents and transport risk are obtained wherever possible (but see Section 3.3.1). This is because there can be large local variations. In the absence of local data, the data presented in Section 2.0 can be used.

3.2

Uncertainties

With respect to the helicopter accident data in Section 2.1, the main uncertainties arise from the relatively limited number of fatal accidents that have occurred in the regions mentioned in Table 2.1, and from the small numbers of flights and of fatal accidents in some of the activities mentioned in Table 2.2. These are discussed further in Section 4.1.1. The data presented in Section 2.1 are based on information provided to OGP by OGP’s members, and may not be representative in all geographical areas. Variations may exist between different helicopter types: this is examined in Section 4.1.1. It is suggested there that there are no significant systematic variations in accident rates between different helicopter types but it may be desirable to use type specific data where available, at least as a sensitivity. Regarding the fixed wing aircraft accident frequencies in Section 2.2, there are significant uncertainties concerning the modification factors. It is preferable to incorporate them in the analysis by some means rather than to use the basis frequencies (Table 2.4) without modification for the specific situation addressed by the QRA. The available data (see Section 4.1.2) do not permit rigorous analysis of the all the factors involved and of possible correlations between them. Two possible approaches may be adopted: 1. As a simple approach, it could be assumed that the above sets of modification factors are independent and can be combined to estimate the risks in specific cases. However, many of the factors could be correlated. For example, much of the observed downward trend in accident frequency has resulted from the introduction of current generation aircraft, which have been used mainly for scheduled passenger services in Western countries. Meanwhile, older jets are used mainly in developing countries and for cargo operations. Hence, the combination of factors will tend to over-estimate the effects in cases where several factors all increase or reduce the risk. 2. An alternative approach would be to select what are judged the most significant issues and just use one or two modification factors. This is illustrated below in Section 3.3.

3.3

Application of frequencies to specific locations

This datasheet contains global data plus more detailed regional data where available. When using these data, it should be realised that they may not be directly applicable to the specific location under study. It is therefore strongly recommended that local data sources on accidents and transport risk be obtained before using the data given in this sheet (but see Section 3.3.1). Local sources could include governmental or

6

©OGP

RADD – Aviation transport accident statistics

other national or regional institutions, or the facility operator's or local air transport operator's data. Should local data not be available, or their reliability/applicability be uncertain, then the data in this datasheet could be used after factoring for local circumstances. However, data which have been adjusted to allow for local circumstances should always be used with caution: the assumptions made are likely to be judgemental and hence may reduce the reliability of the adjusted data vis-à-vis reality. Each assumption should be clearly documented so that an audit trail is maintained. 3.3.1

Helicopter Risk

In Sections 3.1 and 3.3 the use of local data wherever possible is recommended. However, the number of fatal accidents is relatively small. It is therefore recom m ended that local accident frequencies, where available, are com bined with the generic probabilities given in Section 2.1. The following example illustrates how the data in Section 2.1 can be used to estimate helicopter transport annual risks. A North Sea installation crew member works 2 weeks on, 2 weeks off. The flight from the heliport to their installation is in 2 stages (i.e. via another installation) and the total time in the air is 1 hour. Their IR would be calculated as follows. Total flight stages = 13 offshore trips/year × 2 flights/trip × 2 stages/flight = 52 stages/year Total flight time = 13 offshore trips/year × 2 flights/trip × 1 hour/flight = 26 hours/year In-flight IR =

Accident frequency in-flight (8.5 × 10-6 per flight hour) × Flight time (26 hours/year) × Probability of fatal accident (0.20) × Probability of death in fatal accident (0.85) -5

= 3.8 × 10 per year TO/L IR =

Accident frequency in TO/L (1.0 × 10-5 per flight stage) × No of flight stages (52/year) × × Probability of fatal accident (0.17) × × Probability of death in fatal accident (0.48) -5

= 4.2 × 10 per year Total IR =

3.8 × 10-5 + 4.2 × 10-5 per year = 8.0 × 10-5 per year

The annual PLL (Potential Loss of Life) from helicopter transport for the installation can be calculated with the following additional information. The platform POB is 48. 2 crews operate back-to-back. Helicopter transport is provided by the S-76, which has a passenger capacity of 12. Hence each crew change requires 4 helicopter flights. Total PLL =

Total IR × no. of crews × flights/crew × passengers/flight =8.0 × 10-5 per year × 2 × 4 × 12 = 7.7 × 10-3

©OGP

7

RADD – Aviation transport accident statistics

However, it should be noted that in practice not all personnel visiting a platform work exactly 2 weeks on, 2 weeks off. Additional personnel may be flown out for specific tasks lasting perhaps just a few days; there may be visitors to the platform, perhaps arriving and departing within the same day. Hence true risk estimates may vary between individuals. 3.3.2

Fixed Wing Aircraft Risk

To illustrate how the fixed wing data in Section 02.2 could be used, four examples are set out below. 1.

Worldwide average individual risks travelling on Western Jet in 2008

Basic FAR

= 23

Trend factor

× 0.58 (see Section 2.2)

Current FAR

= 13

2.

Scheduled passenger jet flight in Western Europe, N. America, Australasia

Basic FAR

= 23

Scheduled passenger

× 0.83 (from Table 2.7)

Operating Region

× 0.36 (from Table 2.6)

Local FAR

=7

N.B. Modification factors are based only on accident rates and not accident consequences (probability of fatality in an accident) as the latter show relatively small variations. In the above calculation the trend factor is not used, as the use of modern aircraft has been widespread in these regions for some time. 3.

Worldwide average individual risks travelling on Non scheduled passenger flight in 2008

Basic FAR

= 23

Trend factor

× 0.58 (see Section 2.2)

Non scheduled passenger × 2.1 Current Local FAR 4.

(from Table 2.7)

= 28

Specific individual risks travelling on Non scheduled passenger flight in older style of aircraft in Middle East

Basic FAR

= 23

Non scheduled passenger × 2.1

(from Table 2.7)

Operating Region

× 1.8

(from Table 2.6)

Specific Local FAR

= 87

Sensitivity tests can involve applying extra (or fewer) modification factors to obtain realistic ranges. For example in example 4 above, no trend factor was applied as older

8

©OGP

RADD – Aviation transport accident statistics

aircraft were being assessed; however, if it were considered that operational standards were equivalent to today’s standards the trend factor could be applied (× 0.58) leading to a FAR range of 50 to 87.

4.0

Review of data sources

4.1

Basis of data presented

4.1.1

Helicopter Transport

4.1.1.1 Principal Analysis The main source of data is the annual reports produced by OGP [1][2][3][4][5][6][7][8] for each year 1998 to 2006 apart from 1999. These have been supplemented by operational data for 1999 and more detailed accident information provided on behalf of OGP [9]. The operational data are presented by region for offshore activities and aggregated worldwide for other activities. The detailed accident data give: date, helicopter operator, activity, helicopter model and type (see Section 4.1.1.2), country, nos. of passenger and crew injuries and fatalities, flight phase, and a brief description of the accident cause. They do not give the number of passengers carried on the flight. Table 4.1 and Table 4.2 summarise the operational and accident data for offshore transport and other activities respectively. These form the basis of the analysis presented in this datasheet. Table 4.3 and Table 4.4 present the raw analysis of the data given in Table 4.1 and Table 4.2 respectively. It will be noted that in some cases entries appear as 0. Furthermore, given the limited accident data, it can be questioned whether the differences between regions for offshore helicopter transport, and between activities for other activities, are statistically significant. Figure 4.1 shows the accident frequencies for offshore activities by region and overall, with error bars showing 90% confidence limits (see Appendix I). From this it was concluded as follows: •

The difference in in-flight accident frequencies between the three regions is not statistically significant, so the overall value has been substituted in Table 2.1 for the region specific values in Table 4.3.

•

The difference in take-off/landing accident frequencies between the GoM and Other regions is not statistically significant, so the overall value for these two regions has been substituted in Table 2.1 for the region specific values in Table 4.3.

©OGP

9

RADD – Aviation transport accident statistics

Table 4.1 Sum m ary of Offshore Operational and Accident Statistics 1998-2006 North Sea Flight Phase In-flight Take-off Landing TO/L GoM Flight Phase In-flight Take-off Landing TO/L Other Flight Phase In-flight Take-off Landing TO/L

Flight Hours SE 0 -

LT 414 -

MT 341,470 -

Take-Offs and Landings HT 971,320 -

Flight Hours SE LT 2,598,714 285,614 -

MT 719,222 -

Flight Hours

SE 401,561 -

SE 0

LT 456

Accidents by heli type Accidents SE Fatal MT HT LT MT HT s 10 0 0 3 7 2 1 0 0 0 1 0 0 0 0 0 0 0 1,284,244 1,066,270 1 0 0 0 1 0

Take-Offs and Landings

HT 95,609 -

Accidents by heli type Accidents SE Fatal SE LT MT HT LT MT HT s 36 30 2 4 0 12 14 13 1 0 0 3 21 18 1 2 0 4 9,812,645 942,850 1,542,599 159,899 35 31 2 2 0 7 Take-Offs and Landings

Accidents by heli type Accidents SE Fatal LT MT HT SE LT MT HT LT MT HT s 117,569 2,127,399 464,692 23 3 1 16 3 17 8 2 2 2 2 2 15 1 0 11 3 5 2,482,319 240,428 5,334,178 832,160 23 3 2 13 5 7

SE = Single Engine; LT = Light Twin; MT = Medium Twin; HT = Heavy Twin

10

©OGP

Fatals by heli type SE 0

LT 0

MT 2

HT 0

0

0

0

0

Fatalitie s 18 0 0 0

Fatals by heli type SE 10 3 4 7

LT 1 0 0 0

MT 1 0 0 0

HT 0 0 0 0

Fatalitie s 27 6 7 13

Fatals by heli type SE 3 1 0 1

LT 1 0 0 0

MT 11 1 3 4

HT 2 0 2 2

Fatalitie s 99 13 12 25

RADD – Aviation transport accident statistics

Table 4.2 Sum m ary of Other Operational and Accident Statistics 1998-2006 Seismic Flight Phase In-flight Take-off Landing TO/L Geophysica l Flight Phase In-flight Take-off Landing TO/L Pipeline Flight Phase In-flight Take-off Landing TO/L Other Flight Phase In-flight Take-off Landing TO/L

Flight Hours SE 317,127 -

LT 7,071 -

MT 67,927 -

Take-Offs and Landings HT 6,029 -

SE 1,221,253

LT 9,046

MT 146,785

HT 9,072

Accidents by heli type Accidents SE Fatal LT MT HT s 18 17 0 1 0 5 13 11 0 2 0 2 11 11 0 0 0 1 24 22 0 2 0 3

Fatals by heli type SE 4 1 1 2

LT 0 0 0 0

MT 1 1 0 1

HT 0 0 0 0

Fatalitie s 7 5 1 6

Accidents by heli type Flight Hours

Take-Offs and Landings

Fatals by heli type Accidents SE

SE 68,988 -

LT 8,485 -

MT 8,580 -

HT 2,232 -

Flight Hours SE 183,288 -

LT 6,832 -

MT 25,312 -

LT 21,465 -

MT 99,741 -

LT 6,815

MT 6,028

HT 2,633

1 0 0 0

1 0 0 0

LT 0 0 0 0

MT 0 0 0 0

HT 0 0 0 0

Take-Offs and Landings HT 6,138 -

Flight Hours SE 175,687 -

SE 63,881

Fatal s 1 0 0 0

SE 189,149

LT 8,144

MT 96,940

Accidents by heli type Accidents SE Fatal HT LT MT HT s 14 11 0 1 2 5 1 1 0 0 0 1 7 5 0 1 1 1 18,385 8 6 0 1 1 2

Take-Offs and Landings HT 131,271 -

SE 292,044

LT 24,774

MT 396,507

Accidents by heli type Accidents SE Fatal HT LT MT HT s 16 11 1 3 1 4 5 4 0 0 1 1 12 8 1 1 2 2 158,576 17 12 1 1 3 3

SE 1 0 0 0

LT 0 0 0 0

MT 0 0 0 0

HT 0 0 0 0

Fatalitie s 2 0 0 0

Fatals by heli type SE 2 1 0 1

LT 0 0 0 0

MT 1 0 1 1

HT 2 0 0 0

Fatalitie s 16 1 4 5

Fatals by heli type SE 2 1 0 1

LT 1 0 0 0

MT 0 0 1 1

HT 1 0 1 1

Fatalitie s 28 3 2 5

SE = Single Engine; LT = Light Twin; MT = Medium Twin; HT = Heavy Twin

©OGP

11

RADD – Aviation transport accident statistics

Table 4.3 Offshore Transport Flight Accident Data Region

Flight Phase

Frequency

unit

Probability of Fatal Accident

North Sea

In-flight

8.5 × 10-6

0.20

Take-off & Landing In-flight

4.3 × 10-7

0

0

0.33

0.59

Take-off & Landing In-flight

2.8 × 10-6

0.20

0.53

0.74

0.87

Take-off & Landing

2.6 × 10-6

per flight hour per flight stage per flight hour per flight stage per flight hour per flight stage

Probability of Death in Fatal Accident 1.00

0.30

0.48

Gulf of Mexico

Rest of World

9.7 × 10-6

7.4 × 10-6

Table 4.4 Other Activities Flight Accident Data Activity

Flight Phase

Frequency

unit

Probability of Fatal Accident

Seismic

In-flight

2.7 × 10-5

0.28

1.0 × 10-5

0.13

0.74

Geophysical

Take-off & Landing In-flight

1.00

0.86

0

0

0

Pipeline

Take-off & Landing In-flight

0.36

0.62

2.6 × 10-5

0.25

0.47

Other

Take-off & Landing In-flight

0.25

1.00

Take-off & Landing

1.9 × 10-5

per flight hour per flight stage per flight hour per flight stage per flight hour per flight stage per flight hour per flight stage

Probability of Death in Fatal Accident 0.54

0.18

0.33

12

1.1 × 10-5

6.3 × 10-5

3.7 × 10-5

©OGP

RADD – Aviation transport accident statistics

Figure 4.1 Offshore Helicopter Accident Frequencies

No accidents on take-off and landing have occurred during geophysical activities (Table 4.4); an accepted statistical technique of assuming 0.7 accidents to date (see Appendix I) has been applied. The significance of statistical differences in accident frequencies has been analysed for other activities in similar manner to that above for offshore transport, as shown in Figure 4.2. From this it was concluded that: •

The differences in in-flight and take-off/landing accident frequencies between Seismic and Other activities (i.e. apart from pipeline and geophysical activities) is not statistically significant, so the overall values for these two activities have been substituted in Table 2.2 for the activity specific values in Table 4.4.

Similar analysis can be applied to the fatal accident probabilities and the fatalities/fatal accident fractions. Addressing first the zeroes in Table 4.3 and Table 4.4: •

For take-off/landing accidents in the North Sea, the longer-term UK averages based on CAA accident and exposure data have been used in Table 2.1.

•

The same has been done for the fatality rate in fatal in-flight accidents in the North Sea.

•

For take-off/landing accidents in geophysical activities, the averages for all non offshore transport activities have been used in Table 2.2.

Next, considering the significance of statistical differences, it was concluded that: •

The differences in fatal accident probabilities for in-flight and take-off/landing accidents during Seismic and Other activities are not statistically significant, so the overall value for these two activities has been substituted in Table 2.2 for the activity specific values in Table 4.4.

Apart from the above exceptions, the values in Table 2.1 and Table 2.2 are the same as those in Table 4.3 and Table 4.4.

©OGP

13

RADD – Aviation transport accident statistics

Figure 4.2 Other Activities Helicopter Accident Frequencies

4.1.1.2 Effect of Helicopter Type Helicopters are categorised as: •

SE (Single Engine), e.g. AS350B Squirrel

•

LT (Light Twin), e.g. Eurocopter AS355

•

MT (Medium Twin), e.g. Sikorsky S-76A

•

HT (Heavy Twin), e.g. SA332 Super Puma

The OGP data enable comparisons to be made between these 4 categories. The accident frequencies are shown in Figure 4.3. From this it would be reasonable to conclude that there are no significant differences in accident frequencies for the different helicopter types (although the in-flight frequency for SE helicopters and takeoff/landing frequency for MT helicopters could be considered to be significantly different to the overall frequencies for the other types.) Hence no variation by helicopter type is suggested.

14

©OGP

RADD – Aviation transport accident statistics

Figure 4.3 Helicopter Accident Frequencies by Type (all activities)

SE = Single Engine; LT = Light Twin; MT = Medium Twin; HT = Heavy Twin

4.1.2

Fixed Wing Aircraft Transport

4.1.2.1 Large Western Jets 4.1.2.1.1 Fatal Accident Frequencies

The values in Section 2.2 are taken from [10], which uses the Airclaims World Aircraft Accident Summary (WAAS) [11] as the primary data source. This was checked for omissions using data from Boeing [12] and the websites PlaneCrashInfo (www.planecrashinfo.com/) and Aviation Safety Network (http://aviationsafety.net/statistics/). There are relatively few convenient sources of flight exposure data. The main ones are reviewed by NATS [13]. The most convenient source is Boeing [12], which covers large Western passenger jets (defined below). [10] summarises 148 fatal accidents on Large Western Commercial Jets, 1990-2002. Of these 19 were either hostile acts or personal accidents. Thus the total was 129 excluding these events. During 1990-99 there were 157.5 million departures [12]. Departures in the subsequent 3 years have been reported as 18.14, 16.88 and 16.52 million [12], giving a total of 209.05 million during 1990-2002. The number of flight hours in the Boeing data during 1990-2002 has been estimated as 380 million. This gives an average flight length of 380/209 = 1.82 hours. This value has increased during the period, and appears to be approximately 2.0 hours in 2002. This is significantly higher than the standard value of 1.5 hours quoted by Boeing [12], which seems to be based on much older data. Based on the 129 fatal accidents and the exposure data above the Fatal accident frequency per flight = 6.2 × 10-7 and the Fatal accident frequency per aircraft flight hour is 3.4 × 10-7 as shown in Table 2.4. The individual risk values in Table 2.4 are derived from the same data sources. The relevant data are shown in Table 4.5.

©OGP

15

RADD – Aviation transport accident statistics

Table 4.5 Individual Risks on Large W estern Com m ercial Jets, 1990-2002 Individual Risk per flight

Individual Risk per flight hour 8213

Fatalities Exposure Risk

10

2.0 × 10 person flights

3.6 × 10

10

person flight hours

-7

-7

4.1 × 10 per person flight

2.3 × 10 per person flight hr FAR = 23

4.1.2.1.2 Aircraft Accident Frequencies

“Aircraft accidents” are events causing substantial damage to the aircraft or serious/fatal injury to people. The Boeing database [5] for 1959-2002 includes 1337 aircraft accidents, of which 509 were fatal, i.e. 2.63 accidents per fatal accident. For 1993-2002 there were 385 accidents, of which 109 were fatal, i.e. 3.53 accidents per fatal accident. This trend probably reflects improved reporting, so the more recent number is used in Table 2.5. 4.1.2.1.3 Hull Loss Frequencies

“Hull losses” (also known as “total losses”) are events where the aircraft is missing, inaccessible or damaged beyond economic repair. The Boeing database [12] for 1959-2002 includes 695 hull losses, compared to 509 fatal accidents, i.e. 1.37 hull losses per fatal accident. 4.1.2.2 Impact of Operating Regions [14] gives fatal accident frequencies for all commercial aircraft over 5700 kg MTOW during 1980-2001 broken down by operator domicile. This data is used to develop the modification factors summarised in Section 02.2. It should be noted that local air traffic control is not a significant primary cause of accidents (see e.g. [15]) and that the operator domicile dominates any geographic factors. 4.1.2.3 Impact of Types of Operations [16] presents frequencies of hull loss and/or fatal accidents on Western jets and turboprops over 5700 kg MTOW world-wide during 1970-99 for different types of operator: •

Major operators, with large jet fleets, mainly scheduled passenger.

•

Integrators, with large scheduled cargo fleets (e.g. UPS, FedEx, DHL).

•

Supplemental air carriers, with mainly commuter turboprops.

•

Ad-hoc operators, with mainly unscheduled charter flights.

This shows that unscheduled (i.e. ad-hoc) passenger operations have an accident frequency 2.5 times higher than scheduled (i.e. other) passenger operations. These values have been used to derive the modification factors in Table 2.7.

16

©OGP

RADD – Aviation transport accident statistics

4.1.2.4 Impact of Aircraft Type The Boeing analysis includes hull loss frequencies for individual jet types. In most cases the differences are either not statistically significant or reflect operating features specific to the aircraft type (e.g. higher rates per departure for short-haul types). Boeing also groups the aircraft by generation, as follows: •

First generation – B707/720, DC-8.

•

Second generation – B727, B737-100/200, DC-9, BAC 1-11, F-28.

•

Early widebody - B747-100/200/300/SP, DC-10, L-1011, A300

•

Current – B717, B737-300 and later, B747-400, B757/767/777, MD-11/80/90, A300600, A310/319/320/321/330/340, F-70, F-100, BAe 146, RJ-70, RJ-85, RJ-100.

The different rates Boeing derived have been used to derive the first 4 values in Table 2.8. [14] shows the fatal accident frequency for Eastern built aircraft (jets and turboprops over 5700 kg MTOW) roughly equal to that of Western built aircraft during 1980-89. The difference appeared to widen in about 1990, and during the period 1990-2001 the fatal accident frequency for Eastern built aircraft has been approximately a factor of 2 higher than for Western built aircraft. Business (or executive) jets are used for business or private transport, typically less than 20 tonnes. They include Bombardier (Canadair) Challenger and Learjet. [13] estimates a first-world airport-related crash frequency for executive jets of 2.2 crashes per million movements, a factor of 15 higher than for Western jets (excluding first generation jets) on scheduled passenger services. Since scheduled passenger services have a modification factor of 0.83 compared to the basis dataset (Table 2.7), the appropriate modification factor for executive jets is 15 × 0.83 = 13. [13] categorises Western airliner turboprops as follows: •

Early turboprops (T2) first delivered before 1970 – BAe 748, Vanguard, Viscount, Convair 540/580/600/640, Dart Herald, DH Twin Otter, Fairchild F27, FH227, Fairchild Metro, Fokker F27, Gulfstream 1, Hercules, Electra, Skyvan.

•

Other turboprops (T1) first delivered in or after 1970 – ATR 42, ATP 72, BAe ATP, Jetstream 31/41, DH Dash 7/8, Do 228/328, EMB 110/120, Fokker F50, Saab 340/2000, Shorts 330/360.

Airport-related crash frequencies on Western airliner turboprops over 5700 kg MTOW on scheduled passenger services during 1979-97, for first-world and world-wide, are shown in [6] enabling the modification factors in Table 2.8 to be derived. [6] estimates a UK airport-related crash frequency for piston-engine aircraft in commercial use during 1985-97 of 3.27 crashes per million movements, 22 times higher than for Western jets (excluding first generation jets) on scheduled passenger services in the first world. This was assumed applicable to all piston-engine operations in the UK. Since scheduled passenger services have a modification factor of 0.83 compared to the basis dataset, the appropriate modification factor is 22 × 0.83 = 19 (see Table 2.8).

©OGP

17

RADD – Aviation transport accident statistics

4.2

Other data sources

4.2.1

Helicopter Transport

DNV has carried out a more detailed analysis of UK helicopter accident rates for one OGP member based on data for the years 1970-2006 using the UK Civil Aviation statistical reports up to the last year of their publication (2002 data) and for 2003 onwards by direct request to the CAA for the accident data. The CAA’s exposure data is tabulated by helicopter model as “Public Transport Air Taxi Operations”, which cover mainly but not exclusively offshore transport operations. DNV has previously analysed data for Norway, Denmark and The Netherlands. The analysis was based on a combination of CAA and OGP data, which can be obtained by country. DNV also analysed Gulf of Mexico data in more detail. Gulf of Mexico helicopter accident statistics were obtained from WAAS [11] and the NTSB accident database [18]; flight exposure data was obtained from OGP. As an example of using operator specific data, DNV estimated historical accident frequencies in one company’s offshore operations. Its experience prior to 1993 amounted to approximately 56,000 flying hours and 105,000 flight stages [19]. In that time there were 2 crashes, one of which was on landing and one on flight. There were no fatalities. This gives accident frequencies as follows:

At the time of the analysis, these accident frequencies were not significantly different from the frequencies for other regions. Note that, compared with the exposure and accident statistics given in Table 4.1 and SE = Single Engine; LT = Light Twin; MT = Medium Twin; HT = Heavy Twin

Table 4.2, the numbers of flights and accidents are small, giving wide confidence limits on the results. 4.2.2

Fixed Wing Aircraft Transport

[20] derived individual risks on UK airlines doing international flights 1975-92 as a FAR of 15. [21][21] studied annual individual risk for workers in the USA during 1979-83 which gave 9.0 × 10-4 for pilots and 1.6 × 10-4 for stewardesses. The difference between the figures for pilots and stewardesses may result from the inclusion of general aviation pilots.

5.0

Recommended data sources for further information

For further information, the data sources used to develop the frequencies presented in Section 2.0 and discussed in Section 4.0 should be consulted. The references used for the recommended data in Section 2.0 are shown in bold in Section 6.0.

18

©OGP

RADD – Aviation transport accident statistics

[22] provides an interesting model for comparing risks of using different transport modes. However, it does not present any advantages or improved data analysis compared with those presented in the preceding sections (and in the datasheets Land Transport Accident Statistics and Water Transport Accident Statistics).

6.0

References

6.1

Helicopter References

[1] OGP 1999. Safety performance of helicopter operations in the oil & gas industry 1998, Report No. 6.83/300. http://www.ogp.org.uk/pubs/300.pdf (No report published with 1999 data; see [9].) [2] OGP 2002. Safety performance of helicopter operations in the oil & gas industry: 2000 data, Report No. 6.61/333. http://www.ogp.org.uk/pubs/333.pdf [3] OGP 2003. Safety performance of helicopter operations in the oil & gas industry: 2001 data, Report No. 341. http://www.ogp.org.uk/pubs/341.pdf [4] OGP 2004. Safety performance of helicopter operations in the oil & gas industry: 2002 data, Report No. 354. http://www.ogp.org.uk/pubs/354.pdf [5] OGP 2005. Safety performance of helicopter operations in the oil & gas industry: 2003 data, Report No. 366. http://www.ogp.org.uk/pubs/366.pdf [6] OGP 2006. Safety performance of helicopter operations in the oil & gas industry: 2004 data, Report No. 371. http://www.ogp.org.uk/pubs/371.pdf [7] OGP 2007. Safety performance of helicopter operations in the oil & gas industry: 2005 data, Report No. 401. http://www.ogp.org.uk/pubs/401.pdf [8] OGP 2007. Safety performance of helicopter operations in the oil & gas industry: 2006 data, Report No. 402. http://www.ogp.org.uk/pubs/402.pdf [9] OGP, private com m unication, 2008. Helicopter operational data for 1999; additional data on helicopter accidents.

6.2

Fixed Wing Aircraft References

[10] DNV 2004. Aircraft Accident Risks, Technical Note T25 [11] Airclaim s 2003. W orld Aircraft Accident Sum m ary 1990-2002, CAP 479, Airclaim s Ltd, London (updated annually). [12] Boeing 2003. Statistical Summary of Commercial Jet Airplane Accidents, W orldwide Operations, 1959-2003, Boeing Com m ercial Airplanes Group, Seattle, W A, USA (updated annually). [13] NATS 2000. A Methodology for Calculating Individual Risk due to Aircraft Accidents Near Airports, P.G. Cowell et al, R&D Report 0007, National Air Traffic Services Ltd, London. [14] IVW 2002. Civil Aviation Safety Data 1980-2001, Inspectie Verkeer en W aterstaat, Hoofddorp, Netherlands. [15] Eurocontrol, 2005. ATM Contribution to Aircraft Accidents / Incidents, Review and Analysis of Historical Data, SRC Docum ent 2, 4 th ed. http://www.eurocontrol.int/src/gallery/content/public/documents/deliverables/srcdoc2_e40_ri_web. pdf

©OGP

19

RADD – Aviation transport accident statistics

[16] Roelen, A.L.C., Pikaar, A.J. & Ovaa, W ., 2000. An Analysis of the Safety Performance of Air Cargo Operators, Report NLR-TP-2000-210, National Aerospace Laboratory. [17] CAA, UK Airline Statistics, Table 1 13 Public Transport Air Taxi Operations: http://www.caa.co.uk/default.aspx?categoryid=80&pagetype=88&pageid=1&sglid=1 [18] NTSB. Accident Database and Synopses, 1962-present; query using http://ntsb.gov/ntsb/query.asp [19] Spouge, J.R., Smith, E.J., & Lewis, K.J., 1994. Helicopters or Boards – Risk Management Options for Transport Offshore, SPE Paper No. 27277, Conf. on Health, Safety & Environment in Oil & Gas Production, Jakarta, Society of Petroleum Engineers. [20] Collings, H., 1994. Comparative Accident Rates for Passengers by Model of Transport – A Re-Visit, in Transport Statistics Great Britain 1994, Department of Transport, London: HMSO. [21] Leigh, J.P., 1995. Causes of Death in the Workplace, Quorum Books, Westport CT, USA.

6.3

Other References

[22] Koornstra, M.J., 2008. A Model for the Determination of the Safest Mode of Passenger Transport between Locations in any Region of the World, Report for Shell International Exploration and Production B.V.

20

©OGP

RADD – Aviation transport accident statistics

Appendix I – Statistical Methods I.1

Outline

Historical frequencies are estimated from experience of actual events and associated exposure. In simple terms, the event frequency is given by:

The events may be accidents of a particular type, minor incidents with the potential to lead to an accident, component failures or near misses. Examples are pipe leaks, pump trips, ship collisions, lightning strikes, etc. The associated exposure is a measure of size of the population from which the events have been recorded. This is usually a number of items and/or a number of years. Both the accident experience and the exposure must be comprehensive collections from the same population.

I.2

Frequency Estimates

The observed events are used to estimate an underlying event frequency (or failure rate), which can never be known exactly since the experience is limited. Normally the event frequency F is calculated directly from the number of events N and the exposure period Y as:

This is a simple and convenient estimate, but may be an under-estimate if there are few or no failures in the observed period. A more conservative estimate, which assumes that a further failure was about to occur when the end of the period was reached, is:

However, this is not normally used in QRA since it appears counter-intuitive, and is a negligible correction for large numbers of failures.

I.3

Frequency Estimates with No Failures

Where there have been no failures in the observed period, the above approach may still be used, assuming a failure was about to occur at the end of the observed period. A slightly less conservative (and more intuitively reasonable) estimate of the underlying frequency is given by the 50% confidence limit on the true mean of a Poisson distribution when no failures have been observed (also equal to the 50% point on a chi-square distribution with 1 degree of freedom). This is:

In colloquial terms, this assumes that the system was '70% of the way to its first failure' at the end of the observed period, or that '0.7 events' occurred in the period.

©OGP

21

RADD – Aviation transport accident statistics

It might be thought that the 95% confidence limit would be more appropriate for a cautious best-estimate than the 50% limit. However, this would result in a frequency equivalent to 3 events having occurred in the observed period (see below), which is usually considered excessively conservative.

I.4

Confidence Limits on Frequency Estimates

Statistical confidence limits may be attached to the frequency estimate, which reflect the uncertainty in estimating the underlying frequency from a small sample of events. Techniques for calculating confidence limits are presented in [23] and [24]. For QRA, a 90% confidence range is usually adequate, extending between a lower (5%) and an upper (95%) confidence limit, defined in terms of a chi-square distribution as follows:

These imply a 90% chance that the true frequency lies within the stated range, a 5% chance of it being lower than the lower limit, and a 5% chance of it being above the upper limit. The upper limit as defined above takes account of the possibility that the next event was about to occur when the end of the period was reached. When no failures have occurred, the confidence limits cannot be expressed as fractions of the mean (since this is zero). However, using a consistent approach, the 90% confidence range on the number of failures is then 0.05 to 3.0, with the 50% confidence value being 0.7 as above. These confidence ranges only take account of uncertainty due to estimating the frequency from a small number of random events, assuming the underlying frequency is constant. They do not take account of numerous other sources of uncertainty, such as incomplete event data, inappropriate measures of exposure, trends in the frequency etc. Therefore, the total uncertainty in the frequency may be much higher than indicated, and the confidence limits estimated above may be misleading.

I.5

References

[23] Lees, F.P., 1996. Loss Prevention in the Process Industries, 2nd. ed., Oxford: Butterworth-Heinemann. [24] CCPS, 1989. Chemical Process Quantitative Risk Analysis, Centre of Chemical Process Safety, New York: American Institute of Chemical Engineers.

22

©OGP

Risk Assessment Data Directory Report No. 434 – 12 March 2010

Occupational risk International Association of Oil & Gas Producers

P

ublications

Global experience The International Association of Oil & Gas Producers has access to a wealth of technical knowledge and experience with its members operating around the world in many different terrains. We collate and distil this valuable knowledge for the industry to use as guidelines for good practice by individual members.

Consistent high quality database and guidelines Our overall aim is to ensure a consistent approach to training, management and best practice throughout the world. The oil and gas exploration and production industry recognises the need to develop consistent databases and records in certain fields. The OGP’s members are encouraged to use the guidelines as a starting point for their operations or to supplement their own policies and regulations which may apply locally.

Internationally recognised source of industry information Many of our guidelines have been recognised and used by international authorities and safety and environmental bodies. Requests come from governments and non-government organisations around the world as well as from non-member companies.

Disclaimer Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms. This document may provide guidance supplemental to the requirements of local legislation. Nothing herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.

Copyright notice The contents of these pages are © The International Association of Oil and Gas Producers. Permission is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii) the source are acknowledged. All other rights are reserved.” Any other use requires the prior written permission of the OGP. These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.

RADD – Occupational risk

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0 2.1 2.2

Summary of Recommended Data ............................................ 2 Fatal Accident Rates....................................................................................... 2 Causes of Fatal Accidents ............................................................................. 3

3.0 3.1 3.2 3.3

Guidance on use of data ........................................................ 5 General validity ............................................................................................... 5 Uncertainties ................................................................................................... 5 Risk calculation for QRA................................................................................ 5

4.0

Review of data sources ......................................................... 5

5.0

Recommended data sources for further information .............. 6

6.0 6.1 6.2

References ............................................................................ 7 References for Sections 2.0 to 4.0 ................................................................ 7 References for other data sources................................................................ 7

©OGP

RADD – Occupational risk

Abbreviations: CMPT CS DNV E&P FAR FSU IRPA LTIF OGP OSHA QRA UK UKCS

Centre for Marine and Petroleum Technology Continental Shelf Det Norske Veritas Exploration and Production Fatal Accident Rate Former Soviet Union Individual Risk Per Annum Lost Time Injury Frequency International Association of Oil & Gas Producers (US) Occupational Safety and Health Administration Quantitative Risk Assessment (sometimes Analysis) United Kingdom United Kingdom Continental Shelf

©OGP

RADD – Occupational risk

1.0

Scope and Definitions

1.1

Application

This datasheet presents (Section 2.0) occupational risks in the global E&P (Exploration & Production) industry, for both onshore and offshore facilities. The occupational risks include transport risks, which are often analysed separately in QRAs. Some indication is given as to how the occupational risks presented can be adjusted to remove transport risks.

1.2

Definitions

Fatality risks are presented in terms of the FAR (Fatal Accident Rate). This is defined as: FAR = number of fatalities per 108 exposed hours. •

Onshore, “exposed hours” are working hours. Onshore work [1]: All activities and occupations that take place within a land mass, including those in swamps, rivers and lakes. Activities in bays, major inland seas, or in other inland seas directly connected to oceans are counted as offshore (see below).

•

Offshore, “exposed hours” are sometimes defined (e.g. by OSHA) as offshore working hours only (12 hours per day), elsewhere (e.g. Norway) as all hours spent offshore (24 hours per day). The offshore FAR values presented in Section 2.0 are for working hours only. Offshore work [1]: All activities and occupations that take place at sea, including major inland seas (e.g. Caspian Sea) and other inland seas directly connected with oceans. Includes transportation of people and equipment from shore to the offshore location either by vessel or helicopter.

Factors are given to modify the overall fatality risks presented for different functions: Exploration, Drilling and Production, defined as follows in [1]: Exploration: Geophysical, seismographic and geological operations, including their administrative and engineering aspects, construction, maintenance, materials supply, and transportation of personnel and equipment; excludes drilling. Drilling: All exploration, appraisal and production drilling and workover as well as their administrative, engineering, construction, materials supply and transportation aspects. It includes site preparation, rigging up and down and restoration of the drilling site upon work completion. Drilling includes ALL exploration, appraisal and production drilling. Production: Petroleum and natural gas producing operations, including their administrative and engineering aspects, minor construction, repairs, maintenance and servicing, materials supply, and transportation of personnel and equipment. It covers all mainstream production operations including wireline. It does not cover production drilling and workover.

©OGP

1

RADD – Occupational risk

2.0

Summary of Recommended Data

It is recommended, wherever possible, to use local operator specific data for occupational risk (see Section 5.0). Where these are not available, the data presented below can be used.

2.1

Fatal Accident Rates

Table 2.1 presents overall worldwide FAR values by work location (onshore/offshore) for all personnel and separately for company employees and contractors. Note that these values include fatalities due to air and land transport incidents, except where indicated. Table 2.2 presents modification factors that can be used to factor the values in Table 2.1 for different functions: exploration, drilling, production and offshore catering/stewards (but see also Table 2.4 for drilling FAR values). Table 2.3 gives multiplication factors for different regions of the world that can be applied to the worldwide FAR values given in Table 2.1 to obtain region-specific FAR values. Note that the values presented in Table 2.1 and Table 2.3 are based on data published by OGP and the data presented in Table 2.4 are based on data published by IADC: see Section 3.1 regarding their validity. Table 2.1 Overall W orldwide FAR Values Personnel

Events

All Personnel

Com pany Em ployees Contractors

All Locations 4.44

Onshore

Offshore

4.71

3.56

4.16

-

-

N/A

3.13

N/A

All*

2.08

2.24

1.37

All*

5.34

5.74

4.15

All* Excl. Air Transport†‡ Excl. Land Transport†

* See Section 4.0 for definition of ‘All’. †

These values are given as often air and land transport are analysed separately in a QRA.

‡

No separate values are given for onshore and offshore as the relative contributions to each cannot be determined from the data.

Table 2.2 Modification Factors for Specific Functions Function

Exploration Drilling Production Offshore Catering/Stewards

2

Modification Factor W orldwide North Onshore & Sea Offshore Offshore 1.1 1.1 1.6 0.7 1.6 0.1 0.1

©OGP

RADD – Occupational risk

Table 2.3 Multiplication Factors for Different Regions 1 (Apply to Table 2.1 FAR Values) Europ e

FSU

Middle East

North America

South America

1.54

Asia/ Australasia 0.36

0.71

1.38

0.98

0.74

0.86

Offshore

1.22

0.56

1.05

0.69

0.82

1.52

0.92

All

1.49

0.40

0.79

1.42

0.98

0.90

0.88

Onshore

1.19

0.29

0.75

2.14

1.19

0.41

0.64

Offshore

1.00

0.72

2.94

0.00

0.00

0.47

0.00

All

1.17

0.35

1.14

2.25

1.15

0.41

0.55

Onshore

1.46

0.35

0.93

1.28

0.94

0.97

0.82

Offshore

1.17

0.53

0.88

0.68

0.84

1.86

1.10

All

1.42

0.39

0.81

1.32

0.95

1.17

0.88

Personne l

Locatio n

Africa

All

Onshore

Company

Contract or

Table 2.4 FAR Values for Personnel Engaged in Drilling Operations Country/Region USA Canada Central / South America Europe Africa Middle East Asia Pacific Industry Average

FAR values Onshore Offshore Com bined 16.10 7.30 13.17 18.68 0.00 12.19 5.53 5.13 5.41 3.68 2.21 2.45 7.11 6.06 6.49 3.08 5.44 3.69 6.53 5.96 6.17 7.53

For the UK and Norway Continental Shelfs (offshore), Alberta, Canada (onshore), and the USA (oil and gas extraction), the following FAR values are available. Note that these exclude helicopter accidents and are based on 2000 working hours per year. UKCS: FAR = 3.78

2.2

Norway: FAR = 0.94

Alberta: FAR = 8.26

USA: FAR = 11.42

Causes of Fatal Accidents

Figure 2.1 shows the proportions of fatal accidents due to different causes. They apply to the FAR value in Table 2.1 for all events, all locations (i.e. onshore and offshore). Transport fatalities account for almost 24% of the total. Figure 2.2 shows the causal breakdown excluding transport (air and vehicle incidents) and unknown causes.

1

Note that, as these are ratios of FAR values rather than absolute values, the ‘All’ values do not necessarily lie between the corresponding ‘Onshore’ and ‘Offshore’ values. ©OGP

3

RADD – Occupational risk

Figure 2.1 Causes of Fatal Accidents

Figure 2.2 Causes of Fatal Accidents, excluding Transport and Unknown

4

©OGP

RADD – Occupational risk

3.0

Guidance on use of data

3.1

General validity

The occupational risk values given in Table 2.1 and Table 2.3 can be applied to E&P facilities worldwide or in the specific regions presented in Table 2.3. However, they are based on data provided to OGP by OGP’s members, and may not be representative in all geographical areas. The occupational risk values given in Table 2.4 for personnel engaged in drilling operations are based on data provided to IADC by IADC’s members. If drilling operations are undertaken by a contractor that is not a member of IADC, the values in Table 2.4 may not be applicable.

3.2

Uncertainties

The data presented in Section 2.0 are in the main based on that obtained by OGP from its members. OGP’s reports [1] do not discuss data quality, i.e. whether the data from each of the members and the countries where each member operates are subject to consistent reporting criteria and verification. Discrepancies may also occur in that not all companies report contractor hours. A further consideration is that the data do not reflect non OGP members and so may not be representative of the industry as a whole. The overall size of the database, as regards both working hours and fatalities, is sufficiently large (see Section 4.0) that the statistical uncertainties associated with the FAR values in Table 2.1 are small compared to the variations between regions and operators. Uncertainties are dominated by local variations. Even within geographically close countries, such as within the EU, variations can be large. Hence, as discussed in Section 5.0, it is preferable wherever possible to use local operator specific data.

3.3

Risk calculation for QRA

In QRAs, risks are frequently calculated and presented in terms of Individual Risk Per Annum (IRPA). FAR values therefore need to be converted to IRPA values using actual work pattern data. For example: •

Working 2000 hours per year:

•

Offshore, as personnel are exposed to risk whilst off shift and in the TR, their risks are sometimes presented on the basis of 24 hours per day exposure whilst offshore. In this case, the contributions from the on shift and off shift FAR values need to be summed. The off shift FAR value for all workers can be estimated by applying the factor given in Table 2.2 for catering/stewards to the appropriate FAR value in Table 2.1.

4.0

Review of data sources

The principal source of the data presented in Section 2.0 is the data published by OGP [1] for the period 2002-6. During this period, the worldwide FAR has been roughly constant, and significantly lower than in the 1990s. It is therefore believed that it is reasonably representative of current occupational risks. The data for the individual years (both exposure and fatalities) have been summed over the 5-year period to calculate the FAR values given in Section 2.1.

©OGP

5

RADD – Occupational risk

The database from which the OGP reports [1] are drawn contains records of incidents resulting in 532 fatalities over 12 × 109 working hours during that period. Fatalities due to all causes are included, including vehicle incidents and air transport as well as being struck, explosion/burn, electrical, drowning, falls, and ‘caught between’. Fatality rate data are available going back to 1997, facilitating trend analysis. In the most recent report, the data have been contributed by 41 companies representing activities in 84 countries. Data quality is not discussed in the OGP reports and hence judgment as to its completeness cannot be presented here. However, from a review of other potential sources and bearing in mind that activities of OGP members extend worldwide, this is believed to be the most comprehensive source. To determine the modification factors by function for the North Sea (Table 2.2), more local sources [2],[3],[4] were compared and approximate averages taken. The same value for offshore catering/stewards is also suggested for Worldwide use; the other factors in Modification Factors for Specific Functions come from the OGP data. The United Kingdom and Norway Continental Shelf FAR values are given in [5]. They are for the period 2001 to the first half of 2007. The Alberta FAR can be calculated from data given in [6]. The USA oil and gas extraction FAR was calculated from data given in [7]: these data give fatalities per 100,000 employees and it is necessary to make an assumption about annual working hours per employee: for consistency with the OGP data, 2000 hours were assumed.

5.0

Recommended data sources for further information

Lost time injury frequencies (LTIFs) for specific countries are given in the OGP reports [1], however there is no breakdown by company/contractor, onshore/offshore or function. It might be thought that the FAR/LTIF ratio could be used as a surrogate either to obtain country specific FAR values or to obtain a more detailed breakdown of LTIF values. However, a review of the data shows a wide variation in that ratio such that this would be an unreliable approach. Country specific data are available from some statutory authorities (see Section 6.2 for references and URLs): •

UK

•

Norway

•

Denmark

•

Netherlands

•

USA

•

Canada

As most operators maintain incident databases (data from which have been gathered into the OGP database [1]), it may be preferable to use operator specific data. However, if these have not been analysed in a form suitable for QRA, the values presented in Section 2.0 can be used. In any case, these should be used as to validate any operator specific risks calculated.

6

©OGP

RADD – Occupational risk

6.0

References

6.1

References for Sections 2.0 to 4.0

[1] OGP, 2007. Safety performance indicators – 2006 data, Report No. 391. Also corresponding reports for 2001-2005 data. http://www.ogp.org.uk/Publications/index.asp. [2] Spouge et al., 1999. A Guide to Quantitative Risk Assessment for Offshore Installations, App. XIV, ISBN 1 870553 365, Publication 99/100, Centre for Marine and Petroleum Technology (CMPT). Now available from the Energy Institute: http://www.energyinst.org.uk/index.cfm?PageID=5. [3] DNV, 2000. Occupational Risks for Workers on Offshore Installations, Revision 0, report for BP Amoco, DNV Order No. 30400100. [4] BP, 2003. Occupational Risk for Offshore Workers, Rev 0, BP Report No. D/UTG/051/03. [5] Petroleum Safety Authority Norway, 2008. Risk Levels in the petroleum industry – Summary Report Norwegian Continental Shelf 2007, Ptil-08-03: http://www.ptil.no/getfile.php/PDF/Summary_rep_2008.pdf. [6] Alberta Employment, Immigration and Industry, 2007. Lost-Time Claims, Disabling Injury Claims and Claim Rates, Upstream Oil and Gas Industries 2002 to 2006. http://employment.alberta.ca/documents/WHS/WHS-PUB_oid_2006_oil_and_gas.pdf

[7] Bureau of Labor Statistics, 2007. Census of Fatal Occupational Injuries (CFOI): http://www.bls.gov/iif/oshwc/cfoi/CFOI_Rates_2006.pdf. Previous years’ reports can be found at: http://www.bls.gov/iif/oshcfoil.htm.

6.2

References for other data sources

UK http://www.hse.gov.uk/offshore/statistics/hsr0607.pdf (2006/7; earlier years also available) Norway [5] above: follow link to The Trends in Risk Levels report 2006; summary report in English; the full report is only in Norwegian, available via the following link: http://www.ptil.no/nyheter/risikonivaaet-2007-god-utvikling-men-flere-alvorlige-hendelser-article4466-24.html Denm ark http://www.ens.dk/graphics/Publikationer/Olie_Gas_UK/Oil_and_Gas_Production_in_De nmark_2006/html/chapter05.htm Netherlands http://www.sodm.nl/data/jvs/jvs2006_eng.pdf: see Appendix F.

USA http://www.mms.gov/incidents/IncidentStatisticsSummaries.htm#2006-2010:

presentation of inform-ation lacks exposure data. Also available to purchase: API - Survey on Petroleum Industry Occupational Injury and Illness Report: http://www.api.org/ehs/health/measuring/index.cfm

©OGP

7

Risk Assessment Data Directory Report No. 434 – 13 March 2010

Structural risk for offshore installations International Association of Oil & Gas Producers

RADD – Structural risk for offshore installations

contents 1.0 1.1

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1

2.0 2.1

Summary of Recommended Data ............................................ 2 Worldwide (including UKCS) Structural Failure Frequencies .................... 2

2.1.1 2.1.2 2.1.3

All Unit Types ............................................................................................................. 2 Fixed Units .................................................................................................................. 2 Non Fixed Units .......................................................................................................... 3

2.2

UKCS Structural Failure Frequencies........................................................... 3

2.2.1 2.2.2

Fixed Units .................................................................................................................. 3 Non Fixed Units .......................................................................................................... 3

2.3 2.4

Worldwide Mooring / Anchor Failure Frequencies ...................................... 3 UKCS Mooring / Anchor Failure Frequencies .............................................. 3

3.0 3.1 3.2

Guidance on use of data ........................................................ 4 General validity ............................................................................................... 4 Uncertainties ................................................................................................... 4

4.0 4.1

Review of data sources ......................................................... 6 Worldwide........................................................................................................ 6

4.1.1 4.1.2

Likelihood of Severe and Total Loss Situations ..................................................... 7 Likelihood of Mooring / Anchor Failure ................................................................. 10

4.2

UK Continental Shelf .................................................................................... 10

4.2.1 4.2.2

Likelihood of Severe and Total Loss Situations ................................................... 12 Likelihood of Mooring / Anchor Failure ................................................................. 13

4.3

Comparison of Worldwide and UKCS Frequencies................................... 13

4.3.1 4.3.2

Structural Failures.................................................................................................... 13 Mooring / Anchor Failures....................................................................................... 14

5.0

Recommended data sources for further information ............ 14

6.0

References .......................................................................... 14

©OGP

RADD – Structural risk for offshore installations

Abbreviations: FPSO FSU GoM HSE MODU MOPU NPD NS OSHA QRA TLP UKCS WOAD WWx

Floating Production, Storage and Offloading Floating Storage Unit Gulf of Mexico UK Health & Safety Executive Mobile Offshore Drilling Unit Mobile Offshore Production Unit Norwegian Petroleum Directorate North Sea Occupational Safety & Health Administration Quantitative Risk Assessment Tension Leg Platform United Kingdom Continental Shelf Worldwide Offshore Accident Databank Worldwide excluding US GoM and NS

©OGP

RADD – Structural risk for offshore installations

1.0

Scope and Definitions

1.1

Application

This datasheet presents information on structural events statistics for use in Quantitative Risk Assessment (QRA). The datasheet includes guidelines for the use of the recommended data and a review of the sources of the data. The data are applicable to offshore installations only. The following damage categorisation as extracted from the Worldwide Offshore Accident Databank (WOAD [1]) is used, as applied to all accident types: •

Total Loss: Total loss of the unit including constructive total loss from an insurance point of view, however the unit may be repaired and put into operation again.

•

Severe Dam age: Severe damage to one of more modules of the unit; large /medium damage to loadbearing structures; major damage to essential equipment.

•

Significant Dam age: Significant/serious damage to module and local area of the unit; minor damage to loadbearing structures; significant damage to single essential equipment; damage to more essential equipment.

•

Minor Dam age: Minor damage to single essential equipment; damage to more nonessential equipment; damage to non-loadbearing structures.

•

Insignificant Dam age: Insignificant or no damage: damage to part(s) of essential equipment; damage to towline, thrusters, generators and drives.

The datasheet addresses all forms of structural failure but specifically concentrates on Total Loss and Severe Damage Category events. It also addresses mooring line failures for mobile units on location. Towing failures for mobile units are addressed in the Fabrication, Construction & Installation Risks datasheet. Total Loss structural failure events are when an installation loses its ability to support its topside as a result of operational and environmental loading. Possible causes include: • • • • • • •

Extreme weather Marine corrosion Fatigue Foundation failure Construction defects Design errors Earthquakes

In reviewing events classed as Severe Damage within WOAD, the detailed records have been reviewed and the following additional criteria have been added as some records classed as a severe accident within WOAD would not necessarily constitute severe structural failure: • • •

Shipyard or dockside repair of mobile installation required Production or operation shutdown for more than a week Precautionary evacuation required or restrictions placed on manning

©OGP

1

RADD – Structural risk for offshore installations

There are cases where an event was initially classified as structural failure; however, following a thorough review of their description some were deemed as irrelevant and hence not counted in the statistics. Events categorised as insignificant were also discounted. The data exclude topsides structural failure events arising from escalating events such as fires and explosions. The frequency data exclude structural failures that have arisen as a result of other primary events such as ship collisions, loss of mooring systems, loss of towing facilities as these are typically analysed as separate events within an offshore QRA. The frequency data is associated with structural failures which arise when installations are manned to support personal risk estimation within QRAs. This excludes structural failures of installations in hurricane conditions when the installations have been demanned.

2.0

Summary of Recommended Data

Structural failure frequencies for Severe Damage and Total Loss are presented worldwide (Section 2.1) and for the UKCS (Section 2.2). As there have been relatively few structural failures resulting in Severe Damage / Total Loss, there are insufficient data to permit other regional analysis such as GoM data. Mooring/Anchor failure frequencies are likewise presented worldwide (Section 2.3) and for the UKCS (Section 2.4). The same considerations regarding other regional analysis as for structural failure frequencies apply.

2.1 2.1.1

Worldwide (including UKCS) Structural Failure Frequencies All Unit Types

Frequency of all Severe structural failure (excl. towing) year

4.55 × 10-5 per

Frequency of Severe structural failure caused by weather (excl. towing) year

3.25 × 10-5 per

4.55 × 10-5 per year

Frequency of Total Loss (excl. towing)

1.30 × 10-5 per

Frequency of Total Loss caused by weather (excl. towing) year 2.1.2

Fixed Units

Frequency of all Severe structural failure (excl. towing) year

7.40 × 10-6 per

Frequency of Severe structural failure caused by weather (excl. towing)

0 per year

Frequency of Total Loss (excl. towing)

0 per year

Frequency of Total Loss caused by weather (excl. towing)

2

©OGP

0 per year

RADD – Structural risk for offshore installations

2.1.3

Non Fixed Units

Frequency of all Severe structural failure (excl. towing) year

3.20 × 10-4 per

Frequency of Severe structural failure caused by weather (excl. towing) year

2.67 × 10-4 per

3.73 × 10-4 per year

Frequency of Total Loss (excl. towing)

1.07 × 10-4 per

Frequency of Total Loss caused by weather (excl. towing) year

2.2 2.2.1

UKCS Structural Failure Frequencies Fixed Units

Severe structural damage frequency

1.09 × 10-3 per year

Severe structural damage frequency (weather related)

3.63 × 10-4 per year

2.2.2

Non Fixed Units

Severe structural damage frequency

1.09 × 10-2 per year

Severe structural damage frequency (weather related)

3.28 × 10-3 per year

No Total Loss frequency data is generated for the UK, but reference to the Worldwide frequency data can be made, as detailed in Section 2.1.

2.3

Worldwide Mooring / Anchor Failure Frequencies

Frequency of failure of mooring or anchor whilst in operation (drilling/production):5.78 × 10-3 per year 76% of the recorded incidents appear from the data to have been weather related. Outside the UKCS, however, only 64% appear to have been weather related. Additional probabilities are given in Table 2.1. Table 2.1 Probabilities for W orldwide Mooring Failures Damage levels Single/multiple line failures

2.4

Insignificant 0.29 Single 0.70

Minor 0.64 Multiple 0.30

Significant 0.27

Severe 0

Total Loss 0

UKCS Mooring / Anchor Failure Frequencies

Frequency of failure of mooring or anchor whilst in operation (drilling/production):1.04 × 10-2 per year All but one of the 18 recorded incidents in the UKCS appear from the data to have been weather related.

©OGP

3

RADD – Structural risk for offshore installations

Additional probabilities are given in Table 2.2. Table 2.2 Probabilities for UKCS Mooring Failures Damage levels Single/multiple line failures

Insignificant 0.17 Single 0.60

Minor 0.50 Multiple 0.40

3.0

Guidance on use of data

3.1

General validity

Significant 0.33

Severe 0

Total Loss 0

The structural failure frequency values given in Sections 2.1 and 2.2 are applicable to the offshore oil and gas industry worldwide and specifically on the UKCS. However, it is recommended that data to be used on particular studies is localised to the country where the unit will be deployed as there are variations and trends on the frequencies calculated. For example, in exposure data for submersible drilling units, the US GoM dominates as there are 427 unit years for this category out of 532 unit years worldwide. The same applies to semisubmersible production units since the majority of these are located in Central & South America.

3.2

Uncertainties

In some cases the exposure data available makes no distinction between unit categories e.g. in [2], for Monohull units there is no distinction between FPSO and FSU. The same situation occurs for WOAD exposure data for fixed units. [2] provides a summary of exposure data used to calculate worldwide structural failure accident frequencies. Hence, by making no distinction in the exposure data the calculated frequency might be overestimated or underestimated for FSPO, FSU and Fixed units within WOAD [1].

4

©OGP

RADD – Structural risk for offshore installations

Table 3.1 Floating and Fixed Units Exposure Data

Submersibles

Drill Barges

Jackup

Semisubmersibl e

Tension-leg Platform

FPSO

FSU

Drilling Platform

Production Platform

Accommodation

WOAD Exp. data WW 1980-2002 WOAD Exp. data WWx 1980-2002

Fixed Units

Drill Ships

WOAD Exp. data GoM 1980-2002

Monohull

Semisubmersibl e

UKCS Exposure data 1980-2005 WOAD Exp. data NS 1980-2002

MOPUs

Jackup

MODUs

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

Unit Years

586.5

938

8.6

N/A

N/A

17.8

92.2

17.8

123.3

46.7

455

2107

194

1058

1516

26

0

0

12.3

102

36

94.6

7074

4136

941

160

427

25

2

0

52.3

0

85480

10743

4305

1217

532

966

88.5

362.7

88.3

445

135122

5549

1848

1031

105

941

74.2

260.7

0

350.4

42568

©OGP

5

RADD – Structural risk for offshore installations

4.0

Review of data sources

The principal source of the data presented in Section 2 is the data published in WOAD [1] for the period 1980-2002 and the HSE [3],[4] for 1980-2005. Databases available worldwide were thoroughly reviewed and interrogated appropriately in producing these documents. It is therefore believed that they are reasonably complete in recording accidents and incidents worldwide and on the UKCS for offshore units.

4.1

Worldwide

For this section statistics are presented in four groups: North Sea1, Gulf of Mexico2 (GoM), Worldwide data and Worldwide excluding North Sea and GoM (WWx). These statistics are based on the numbers of incidents evident within WOAD [1] and the exposure data (number of unit years) [2]. Accident data used cover the time period from 1980 to 2002 as this is the basis of the exposure data. A visual categorisation of these units and their purpose is presented in Figure 4.1. This figure includes submersibles and drill barges. WOAD [1] contains records that distinguish semi-submersibles from submersibles; the associated exposure data have this distinction also, hence these two types of units are considered separately. Non fixed accommodation units are discounted as there is no exposure information available for this kind of unit. Figure 4.1 Categorisation of W orldwide Offshore Units

The worldwide recommended statistics consider the first chain of events and discount those cases deemed as not significant or irrelevant to the data sheet.

1

North Sea states comprise the United Kingdom, Denmark, Norway, Germany and the Netherlands. 2 Gulf of Mexico refers to the United States of America side only. 6

©OGP

RADD – Structural risk for offshore installations

Table 4.1 presents the data for all structural failures: the numbers of relevant cases (N) that occurred during the time period 1980-2002 and the corresponding associated frequencies (F) for selected worldwide geographies. In this datasheet frequency is defined as the number of cases divided by the number of unit years for each type of unit. Table 4.1 W orldwide – All Structural Failures (per unit year) Worldwide Data

Non Fixed Offshore Units

MODUs

Geographical Area

Jackup Semisubmersible

MOPUs

6

10

59

5.67 × 10 3

-3

1.98 × 10

-3

2.42 × 10 3

-3

3.19 × 10

-3

WW excl. GoM, North Sea 43

5.49 × 10 7

-3

7.75 × 10 1

-3

1.63 × 10

-3

5.41 × 10

-4

0 0

1 -3 6.25 × 10

7 -3 5.75 × 10

6 -3 5.82 × 10

Jackup

N F

0

0

2

2

0 4

0 0

2.26 × 10 4

-2

0

1.10 × 10

-2

N F

3.92 × 10

Tension-leg Platform

N F

0 0

0 0

0 0

FPSO

N F

0

0

1

N F

Production Platform

N F N F

-2

2.70 × 10 0

-2

0 0 0 1

-3

0 0

2.25 × 10 0

0

0

0

0

7 -4 9.90 × 10

7 -5 8.19 × 10

15 -4 1.11 × 10

1 -5 2.35 × 10

2 2.83 × 10 0

29 -4

0

34

2.85 × 10 0

-3

0 0

N F

Drilling Platform

Accommodation

4.1.1

World Wide (WW)

N F

FSU

Fixed Offshore Units

N F

US GoM

Drill Ships

Semisubmersible

Monohull

N F

North Sea

3

3.39 × 10 2

-4

2.52 × 10 2

-4

2.34 × 10

-5

1.48 × 10

-5

7.05 × 10 0

-5

0

Likelihood of Severe and Total Loss Situations

The frequencies given in Table 4.1 indicate the frequency of all types of structural failures which includes minor, significant, severe and total loss situations. Minor and significant structural failures are unlikely to pose significant risks to individuals on the units and their inclusion within personnel risk calculations is not normally undertaken within a QRA. The associated data also features many US GoM hurricane events where there had been timely warnings and the units had been totally evacuated before structural failures occurred. Again inclusion of these data as part of QRA personnel risk calculations is not normally undertaken. A significant proportion of structural events featured in the data stem from the loss of towing mobile units in severe weather which then has resulted in structural failures. The fatality rates for towing events are typically

©OGP

7

RADD – Structural risk for offshore installations

considered as a separate accident category within a QRA and it is inappropriate to double count their contribution within structural failure risks. The WOAD data have therefore been reviewed in detail to determine the number of events which genuinely contribute to severe and total loss situations where occupants have been at risk. The following data are derived for worldwide activity for all unit types, and can be used to derive worldwide average frequencies as set out below: Number of Severe structural failures

16

Number of Severe structural failures associated with weather 8 Number of Severe structural failures (excl. towing) 7 Number of severe structural failures (excl. towing) associated with weather 5 Number of Total Loss (excluding hurricanes) structural failures 13 Number of Total Loss structural failures associated with weather 10 Number of Total Loss structural failures (excl. towing)

7

Number of Total Loss structural failures (excl. towing) associated with weather 2 Applying the above data to the unit years the following frequencies are derived based on the worldwide exposure time of 153870 unit years: Frequency of all Severe structural failure (excl. towing) year

4.55 × 10-5 per

Frequency of Severe structural failure caused by weather (excl. towing) year

3.25 × 10-5 per

4.55 × 10-5 per year

Frequency of Total Loss (excl. towing) Frequency of Total Loss caused by weather (excl. towing) year

1.30 × 10-5 per

The above frequencies are based on the total number of unit years for all types of unit. Splitting these by fixed and non fixed units the following results are obtained, noting that for Total Loss failures none have been attributed to fixed units W orldwide Fixed Units Frequency of all Severe structural failure (excl. towing) year

8

©OGP

7.40 × 10-6 per

RADD – Structural risk for offshore installations

Frequency of Severe structural failure caused by weather (excl. towing) Frequency of Total Loss (excl. towing)

0 per year

0 per year

Frequency of Total Loss caused by weather (excl. towing)

0 per year

W orldwide Non Fixed Units Frequency of all Severe structural failure (excl. towing) year

3.20 × 10-4 per

Frequency of Severe structural failure caused by weather (excl. towing) year

2.67 × 10-4 per

3.73 × 10-4 per year

Frequency of Total Loss (excl. towing) Frequency of Total Loss caused by weather (excl. towing) year

1.07 × 10-4 per

The data have not been further broken down and analysed by unit type and geographical location. Further detailed analysis would however indicate that the risks of structural failure are higher for Jackups and lower for all other types of unit, although the statistical uncertainties begin to increase on further breakdown on the analysis. For very approximate guidance on the frequencies attributable to unit types and regions, data in Table 4.1 can be used. For example: a total of 229 structural events of all types worldwide is evident of which 13 are associated with Total Loss, giving a worldwide probability of Total Loss of approximately 0.06. If this is then applied to Jackups in the GoM when the frequency of all structural failures is approximately 0.01 per unit year, the frequency of Total Loss can be estimated as 5.68 × 10-4 per unit year (when numerical rounding is removed). No fatalities have arisen from worldwide severe structural failures (excluding towing) and 145 fatalities have arisen from all worldwide total losses resulting from structural failure (excluding towing) in the period stemming from 2 events only, but on average 21 persons for each Total Loss event. Table 4.2 summarises the documented Total Loss Structural failure accidents. Table 4.2 Fatal Structural Failure Accidents (reproduced from W OAD [1]) Date 15th 1991

August

16th March 1980

Event Description During the typhoon "Fred", 100-125 knots wind and 18 m waves, the barge involved in pipelaying work sank 105 km NE of Hong Kong. 191 people onboard were tossed into the sea and 4 divers in a diving bell beneath the barge went down with the barge. The barge…

Fatalities

Due to bad weather, the ALK (Alexander Keilland) was shifted away from Edda and (the) gangway (was) hoisted onboard ALK Time 1750. 40 mins later bracing to leg D broke and shortly after lost leg. ALK rapidly listed 30/35 deg. After 20 mins the platform turned upside down.

123

©OGP

22

9

RADD – Structural risk for offshore installations

4.1.2

Likelihood of Mooring / Anchor Failure

Table 4.3 presents mooring and anchor failures worldwide during the period 1980-2002, taken from WOAD [1]. All have occurred on semisubmersible drilling units; 18 out of 28 appear from the WOAD data to have been weather related. The corresponding exposure is 4305 unit years for MODUs and 363 unit years for MOPUs, taken from [2]. These have been combined to give a frequency of mooring/anchor failure for semisubmersible units of 5.78 × 10-3 per year. The incidents have been broken down by damage category and single/multiple line failure as set out in Table 4.4, yielding the probabilities given in Table 2.1. Table 4.3 Mooring / Anchor Failures W orldwide, 1980 – 2002 (from W OAD [1]) Operation

No. of Incidents

Development Drilling

9

Exploration drilling

12

Well workover

2

Other

5

TOTAL

28

Table 4.4 Breakdown of W orldwide Mooring Failure Statistics (Num bers of Incidents) Damage levels Single/multiple line failures

Insignificant 13 Single 23

Minor 20 Multiple 10

Significant 12

Severe 0

Total Loss 0

(not specified: 12)

Note that these data do not include two further incidents of mooring line failure in the Gulf of Mexico in 2005 as a result of Hurricanes Katrina and Rita respectively. Damage levels are not available for these incidents.

4.2

UK Continental Shelf

For UK facilities, two different sources of information related to the United Kingdom Continental Shelf (UKCS) were used to examine the data as follows: •

Accident statistics for fixed offshore units on the UK Continental Shelf 1980-2005, HSE [3]

•

Accident statistics for floating offshore units on the UK Continental Shelf 1980-2005, HSE [4]

The main objective of these two references was to obtain complete statistics for accidents and incidents that occurred on floating and fixed units in the oil and gas activities on the UKCS in the period 1980-2005.

10

©OGP

RADD – Structural risk for offshore installations

These reports were produced using different databases for interrogation with respect to both population and accident data. Such databases were: •

ORION (the former Sun Safety System): HSE (www.hse.gov.uk) Offshore Safety Division

•

MAIB accident database: (www.maib.gov.uk)

•

Offshore Blowout Database BLOWOUT: SINTEF, Norway (www.sintef.no)

•

Worldwide Offshore Accident Databank (WOAD) [1]: DNV Norway

UK

Marine

Accidents

Investigation

Bureau

Offshore units for the UKCS are defined as comprising Jackups, Semi-Submersibles, Drill Ships, Tension-Leg Platforms (TLP), Floating Production, Storage and Offloading (FPSO), Floating Storage Units (FSU), and Platforms. A visual categorisation of the classification of these units is presented in Figure 4.2. Figure 4.2 Categorisation of UKCS Offshore Units

It is important to note that the classification of events reviewed was made according to the WOAD concept where one accident may comprise a chain of consecutive events. This means that a single accident or incident may give rise to several outcomes. However, for this report only the first event of the chain was considered. Table 4.5 presents the data for all structural failures: the numbers of relevant cases (N) that occurred during the time period 1980-2005 and the corresponding associated frequencies (F) for the UK Continental Shelf. In this datasheet frequency is defined as the number of cases divided by the number of unit years for each type of installation. No statistics are presented for non fixed accommodation units as there are no available data specific for units built solely for this purpose.

©OGP

11

RADD – Structural risk for offshore installations

Table 4.5 UKCS – All Structural Failures Frequencies (per unit year) UKCS Data

Geographical Area UK Continental Shelf

Non Fixed Offshore Units

MODUs

MOPUs

Monohull

Fixed Offshore Units

4.2.1

Jackup

N F

21 -2 3.58 × 10

Semisubmersible

N F

25

Drill Ships

N F

2.67 × 10 0

-2

0

Jackup

N F

0 0

Semisubmersible

N F

3 3.25 × 10 1

-2

5.62 × 10

-2

Tension-leg Platform

N F

FPSO

N F

3 -2 2.43 × 10

FSU

N F

2

Drilling Platform

N F

4.28 × 10 12

-2

2.64 × 10

-2

Production Platform

N F

3 -3 1.42 × 10

Accommodation

N F

5.15 × 10

1 -3

Likelihood of Severe and Total Loss Situations

The frequencies given in Table 4.5 indicate the frequency of all types of structural failures which includes minor, significant, severe and total loss situations. Minor and significant structural failures are unlikely to pose significant risks to individuals on the facilities and their inclusion within personnel risk calculations is not normally undertaken within a QRA. A detailed review of the incident records shows no Total Loss structural failure events for UK Fixed or Floating facilities in the period. For UK Floating facilities a total of 20 severe structural failure scenarios have been identified of which 6 have been clearly associated with adverse weather. For UK Fixed units 3 severe structural failure scenarios have been identified of which only 1 is clearly associated with adverse weather. The following failure frequencies have been derived: UK Fixed Units = 3/2756 = 1.09 × 10-3 per year

Severe structural damage frequency

Severe structural damage frequency (weather related) = 1/2756 = 3.63 × 10-4 per year

12

©OGP

RADD – Structural risk for offshore installations

UK Non Fixed Units = 20/1831 = 1.09 × 10-2 per year

Severe structural damage frequency

Severe structural damage frequency (weather related) = 6/1831 = 3.28 × 10-3 per year No fatalities have arisen from UK fixed unit severe structural failures and 3 fatalities have arisen from UK non fixed unit severe structural failures. No Total Loss frequency data have been generated for the UK, but reference to the Worldwide frequency data can be made, as detailed in section 4.1.1. 4.2.2

Likelihood of Mooring / Anchor Failure

Table 4.6 presents mooring and anchor failures worldwide during the period 1980-2005 taken from [4]. All have occurred on semisubmersible drilling units; all but one appear from the data to have been weather related. The corresponding exposure is 4305 unit years for MODUs and 363 unit years for MOPUs, also taken from [4]. These have been combined to give a frequency of mooring/anchor failure for semisubmersible units of 5.78 × 10-3 per year. The incidents have been broken down by damage category and single/multiple line failure as set out in Table 4.7, yielding the probabilities given in Table 2.2. Table 4.6 Mooring / Anchor Failures in UKCS, 1980 – 2002 (from W OAD [1]) Operation

No. of Incidents

Development Drilling

8

Exploration drilling

8

Other

2

TOTAL

18

Table 4.7 Breakdown of UKCS Mooring Failure Statistics (Num bers of Incidents) Damage levels Single/multiple line failures

4.3 4.3.1

Insignificant 3 Single 9

Minor 9 Multiple 6

Significant 6

Severe 0

Total Loss 0

(not specified: 3)

Comparison of Worldwide and UKCS Frequencies Structural Failures

There have been no Total Loss events within the UKCS, so reference has to be made to the worldwide data or adopt more detailed predictive theoretical methods to determine the associated Total Loss frequency.

©OGP

13

RADD – Structural risk for offshore installations

For severe damage events, UKCS frequencies are significantly higher than worldwide average values. This difference is believed to arise from the harsher water environment of the UKCS compared with the average worldwide offshore environment (removing hurricane influences), and with the possibly higher reporting standards within the UKCS compared with worldwide average reporting systems. 4.3.2

Mooring / Anchor Failures

The frequency of mooring/anchor failure on the UKCS is almost double the worldwide average. Given that all but one of these incidents appear to have been weather related, compared with 64% worldwide (outside the UKCS), the harsher water environment of the UKCS and the possibly higher reporting standards within the UKCS would account for this as it does for structural failures (see Section 4.3.1).

5.0

Recommended data sources for further information

Country-specific accidents and incidents data bases may be interrogated depending on the area that the installation will be deployed. As a starting point WOAD [1] is a reliable source of information that can be interrogated in a variety of ways. There are more sources of data including, but not limited to, the HSE in the United Kingdom, the Occupational Safety & Health Administration (OSHA) in the United States of America, and the Norwegian Petroleum Directorate.

6.0

References

[1] DNV. WOAD - Worldwide Offshore Accident Databank, v5.0.1. [2] DNV, 2004. Exposure Data for Offshore Installations 1980-2002, Technical Note 22, DNV internal documentation. [3] DNV, 2007a. Accident statistics for fixed offshore units on the UK Continental Shelf 19802005, HSE Research Report RR566, Sudbury, Suffolk: HSE Books. http://www.hse.gov.uk/research/rrhtm/rr566.htm [4] DNV, 2007b. Accident statistics for floating offshore units on the UK Continental Shelf 1980-2005, HSE Research Report RR567, Sudbury, Suffolk: HSE Books. http://www.hse.gov.uk/research/rrhtm/rr567.htm

14

©OGP

Risk Assessment Data Directory Report No. 434 – 14.1 March 2010

Vulnerability of humans International Association of Oil & Gas Producers

P

ublications

Global experience The International Association of Oil & Gas Producers has access to a wealth of technical knowledge and experience with its members operating around the world in many different terrains. We collate and distil this valuable knowledge for the industry to use as guidelines for good practice by individual members.

Consistent high quality database and guidelines Our overall aim is to ensure a consistent approach to training, management and best practice throughout the world. The oil and gas exploration and production industry recognises the need to develop consistent databases and records in certain fields. The OGP’s members are encouraged to use the guidelines as a starting point for their operations or to supplement their own policies and regulations which may apply locally.

Internationally recognised source of industry information Many of our guidelines have been recognised and used by international authorities and safety and environmental bodies. Requests come from governments and non-government organisations around the world as well as from non-member companies.

Disclaimer Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the OGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer. The recipient is obliged to inform any subsequent recipient of such terms. This document may provide guidance supplemental to the requirements of local legislation. Nothing herein, however, is intended to replace, amend, supersede or otherwise depart from such requirements. In the event of any conflict or contradiction between the provisions of this document and local legislation, applicable laws shall prevail.

Copyright notice The contents of these pages are © The International Association of Oil and Gas Producers. Permission is given to reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii) the source are acknowledged. All other rights are reserved.” Any other use requires the prior written permission of the OGP. These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales. Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.

RADD – Vulnerability of humans

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0 2.1

Summary of Recommended Data ............................................ 2 Fire ................................................................................................................... 2

2.1.1 2.1.2 2.1.3

Engulfment by fire...................................................................................................... 3 Thermal radiation ....................................................................................................... 3 People inside buildings ............................................................................................. 5

2.2 2.3

Explosion......................................................................................................... 7 Toxic gases ................................................................................................... 10

2.3.1 2.3.2

General ...................................................................................................................... 10 Hydrogen Sulphide .................................................................................................. 11

2.4

Smoke ............................................................................................................ 13

2.4.1 2.4.2

Smoke Inhalation...................................................................................................... 13 Smoke Obscuration ................................................................................................. 16

2.5

Vulnerability inside a Temporary Refuge ................................................... 16

2.5.1 2.5.2 2.5.3 2.5.4

Smoke ingress.......................................................................................................... 16 Heat build-up ............................................................................................................ 18 Ingress of unignited hydrocarbon gas................................................................... 18 Structural collapse ................................................................................................... 18

2.6

Cold Water ..................................................................................................... 18

3.0 3.1 3.2

Guidance on use of data ...................................................... 18 General validity ............................................................................................. 18 Uncertainties ................................................................................................. 19

4.0

Review of data sources ....................................................... 19

5.0

Recommended data sources for further information ............ 19

6.0 6.1

References .......................................................................... 19 References for Sections 2.0 to 4.0 .............................................................. 19

Appendix I – Relationship between Lethality and Probit ................. 21

©OGP

RADD – Vulnerability of humans

Abbreviations: API BLEVE BR CIA CO CO2 COHb CSTR DNV DTL ERPG HSE IDLH LCx LDx LFL O2 QRA SFPE SLOD SLOT tdu TNO Onderzoek

American Petroleum Institute Boiling Liquid Expanding Vapour Explosion Breathing Rate Chemical Industries Association Carbon Monoxide Carbon Dioxide Carboxyhaemoglobin Continuous Stirred Tank Reactor Det Norske Veritas Dangerous Toxic Load Emergency Response Planning Guideline (UK) Health and Safety Executive Immediate Danger to Life or Health Lethal concentration resulting in x% fatalities Lethal dose resulting in x% fatalities Lower Flammable Limit Oxygen Quantitative Risk Assessment (sometimes Analysis) Society of Fire Protection Engineers Significant Likelihood of Death Specified Level of Toxicity Thermal Dose Units Nederlandse Organisatie voor Toegepast Natuurwetenschappelijk

(Netherlands Organization for Applied Scientific Research) TR Temporary Refuge VROM (Dutch) Ministerie van Volkshuisvesting, Ruimtelijke Ordening en Milieubeheer

©OGP

RADD – Vulnerability of humans

1.0

Scope and Definitions

1.1

Application

This datasheet provides information on the vulnerability of humans to the consequences of major hazard events at onshore and offshore installations, primarily those producing and/or processing hydrocarbon fluids. The focus is on fatality criteria as QRAs generally address fatality risks, however injury thresholds are also identified where appropriate. Information is presented relating both to people who are out of doors and people within buildings. The following consequences are considered: •

Fire

•

Explosion

•

Toxic gases

•

Smoke

Information on vulnerability within a Temporary Refuge and vulnerability following entry to water (e.g. during evacuation/escape from an offshore installation) is also presented. For onshore installations, the information presented applies both to personnel working within the installation and to third parties outside the installation boundary fence. It can therefore be used for QRAs addressing onsite and offsite risks. The focus of this datasheet is vulnerability to the consequences described in the Consequence Modelling datasheet. Vulnerability to other potentially fatal events such as dropped loads and vehicle impacts are not addressed here; information on these can be found in other datasheets.

1.2

Definitions

•

Fatality is used to refer to qualitative effect

•

Lethality refers to the quantitative effect, namely the fraction/percentage of the exposed population who would suffer fatality on exposure to a given consequence level.

•

Radiation is here always used to refer to thermal radiation. The effects of ionising radiation are not considered in this datasheet.

•

Probit: a function that relates lethality to the intensity or concentration of a hazardous effect and the duration of exposure. It typically takes the form: Pr = a + b ℓn V where:

Pr = probit

a, b are constants V = “dose”, typically: For toxic materials: V = (cnt) where c = concentration, n = constant, t = exposure duration For thermal radiation: V = (I4/3t) where I = thermal radiation, t = exposure duration Lethality is related to probit as shown in Appendix I.

©OGP

1

RADD – Vulnerability of humans

2.0

Summary of Recommended Data

The data presented in this section are set out as follows: •

Fire (engulfment, thermal radiation, and exposure of buildings): Section 2.1

•

Explosion (effects of overpressure): Section 2.2

•

Toxic gases (excluding smoke): Section 2.3

•

Smoke: Section 2.4

•

Vulnerability inside a Temporary Refuge (including smoke and unignited gas): Section 2.5

•

Cold water immersion: Section 2.6

2.1

Fire

Depending on the duration, intensity and area of exposure, the effects of fire range from pain, through 1st, 2nd and 3rd degree burns, to fatality. 2nd degree burns may result in fatality in a small number of cases (1% lethality for average clothing); 3rd degree burns are likely to result in fatality (50% lethality for average clothing). As identified in the Consequence Modelling datasheet, several different types of fire are potentially of concern depending on the release material and scenario: •

Flash fire

•

Pool fire

•

Jet fire

•

Fireball/BLEVE

Humans are vulnerable to fire in the following ways: •

Engulfment by the fire

•

Thermal radiation from the fire (outside the fire)

•

Inside a building that is exposed to fire/radiation

The relationship between fire type and potential vulnerability can be illustrated thus as shown in Table 2.1. Table 2.1 Relationships between Fire Types and Potential Vulnerabilities Fire type

Flash fire Jet fire Pool fire Fireball/BLEVE

2

Potential Vulnerability Engulfm ent Radiation Inside Building   possibly         possibly

©OGP

RADD – Vulnerability of humans

2.1.1

Engulfment by fire

A person momentarily and only partially exposed directly to fire is most likely to suffer pain and non-fatal burns. A person fully or substantially engulfed by fire can be considered to suffer fatality. For the purposes of QRA, the following lethality levels are recommended: •

100% lethality for people outdoors engulfed by a jet fire, pool fire or fireball

•

100% lethality for m em bers of the public outdoors engulfed by a flash fire

•

50% to 100% lethality, depending on ease of escape, for workers wearing fire resistant clothing m ade from fabrics m eeting the requirem ents of NFPA 2112 [11] or equivalent

People indoors are considered separately in Section 2.1.3 2.1.2

Thermal radiation

The effects of thermal radiation depend strongly on the thermal radiation flux, the duration of exposure, the type of clothing worn, the ease of sheltering, and the individual exposed. Hence the information provided below provides guidance on the range of effects rather than exact relationships between thermal radiation and effects valid in all circumstances. Table 2.2 summarises thermal radiation exposure effects over a range of radiation fluxes. Table 2.3 sets out thermal radiation criteria applicable to longer fire durations, i.e. to jet fires and pool fires, for which the exposure duration is more dependent on the ability to esc ape than on the fire duration. Figure 2.1 shows exposure times to the pain threshold and 2nd degree burns for different thermal radiation levels. ANSI/API Standard 521 [3] sets out permissible design levels for thermal radiation exposure to flares. Table 2.2 Therm al Radiation Exposure Effects [1] Thermal Radiation 2 (kW/m ) 1.2

Effect

2

Minimum to cause pain after 1 minute

Less than 5

Will cause pain in 15 to 20 seconds and injury after 30 seconds’ exposure Pain within approximately 10 seconds; rapid escape only is possible

Greater than 6 12.5

25

35

Received from the sun at noon in summer

• • • • • • • •

Significant chance of fatality for medium duration exposure. Thin steel with insulation on the side away from the fire may reach thermal stress level high enough to cause structural failure. Wood ignites after prolonged exposure. Likely fatality for extended exposure. Spontaneous ignition of wood after long exposure. Unprotected steel will reach thermal stress temperatures that can cause failure. Significant chance of fatality for people exposed instantaneously. Cellulosic material will pilot ignite within one minute’s exposure.

©OGP

3

RADD – Vulnerability of humans

Table 2.3 Therm al Radiation Criteria (use for jet/pool fires) Therm al Radiation (kW /m 2 ) 35 20 12.5

6 4

Effect

Immediate fatality (100% lethality) Incapacitation, leading to fatality unless rescue is effected quickly Extreme pain within 20 s; movement to shelter is instinctive; fatality if escape is not possible. Outdoors/offshore: 70% lethality Indoors onshore: 30% lethality* Impairment of escape routes Impairment of TEMPSC embarkation areas

* People indoors are only vulnerable if they have line-of-sight exposure to thermal radiation, hence a lower lethality than for people outdoors.

Figure 2.1 Tim es to Pain Threshold and 2 nd Degree Burns [2]

4

©OGP

RADD – Vulnerability of humans

For short exposures (up to a few tens of seconds, typical of fireballs), therm al radiation dose units (tdu) should be used: Dose (tdu) = (I4/3)t where:

I t

= incident thermal flux (kW/m2)

= duration of exposure (s)

Thermal dose units thus have the units (kW/m2)4/3s. Table 2.4 sets out thermal dose criteria, which should be used for fireballs. Table 2.4 Therm al Dose Fatality Criteria (use for fireballs) Therm al Dose Units ((kW /m 2 ) 4/3 s) 1000 1800 2000 3200

2.1.3

Effect

1% lethality 50% lethality, members of the public 50% lethality, offshore workers 100% lethality

People inside buildings

Besides being vulnerable to thermal radiation if they have a direct line of sight to a jet or pool fire, people inside buildings may be vulnerable to the building catching fire if combustible building material is exposed to the fire (either to a directly impinging fire or to radiation). Two types of ignition are recognised: •

Piloted ignition, resulting from the flame impinging directly on a surface

•

Spontaneous ignition, resulting from exposure to thermal radiation from a fire

Table 2.2 indicates thermal radiation levels for ignition of wood and cellulosic material. Figure 2.2 shows, as an example, the relationship between thermal radiation and time to ignition (both piloted and spontaneous) for oak. Personnel inside a building are vulnerable to the building catching fire if they cannot escape in sufficient time. This will depend on the time to ignition as compared to the time to alert the people inside to the source fire and evacuate them. People inside a building are also vulnerable if escape routes are exposed to thermal radiation: in this case the criterion of 6 kW/m2 given in Table 2.3 can be applied.

©OGP

5

RADD – Vulnerability of humans

Figure 2.2 Exam ple Tim es to Ignition of Oak

6

©OGP

RADD – Vulnerability of humans

2.2

Explosion

Explosions generate overpressures and drag forces that in turn result in damage to buildings and structures, and generate missiles (fragments of damaged structures, window glass shards, or loose objects). The effects of overpressure on humans are normally categorised as follows: •

Direct or Primary: injury to the body as a result of the pressure change

•

Secondary:

injury as a result of fragments or debris produced by the overpressure impacting on the body

•

Tertiary:

injury as a result of the body (especially the head) being thrown by the explosion drag and impacting on stationary objects or structures

For QRA, lethality is not typically estimated independently for these effects; instead, an overall lethality is estimated based on the combination of these effects. Casualties requiring medical treatment from direct blast effects are typically produced by overpressures between 1.0 and 3.4 bar. However, other effects (such as secondary effects and thermal injuries) are so predominant that casualties with only direct blast injuries make up a small part of an exposed group. For people onshore, outdoors and in the open, the following lethality levels are recommended: •

0.35 bar overpressure: 15% lethality for people outdoors, in the open

•

0.5 bar overpressure:

50% lethality for people outdoors, in the open

For people onshore, outdoors but adjacent to buildings or in unprotected structures (e.g. process units), the following lethality levels are recommended: •

0.35 bar overpressure: 30% lethality for people outdoors

•

0.5 bar overpressure:

100% lethality for people outdoors

For people indoors, the lethality level depends on the building type as well as the overpressure. Two frequently used sets of relationships between lethality level and over-pressure are presented below: Figure 2.3 shows that from API RP 752 [4], Figure 2.4 that from the CIA Guidance [6]. Both differentiate between building construction types. For personnel offshore in modules affected by an explosion, the following approach is suggested: •

100% lethality for personnel in the m odule where the explosion occurs, if the explosion overpressure exceeds 0.2 to 0.3 barg

•

100% lethality in adjacent m odules if the intervening partition (wall or deck) is destroyed by the explosion.

A more sophisticated approach could involve more detailed study of other explosion characteristics: overpressure phase duration and impulse. A probabilistic approach is recommended to estimate the likelihood of exceeding overpressures that could result in immediate fatality, escalation within the module, and escalation to adjacent areas.

©OGP

7

RADD – Vulnerability of humans

Figure 2.3 Overpressure – Lethality Relationships from API 752* [4]

Building Types B1:

Wood-frame trailer or shack.

B2:

Steel-frame/metal siding or pre-engineered building.

B3:

Unreinforced masonry bearing wall building.

B4:

Steel or concrete framed with reinforced masonry infill or cladding.

B5:

Reinforced concrete or reinforced masonry shear wall building.

* Note that API RP 753 [5] has superseded API RP 752 [4] with regard to locating portable buildings (building type B1). However, it does not give any overpressurelethality relationship for such buildings, for which API RP 753 [5] should be followed rather than using the curve on the above graph.

8

©OGP

RADD – Vulnerability of humans

Figure 2.4 Overpressure – Lethality Relationships from CIA Guidance [6]

Building Types CIA1: Hardened structure building: special construction, no windows CIA2: Typical office block: four storey, concrete frame and roof, brick block wall panels CIA3: Typical domestic building: two-storey, brick, walls, timber floors CIA4: ‘Portacabin’ type timber construction, single storey

Note that the presentations of the graphs in Figure 2.3 and Figure 2.4 follow those of the original publications and no attempt has been made to convert either or both to a common set of axes.

©OGP

9

RADD – Vulnerability of humans

2.3

Toxic gases

2.3.1

General

Various approaches are used to determine the consequences of toxic gases (not including smoke, which is addressed separately in Section 2.4): •

IDLH

•

ERPG

•

Probit

•

SLOT & SLOD DTLs

Of these, the IDLH (“Immediate Danger to Life or Health”) is the maximum concentration from which escape is possible within 30 minutes without any escape-impairing symptoms or irreversible health effects. Its use as the limiting value for the onset of fatalities has several disadvantages, chief amongst them as regards QRA is significant conservatism. IDLHs are more suitable for use as a workplace risk management tool rather than in a major accident risk assessment. In most cases, exposure to the IDLH concentration would be extremely unlikely ( 2000 ppm

Rapidly lethal

©OGP

11

RADD – Vulnerability of humans

Table 2.6 SLOT & SLOD DTL Values and Probit Constants (concentration in ppm , duration in m inutes) Material

HSE SLOT & SLOD SLOT

Ammonia

Chlorine

“n”

a

b

n

a

b

n

2

-43.24

2.32

2

-16.33

1

2

57000

1

-67.68

6.64

1

-7.26

1

1

4.84 × 5 10

2

-15.33

1.55

2

-4.89

0.5

2.75

1.5 × 13 10

4

-30.08

1.16

4

-10.87

1

1.9

7.45 × 7 10

2

-10.23

0.84

2

-16.89

1

2.4

12000

41000

1

-36.44

4.16

1

-8.70

1

1.5

96000

6.24 × 5 10

2

-11.61

1.24

2

-16.26

1

3.7

2 × 10

Sulphur Dioxide Hydrogen Fluoride Nitrogen Dioxide

8

40125 1.08 × 10

Hydrogen Sulphide

TNO Probit

SLOD 1.09 × 9 10

3.78 × 10

Carbon Monoxide

HSE Probit

5

12

4.66 × 10

6

Table 2.7 Exam ple Concentrations (ppm ) to give 1% and 50% Lethality for 10 m inute and 30 m inute Exposures M aterial

Ammonia Carbon Monoxide Chlorine Hydrogen Sulphide Sulphur Dioxide Hydrogen Fluoride Nitrogen Dioxide 12

10 minutes, 1% lethality

30 minutes, 1% lethality

HSE SLOT

TNO Probit

HSE SLOT

TNO Probit

HSE SLOD

TNO Probit

HSE SLOD

TNO Probit

6148

4218

3550

2435

10149

13523

5859

7808

4013

2063

1338

688

5700

21203

1900

7068

104

105

60

71

220

573

127

384

669

371

508

208

1107

1265

841

709

683

1327

394

840

2729

3504

1576

2217

1200

422

400

203

4100

1996

1367

960

9600

90

3200

67

62400

168

20800

125

©OGP

10 minutes, 50% lethality

30 minutes, 50% lethality

RADD – Vulnerability of humans

2.4

Smoke

Smoke from hydrocarbon fires contains carbon monoxide, which is toxic, and carbon dioxide, which contributes to the physiological effects of smoke in various ways. Smoke is also deficient in oxygen, hence its inhalation will result in oxygen depletion. Hence the direct effect of smoke needs to consider the combined effects of these constituents: see Section 2.4.1. Smoke also obscures vision and hence may prevent personnel from reaching the TR or lifeboat embarkation points on an offshore installation, or muster location onshore: see Section 2.4.2. Once personnel are mustered in the TR offshore, they continue to be vulnerable through smoke ingress to the TR; this is addressed separately in Section 2.5. 2.4.1

Smoke Inhalation

2.4.1.1 Effects of carbon monoxide exposure Table 2.8 Effects of Carbon Monoxide Exposure [1] CO concentration

Effects

1500 ppm

Headache after 15 minutes, collapse after 30 minutes, death after 1 hour

2000 ppm

Headache after 10 minutes, collapse after 20 minutes, death after 45 minutes Maximum "safe" exposure for 5 minutes, danger of collapse in 10 minutes, danger of death in 15 to 45 minutes

3000 ppm 6000 ppm 12800 ppm

Headache and dizziness in 1 to 2 minutes, danger of death in 10 to 15 minutes Immediate effect, unconscious after 2 to 3 breaths, danger of death in 1 to 3 minutes

The toxicity of carbon monoxide is due to the formation of blood carboxyhaemoglobin. This results in a reduction of the supply of oxygen to critical body organs and is referred to as anaemic anoxia. The affinity of haemoglobin for CO is extremely high (over 200 times higher than O2), so that the proportion of haemoglobin in the form of carboxyhaemoglobin (COHb) increases steadily as CO is inhaled. There is little doubt that CO is the most important toxic agent formed in hydrocarbon fires because: •

It is always present in fires, often at high concentrations.

•

It causes confusion and loss of consciousness, thus impairing or, preventing escape.

The rate of change (per second) of the carboxyhaemoglobin level (COHb, %) is given by:

where CO is in %, BR is in m3/s and is the actual breathing rate (approximately 3 × 10-3 m3/s for an average individual). The cumulative effect of CO can be calculated by integrating this expression.

©OGP

13

RADD – Vulnerability of humans

The actual breathing rate may exceed the nominal breathing rate because of the effects of CO2 and is estimated as follows:

Table 2.9 shows the effects of COHb in blood. From this table it can be concluded that COHb levels in the range 10-20% represent a range of values where there is a reduced potential of ability to escape or carry out functions requiring dexterity or conscious effort. Above 20% COHb impairment and death become more certain within a relatively short period and recovery may not be possible. It is suggested that the upper limit for survivability without significant impairment is 15% COHb with a cautious best estimate of 10% COHb to be used where exposure is followed by intense physical activity such as escape or evacuation under harsh conditions. Table 2.9 Effects of COHb in Blood [1] % COHb in Blood 2.5-5

Physiological and Subjective Symptoms

5-10

Visual light threshold slightly increased

10-20

Tightness across forehead and slight headache, dyspnoea on moderate exertion, occasional headache, signs of abnormal vision

20-30

Definite headache, easily fatigued, Impaired judgment, possible dizziness and dim vision, impaired manual dexterity

30-40 40-50

Severe headache with dizziness, nausea and vomiting Headache, collapse, confusion, fainting on exertion

60-70

Unconsciousness, convulsions, respiratory failure and death

80 80+

Rapidly fatal Immediately fatal

No symptoms

2.4.1.2 Effects of carbon dioxide exposure Table 2.10 Effects of Carbon Dioxide Exposure [1] CO 2 Concentration 45 000 ppm / 4.5%

Responses

55 000 ppm / 5.5%

Breathing difficulty, headache and increased heart rate after 1 hour

65 000 ppm / 6.5% 70 000 ppm / 7.0%

Dizziness, and confusion after 15 minutes exposure Anxiety caused by breathing difficulty, effects becoming severe after 6 minutes exposure

100 000 ppm / 10%

Approaches threshold of unconsciousness in 30 minutes

120 000 ppm / 12% 150 000 ppm / 15%

Threshold of unconsciousness reached in 5 minutes Exposure limit 1 minutes

200 000 ppm / 20%

Unconsciousness occurs in less than 1 minute

14

Reduced concentration capability for more than 8 hours exposure, adaptation possible

©OGP

RADD – Vulnerability of humans

While carbon dioxide is not considered to be particularly toxic, at levels normally observed in fires, a moderate concentration does stimulate the rate of respiration. This would be expected to cause accelerated uptake of any toxic and/or irritant gasses present during an incident involving fire and fume as breathing rate increases 50% for 20 000 ppm (2% v/v) carbon dioxide and doubles for 30 000 ppm (3% v/v) carbon dioxide in air. At 50 000 ppm (5%v/v), breathing becomes laboured and difficult for some individuals as it represents a significant level of oxygen depletion. The effect of CO2 can be expressed as the fraction, FCO2, of the incapacitating dose by integrating the following expression:

where CO2 is the concentration of CO2(%) in air, which can be estimated using the approach suggested in Section 2.5.1 of the Consequence Modelling datasheet.. Concentrations of less than 3% are considered to have no effect. 2.4.1.3 Effects of oxygen depletion Table 2.11 Effects of Oxygen Depletion [1] % Oxygen in Air

Symptoms

21-20

Normal

18 17

Night vision begins to be impaired Respiration volume increases, muscular coordination diminishes, attention and thinking clearly requires more effort

12 to 15

Shortness of breath, headache, dizziness, quickened pulse, effort fatigues quickly, muscular coordination for skilled movement lost

10 to 12 6 to 8

Nausea and vomiting, exertion impossible, paralysis of motion Collapse and unconsciousness occurs

6 or below

Death in 6 to 8 minutes

Oxygen constitutes approximately 21% v/v in clean air. Oxygen concentrations below 15% by volume produce oxygen starvation (hypoxia) effects such as increased breathing, faulty judgment and rapid onset of fatigue. Concentrations below 10% cause rapid loss of judgment and comprehension followed by loss of consciousness, leading to death within a few minutes. This is taken to be the limiting oxygen concentration where escape needs only a few seconds. If escape is not possible within few seconds, incapacitation and death is assumed to occur. The effect of oxygen depletion can be expressed as the fraction, FO2, of the incapacitating dose by integrating the following expression:

where O2 is the oxygen concentration (%) in air.

©OGP

15

RADD – Vulnerability of humans

2.4.1.4 Combined effects of carbon monoxide, carbon dioxide and oxygen depletion The combined effect of these smoke constituents can be considered to give an incapacitating dose, FTot, calculated as follows:

If FTot > 1.0, impairment is considered to result. 2.4.2

Smoke Obscuration

A visibility of 4-5 m is about the threshold of diminished performance, and this is the smoke level that should be considered in smoke ventilation system design. It is suggested that there should be a minimum of 3 m vision for escape from a primary compartment and at least 10 m for an escape route. Important factors to consider in a risk analysis with regard to obscuration of vision (and time to escape) are: •

Exposure to smoke

•

Arrangements of escape ways (layout, sign, illumination, railing, etc.)

•

Training of personnel

•

Familiarity with the installation

Where an escape way is well laid out and provided with high visibility marking or illumination (including effective provision of torches / light-sticks), then the 3 m criterion may be applied. Alternatively, impairment of escape ways or of the TR can be considered to occur when the particulate concentration exceeds that giving a visibility reduction of 1 dB/m. This can be estimated using the approach suggested in Section 2.5.1 of the Consequence Modelling datasheet.

2.5

Vulnerability inside a Temporary Refuge

Personnel inside a Temporary Refuge continue to be vulnerable to the consequences of an incident that has caused them to muster there. They are vulnerable to: •

Smoke ingress to the TR

•

Heat build-up in the TR

•

Ingress to the TR of unignited hydrocarbon gas

•

Delayed explosion or structural collapse resulting in the TR being breached or otherwise ceasing to be habitable

2.5.1

Smoke ingress

Smoke ingress to the TR also results in heat build-up. CO2 build-up and oxygen depletion are also enhanced through respiration. Hence application of a simple model for gas build-up in the TR such as the CSTR model suggested in Section 2.5.1 of the Consequence Modelling datasheet will under-estimate the effects of smoke ingress.

16

©OGP

RADD – Vulnerability of humans

It can be assumed that the smoke plume totally engulfs the TR at a uniform concentration. It is further assumed that any smoke that enters the TR will be rapidly and evenly dispersed around the relevant interior space. The CO and particulates concentrations, Conc, in the TR are evaluated as:

where:

Concin

is the concentration of CO/particulate inside the TR

Concout

is the concentration of CO/particulates outside the TR

Vent Rate

is the TR ventilation rate (air changes per second)

The CO2 concentration, Conc, in the TR is calculated as:

where: C is the concentration of CO2 in exhaled air, assumed to be 3% N is the number of persons in the TR BR is an average individual’s breathing rate (m3/s) V is the TR volume (m3) The O2 concentration in the TR is calculated as:

where P is the percentage of inhaled air that is converted from O2 to CO2, usually 3%. The initial concentrations are all taken to be zero, except O2 which is taken to be 20.9%. The internal temperature (neglecting any changes in humidity level) is calculated by integrating the following function:

where Q1 Q2 and

is the heat conducted through the TR fabric (assumed zero) is the heat generated by the TR occupants (350 W per person at normal temperatures) Vρ C is the heat capacity of the TR air (volume × density × specific heat).

Impairment of the TR is then taken to occur if either: •

The particulate concentration exceeds that giving a visibility reduction of 1 dB/m, or,

•

The total incapacitating dose of COHb, CO2, O2, and temperature effects exceeds 1.0. The total dose FTot is calculated as:

©OGP

17

RADD – Vulnerability of humans

2.5.2

Heat build-up

Besides heat build-up through smoke ingress, the TR may also be heated by an externally impinging fire. However, on many modern installations there is at least an H60 rated firewall protecting the TR from fire. Hence, provided the integrity of the firewall is not breached (e.g. by an explosion), the TR should not be impaired solely by the effects of heat build-up due to external radiation within its expected endurance time. 2.5.3

Ingress of unignited hydrocarbon gas

As discussed in Section 2.5.1 of the Consequence Modelling datasheet, a gas concentration inside the TR exceeding 60% of LFL can be assumed to cause TR impairment. 2.5.4

Structural collapse

Structural collapse and/or breach of the TR is addressed in the Structural Vulnerability datasheet.

2.6

Cold Water

The survival of people immersed in cold water (e.g. as a result of escape to water from an offshore installation) depends on a range of variables: •

Environmental factors: temperature, sea state, visibility

•

Clothing: survival suit, lifejacket

•

Personal factors, e.g. body fat, fitness

An HSE offshore safety report [7], published in 1996 but still referenced by the HSE, presents a comprehensive discussion of the subject and a recommended approach.

3.0

Guidance on use of data

3.1

General validity

The criteria set out in Section 2.0 should be used where no equivalent criteria are specified either by the regulatory authority or by the party commissioning the QRA. They should generally be considered valid for most studies related to onshore and offshore facilities. Where the combustion products in smoke include other toxic materials besides CO, their effects should be incorporated in the analysis, e.g. by using the probits for those materials.

18

©OGP

RADD – Vulnerability of humans

3.2

Uncertainties

Individuals’ vulnerabilities to all the potential causes of injury/fatality discussed in Section 2.0 vary widely, depending on many factors such as: •

Personal factors: physical (e.g. fitness), psychological, training

•

Clothing (applies to thermal radiation, exposure to fire, cold water immersion)

•

Ability to escape (e.g. ease of egress, availability of escape routes/means)

•

Availability and ongoing integrity of shelter (e.g. TR)

•

Availability of means of breathing assistance (applies to toxic gases and smoke)

In addition, factors such as warning time, the reliability of HVAC shutdown systems and TR fabric integrity will impact on the dose received. All of these factors should be considered for their relevance and impact when using the criteria.

4.0

Review of data sources

For all of the impact criteria except cold water, an HSE document [1] provides a good general summary of vulnerabilities and physical effects of the hazards discussed in Section 2.0. It draws on a range of other published studies referenced within it. This document accordingly forms the basis of the recommended data. Supplementary references are as follows: •

Fire

API [3]

•

Explosion

API [4] (but see note below Figure 2.3), CIA [6]

•

Toxic gases

Dutch “Purple Book” [8], [12]

•

Smoke

SFPE [9]

•

TR

Purser [10]

•

Cold Water

HSE [7]

5.0

Recommended data sources for further information

HSE SLOD and SLOT values for a wide range of materials additional to those presented in Section 2.3 are given in [12]. The “Purple Book” [8] likewise gives probits for a wide range of materials.

6.0

References

6.1

References for Sections 2.0 to 4.0

[1] HSE, 2008. Indicative Human Vulnerability to the Hazardous Agents Present Offshore for Application in Risk Assessment of Major Accidents, HID Semi Permanent Circular no. SPC/Tech/OSD/30, http://www.hse.gov.uk/foi/internalops/hid/spc/spctosd30.pdf. [2] FEMA, 1989. Handbook of Chemical Hazard Analysis Procedures, Washington, D.C: Federal Emergency Management Agency. [3] American Petroleum Institute (API), 2007. Pressure-Relieving and Depressuring Systems, ANSI/API STD 521, 5th ed., Washington, D.C: API. [4] American Petroleum Institute (API), 2003. Management of Hazards Associated with Location of Process Plant Buildings, 2nd. ed., API RP 752, Washington, D.C: API.

©OGP

19

RADD – Vulnerability of humans

[5] American Petroleum Institute (API), 2007. Management of Hazards Associated with Location of Process Plant Portable Buildings, 1st. ed., API RP 753, Washington, D.C: API. [6] Chemical Industries Association (CIA), 2003. Guidance for the location and design of occupied buildings on chemical manufacturing sites, 2nd. ed., London: Chemical Industires Association, ISBN 1 85897 114 4. [7] HSE, 1996. Review of Probable Survival Times for Immersion in the North Sea, Offshore Technology Report OTO 95 038, http://www.hse.gov.uk/research/otopdf/1995/oto95038.pdf. [8] VROM, 1999/2005. Guidelines for quantitative risk assessment, Publication Series on Dangerous Substances, PGS 3 (formerly CPR18, “Purple Book”), Ministerie van Volkshuis-vesting, Ruimtelijke Ordening en Milieubeheer, http://www.vrom.nl/pagina.html?id=20725. [9] SFPE, 2002. The SFPE Handbook of Fire Protection Engineering, 3rd. ed., ch. 2-6, Quincy, MA: National Fire Protection Association. [10] Purser, D, 1992. Toxic Effects of Fire Cases, Offshore Fire and Smoke Hazards, Aberdeen. [11] NFPA 2007. Standard on Flame-Resistant Garments for Protection of Industrial Personnel against Flash Fire, NFPA 2112. [12] HSE, 2008. Assessment of the Dangerous Toxic Load (DTL) for Specified Level of Toxicity (SLOT) and Significant Likelihood of Death (SLOD), http://www.hse.gov.uk/hid/haztox.htm.

20

©OGP

RADD – Vulnerability of humans

Appendix I – Relationship between Lethality and Probit The following table shows the percentage affected (lethality) for a given probit value. Lethality (%) 0

1

2

3

4

5

6

7

8

9

0

-

2.67

2.95

3.12

3.25

3.36

3.45

3.52

3.59

3.66

10

3.72

3.77

3.82

3.87

3.92

3.96

4.01

4.05

4.08

4.12

20

4.16

4.19

4.23

4.26

4.29

4.33

4.36

4.39

4.42

4.45

30

4.48

4.50

4.53

4.56

4.59

4.61

4.64

4.67

4.69

4.72

40

4.75

4.77

4.80

4.82

4.85

4.87

4.90

4.92

4.95

4.97

50

5.00

5.03

5.05

5.08

5.10

5.13

5.15

5.18

5.20

5.23

60

5.25

5.28

5.31

5.33

5.36

5.39

5.41

5.44

5.47

5.50

70

5.52

5.55

5.58

5.61

5.64

5.67

5.71

5.74

5.77

5.81

80

5.84

5.88

5.92

5.95

5.99

6.04

6.08

6.13

6.18

6.23

90

6.28

6.34

6.41

6.48

6.55

6.64

6.75

6.88

7.05

7.33

%

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

99

7.33

7.37

7.41

7.46

7.51

7.58

7.65

7.75

7.88

8.09

Examples: •

1% is equivalent to 2.67 probits.

•

42% is equivalent to 4.80 probits.

•

50% is equivalent to 5.00 probits.

•

75% is equivalent to 5.67 probits.

•

99.9% is equivalent to 8.09 probits.

©OGP

21

Risk Assessment Data Directory Report No. 434 – 15 March 2010

Vulnerability of plant/structure International Association of Oil & Gas Producers

RADD – Vulnerability of plant/structure

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0 2.1

Summary of Recommended Data ............................................ 1 Fire ................................................................................................................... 2

2.1.1 2.1.2

Vulnerability of Plant/Structure under Fire Loading ............................................... 2 Derivation of Fire Loads ............................................................................................ 4

2.2

Explosions....................................................................................................... 7

2.2.1 2.2.2 2.2.3 2.2.4

Vulnerability of Plant/Structure to Explosions ........................................................ 7 Overpressure Loading ............................................................................................. 10 Drag Loading on Equipment ................................................................................... 11 Response of Plant/Structure ................................................................................... 12

2.3

Missiles .......................................................................................................... 14

3.0 3.1 3.2

Guidance on use of data ...................................................... 17 General validity ............................................................................................. 17 Uncertainties ................................................................................................. 17

4.0

Review of data sources ....................................................... 17

5.0

Recommended data sources for further information ............ 18

6.0 6.1 6.2

References .......................................................................... 19 References for Sections 2.0 to 4.0 .............................................................. 19 References for other data sources examined ............................................ 19

©OGP

RADD – Vulnerability of plant/structure

Abbreviations: 2D AIChE API BLEVE BS CCPS CoP DLM DNV ESREL FPSO HSE ISO LPG LPGA MDOF QRA SDOF UKOOA

Two-dimensional American Institute of Chemical Engineers American Petroleum Institution Boiling Liquid Expanding Vapour Explosion British Standard Center for Chemical Process Safety Code of Practice Direct Load Measurement Det Norske Veritas European Safety and Reliability Floating Production, Storage and Offloading unit (UK) Health and Safety Executive International Organization for Standardization Liquefied Petroleum Gas LP Gas Association Multiple Degree of Freedom Quantitative Risk Assessment Single Degree Of Freedom United Kingdom Offshore Operators Association (now Oil & Gas UK)

©OGP

RADD – Vulnerability of plant/structure

1.0

Scope and Definitions

1.1

Application

This datasheet provides information on vulnerability of plant/structure to the consequences of major hazard events on onshore and offshore installations. The focus is on primary structures (e.g. primary beams/columns, firewalls, control rooms etc.) and major items of equipment such as pressure vessels where failure can lead to escalation effects. Information is presented relating to the structural response failure criteria. The following consequences are considered: •

Fire

•

Explosion

•

Missile

For the purposes of a QRA the information provided in this datasheet may be sufficient and, where applicable, acceptable to the regulatory authority. However, where the risks arising from structural failure are significant, more detailed analysis of the vulnerability of plant/structure to heat, overpressure and impact loads may be required. This should be carried out by specialists within those fields as it requires both a sound understanding of the underlying physics and the use of complex numerical simulations. Such assessments would, typically, require a multi-disciplinary approach involving safety, process and structural engineering disciplines amongst others. It should also be stressed the vulnerability of plant/structure can be significantly reduced by employing the principles of inherent safety. For example, application of good local and global layout methods can reduce not only the likelihood and the severity of fires and explosions but also the likelihood of escalation of the event and the overall consequences.

1.2

Definitions

•

Em issivity

•

Convective Flux Refers to the transfer of heat from one point to another within a fluid, gas or liquid, by the mixing of one portion of the fluid with another.

•

Im pulse

•

Radiative Flux Refers to the transfer of heat from one body to another by thermal radiation.

•

Rise Tim e

2.0

A constant used to quantify the radiation emission characteristics of a flame: it is the fraction of the maximum theoretical radiative flux (that of a “perfect black body”) emitted by the flame.

The integral of a force or load over an interval of time.

The time taken for the explosion overpressure to increase from zero to the peak overpressure.

Summary of Recommended Data

The data presented in this section are set out as follows: •

Section 2.1: Response to Fires

•

Section 2.2: Response to Explosions

•

Section 2.3: Impact of Missiles

©OGP

1

RADD – Vulnerability of plant/structure

2.1

Fire

Section 2.1.1 gives typical data for vulnerability of plant/structure under fire loading. Characteristic data for typical hydrocarbon fires are given in Section 2.1.2. 2.1.1

Vulnerability of Plant/Structure under Fire Loading

Table 2.1 gives typical times to failure of various items of plant/structure. Critical temperatures for failure of various components and vessels are shown in Table 2.2. Table 2.1 Tim e to Failure of Pipework, Vessels, Equipm ent and Structures affected by Fire [1]

2

Fire Scenario (Note 1)

Failure

Tim e to Failure (Note 2)

Flame with heat flux of 250 kW/m2 impinging onto a pipe support with no fire protection.

Excessive deformation of pipe supports leading to loss of tightness and potential rupture.

< 5 min

Flame with heat flux of 250 kW/m2 impinging onto a connector or flange (clamp or bolted) with no fire protection. Flame with heat flux of 250 kW/m2 impinging onto a valve with no fire protection. Flame with heat flux of 250 kW/m2 impinging onto a safety valve with no fire protection.

Hub connector or flange (clamp or bolted), loss of tightness.

< 5 min

Valve, loss of tightness.

< 10 min

Safety valve, opens at a pressure lower than the setting pressure.

< 10 min

Flame with heat flux of 250 kW/m2 impinging onto a bursting disc device with no fire protection.

Bursting disc, opens at a pressure lower than the setting pressure or is destroyed.

< 10 min

Flame with heat flux of 250 kW/m2 impinging onto pressure vessel with no fire protection.

Pressure vessel rupture with the potential formation of projectiles.

< 40 min depending on the flame size with respect to vessel size, vessel contents, wall thickness and the size of pressure relief/blowdown orifice. Determine the time to failure by multi-physics analysis.

©OGP

RADD – Vulnerability of plant/structure

Fire Scenario (Note 1)

Failure

Tim e to Failure (Note 2)

Flame with heat flux of 250 kW/m2 impinging onto a pipe attached to a pressure vessel. The pipe is unprotected and the vessel is protected so that heat is conducted by the pipe into the pressure vessel shell forming a hot spot with loss of strength.

Pressure vessel rupture with the potential formation of projectiles.

< 40 min depending on the size of the pipe and fire intensity.

Flame with heat flux of 250 kW/m2 impinging onto a vessel support with no fire protection.

Excessive deformation of vessel supports leading to loss of tightness at nozzle flanges.

< 5 min

Flame with heat flux of 250 kW/m2 impinging locally onto a structural member with no fire protection.

Loss of load bearing capacity of a structural member, which may lead to large deformation in some locations and loss of tightness of pipework. Collapse of structure or its part leading to loss of tightness of pipework and large releases of hazardous fluids.

< 15 min depending on the member size

Collapse of atmospheric storage tanks, road tankers, rail tank cars and marine tankers leading to large releases of hazardous fluids.

< 40 min depending on the flame size with respect to tank size and the tank contents, fill level, wall thickness and the size of any pressure relief device. Determine the time to failure by multi-physics analysis.

Flame with heat flux of 250 kW/m2 impinging locally onto a joint of structural members or engulfing several joints. Flame with heat flux of 250 kW/m2 impinging onto the storage or transport tanks with no fire protection.

< 30 min depending on the member sizes.

Notes

1. The time to failure for heat fluxes other than 250 kW/m2 should ideally be determined by transient calculations.

2. The times to failure given are upper limits, as per the original source reference. Judgment should be used to select a suitable minimum or other absolute value if required.

©OGP

3

RADD – Vulnerability of plant/structure

Table 2.2 Com m only used critical tem peratures [2] Exposed Structure Structural steel onshore LPG tanks (France and Italy) Structural steel offshore LPG tanks (UK and Germany) Structural aluminium offshore Unexposed face of a division/boundary Unexposed face of a division/boundary Surface of safety related control panel

Tem perature (°C) 550-620 427 400 300 200 180 140 40

Note that these values are indicative only and, if the risks from structural failure due to fire are significant, more detailed analysis may be required in order to determine the thermal response of plant/structure. Generally for simple linear elements, all that is required is the temperature distribution across the section at the mid point. This may be computed using 2D thermal analysis. For more complex elements and whole structures, typically the complete temperature history of all parts of the structure is required although some simplification may be possible. In particular, the material behaviour under elevated temperatures i.e. temperatures above ambient, should be accounted for. The effects of elevated temperatures when the structure is considered to be stress-free are threefold: •

reduction of modulus of elasticity and hence changes in stiffness

•

reduction in yield strength of structural steel and

•

thermal strains.

Data for the behaviour of various grades of steel under elevated temperatures is given in [3]. 2.1.2

Derivation of Fire Loads

The assessment of the vulnerability of plant/structure to fires requires that the following be established: a) The fire scenario or design fire b) Heat flow characteristics from the fire to the plant/structure c) The behaviour of material properties of the plant/structure at elevated temperatures d) The properties of fire protection systems. The actual fire scenarios and design fluxes must first be defined. Design fires are usually characterised in terms of the following variables with respect to time [4]: •

heat release rate

•

toxic-species production rate

•

smoke production rate

•

fire size (including flame length)

4

©OGP

RADD – Vulnerability of plant/structure

•

duration.

Other variables such as temperature, emissivity and location may be required for particular types of numerical analysis. Generally, the following should be considered in the determination of fire loads: a) whether the fire is a pool or jet fire and confined/unconfined b) whether fire is ventilation or fuel controlled c) whether flame is obstructed/unobstructed d) composition of fire fuel (one-phase or two-phase) e) gas to oil ratio in the burning fluid f) temporal and spatial variation of heat flux within a flame. [2] and [5] include details of a wide range of pool and jet fires that enable the radiative and convective heat transfer to be calculated more accurately than in the past for a wide range of fire scenarios. These are presented in Table 2.3 to Table 2.7 below for high pressure gas jet fires, high pressure two-phase jet fires, pool fires on installation, pool fires on sea and fire loading on pressure vessels respectively. Table 2.3 Characteristic Data for High Pressure Gas Jet Fires [2] Size (kg/s) Flame Length (m) Radiative flux (kW/m2) Convective flux (kW/m2) Total heat flux (kW/m2) Flame emissivity

0.1 5 80 100

1 15 130 120

10 40 180 120

>30 65 230 120

180 0.25

250 0.4

300 0.55

350 0.7

Table 2.4 Characteristic Data for High Pressure Two-Phase Jet Fires [2] Fuel m ix of 30% gas, 70% liquid by m ass Size (kg/s) Flame Length (m) Radiative flux (kW/m2) Convective flux (kW/m2) Total heat flux (kW/m2) Flame emissivity

0.1 5 100

1 13 180

10 35 230

>30 60 280

Flashing Liquid fires (e.g. propane/butane) 1 not given in [2] 160

100

120

120

120

70

200

300

350

400

230

0.3

0.55

0.7

0.85

1

©OGP

5

RADD – Vulnerability of plant/structure

Table 2.5 Characteristic Data for Pool Fires on Installations [2] Methanol Pool

Typical Pool Diameter (m) Flame Length (m) Mass burning rate (kg/(m2s))

Radiative flux (kW/m2) Convective flux (kW/m2) Total heat flux (kW/m2) Flame emissivity

5 Equal to pool diameter 0.03

35 0 35 0.25

Sm all Hydrocarbon Pool 5 Up to twice pool diameter Crude: 0.045 0.06 Diesel: 0.055 Kerosene: 0.06 Condensate: 0.10 C3/C4s: 0.12 230 20 250 0.9

Table 2.6 Characteristic Data for Pool Fires on Sea [2] Typical Pool Diameter Flame Length (m) Mass burning rate (kg/(m2s))

Radiative flux (kW/m2) Convective flux (kW/m2) Total heat flux (kW/m2) Flame emissivity

> 10 Up to twice diameter Crude: 0.045 - 0.06 Diesel: 0.055 Kerosene: 0.06 Condensate: 0.10 C3/C4s: 0.20 230 20 250 0.9

Table 2.7 Characteristic Fire Loading for Pressure Vessels and Other Equipm ent [5]

Local Peak Heat Load (kW/m2) Global Average Heat Load (kW/m2)

Jet Fire 0.1 kg/s < leak leak rate > 2 kg/s rate < 2 kg/s 250 350 0 100

Pool Fire

150 100

The global average heat load represents the average heat load that exposes a significant part of the process segment or structure and provides the major part of the heat input to the process segment thereby affecting the pressure in the segment.

6

©OGP

RADD – Vulnerability of plant/structure

The local heat load exposes a small area of the process segment or structure to the peak heat flux. The local peak heat load, with the highest flux, determines the rupture temperature of different equipment and piping within the process segment.

2.2

Explosions

The loading on plant/structure from an explosion arises from both overpressure loading and drag loading. The input data required for the assessment of the vulnerability of plant/structure include: •

Peak pressure

•

Impulse

•

Load duration

•

Rise time (to peak pressure)

•

Drag pressure

•

Approximate impulse duration for dynamic drag

2.2.1

Vulnerability of Plant/Structure to Explosions

Survey of damage due to explosion overpressure has been carried by a number of researchers, where Table 2.8 and Table 2.9 present the data from Clancey [6], which looked at damage effects produced by a blast wave in general, and Stephens [7], which focused on vulnerable refinery parts. As for the fire damage cases reported in Table 2.1, the values given in Table 2.8 and Table 2.9 are indicative only. The determination of the vulnerability of a plant/structure should be determined based on an assessment of the criticality of the structure followed by a proportionate modelling approach (i.e. one based on the criticality and complexity).

©OGP

7

RADD – Vulnerability of plant/structure

Table 2.8 Dam age Estim ates for Com m on Structures Based on Overpressure [6] Pressure Psig kPa 0.02 0.14 0.03 0.21 0.04 0.28 0.1 0.69 0.15 1.03 0.3 2.07

1

8

0.4 0.5-1.0

2.76 3.4-6.9

0.7 1.0 1.0-2.0

4.8 6.9 6.9-13.8

1.3 2 2.0-3.0 2.3 2.5 3

9.0 13.8 13.8-20.7 15.8 17.2 20.7

3.0-4.0

20.7-27.6

4 5

27.6 34.5

5.0-7.0 7 7.0-8.0

34.5-48.2 48.2 48.2-55.1

9 10

62 68.9

300

2068

Dam age Annoying noise (137 dB if of low frequency 10-15 Hz) Occasional breaking of large glass windows already under strain Loud noise (143 dB), sonic boom, glass failure Breakage of small windows under strain Typical pressure for glass breakage "Safe distance" (probability 0.95 of no serious damage1 below this value); projectile limit; some damage to house ceilings; 10% window glass broken Limited minor structural damage Large and small windows usually shattered; occasional damage to window frames. Minor damage to house structures Partial demolition of houses, made uninhabitable Corrugated asbestos shattered; corrugated steel or aluminium panels, fastenings fail, followed by buckling; wood panels (standard housing) fastenings fail, panels blown in Steel frame of clad building slightly distorted Partial collapse of walls and roofs of houses Concrete or cinder block walls, not reinforced, shattered Lower limit of serious structural damage 50% destruction of brickwork of houses Heavy machines (3000 lb) in industrial building suffered little damage; steel frame building distorted and pulled away from foundations Frameless, self-framing steel panel building demolished; rupture of oil storage tanks Cladding of light industrial buildings ruptured Wooden utility poles snapped; tall hydraulic press (40,000 lb) in building, slightly damaged Nearly complete destruction of houses Loaded, lighter weight (British) train wagons overturned Brick panels, 8-12 inch thick, not reinforced, fail by shearing or flexure Loaded train boxcars completely demolished Probable total destruction of buildings; heavy machine tools (7,000 lb) moved and badly damaged, very heavy machine tools (12,000 lb) survive Limit of crater lip

Understood to be to typical brick built buildings

©OGP

RADD – Vulnerability of plant/structure

Table 2.9 Dam age Estim ates Based on Overpressure for Process Equipm ent [7] (legend on next page) Equipment

Overpressure, psi 0.5

1.0

1.5

Control house steel roof

A

C

D

Control house concrete roof Cooling tower

A

E

P

Tank: cone roof Instrument cubicle

B

2.0

2.5

3.0

3.5

4.0

4.5

5.0

6.0

6.5

7.0

7.5

8.0

8.5

9.0

9.5

10.0 12.0

14.0

16.0

18.0

20.0

N D

N

F

O

D

K A

U

LM

Fixed heater

G

Reactor: chemical

A

Filter

H

T

I

T I

P

T

F

Regenerator

I

Tank: floating roof

K

V IP

T

T U

Reactor: cracking

I

Pipe supports

P

D I

T

SO

Utilities: gas meter

Q

Utilities: electronic

H

I

Electric motor

H

Blower

Q

Fractionation column

5.5

T I

V T

R

Pressure vessel: horizontal Utilities: gas regulator

T PI

T

I

Extraction column

MQ I

V

Steam turbine

I

Heat exchanger

I

Tank sphere

T M

I

I

Pressure vessel: vertical

I

Pump

I

©OGP

S

V

T T

T V

9

RADD – Vulnerability of plant/structure

Legend to Table 2.9: A. Windows and gauges broken B. Louvres fail at 0.2-0.5 psi

L. Power lines are severed M. Controls are damaged

C. Switchgear is damaged from roof collapse

N. Block walls fail

D. Roof collapses E. Instruments are damaged

O. Frame collapses P. Frame deforms

F. Inner parts are damaged

Q. Case is damaged

G. Brick cracks H. Debris - missile damage occurs

R. Frame cracks S. Piping breaks

I. Unit moves and pipes break

T. Unit overturns or is destroyed

J. Bracing fails K. Unit uplifts (half tilted)

U. Unit uplifts (0.9 tilted) V. Unit moves on foundation

2.2.2

Overpressure Loading

DNV OS-A101 [8] provides some generic overpressure values for various offshore units including drill rigs, FPSOs and production platforms as detailed in Table 2.10. Table 2.10 Nom inal Design Blast Overpressures for Various Offshore Units [8]

The characteristic representation of the overpressure load is via a triangular blast profile and the response of the plant/structure to the explosion is primarily determined by the ratio of the blast load duration, td, to the natural period of vibration of the plant/structure, T as detailed in Table 2.11 [2]. In an impulsive response regime, the blast load is very short compared with the natural period of the structural element. The duration of the load is such that the load has

10

©OGP

RADD – Vulnerability of plant/structure

finished acting before the element has had time to respond. Due to inertial resistance of the structure, most of the deformation occurs after the blast load has passed. Impulse is an important aspect of damage-causing ability of this type of blast and may become a controlling factor in design situations where the blast wave is of relatively short duration. In the quasi-static regime, the duration of the blast load is much longer than the natural period of the structural element. In this case, the blast loading magnitude may be considered constant while the element reaches its maximum deformation. For quasistatic loading, the blast will cause the structure to deform while the loading is still applied. In the dynamic regime, the load duration is similar to the time taken for the element to respond significantly. There is amplification of response above that which would result from static application of the blast load. Table 2.11 Regim es of Dynam ic Response [2]

Peak Load

Duration

Impulse

Rise Time

2.2.3

Im pulsive t d /T < 0.3 Preserving the exact peak value is not critical Preserving the exact load duration is not critical

Accurate representation of impulse is not critical Preserving rise time is not important

Dynam ic 0.3 < t d /T < Quasi-static t d /T > 3.0 3.0 Preserve peak value - the response is sensitive to increases or decreases in peak load for a smooth pressure pulse Preserve load duration Not important if since in this range it is response is elastic close to the natural but is critical when period of the structure. response is plastic. Even slight changes may affect response. Accurate representation Accurate of the impulse is representation of the important impulse is not important Preserving rise time is important; ignoring it can significantly affect response

Drag Loading on Equipment

For the drag loading, the directional force on equipment is given by: F d = 0.5 ρ A Cd |v| v where F d is the drag force vector, ρ is the fluid density, A is the maximum cross sectional area of the object in a plane normal to v, Cd is the drag coefficient and v is the large scale fluid velocity ignoring spatial fluctuations in the vicinity of the object. For small obstacle diameters, the drag coefficient can be estimated by using the values given in Figure 2.1. For equipment with diameters greater than 2 m, it is recommended to use the Direct Load Measurement (DLM) method in which the pressure difference between upwind and downwind sides is computed (using Computational Fluid Dynamics) and multiplied by the obstacle windage area for the X, Y and Z direction. A description of this approach is given in [9].

©OGP

11

RADD – Vulnerability of plant/structure

Figure 2.1 Drag Coefficients, C D , for Various Shapes [9]

2.2.4

Response of Plant/Structure

Essentially three methods of analysis are available to calculate the response of a structure subjected to transient loads as illustrated in Figure 2.2. These methods are termed: •

Approximate methods

•

Single degree of freedom

•

Multiple degree of freedom

12

©OGP

RADD – Vulnerability of plant/structure

Figure 2.2: Methods of Analysis

Approximate methods are limited to energy methods and static analysis methods. The energy method (based on principle of equating work done by load to change in strain energy in structure) are adequate for simple structural elements and load regimes but for more complex structural elements and load configurations, these methods become very laborious and time consuming. They are therefore not recommended for any but the simplest cases. Static analysis methods have been used where quasi-static blast loads act (i.e. dynamic amplification in response is minimal). As large conservatism can occur, these methods are generally not recommended. Single-degree-of-freedom (SDOF) methods are commonly used to model the response of simple elements to dynamic loading. This method can only be used if the structural system can be adequately idealised as a single-degree-of-freedom system (i.e. a real system that is comparatively simple e.g. a single plate or beam). The SDOF model has the ability to modify equations and parameters if a time-stepping procedure is employed which enables a nonlinear system to be modelled. This method is most suited if the primary requirement in determining the behaviour of a blast-loaded structure is its final state (e.g. maximum displacement) rather than a detailed knowledge of its response history. Where a structure cannot be idealised as a SDOF system, a more rigorous approach is required. This can be obtained by performing a multiple-degree-of-freedom (MDOF) analysis using numerical techniques e.g. finite element analysis. Such analysis can be carried out using commercially available software such as ANSYS, ABAQUS, NASTRAN, DYNA-3D. It should also be noted that the mechanical properties of materials are affected by the dynamic loading induced by a blast load. In particular, those materials having definite yield points and pronounced yielding zones show a marked variation in mechanical properties with changes in loading rate. Yield strengths are generally higher under rapid strain rates (as what happens under blast loads) than under slowly applied loads. The strain rate dependency in steels is generally modelled using the Cowper-Symonds relationship:

©OGP

13

RADD – Vulnerability of plant/structure

where σd is the dynamic stress at a particular strain rate, σ is the static stress at a particular strain rate, is the uniaxial plastic strain rate and D and q are constants specific to the steel. Typical values for D and q are as follows: •

Mild steel: D = 40 s-1, q = 5

•

Stainless steel (grade 304); D = 100 s-1, q = 10

2.3

Missiles

There are two possible types of missiles/projectiles. Primary missiles result from the rupture of pressurised equipment such as pressure vessels or failure of rotating machinery (e.g. gas turbines and pumps). Secondary missiles arise from the passage of a blast wave which imparts energy to objects in its path. These objects could be small tools, loose debris and other structures disrupted by the explosion. Various models for the calculation of the missile velocity and range of missiles are given in [10] and [11]. However, the models provide no information on the distribution of mass, velocity or range of fragments to be expected. Baker et al. ([12],[13]) compiled data on the number and distribution of fragments for 25 accidental bursts as shown in Table 2.12. As the data on most of the events considered were limited, it was necessary to group similar events into six groups in order to yield an adequate base for useful statistical analysis. The range for the source energy was calculated based on the assumption that the total internal energy E of the vessel contents is translated into fragment kinetic energy. Baker also performed statistical analysis on each of the groups to yield estimates of fragment-range distributions and fragment mass distributions as illustrated in Figure 2.3. It should, however, be noted that a number of problems still exist with regard to the determination of missile loading, namely [9]: •

Fraction of explosion energy which contributes to fragment generation is unclear

•

Methods do not exist to predict even the order of magnitude of the number of fragments produced. Effect of parameters such as material, wall thickness and initial pressure are not known.

14

©OGP

RADD – Vulnerability of plant/structure

Table 2.12 Behaviour of fragm ents in som e vessel explosions [10] Event Group Number 1

Number of Events 4

Explosion Material

Source Energy (J)

Vessel Shape

Vessel Mass

Number of Fragments

1.49 to 5.95 × 105

Rail tank car

25542 to 83900

14

9

Propane, anhydrous ammonia LPG

2

3814 to 3921

25464

28

3

1

Air

5.2 × 1011

145842

35

4

2

550

3

6343 to 7840 48.3 to 187

31

5

LPG, propylene Argon

Rail tank car Cylinder pipe and spheres Semitrailer (cylinder) Sphere

6

1

Propane

Cylinder

512

11

244 to 1133 × 1010 24.8

©OGP

14

15

RADD – Vulnerability of plant/structure

Figure 2.3: Fragm ent range distribution from som e accidental events [10]: (a) event groups 1 and 2, and (b) event groups 3-6 (see Table 2.12 for event groups)

16

©OGP

RADD – Vulnerability of plant/structure

3.0

Guidance on use of data

3.1

General validity

The data set out in Section 2.0 are based on a review of the latest guidance in the literature. However, the limits of applicability of the data should be recognised particularly with regard to the damage data. The vulnerability of plant/structure should generally be assessed via a recognised analytical framework and should not rely on solely on data provided in Table 2.5 and Table 2.6 for example. The analytical framework would typically involve numerical simulations and the depth of those simulations would depend on the complexity of the problem and the critically of the plant/structure. It is highly recommended that expert judgement is sought for those assessments.

3.2

Uncertainties

The main area of uncertainty relate to the numerical modelling of plant/structure under dynamic loads such as blast loading. The complexity of the problem requires simplifying assumptions regarding the: •

Structural model and boundary conditions

•

Loading characteristics

•

Geometric nonlinearity

•

Material nonlinearity

Comprehensive data on material behaviour at elevated temperatures and under dynamic loading are not available.

4.0

Review of data sources

The principal source of the fire and explosion criteria presented in Section 2.0 is the UKOOA/ HSE Fire and Explosion Guidance [2]; besides the references included in the table captions and text of Section 2.0, additional information has been obtained from the following references: •

Fire

[11], [14]

•

Explosion [14]

The data sources from which the critical temperatures given in Table 2.2 were obtained are identified in Table 4.1; [2] gives the full references for these data sources.

©OGP

17

RADD – Vulnerability of plant/structure

Table 4.1 Data sources for com m only used critical tem peratures given in Table 2.2 [2] Tem perature (°C) 550-620

427

Structural steel onshore

Source (see [2] for full reference) ASFP, 2002 (BS 5950)

LPG tanks (France and Italy) Structural steel offshore

ISO 23251:2006 (2007) ISO 13702, 1999

300

LPG tanks (UK and Germany)

LPGA CoP 1, 1998

200

Structural aluminium offshore

180

Unexposed face of a division/boundary

ISO 834 BS 476

140

Unexposed face of a division/boundary

ISO 834 BS 476

40

Surface of safety related control panel

400

5.0

Use

ISO 13702, 1999

ISO 13702

Criteria

Temperature at which fully stressed carbon steel loses its design margin of safety Based on the pressure relief valve setting Temperature at which the yield stress is reduced to the minimum allowable strength under operating loading conditions Integrity of LPG vessel is not compromised at temperatures up to 300°C for 90 minutes Temperature at which the yield stress is reduced to the minimum allowable strength under operating loading conditions Maximum allowable temperature at only one point of the unexposed face in a furnace test Maximum allowable average temperature of the unexposed face in a furnace test Maximum temperature at which control system will continue to function

Recommended data sources for further information

The following references should be consulted if further information is required. •

Structural Dynamics: [15]

•

Structural response to dynamic loading:

•

Offshore fire and blast loading: [18]

18

©OGP

[16][17]

RADD – Vulnerability of plant/structure

6.0

References

6.1

References for Sections 2.0 to 4.0

[1] Medonos S, 2003. Improvement of Rule Sets for Quantitative Risk Assessment in Various Industrial Sectors, Safety and Reliability, Proc. ESREL 2003 Conf., Vol. 2, A.A. Balkema Publishers, ISBN 5809 596 7. [2] UKOOA/HSE, 2007. Fire and Explosion Guidance, Issue 1. [3] Steel Construction Institute, 2001. Elevated temperature and high strain rate properties of offshore steels, Offshore Technology Report OTO 2001 020, Sudbury, Suffolk: HSE Books. http://www.hse.gov.uk/research/otopdf/2001/oto01020.pdf. [4] Fire safety engineering. Structural response and fire spread beyond the enclosure of origin, BS ISO/TR 13387-6:1999, ISBN 0 580 34037 6. [5] NORSOK N-004 Design of Steel Structures, N-004, Rev.1, December 1998. [6] Clancey V J, 1972. Diagnostic features of explosion damage, 6th Intl. Meeting on Forensic Sciences, Edinburgh, Scotland. [7] Stephens M M, 1970. Minimising damage to refineries from nuclear attack, natural or other disasters, Office of Oil and Gas, US Department of the Interior. [8] DNV, 2005. DNV OS-A101, Safety Principles and Arrangements, DNV Offshore Standard. [9] Natabelle Technology Ltd., 1999. Explosion Loading on Topsides Equipment, Part 1, Treatment of Explosion Loads, Response Analysis and Design, Offshore Technology Report OTO 1999 046, Sudbury, Suffolk: HSE Books. http://www.hse.gov.uk/research/otopdf/1999/oto99046.pdf. [10] CCPS, 1994. Guidelines for evaluating the characteristics of vapor cloud explosions, flash fires and BLEVEs, New York: AIChE. [11] Lees’ Loss Prevention in the Process Industries, Hazard Identification, Assessment and Control, 3rd ed., Mannan S (Ed.), 2004. [12] Baker W E, Kulesz J J, Ricker R E, Westine P S, Parr V B, Vargas L M, and Mosely P K, 1978. Workbook for Estimating the Effects of Accidental Explosion in Propellant Handling Systems. NASA Contractors Report 3023, Contract NAS3-20497. NASA Lewis Research Center, Cleveland, Ohio. [13] Baker W E, Cox P A, Westine P S, Kulesz J J, and Strehlow R A, 1983. Explosion Hazards and Evaluation, Amsterdam: Elsevier Scientific Publishing Company. [14] Steel Construction Institute, 2005. Protection of Piping Systems subject to Fires and Explosions, Technical Note 8.

6.2

References for other data sources examined

[15]

Biggs, J M, 1964. Introduction to Structural Dynamics, New York: McGraw-Hill Companies. Steel Construction Institute, 2002. Simplified Methods for Analysis of Response to Dynamic Loading, Technical Note 7. Steel Construction Institute, 2007. An Advanced SDOF Model for Steel Members Subject to Explosion Loading: Material Rate Sensitivity, Technical Note 10. API, 2006. Recommended Practice for the Design of Offshore Facilities Against Fire and Blast Loading, API Recommended Practice 2FB, 1st. ed.

[16] [17] [18]

©OGP

19

Risk Assessment Data Directory Report No. 434 – 16 March 2010

Ship/ installation collisions International Association of Oil & Gas Producers

RADD – Ship/installation collisions

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Scope ............................................................................................................... 1 Definitions ....................................................................................................... 1

1.2.1 1.2.2

Collisions .................................................................................................................... 1 Damage ....................................................................................................................... 2

2.0 2.1

Summary of Recommended Data ............................................ 3 Basics of ship collision risk modelling......................................................... 3

2.1.1 2.1.2

Collision Frequency ................................................................................................... 3 Collision consequences ............................................................................................ 4

2.2 2.3

Overview of historical ship/installation collision information.................... 7 Passing vessel collisions............................................................................... 9

2.3.1 2.3.2

Shipping traffic patterns and vessel behaviour ...................................................... 9 Best practice collision risk modelling for passing vessels ................................. 11

2.4

Field related vessel collisions ..................................................................... 12

2.4.1 2.4.2 2.4.3

Frequencies of field related vessel collisions ....................................................... 12 Consequences of vessel related field collisions................................................... 16 Collisions of mobile units........................................................................................ 17

2.5

Collision risk management .......................................................................... 18

3.0 3.1 3.2 3.3

Guidance on use of data ...................................................... 18 General validity ............................................................................................. 18 Uncertainties ................................................................................................. 18 Example ......................................................................................................... 18

4.0

Review of data sources ....................................................... 19

5.0

Recommended data sources for further information ............ 20

6.0 6.1 6.2

References .......................................................................... 20 References for Sections 2.0 to 4.0 .............................................................. 20 References for other data sources.............................................................. 21

©OGP

RADD – Ship/installation collisions

Abbreviations: AIS ARPA BHN DP DSV ERRV FPSO FPU FSU H 2S HC HSE MODU MSV QRA REWS ROV TEMPSC TLP TR UK UKCS

Automatic Identification System Automatic Radar Plotting Aid Bombay High North Dynamic Positioning Diving Support Vessel Emergency Response and Rescue Vessel Floating Production, Storage and Offloading unit Floating Production Unit Floating Storage Unit Hydrogen sulphide Hydrocarbon Health and Safety Executive Mobile Offshore Drilling Unit Multipurpose Support Vessel Quantitative Risk Assessment Radar Early Warning System Remotely Operated Vehicle Totally Enclosed Motor Propelled Survival Craft Tension Leg Platform Temporary Refuge United Kingdom United Kingdom Continental Shelf

©OGP

RADD – Ship/installation collisions

1.0

Scope and Definitions

1.1

Scope

This datasheet provides data on ship/installation collision risks in relation to activities within the offshore oil & gas Exploration and Production industry, for use in Quantitative Risk Assessment (QRA). The risks related to icebergs are not considered. Ship traffic may be divided into two groups: •

Passing vessels: Ship traffic which is not related to the installation being considered, including merchant vessels, fishing vessels, naval vessels and also offshore related traffic going to and from other installations than that being considered.

•

Field related: Offshore related traffic which is there to serve the installation being considered, e.g. supply vessels, oil tankers, work vessels.

For passing vessels, collision risk is highly location dependent due to variation in ship traffic from one location to another. The ship traffic volume and pattern at the specific location should hence be considered with considerable care. This dependency on location also means that use of historical data which are averaged over a large number of different locations, is not possible. For passing vessels, the datasheet therefore presents best current practice in modelling collisions of passing vessels with offshore installations rather than recommended frequencies. Field related offshore traffic refers to those vessels which are specifically visiting the installation, and is therefore considered to be less dependent of the location of the installation. The frequency of infield vessel impacts will depend on the durations that vessels are alongside, the installation layout, environmental conditions, and procedures, so care is required to ensure these factors are considered appropriately. In addition, the datasheet presents an overview of historical data on ship collisions that have occurred, with an emphasis on the circumstances and consequences of the collisions.

1.2

Definitions

1.2.1

Collisions

Collisions can be divided into two groups: •

Powered collisions (vessel moving under power towards the installation)

•

Drifting collisions (vessel drifting towards the installation)

Powered collisions include navigational/manoeuvring errors (human/technical failures), watch keeping failure, and bad visibility/ineffective radar use. A drifting vessel is a vessel that has lost its propulsion or steerage, or has experienced a progressive failure of anchor lines or towline and is drifting only under the influence of environmental forces. Table 1.1 sets out the different types of vessels that may collide with an offshore installation.

©OGP

1

RADD – Ship/installation collisions

Table 1.1 Categories of Colliding Vessels Type Of Traffic Passing

Traffic Category Merchant

Naval traffic

Fishing vessels Pleasure Offshore traffic

Vessel Category Merchant ships: cargo, ferries etc. Surface vessels Submerged vessels Fishing vessels

Pleasure vessels Standby boats Supply vessels Offshore tankers

Field related

Tow Standby vessels Supply vessels Working vessels

Offshore traffic

Drilling rigs

1.2.2

Offshore tankers MODUs

Rem arks Commercial traffic passing the area

Both war ships and submarines Submerged submarines Sub-categorised into vessels in transit and vessels operating in the area Traffic passing the area Vessels going to and from other fields Vessels going to and from other fields Vessels going to and from other fields Towing of drilling rigs, flotels, etc. Dedicated standby vessels Visiting supply vessels Special services/support such as diving vessels, flotels, pipe lay barges, intervention vessels and crane barges Shuttle tankers visiting the field May collide with fixed installation either on approach or as a result of mooring failure

Damage

Sections 2.2 and 2.4.2 present data for the following damage levels as defined in WOAD [1]: •

Total loss

Total loss of the unit including constructive total loss from an insurance point of view. However, the unit may be repaired and put into operation again.

•

Severe dam age

Severe damage to one or more modules of the unit; large/medium damage to loadbearing structures; major damage to essential equipment.

•

Significant dam age Significant/serious damage to module and local area of the unit; minor damage to loadbearing structures; significant damage to single essential equipment; damage to more essential equipment.

•

Minor dam age

2

Minor damage to single essential equipment; damage to more none-essential equipment; damage to non-loadbearing structures.

©OGP

RADD – Ship/installation collisions •

Insignificant dam age Insignificant or no damage; damage to part(s) or essential equipment; damage to towline, thrusters, generators and drives.

2.0

Summary of Recommended Data

The data presented in this section are set out as follows: • • • • •

Basics of ship collision risk modelling (Section 2.1) Overview of historical ship/installation collision information (Section 2.2) Passing vessel collisions (Section 2.3) Field related vessel collisions (Section 2.4) Collision risk reduction (Section 2.5)

2.1

Basics of ship collision risk modelling

The risk arising from collision of a ship with an offshore installation is considered in two parts: collision frequency and collision consequences. 2.1.1

Collision Frequency

The collision frequency is calculated as: Collision frequency = Frequency of ship being on collision course × Probability that collision is not avoided For powered collisions, the frequency of a ship being on a collision course can be estimated from knowledge of shipping traffic in the vicinity of the installation. This is discussed, for passing vessels, in Section 2.3.2.1. For drifting collisions, the frequency of a ship being on a collision course depends on where the ship loses power or steerage, and the direction and strength of the current and wind. For a passing vessel, not suffering from propulsion or steerage problems, to collide with an offshore installation, the following three conditions must occur: 1. The ship needs to be on a collision course with the installation; 2. The navigator/watchkeeper must be unaware of the collision course sufficiently long for the ship to reach the installation (“watchkeeping failure”); 3. The installation/standby vessel crews must be either be unaware of the developing situation or be unable to warn the vessel to “normalise” the situation. Watchkeeping failure is discussed further in Section 2.3.2.1. Measures available to the operator to prevent a collision can be divided into two categories: •

Standby vessel (or ERRV) intervention: Detection of the errant vessel by radar / AIS / visual sighting; intervention in the form of VHF communication, or approaching the vessel and attracting its attention using light and sound signals, such as pyrotechnics.

•

Installation intervention: This is normally limited to VHF communication, assuming there is a means to detect the errant vessel on the installation, such as radar and/or AIS.

Standby vessel intervention is normally more effective as the bridge crew consists of dedicated watch-keepers with maritime training and experience.

©OGP

3

RADD – Ship/installation collisions

These scenarios can be addressed by using appropriate collision risk models. Care should be taken that the model used is calibrated against historical data1. 2.1.2

Collision consequences

If a collision occurs, consequences can range from superficial damage to complete loss of the installation. The damage to the installation depends on: The Impact Energy, E (kJ), is related to these by E = 0.5 • Size of vessel (M, te) kMV2 where k is the “hydrodynamic added mass constant: k = 1.1 • Speed of vessel for end-on (powered) impact, k = 1.4 for broadside (drifting) (V, m/s) impact. •

Point of impact, e.g. legs, conductors, risers, bracings

•

Whether angle of impact is head-on, glancing, or sideways-on (broadside)

•

Partitioning of impact energy between installation and vessel

Fatalities on the installation as a result of a collision will depend first and foremost on whether the impending collision has been detected, e.g. by radar or AIS, and whether a precautionary alarm, evacuation or down-manning has then been carried out. If a vessel under power is observed on a collision course, the time available for precautionary evacuation/down-manning will be limited (e.g. typically 30 minutes if observed by radar down to zero if visual observation only in conditions of poor or night visibility). A decision may have to be made whether to carry out a precautionary evacuation/downmanning, which would have to be by TEMPSC or escape direct to sea (see datasheet Evacuation, Escape and Rescue), or for personnel to remain on the installation. Each of these carries attendant risks. If a drifting vessel is observed on a collision course, the time available for response is likely to be much longer and it may be possible to initiate precautionary evacuation/down-manning by helicopter, or to manoeuvre the vessel / barge clear of the installation by a security or field support vessel. Figure 2.1 and Figure 2.2 give example flow charts to determine possible outcomes given potential collisions by powered and drifting vessels respectively. These figures are more typical of a fixed production installation than a MODU but illustrate issues that may need to be considered when analysing ship collisions for any type of installation. The appropriate flow chart for a specific analysis will depend on the means provided to detect vessels on a collision course, their availability, and the procedures to decide on mustering and precautionary evacuation/down-manning. Any or all of these may be dependent on the weather conditions at the time (e.g. visibility may affect observation, sea state affects the risks in evacuation by TEMPSC). Note: Figure 2.1 and Figure 2.2 refer to the ‘TR’ (Temporary Refuge), defined as [14]: “[a] place provided where personnel can take refuge for a predetermined period whilst investigations, emergency response and evacuation preparations are undertaken”. Depending on the jurisdiction, impending ship collision is not necessarily considered to require a TR; however, the muster location in this scenario is conveniently identified with the TR.

1

4

Lack of such calibration is often a shortfall of simple models. ©OGP

RADD – Ship/installation collisions

Figure 2.1 Exam ple Flow Chart for Powered Vessel on Collision Course with Installation

Note: No specific time value is given to “Early” or “Late” observation of a vessel on a collision course. “Early” can be considered to be sufficient to muster personnel, make a decision whether or not to evacuate, and if to evacuate then for TEMPSCs to be sufficiently far away at the time of collision. “Late” can be considered to give some time to muster at least some personnel in the TR but insufficient for TEMPSC evacuation; on a bridge linked complex, some personnel are considered in this example to have insufficient time to reach the TR and therefore to attempt escape to sea.

©OGP

5

RADD – Ship/installation collisions

Figure 2.2 Exam ple Flow Chart for Drifting Vessel on Collision Course with Installation

Note: No specific time value is given to “Early” or “Late” observation of a vessel on a collision course. “Early” can be considered to be sufficient to initiate helicopter evacuation (considering the time required to mobilise sufficient helicopters) if this is possible (e.g. sufficient visibility), or else to muster personnel, and make a decision whether or not to evacuate. “Late” can be considered to give some time to muster at least some personnel in the TR but insufficient for TEMPSC evacuation; on a bridge linked complex, some personnel are considered in this example to have insufficient time to reach the TR and therefore to attempt escape to sea. A drifting vessel typically moves at 1 to 2 kn so, in this example, it is assumed that the drifting vessel is observed sufficiently early for at least partial mustering to take place. The likelihood of receiving an “Early” or “Late” warning will be dependent on the procedures in place at the field and the detection system that is used. Information on the performance of some detection systems is available in [13].

6

©OGP

RADD – Ship/installation collisions

2.2

Overview of historical ship/installation collision information

WOAD [1] provides details of 465 collision incidents worldwide during 1970-2002, of which 326 have occurred since 1980. As the collision frequency is strongly location specific, it is not useful to use these records to estimate absolute collision frequencies. However, other useful information can be derived. 57 of the 1980-2002 incidents in WOAD can be identified with passing vessels unconnected with field activity. 189 of the remaining incidents in WOAD occurred during drilling, production or workover, including 10 during shuttle tanker operations (loading of liquids). Many of these involved supply vessels, standby vessels or crew boats. Table 2.1 presents statistics for different levels of damage resulting from collisions. Table 2.1 Collisions with Offshore Installations (W orldwide) Dam age* Total Loss Severe Significant Minor Insign./No All

Passing Vessels Num ber Percent 3 5% 19 33% 8 14% 10 18% 17 30% 57 100%

Infield Vessels Num ber Percent 1 0.5% 16 8% 55 29% 65 34% 52 28% 189 100%

* See Section 1.2.2 for definitions of damage categories.

These records do not include the most serious ship-installation collision, that at Bombay High North (BHN) on 27 July 2005, when an MSV (Multipurpose Support Vessel) approaching the installation lost control, drifted and collided with the installation. This resulted in serious oil leakage and a major fire, resulting in the loss, within two hours, of both the BHN platform and a jackup rig working alongside. A total of 22 fatalities resulted, on the installation, jackup and MSV; 362 personnel were rescued, some after spending more than 12 hours in the water [15]. The collision occurred despite the MSV being DP (Dynamic Positioning) equipped. Other types of incident in the WOAD database include: •

Collision during towing or mobilizing/demobilizing of MODUs (involving vessels associated with the activity such as tugs, supply vessels, and anchor handling vessels).

•

Collision during construction/repair (involving vessels involved with the activity such as crane barges, pipeline barges and tugs).

•

Moorings broken when MODU was idle/stacked.

In only one incident did fatalities occur, when a jackup punched through the seabed, resulting in collapse of two legs; subsequently the jackup drifted into an adjacent unit. In this incident, there were 2 fatalities and 43 personnel were successfully evacuated. In 7 incidents, of which 3 were during loading, there was a release of oil from the struck installation, a pipeline or a loading hose. In one incident, the colliding vessel was damaged and oil leaked from its fuel and lube oil tanks. In a further 2 incidents, gas including H2S was released.

©OGP

7

RADD – Ship/installation collisions

Worldwide passing vessel collision frequencies for the periods 1980-1989 and 19902002 have been estimated separately as shown in Table 2.2. Both passing vessel and infield vessel collisions have considerably reduced from the earlier to the later period, by almost 60% for passing vessels and 50% for infield vessels. Table 2.2 W orldwide Collision Data during 1980-1989 and 1990-2002 Vessel Type

Passing Infield

Collisions 1980-1989

1990-2002

33

24

103

86

Exposure (installation-years) 1980-1989 1990-2002 56243

97627

Collision Frequency (per installation-year) 1980-1989 1990-2002 5.9 × 10

-4

2.5 × 10

-4

1.8 × 10

-3

8.8 × 10

-4

Note: figures for Infield vessels exclude loading buoy incidents, for which exposure data is not available.

DNV has prepared research reports [3], [4] and associated incident databases for the UK HSE covering accident statistics for offshore installations on the UKCS 1980-2005. These include 432 events described as ‘Collision’, although not all of these resulted in actual impact. Table 2.3 summarises the statistics for all recorded collision related events, including near misses; Table 2.4 presents summary statistics for those events that resulted in actual impact, however minor. Clearly visiting vessels dominate the statistics even more completely than they do worldwide. However, as Table 2.5 shows, only 5% of collision events are classified as ‘Accidents, as compared with 31% of passing vessel events; most visiting vessel events involve minor scrapes. The number of collision related events involving passing powered vessels appears to have increased significantly from 1980-1989 to 1990-2005, possibly due to better reporting of near misses; however, the frequency of actual collisions has fallen by 30% to 40%, for both passing and visiting vessels. This may be attributable to improved communication systems, electronic charting, and navigational techniques, systems and procedures. Introduction of ARPA and DP systems may also have played a role. Table 2.3 UKCS Collision Event Data during 1980-1989 and 1990-2005 Vessel Type

Passing Visiting

Events 1980-1989

1990-2005

5

42

140

245

Exposure (installation-years) 1980-1989 1990-2005 1685

4630

Event Frequency (per installation-year) 1980-1989 1990-2005 3.0 × 10

-3

9.1 × 10

-3

8.3 × 10

-2

5.3 × 10

-2

Table 2.4 UKCS Collision Data during 1980-1989 and 1990-2005 Vessel Type

Passing Visiting

8

Collisions 1980-1989

1990-2005

5

10

132

213

Exposure (installation-years) 1980-1989 1990-2005 1685

©OGP

4630

Collision Frequency (per installation-year) 1980-1989 1990-2005 3.0 × 10

-3

2.2 × 10

-3

7.8 × 10

-2

4.6 × 10

-2

RADD – Ship/installation collisions

Table 2.5 UKCS Collision Event Categories 1990-2005 Event Category 1 Accident Incident Near Miss Unsignificant2 All

Passing Vessels Num ber Percent

Visiting Vessels Num ber Percent

13

31%

11

4%

4

10%

54

22%

23

55%

77

31%

2 42

5%

103 245

42%

100%

100%

Notes 1. The event categories in this table are not equivalent to those used in Table 2.1. 2. This can be read as “Insignificant” (“Unsignificant is used for consistency with the original data source: see Table 4.1).

Of the 31 passing vessel collision events listed for fixed installations, 14 (46%) involved fishing vessels, and of these 3 involved fishing gear becoming entangled with subsea wellhead equipment rather than vessel impact with the surface installation. 7 (23%) of these 31 collision events are known to have involved either infield vessels visiting other installations or shuttle tankers, i.e. 7 of the events are known to have involved field related vessels. Visiting vessel collisions are examined in more detail in Section 2.4.

2.3

Passing vessel collisions

2.3.1

Shipping traffic patterns and vessel behaviour

Each of the passing vessel traffic types listed in Table 1.1 behaves in one of several distinct ways in relation to a installation. This must be considered both when reviewing traffic data and when estimating collision frequency. Each type is discussed in the following sub-sections, with an evaluation of relevant traffic patterns and vessel behaviour in the vicinity of offshore installations. 2.3.1.1 Merchant Vessels Merchant vessels are frequently found to represent the greatest installation collision hazard, since: •

Merchant vessels are often large and may thus represent considerable impact energy.

•

Traffic may be very dense in some areas.

•

Oil and gas operators have no prevailing influence.

In addition there is a problem with the uncertainties in the risk estimates, which are higher than for many of the other vessel groups as merchant vessel operating standards vary.

©OGP

9

RADD – Ship/installation collisions

2.3.1.2 Naval Traffic Estimating risk associated with naval vessels is difficult because information about movements and volume is restricted and hence difficult to obtain. Estimation very often has to be based on surveys or subjective evaluation. Further, the naval traffic volume is difficult to assess since possible routes and areas where naval vessels operate/exercise can vary from year to year. The variation in traffic routes and density can also be dependent on the political situation. Naval traffic may be divided into two main categories, surface traffic (submarines included) and submerged traffic. 2.3.1.2.1 Surface Traffic

As for merchant vessels, collisions are either due to drifting of the vessel or may occur while the vessel is under power (errant vessels). As regards collisions under power, it may be acceptable to disregard this scenario as these vessels have a large crew compared to merchant vessels. They will always have at least two persons on the bridge (large vessels such as frigates, destroyers and aircraft carriers will have more personnel on the bridge). Normally the operations room is also manned. Considering the number of personnel on watch it seems very unlikely, compared to a merchant vessel, that a naval surface vessel should not know of or detect the installation, and avoid it. In addition, naval vessels are more likely to operate in groups, which also will reduce the collision probability. Submarines operating on the surface are not considered to represent any higher threat to the installation than any other surface vessel. Overall, it is considered that the contribution to overall collision risk from such vessels is in general likely to be very low. 2.3.1.2.2 Submerged Submarine Traffic

As for naval surface vessels, due to a reduced probability of drifting combined with a relatively low number of vessels, the contribution from drifting submarines to the overall collision risk is negligible. Submerged submarines are in a special situation because they do not have a look-out. Navigation is therefore completely dependent on electronic navigational aids and sonar. In principle submarines are officially restricted from operating in the immediate vicinity of offshore installation in times of peace. Nevertheless a 1988 incident when a submarine collided with Norsk Hydro’s Oseberg B platform shows a deviation from this principle. In connection with this accident, it was stated that it was often very difficult for submarines to detect platforms, which do not emit much sound in the water. Some data on submarine traffic have been collected [2]. At the time of publication (1995), an appropriate number of submarines active in the entire North Sea, at all times, seems to have been in the region of 15 to 25. It is not known if this has changed appreciably since then. 2.3.1.3 Fishing Vessels Fishing vessels are divided into two groups, depending on the operational pattern: •

Fishing vessels in transit from the coast to and from different fishing areas.

•

Vessels may be fishing in an area. The vessels’ operation and behaviour during fishing (primarily trawling) will be complex and varied, but usually at low speed and with no preferred heading.

10

©OGP

RADD – Ship/installation collisions

Fishing vessels vary in size from large factory/freezer ships to smaller vessels operating near the coast. Typically, a large fishing vessel will have a displacement around 1000 tonnes. This implies that the collision energy will be less than 20 MJ. For a typical North Sea installation neither drifting vessels nor vessels under power will normally be able to threaten the installation’s integrity. However, risers and other relevant equipment have considerably less impact resistance; being typically much smaller than merchant vessels, it is also more likely that a fishing vessel may pass between the legs of an installation and reach risers or conductors. Collisions of both powered and drifting fishing vessels should therefore be considered, taking this into account. 2.3.1.4 External Offshore Traffic Passing offshore vessels and tankers as well as supply, standby and work vessels are in many respects similar to passing merchant vessels, except that such vessel operations tend to be more aware of the offshore installations and also may benefit from operator influence (procedure, training competency, communication etc.). Vessels or installations under tow pose particular problems which are considered separately (Section 2.4.3). 2.3.2

Best practice collision risk modelling for passing vessels

2.3.2.1 Collision frequency estimation As set out in Section 2.1.1, there are two parts to this: 1. Estimating the frequency of a ship being on a collision course 2. Estimating the probability that collision is not avoided The first of these is strongly dependent on the installation’s location with respect to shipping traffic, and also on the installation’s size (although, in a bridge linked complex, for some approach directions one platform may be shielded by another). Shipping databases are available to assist in this task such as ShipRoutes. Where possible, other methods of logging vessel tracks in and around a field can be implemented such as Automatic Identification Systems (AIS). This can be achieved using systems such as AISTracker and will provide an enhanced understanding of the behaviour of shipping around the field. This offers considerable benefit to collision risk assessment work in relation to passing and infield vessel risk assessment. Details are provided on ship type, size, speed, navigation status, etc. Fishing vessel activity can be assessed by processing satellite tracking data on fishing vessel movements: this has already been done, for example, for part of the North Sea (Anatec – unpublished). Based on the work undertaken within the HSE’s OTO 1999 052 study [9], the following causes of ineffective watchkeeping were identified: •

Watch-keeper present on bridge but: o

Busy/preoccupied with other tasks

o

Asleep

o

Incapacitated due to sickness, accident or substance abuse

•

Watch-keeper absent from the bridge

•

Poor visibility combined with undetected radar fault.

Further discussion on each of these causation factors is provided in the OTO report [9]. ©OGP

11

RADD – Ship/installation collisions

The probability of radar failure can be estimated from reliability data for the system concerned (considering all parts: radar, processor, power supply, display). One widely used model which takes account of these factors when assessing passing ship collision is COLLRISK [12]. Based on analysis of collision data for the region of interest (e.g., North Sea), as well as traffic data and installation operating experience, the model has been back-tested to ensure it provides results in line with experience. As well as the calibration factor, the main influences on the collision risk are traffic volumes in proximity to the installation, ship characteristics (e.g. type, size and speed), installation dimensions/orientation, and metocean data, in particular visibility. The model can also take into account the benefits of various risk reducing measures. 2.3.2.2 Collision consequences As shown in Table 2.1, collisions of passing vessels can result in damage ranging from insignificant to total loss. Table 2.1 shows that almost 40% of such collisions resulted in severe damage or total loss, although none of these resulted in fatalities to installation personnel. Initially, the damage breakdown in Table 2.1 could be used directly in a QRA together with suitable assumptions about warning, mustering and precautionary evacuation (using a flow chart such as the examples in Figure 2.1 and Figure 2.2). Although no fatalities have occurred to date as a result of a passing vessel collision, the Bombay High North incident summarised in Section 2.2 demonstrates that a major accident involving fatalities is credible, especially if escalation to a hydrocarbon fire or explosion occurs. If this relatively simple approach indicates high ship collision risks, then more detailed analysis may be required in order to demonstrate that the simple approach is conservative. This could involve structural analysis of the effect of a vessel collision with the installation2.

2.4

Field related vessel collisions

2.4.1

Frequencies of field related vessel collisions

Unlike passing vessel collisions, the dependency of field related vessel collisions on geographical location is largely limited to metocean conditions and allowable weather criteria; conversely, field related vessel collisions are strongly dependent on the field activities (drilling or production) and on the associated support requirements (e.g. provision of supplies, anchor handling, diving support). Table 2.6 presents worldwide field related vessel collision statistics based on WOAD [1] and corresponding exposure data3 [8]. This shows much lower collision frequencies for fixed platforms compared with FPSOs and FPUs, and wide variation between the collision frequencies for the different types of FPU. There are also variations between different types of MODU but these are not so great.

2

Such a project was undertaken in 2008 for a variety of jacket types; it is intended to publish the outcome of this work. 3 Note that exposure data is here measured by unit-years in service. It should be noted that collision frequencies for a particular unit will be strongly dependent on the number of visits per year and on the types of vessel visiting. Such data are not readily available. However, if the unit being studied can be considered to have a ‘typical’ number of visits per year, then the frequencies given in Table 2.6 can be used. If field related collision frequencies prove to be an issue, then a more detailed analysis should be undertaken, using actual data combined with collision risk modelling. 12

©OGP

RADD – Ship/installation collisions

Figure 2.3 shows worldwide collision frequencies for production installations, Figure 2.4 collision frequencies for MODUs; both show error bars corresponding to 90% confidence limits. From these figures it is concluded: •

The collision frequency for fixed production units is significantly different from those for FPSOs and FPUs.

•

TLPs appear to be subject to a significantly higher collision frequency than jackups and semi-submersibles. Table 2.6 Field Related Vessel Collision Statistics (W orldwide)

Unit Type

Collisions

Exposure (unit-years)

Collision Frequency (per unit-year)

Production Units Fixed

77

135122

5.7 × 10 -4

FPSO

4

445

9.0 × 10 -3

TLP

3

88

3.4 × 10 -2

Jackup

1

89

1.1 × 10-2

Semi-submersible

4

363

1.1 × 10-2

All FPU (not FPSOs)

8

540

1.5 × 10-2

Jackups + Semi-subs

5

452

1.1 × 10 -2

Loading Buoy Drilling Units (MODUs) Jackup

6

Not available

-

41

10743

3.8 × 10-3

Semi-submersible

45

4837

9.3 × 10-3

Drill ship/barge/tender

14

2183

6.4 × 10-3

All MODUs

100

17763

5.6 × 10-3

Figure 2.3 Production Unit Vessel Collision Frequencies (W orldwide)

Error bars indicate 90% confidence limits.

©OGP

13

RADD – Ship/installation collisions

Figure 2.4 MODU Vessel Collision Frequencies (W orldwide)

Error bars indicate 90% confidence limits.

Table 2.7 shows the proportions of collisions by vessel type. Table 2.7 Collisions by Vessel Type (W orldwide) Vessel Type Supply Vessel Standby Vessel Working Vessel Rig Shuttle Tanker Other Unknown

Production Units 34% 19% 34% 7% 3% 3% 0%

MODUs 60% 11% 16% 6% 1% 5% 1%

Generally, collisions with any sort of offshore-related traffic can be more easily controlled because many of these vessels are operated by the oil companies themselves, and they can impose restrictions on vessel operations if it is deemed necessary. Figure 2.5 shows infield vessel collision frequencies by geographical region. Comparing this with Table 2.2, it is clear that infield vessel collision frequencies vary significantly from region to region, even considering only the regions with large numbers of offshore installations and MODUs operating. Of these areas, the frequency is highest by far in the North Sea (see also Table 2.9) and has only reduced by 19% over the two time periods presented. On the UKCS the frequency is even higher relative to the worldwide average. It is not clear from the data whether these high frequencies are due to better reporting, especially of minor collisions, the more severe weather conditions in the North Sea compared with other regions, or better control of infield vessel movements in other regions. There has been no collision resulting in significant or severe damage or total loss in the North Sea since 1994. Table 2.8 gives a detailed breakdown of collisions between visiting vessels and installations on the UKCS for 1990-2005. This shows considerably higher frequencies. Table 2.10 shows the distribution of damage levels for the main regions: it shows a much higher proportion of collisions in the North Sea resulting in insignificant or no damage than any other region. Nevertheless, even excluding these, or counting those 14

©OGP

RADD – Ship/installation collisions

resulting in significant or severe damage or total loss, the North Sea frequency is significantly higher than any other region. Table 2.8 UKCS Field Related Vessel Collision Statistics 1990-2005 Unit Type

Collisions

Exposure (unit-years)

Collision Frequency (per unit-year)

Production Units Fixed

90

3383

2.7 × 10 -2

FPSO & FSU

14

265

5.3 × 10 -2

Drilling Units (MODUs) All MODUs

109

982

1.1 × 10 -1

Figure 2.5 Geographical Variation of Infield Vessel Collision Frequencies

Table 2.9 Geographical Variation of Infield Vessel Collision Frequencies Com pared to W orldwide Average Region

Fraction of 19902002 W orldwide Average 0.36 0.17 0.59 9.55 0.11 0.24 49.35

Africa Asia Central & S. America Europe: North Sea Middle East US: Gulf of Mexico UKCS*

* Fraction is based on UKCS 1990-2005 frequency as given in Table 2.4.

©OGP

15

RADD – Ship/installation collisions

Table 2.10 Infield Vessel Collision Dam age Levels by Region: All Installations Geographical Area

Damage Level (see Section 1.2.2 for definitions) Total Loss 0%

Africa

Severe 0%

Significant 14%

Minor 86%

Insignif./No 0%

Asia

0%

0%

44%

33%

22%

Central & S America Europe: N Sea

0% 0%

17% 5%

33% 16%

33% 31%

17% 48%

Middle East

0%

20%

10%

60%

10%

US-GoM

2%

13%

48%

33%

4%

2.4.2

Consequences of vessel related field collisions

Worldwide average collision damage levels are tabulated for different vessel types and overall as follows: Fixed installations: FPSOs: FPUs: MODUs:

• • • •

Table 2.11 Table 2.12 Table 2.13 Table 2.14

Table 2.11 Collision Dam age Levels by Vessel Type: Fixed Installations Vessel Type

Damage Level (see Section 1.2.2 for definitions) Total Loss Severe Significant Minor Insignif./No

Supply

0%

11%

15%

52%

22%

Standby Barge/Tug

0% 0%

0% 30%

20% 11%

13% 48%

67% 11%

Rig

0%

0%

0%

80%

20%

Shuttle Tanker Other

0% n/a

0% n/a

33% n/a

33% n/a

33% n/a

Unknown

n/a

n/a

n/a

n/a

n/a

ALL

0%

14%

14%

44%

27%

Table 2.12 Collision Dam age Levels by Vessel Type: FPSOs Vessel Type

Damage Level (see Section 1.2.2 for definitions) Total Loss Severe Significant Minor Insignif./No

Supply

0%

0%

0%

0%

100%

Standby Barge/Tug

n/a n/a

n/a n/a

n/a n/a

n/a n/a

n/a n/a

Rig

n/a

n/a

n/a

n/a

n/a

Shuttle Tanker Other

n/a n/a

n/a n/a

n/a n/a

n/a n/a

n/a n/a

Unknown

0%

0%

33%

33%

33%

ALL

0%

0%

25%

25%

50%

16

©OGP

RADD – Ship/installation collisions

Table 2.13 Collision Dam age Levels by Vessel Type: FPUs Vessel Type

Damage Level (see Section 1.2.2 for definitions) Total Loss Severe Significant Minor Insignif./No

Supply

0%

0%

50%

50%

0%

Standby Barge/Tug

0% 0%

0% 33%

0% 0%

0% 33%

100% 33%

Rig

0%

0%

0%

0%

100%

Shuttle Tanker Other

n/a n/a

n/a n/a

n/a n/a

n/a n/a

n/a n/a

Unknown

n/a

n/a

n/a

n/a

n/a

ALL

0%

13%

13%

25%

50%

Table 2.14 Collision Dam age Levels by Vessel Type: MODUs Vessel Type

Damage Level (see Section 1.2.2 for definitions) Total Loss Severe Significant Minor Insignif./No

Supply

0%

5%

43%

33%

18%

Standby Barge/Tug

0% 0%

9% 0%

18% 56%

27% 25%

45% 19%

Rig

17%

0%

50%

0%

33%

Shuttle Tanker Other

0% 0%

0% 0%

40% 0%

20% 0%

40% 100%

Unknown

0%

0%

0%

0%

100%

ALL

1%

4%

42%

28%

25%

Note however that, for example, the Norwegian and the UK criteria for design against vessel impacts have been derived from a probabilistic evaluation of supply vessel impacts [6], [7]. These collisions are therefore to a large degree minimized by platform design. Hence the distribution of damage levels to be expected from field related vessel collisions in different geographical areas may vary from those tabulated above according to the installation design criteria. They may also vary according to operational procedures: for example, an arriving supply vessel may be required to stop on arrival at the installation exclusion zone (500 m radius) and then proceed at low speed to the installation. Hence, where more specific information is available on design criteria and operational procedures, these should be taken into account if the risk levels are sufficiently high to occasion concern. The trend towards the use of larger, multipurpose vessels, which may exceed the size the installation was originally designed for, should also be considered where appropriate. 2.4.3

Collisions of mobile units

9 separate incidents of collisions between installations have been identified in WOAD [1]. Of these, 1 occurred during hurricane ‘Juan’ (27/10/1985) and 3 during hurricane ‘Andrew’ (27/08/1992). 3 further weather related incidents occurred. Of the remaining 2 incidents, one appears to have been an operational error; in the other case, the description refers to a drifting rig but does not indicate the cause. The HSE report [4] and database identifies 5 collision incidents during towing of mobile units. One involved a collision during preparation for tow-out from the construction yard; no details are given for the remaining 4 but, based on WOAD information, it is

©OGP

17

RADD – Ship/installation collisions

possible these involved the towing tugs contacting the unit rather than the unit itself contacting another unit.

2.5

Collision risk management

Collision risk management is examined in the UK HSE OTO 1999 052 report [9], to which reference should in the first place be made, in particular to Chapter 7. This commences with the HSE’s general Safety Management System model as set out in HS(G)65 [10] and shows how this can be applied specifically to managing ship collision risks. [9] then presents specific measures for managing in-field and passing vessel collision risks. It also includes as Appendix B an overview of ship collision detecting and alerting (hardware) systems. This includes normal setups such as standby vessel with standard marine radar or ARPA, and more sophisticated systems such as REWS (Radar Early Warning System using installation-mounted scanners to increase detection range and provide early warning of vessels on a possible collision course with the installation, allowing an early decision and response such as precautionary partial or full evacuation).Although still cited by the HSE [11], this report is already outdated in some respects in that the general introduction of AIS post-date it. AIS enables tracking and identification of vessels in the vicinity of an offshore installation with improved range and accuracy over radar. Models (e.g. COLLRISK [12]) allow the benefits of such measures to be taken into account within the risk modelling.

3.0

Guidance on use of data

3.1

General validity

As stressed in Section 2.3.2.1, the frequency of passing vessel collisions with offshore installations is highly location specific and therefore it is not appropriate to present in this datasheet any statistical passing vessel collision frequencies. The frequencies required should be estimated as described in Section 2.3.2.1. The data selected for presentation in Section 1.2.2 are those which can be considered valid for use in QRA, at least to determine whether ship collision risks are significant. If they are, then more detailed analysis of frequencies (for infield vessel collisions) and/or of consequences may be required.

3.2

Uncertainties

As in all analyses of incident data, the completeness of incident reporting in particular is open to question, especially as regards potential under-reporting of minor incidents. However, for a QRA it is those collisions with the potential to result in fatalities, significant damage or pollution that need to be considered, and reporting of such incidents is more likely to be complete. The exposure data (i.e. unit-years) can be considered reliable, although for MODUs they do not appear to distinguish between units in operation offshore and units laid-up; also, prior to 1983, geographical data are only available for some regions.

3.3

Example

The frequency of supply vessel collisions causing significant or severe damage or total loss to a fixed installation in the North Sea is required for a QRA. It is assumed that the supply vessel visit frequency is typical of such installations.

18

©OGP

RADD – Ship/installation collisions -4

•

Worldwide average infield vessel collision frequency = 9.3 × 10 per year (Table 2.2, 19902002)

•

North Sea weighting = 9.55 (Table 2.9)

•

Fraction of collisions due to supply vessels = 0.34 (Table 2.7, production units)

•

Fraction of significant damage + severe damage + total loss = 0.26 (Table 2.11, supply 4 vessels )

Hence the overall frequency of significant supply vessel collisions with the installation is estimated as: (9.3 × 10-4) × 9.55 × 0.34 × 0.26 = 7.9 × 10-4 Further, installation specific analysis would be required to determine the consequences (e.g. damage to conductors, escalation) of such a collision. If the overall risk were considered high, then more detailed analysis taking into account existing collision risk management (e.g. supply vessel approach procedures) could be carried out.

4.0

Review of data sources

The analysis presented in Section 1.2.2 is derived from two sources: •

Worldwide: WOAD incident data [1] for the period 1980-2002 combined with DNV’s analysis of offshore unit exposure [8] for the same period. The WOAD database has been used for the detailed information available in it as regards damage levels and geographical region.

•

UKCS: HSE reports [3][4] and associated accident databases for the period 19802005. The reports include exposure data as well as summaries of accident statistics. The databases give the year, type of unit involved, operation mode and event category (see below) as well as an event description.

Incidents involving collision recorded in the WOAD database include incidents that have occurred during transfer of mobile units, to units that were idle, to units under construction, or to units under repair in port or in a yard. These were eliminated from consideration, as have units of other types, i.e. not involved in drilling or production. However, accommodation units are included. The analysis in Section 1.2.2 is therefore for fixed units offshore and for mobile units operating (drilling or production) offshore. The UKCS databases distinguish between collision events involving passing vessels (event code ‘CL’) and collision events involving visiting vessels (event code ‘CN’), The accident descriptions have been reviewed to identify those that resulted in an actual collision as well as the type of vessel involved (for passing vessel collisions). Event categories do not specifically indicate damage levels; they are defined in Table 4.1.

4

The last of these could also have been selected from Table 2.10, taking the North Sea value. Table 2.11 has been used as the data are specific to a fixed installation and to a supply vessel. The value is also higher than would have been obtained from Table 2.10 (0.21), hence the result will be more conservative and hence will accentuate any requirement for more detailed analysis and/or improved collision risk management. ©OGP

19

RADD – Ship/installation collisions

Table 4.1 Event Categories in UKCS Database [3][4] Category A Accident

Description Hazardous situation which have developed into an accidental situation. In addition, for all situations/events causing fatalities and severe injuries this code should be used

I

Incident

Hazardous situation not developed into an accidental situation. Low degree of damage, but repairs/replacements are required. This code should also be used for events causing minor injuries to personnel or health injuries.

N

Near-Miss

Events that might have or could have developed into an accidental situation. No damage and no repairs required

U

Unsignificant

Hazardous situation, but consequences very minor. No damage, no repairs required. Small spills of crude oil and chemicals are also included. To be included are also very minor personnel injuries, i.e. "lost time incidents".

5.0

Recommended data sources for further information

The analysis derived from the WOAD database [1] has used only some of the information available in the database. Each incident record contains a description (of varying quality) and (besides the information used in the analysis presented here) also the following information that could be used for more detailed investigation: • • • • • • • •

Accident date Unit name Human and equipment causes Geographical area, shelf and field block Numbers of crew and 3rd party fatalities and injuries Fluid spilt (if any) Repairs required Evacuation

The WOAD database also includes collisions that have occurred in situations other than drilling and production offshore: units that were under transfer, idle, under construction or under repair in a port or yard. It can therefore be used to obtain information about collision incidents in these circumstances if required. The UK HSE has published accident statistics for fixed and floating offshore units on the UK Continental Shelf 1980-2005 ([3], [4] respectively). These include collisions but do not give details in the reports; more detailed information is available in the accompanying databases (available as Excel spreadsheets) The Petroleum Safety Authority Norway publishes annual reports on risk levels in the petroleum industry and an annual report including a Facts Section that includes some information on accidents including collisions. The US Minerals Management Service publishes numbers of incidents including collisions by year and provides links to more detailed descriptions of each incident, however it has not proved possible to obtain the corresponding annual exposure data.

6.0

References

6.1

References for Sections 2.0 to 4.0

[1] DNV. WOAD - Worldwide Offshore Accident Databank, v5.0.1. [2] Dovre Safetec AS, 1995. SAFETOW Reference Manual – Risk Assessment of Towing Operations, Draft Report No. ST-95-CR-015-00. 20

©OGP

RADD – Ship/installation collisions

[3] DNV, 2007a. Accident statistics for fixed offshore units on the UK Continental Shelf 19802005, HSE Research Report RR566, Sudbury, Suffolk: HSE Books. http://www.hse.gov.uk/research/rrhtm/rr566.htm [4] DNV, 2007b. Accident statistics for floating offshore units on the UK Continental Shelf 1980-2005, HSE Research Report RR567, Sudbury, Suffolk: HSE Books. http://www.hse.gov.uk/research/rrhtm/rr567.htm [5] J. P. Kenny, 1988. Protection of Offshore Installations Against Impact, Report No. OTI 88 535, Sudbury, Suffolk: HSE Books. [6] NPD, 1984. Regulation of Structured Design of Loadbearing Structures. [7] Department of Energy, 1990. Offshore Installations, Guidance on Design, Construction and Certification, 4th. ed. [8] DNV, 2004. Exposure Data for Offshore Installations 1980-2002, Technical Note 22 (unpublished internal document). [9] HSE, 2000. Effective Collision Risk Management for Offshore Installations, Offshore Technology Report OTO 1992 052, Sudbury, Suffolk: HSE Books. http://www.hse.gov.uk/research/otopdf/1999/oto99052.pdf [10] HSE, 1997. Successful health and safety management, ISBN 0717612767, HS(G)65, Sudbury, Suffolk: HSE Books. [11] HSE, 2008. Collision risk management guidance on enforcement, HSE Semi Permanent Circular SPC/ENFORCEMENT/24. http://www.hse.gov.uk/foi/internalops/hid/spc/spcenf24.htm [12] Anatec. COLLRISK. www.anatec.com/collrisk.htm [13] Anatec, 2007. Assessment of the benefits to the offshore industry from new technology and operating practices used in the shipping industry for managing collision risk, HSE RR592. [14] ISO, 2000. Petroleum and natural gas industries — Offshore production installations — Requirements and guidelines for emergency response, International Organization for Standardization, ISO 15544:2000. [15] ONGC, 2006. Annual Report 2005-06, p33. http://www.ongcindia.com/download/AnnualReports/annual_reports05-06.htm

6.2

References for other data sources

Norway Petroleum Safety Authority Norway. Annual Report 2007 Facts Section http://www.ptil.no/getfile.php/PDF/FACTS%202008.pdf Risk Levels in the Petroleum Industry, Trends 2007 http://www.ptil.no/getfile.php/PDF/Summary_rep_2008.pdf Similar reports available for previous and subsequent years from the above. USA Minerals Management Service, OCS Related Incidents, Incident Statistics and Summaries 1996-2010 http://www.mms.gov/incidents/IncidentStatisticsSummaries.htm tabulates numbers of incidents including collisions by year and provides links to more detailed descriptions of each incident.

©OGP

21

Risk Assessment Data Directory Report No. 434 – 17 March 2010

Major accidents International Association of Oil & Gas Producers

RADD – Major accidents

contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Application ...................................................................................................... 1 Definitions ....................................................................................................... 1

2.0 2.1

Summary of Recommended Data ............................................ 1 Major offshore accidents ............................................................................... 2

2.1.1 2.1.2 2.1.3

Major offshore accidents resulting in significant fatalities.................................... 2 Major offshore accidents resulting in total loss or severe damage ...................... 9 Major offshore accidents resulting in significant pollution ................................. 17

2.2

Major onshore accidents.............................................................................. 22

2.2.1 2.2.2

Major onshore accidents resulting in significant fatalities .................................. 22 Major onshore accidents resulting in significant property damage ................... 26

3.0 3.1 3.2

Guidance on use of data ...................................................... 30 General validity ............................................................................................. 30 Uncertainties ................................................................................................. 30

4.0 4.1 4.2

Review of data sources ....................................................... 30 Major offshore accidents ............................................................................. 30 Major onshore accidents.............................................................................. 31

5.0

Recommended data sources for further information ............ 31

6.0

References .......................................................................... 31

©OGP

RADD – Major accidents

Abbreviations: API BBL BLEVE DECC DNV FPSO FSU GoM ITOPF LNG LPG MMS OLF QRA SBM SFT US WOAD

American Petroleum Institute Barrels Boiling Liquid Expanding Vapour Explosion Department of Energy and Climate Change Det Norske Veritas Floating Production, Storage and Offloading Unit Floating Storage Unit Gulf of Mexico International Tanker Owners Pollution Federation Limited Liquefied Natural Gas Liquefied Petroleum Gas (US) Minerals Management Services The Norwegian Oil Industry Association Quantitative Risk Assessment (sometimes Analysis) Synthetic Based Mud Statens forurensningstilsyn (Norwegian Pollution Control Authority) United States (of America) World Offshore Accident Databank

©OGP

RADD – Major accidents

1.0

Scope and Definitions

1.1

Application

This datasheet provides background historical information on major accidents in the onshore and offshore oil and gas production and process industries, to serve as background for QRA studies. The focus of this datasheet is on presenting an overview the range of accident types and their relative frequency of occurrence, rather than on absolute frequencies. Attention is focused on major accidents, taken to be those that have resulted in significant numbers of fatalities, asset damage and/or environmental pollution. Frequencies have been estimated for several of the accident types most commonly addressed in QRAs in other datasheets of this set.

1.2 •

Definitions An accident1 resulting in at least one of:

M ajor Accident •

Multiple fatalities

•

For Offshore units: 

•

For Onshore units: 

•

Total Loss or Severe Damage (as defined below) Approximately USD 100M property damage

1000 barrels of oil spilt

(Note: these definitions should not be treated as implying any equivalence between the stated levels of fatalities, loss and environ-mental damage.) •

Total Loss

•

Severe Dam age Severe damage to one of more modules of the unit; large /medium damage to loadbearing structures; major damage to essential equipment (as per definition in WOAD [1]).

2.0

Total loss of the unit including constructive total loss from an insurance point of view, however the unit may be repaired and put into operation again (as per definition in WOAD [1]).

Summary of Recommended Data

The data presented in this section are set out as follows: •

•

Major offshore accidents (Section 2.1) o

Major offshore accidents resulting in significant fatalities (Section 2.1.1)

o

Major offshore accidents resulting in total loss or severe damage (Section 2.1.2)

o

Major offshore accidents resulting in significant pollution (Section 2.1.3)

Major onshore accidents (Section 2.2) o

Major onshore accidents resulting in significant fatalities (Section 2.2.1)

1

Road accidents are excluded from this database. They are addressed in the Land Transport Risks datasheet. ©OGP

1

RADD – Major accidents

o

Major onshore accidents resulting in significant property damage (Section 2.2.2)

Note that data on major onshore accidents resulting in significant pollution is not readily available to a standard comparable with that available for offshore accidents; hence no such data are presented.

2.1

Major offshore accidents

2.1.1

Major offshore accidents resulting in significant fatalities

The WOAD database [1] was searched for all accidents involving fatalities. The data cover the period 1970 to 2007, in which there were a total of 553 accidents resulting in a total of 2171 fatalities. Table 2.1 lists all accidents resulting 10 or more fatalities along with the operating mode, the main event that caused the accident, the extent of damage involved, and the geographic area where the platform was operating. Table 2.2 breaks down the numbers of fatal accidents and fatalities by the type of unit involved. Table 2.3 provides a breakdown of fatalities by 5-year periods; the numbers of fatal accidents and fatalities are graphed in Figure 2.1. Table 2.4 provides a breakdown of fatalities by geographical area.

2

©OGP

RADD – Major accidents

Table 2.1 Top Offshore Incidents Listed in Decreasing Order of Fatalities Involved: W orldwide, 1970 – 2007 (m ainly [1]) 2

Accident Date Installation/ Type of Unit Operation Mode Damage 1 (dd/mm/yyyy) Field

Event Sequence

06/07/1988

Piper Alpha

Jacket

Production

Total loss

Release → Explosion → Fire

167

60

Europe North Sea

27/03/1980

Alexander L Kielland

Semisubmersible

Accommodation

Total loss

Breakage or fatigue → List → Capsizing, overturn, toppling

123

NA

Europe North Sea

03/11/1989

Seacrest

Drill ship

Exploration drilling Severe damage

Breakage or fatigue → Capsizing, overturn, toppling

91

0

Asia South

15/02/1982

Ocean Ranger Semisubmersible

Exploration drilling Total loss

Breakage or fatigue → Leakage into hull → List → Capsizing, overturn, toppling

84

0

America North East

25/10/1983

Glomar Java Sea

Drill ship

Drilling, unknown Total loss phase

Breakage or fatigue → Leakage into hull → List → Capsizing, overturn, toppling → Loss of buoyancy or sinking

81

0

Asia East

25/11/1979

Bohai II

Jackup

Transfer, wet

Total loss

Breakage or fatigue → Leakage into hull → List → Capsizing, overturn, toppling

72

0

Asia East

06/11/1986

Brent field

HelicopterOther Offshore duty

Total loss

Breakage or fatigue → Helicopter accident → Loss of buoyancy or sinking

45

2

Europe North Sea

16/08/1984

Enchova Central

Jacket

Significant Blowout → Fire → Explosion damage

42

19

America South East

11/08/2003

Neelam field

HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

27

0

Asia South

15/10/1995

DLB 269

Barge (not drilling)

Severe damage

Leakage into hull → List → Capsizing, overturn, toppling → Loss of buoyancy or sinking

26

0

Gulf of Mexico, excl. US

02/10/1997

Caspian Sea

HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

23

1

Caspian/Black Sea

Development Drilling

Transfer, wet

©OGP

No. of No. of 3 Fatalities Injuries

Geographical Area

3

RADD – Major accidents Event Sequence

15/08/1991

Leakage into hull → Capsizing, overturn, toppling → Loss of buoyancy or sinking

22

NA

Asia South

Geographical Area

Severe damage Exploration drilling Minor damage

Collision → Release → Fire

22

4

NA

Blowout

19

19

Gulf of Mexico, excl. US Middle East

Drilling, unknown Severe phase damage

Breakage or fatigue → Capsizing, overturn, toppling → Loss of buoyancy or sinking

18

0

Middle East

Construct. work unit

Usumacinta

Jackup

Drilling

02/10/1980

Ron Tappmeyer

Jackup

09/10/1974

Gemini

Jackup

26/06/1978

Statfjord field HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

18

0

Europe North Sea

08/12/1977

South Marsh, HelicopterOther 128A Offshore duty

Total loss

Collision → Helicopter accident → Loss of buoyancy or sinking

17

1

US Gulf of Mexico

Minor damage

Collision (helicopter)

17

5

1

5

US Gulf of Mexico

Blowout → Explosion → Fire

16

0

America South West

15

0

Middle East

15

0

Asia East

4

Total loss

No. of No. of 3 Fatalities Injuries

McDermott Lay barge Lay Barge 29

23/10/2007

Jacket

Production

Exploration drilling Severe damage

13/10/1971

Western Offshore 2

Drill barge

03/06/1978

Zakum field

HelicopterOther Offshore duty

Total loss

17/11/1982

NA

HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking Collision (helicopter)

21/12/1987

Eugene Island, HelicopterOther 190 Offshore duty

Total loss

Collision → Fire

15

0

US Gulf of Mexico

Minor damage

Helicopter accident

15

2

0

US Gulf of Mexico

Jackup

4

2

Accident Date Installation/ Type of Unit Operation Mode Damage 1 (dd/mm/yyyy) Field

Stacked

20/03/1980

off Macae, Brazil

HelicopterOther Offshore duty

Total loss

Breakage or fatigue → Helicopter accident → Loss of buoyancy or sinking

14

0

America South East

17/10/1985

Trintoc Atlas

Mobile unit (not drilling)

Severe damage

Release → Explosion

14

0

Centr.Amer.East, not GoM

Construct. work unit

©OGP

RADD – Major accidents 2

Accident Date Installation/ Type of Unit Operation Mode Damage 1 (dd/mm/yyyy) Field

Event Sequence

15/04/1976

Ocean Express

Jackup

Total loss

Towline failure/rupture → Capsizing, overturn, toppling

13

0

US Gulf of Mexico

13/08/1981

Leman field

HelicopterOther Offshore duty

Total loss

Helicopter accident

13

0

Europe North Sea

30/04/1982

Gulf of Thailand

HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

13

0

Asia South

20/03/1983

B.O.S. 355

13

32

Africa West

Adriatic

Severe damage Total loss

Explosion → Fire

25/11/1990

Barge (not Construct. work drilling) unit HelicopterOther Offshore duty

Breakage or fatigue → Helicopter accident

13

0

Europe South,Mediterr.

18/11/1998

Campeche S. HelicopterOther field Offshore duty

Total loss

Collision → Loss of buoyancy or sinking

13

0

Gulf of Mexico, excl. US

23/11/1977

nr. Varhaug field

HelicopterOther Offshore duty

Total loss

Breakage or fatigue → Helicopter accident

12

0

Europe North Sea

08/09/1997

en route Norn HelicopterOther field Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

12

0

Europe North Sea

02/10/1999

off Dharan, Saudi Arabia

Severe damage

Helicopter accident → Loss of buoyancy or sinking

12

8

Middle East

27/07/2005

Bombay High Jacket North

Severe damage

Collision → Release → Fire

12

0

Asia South

29/05/1972

SS, 201

HelicopterOther Offshore duty

Total loss

Helicopter accident

11

NA

US Gulf of Mexico

04/06/1980

Opobo, Nigeria

HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

11

0

Africa West

20/05/1985

Tonkawa

Drill barge

Transfer, wet

Severe damage

List → Capsizing, overturn, toppling → Loss of buoyancy or sinking → Release

11

0

US Gulf of Mexico

03/10/1989

High Island Pipeline

Pipeline

Production

Significant Collision → Release → damage Explosion → Fire

11

4

US Gulf of Mexico

14/03/1992

Cormorant field

HelicopterOther Offshore duty

Total loss

11

1

Europe North Sea

Mobilizing

HelicopterOther Offshore duty Production

©OGP

Helicopter accident → Loss of buoyancy or sinking

No. of No. of 3 Fatalities Injuries

Geographical Area

5

RADD – Major accidents Accident Date Installation/ Type of Unit Operation Mode Damage 1 (dd/mm/yyyy) Field 25/03/1993 15/03/2001

6

Lake NA Maracaibo Petrobras P-36 Semisubmersible

NA Production

Event Sequence

2

Geographical Area

Significant Explosion & Fire damage Total loss Explosion → Fire → Capsizing, overturn, toppling → Loss of buoyancy or sinking → Release

11

NA

America South East

11

0

America South East

16/07/2002

Leman field

HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

11

0

Europe North Sea

24/03/2004

NA

HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

11

0

US Gulf of Mexico

27/05/1982

nr. Natuna Island

HelicopterOther Offshore duty

Total loss

Helicopter accident → Loss of buoyancy or sinking

10

0

Asia South

04/11/1985

Concem

Barge (not drilling)

Construct. work unit

Total loss

Capsizing, overturn, toppling

10

0

Europe North Sea

31/07/1989

Avco 5

Barge (not drilling)

Transfer, wet

Total loss

Capsizing, overturn, toppling

10

0

US Gulf of Mexico

05/05/1989

Bohai Harbour HelicopterOther Offshore duty

Total loss

Breakage or fatigue → Helicopter accident

10

0

Asia East

06/12/1990

nr. Matak

HelicopterOther Offshore duty

Total loss

Explosion → Helicopter accident → Loss of buoyancy or sinking

10

2

Asia South

18/01/1995

Ubit

Jacket

Severe damage

Explosion & Fire

10

23

Africa West

Repair work/ under repair

Notes 1: Installation given for installation accidents; field or location given for helicopter accidents 2: Event sequence given as in WOAD [1] except ‘Other’ replaced by ‘Helicopter accident’ where applicable 3: Fatalities and Injuries includes crew members and contract workers 4: Source: [12] 5: Fatalities and Injuries were only in helicopter 6: Source: [8] NA = Not Available

6

No. of No. of 3 Fatalities Injuries

©OGP

RADD – Major accidents

Table 2.2 Breakdown of Incidents and Fatalities by Type of Unit: W orldwide, 1970 – 2007 [1] Type Of Unit

No. of 1 units

% of Total Units

No. of Fatal 2 Incidents

% of Total No. of Fatal Incidents

Total No. of 2 Fatalities

% of Total No. of Fatalities

Artificial Island

2

0.1

0

0.0

0

0.0

Barge (not drilling)

62

1.7

9

1.6

44

2.0

Concrete structure

31

0.9

8

1.4

19

0.9

Drill barge

141

3.9

15

2.7

70

3.2

Drill ship

110

3.0

47

8.5

236

10.9

Drilling tender

16

0.4

3

0.5

14

0.6

Flare

10

0.3

0

0.0

0

0.0

FPSO/FSU

22

0.6

4

0.7

8

0.4

Helicopter-Offshore duty Jacket

260

7.2

113

20.4

646

29.8

1278

35.2

202

36.5

509

23.4

Jackup

720

19.8

66

11.9

233

10.7

Lay barge

22

0.6

4

0.7

29

1.3

Loading buoy

30

0.8

0

0.0

0

0.0

Mobile unit (not drilling) Other

18

0.5

6

1.1

21

1.0

8

0.2

1

0.2

1

0.0

Other/Unkn. fixed structure

7

0.2

1

0.2

2

0.1

Pipeline

236

6.5

5

0.9

19

0.9

Platform rig

1

0.0

0

0.0

0

0.0

Semi-submersible

326

9.0

47

8.5

292

13.5

Ship, not drilling or production

26

0.7

12

2.2

17

0.8

Submersible

42

1.2

3

0.5

3

0.1

Subsea installation

22

0.6

0

0.0

0

0.0

Tension leg platform Well support structure

13

0.4

2

0.4

2

0.1

229

6.3

5

0.9

6

0.3

Totals

3632

100.0

553

100.0

2171

100.0

Notes 1. Since WOAD is an incident database only (i.e., it does not provide unit operating years), the numbers in this row represent the frequency of the unit in the incident database. 2. To avoid double counting of fatal accidents and fatalities, the number given is for the installation/ vessel/aircraft which suffered fatalities (e.g. helicopter hits offshore platform/installation/vessel, crew/passenger(s) in helicopter killed give number of fatalities and fatal accident is recorded on the helicopter)

©OGP

7

RADD – Major accidents

Table 2.3 Breakdown of Fatalities by Year Period: W orldwide, 1970 – 2007 [1] Year Period

No. of Fatal Incidents

% of Total No. of Fatal Incidents

No. of Fatalities

% of Total No. of Fatalities

1970-1975

94

17.0

188

8.7

1976-1980

107

19.3

320

14.7

1981-1985

112

20.3

639

29.4

1986-1990

83

15.0

568

26.2

1991-1995

39

7.1

114

5.3

1996-2000

40

7.2

134

6.2

2000-2005

55

9.9

158

7.3

2006-2007

23

4.2

50

2.3

Total

553

100.0

2171

100.0

Figure 2.1 Breakdown of Num ber of Fatalities and Num ber of Incidents by Year Period: W orldwide, 1970 – 2007

Note 1. This chart shows, for each period, the percentage of total incidents/fatalities in 1970-2007 that occurred during that period. (As the numbers of installations have varied during this time, they cannot be used to estimate per-installation incident frequencies or fatality rates.) 2. The period 2006-2007 represents only 2 years’ data whereas the previous periods are 5 years.

8

©OGP

RADD – Major accidents

Table 2.4 Breakdown of Fatalities by Geographical Area: W orldwide, 1970 – 2007 [1] Geographica l Area

No. of Fatal incidents

% of Total No. of Fatal Incidents

No. of Fatalities

% of Total No. of Fatalities

US GoM

344

62.2

611

28.1

Europe N.S.

88

15.9

574

26.4

Asia + Australia Other

41

7.4

443

20.4

80

14.5

543

25.0

Totals

553

100.0

2171

100.0

2.1.2

Major offshore accidents resulting in total loss or severe damage

Table 2.5 to Table 2.7 give the numbers of major accidents resulting in total loss by unit type, worldwide for the period 1970 to 2007, taken from WOAD [1], broken down further as follows: •

By Operation Mode:

Table 2.5

•

By Main Event:

Table 2.6

•

By Geographical Area: Table 2.7

Table 2.8 to Table 2.10 give the numbers of major accidents resulting in severe damage by unit type, worldwide for the period 1970 to 2007, taken from WOAD [1], broken down further as follows: •

By Operation Mode:

Table 2.8

•

By Main Event:

Table 2.9

•

By Geographical Area: Table 2.10

©OGP

9

RADD – Major accidents

Table 2.5 Num ber of Total Losses by Type of Unit and Operation Mode: W orldwide, 1970 – 2007 [1] Type of Unit

Operation mode (see below for key to codes) DR ID LO MO OT PR RE SC SE ST

AB

AC

CP

C W

DM

Artificial Island Barge (not drilling)

0 0

0 0

0 0

0 4

0 0

0 0

0 0

0 0

0 0

0 0

1 0

0 0

0 0

0 1

Concrete structure

0

0

0

0

0

0

0

0

0

0

0

0

0

Drill barge Drill ship

0 0

0 0

2 0

0 0

0 0

9 3

0 0

0 0

1 0

0 0

0 0

0 0

0 0

Drilling tender

0

0

0

0

0

1

0

0

0

0

0

0

Flare FPSO/FSU

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

Helicopter-Offshore duty

0

0

0

0

0

0

0

0

0

145

0

Jacket Jackup

1 0

0 0

0 0

0 3

0 0

10 30

1 1

0 0

0 9

0 1

Lay barge

0

0

0

1

0

0

0

0

0

Loading buoy Mobile unit (not drilling)

0 0

0 0

0 0

0 2

0 0

0 0

0 0

3 0

Other fixed structure

0

0

0

0

0

0

0

Pipeline Semi-submersible

0 0

0 1

0 1

0 0

0 0

0 4

Ship, not drilling or production Submersible

0

0

0

0

0

Subsea installation

0

0

0

0

0

Well support structure Total

0 1

0 1

0 3

0 10

0

10

TE

TR

UC

W O

Tota l

0 0

0 0

0 3

0 0

0 1

1 9

0

0

0

0

1

0

1

0 0

0 0

0 0

1 1

0 0

2 0

15 4

0

0

0

0

0

0

1

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0

0

0

0

0

0

0

0

145

15 1

0 0

1 1

0 3

0 1

0 0

0 27

2 0

3 4

33 81

0

0

0

0

0

0

0

1

0

0

2

0 0

0 0

0 0

0 0

0 0

0 0

0 1

0 0

0 3

0 0

0 0

3 6

0

0

0

0

0

0

0

0

0

0

0

0

0

0 0

0 0

0 0

0 0

0 1

0 0

0 0

0 0

0 0

0 0

2 2

0 1

0 0

2 10

0

0

0

0

0

0

1

0

0

0

0

1

0

0

2

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0 57

0 2

0 3

0 10

0 146

3 21

0 1

0 2

0 4

0 2

0

0 41

0 4

0 10

3 318

©OGP

RADD – Major accidents Code Operation Mode

Code Operation Mode

Code Operation Mode

Code Operation Mode

Code Operation Mode

AB

DM

Demobilizing

MO

Mobilizing

SC

Scrapped

TR

Transfer

DR ID LO

Drilling Idle Loading of liquids

OT PR RE

Other Production Repair work/under repair

SE ST TE

Service Stacked Testing

UC WO

Under construction Well workover

AC CP CW

Abandonment of production Accommodation Completion Construction work

Table 2.6 Num ber of Total Losses by Type of Unit and Main Event: W orldwide, 1970 – 2007 [1] Type of Unit

Main event (see below for key to codes) FA FI FO GR HE LE LI LG MA

AN

BL

CA

CL

CN

CR

EX

OT

PO

ST

TO

WP

Total

Artificial Island Barge (not drilling)

0 0

0 0

0 5

0 0

0 0

0 0

0 0

0 0

0 1

0 1

0 2

0 0

0 0

0 0

0 0

0 0

0 0

0 0

1 0

0 0

0 0

1 9

Concrete structure

0

0

0

0

0

0

0

0

0

0

0

0

1

0

0

0

0

0

0

0

0

1

Drill barge Drill ship

0 0

0 0

4 4

0 0

0 0

0 0

0 0

0 0

8 0

2 0

1 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

15 4

Drilling tender

0

0

0

0

0

0

0

0

0

1

0

0

0

0

0

0

0

0

0

0

0

1

Helicopter-Offshore duty

0

0

0

11

13

0

0

0

2

119

0

0

0

0

0

0

0

0

0

0

0

145

Jacket Jackup

0 0

1 0

6 47

5 1

0 1

0 0

0 0

0 1

16 10

1 8

0 3

0 0

0 2

1 3

1 0

0 0

0 0

0 0

2 5

0 0

0 0

33 81

Lay barge

0

0

1

0

0

0

0

0

0

Loading buoy Mobile unit (not drilling)

0 0

0 0

0 1

0 1

0 0

0 0

0 0

0 0

0 0

0

1

0

0

0

0

0

0

0

0

0

0

2

0 2

0 2

0 0

0 0

0 0

0 0

0 0

0 0

0 0

3 0

0 0

0 0

3 6

0 0

0 0

0 4

0 0

0 0

0 0

0 0

0 0

0 3

2 2

0 1

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

2 10

Submersible Subsea installation

0

0

1

0

0

0

0

0

0

1

0

0

0

0

0

0

0

0

0

0

0

2

Well support structure

0

1

0

0

0

0

0

0

0

Total

0

2

73

18

14

0

0

1

40

1

0

0

0

0

0

0

0

0

1

0

0

3

140

10

0

3

4

1

0

0

0

12

0

0

318

Flare FPSO/FSU

Other fixed structure Pipeline Semi-submersible Ship, not drilling or production

©OGP

11

RADD – Major accidents Code Main Event

AN BL CA CL CN

12

Anchor/mooring failure Blowout Capsizing, overturn, toppling Collision, not offshore units Collision, offshore units

Code Main Event

CR EX FA FI FO

Crane accident Explosion Falling load / Dropped object Fire Loss of buoyancy or sinking

Code Main Event

GR HE LE LG LI

Grounding Helicopter accident Leakage into hull Release of fluid or gas List, uncontrolled inclination

©OGP

Code Main Event

MA OT PO ST TO

Machinery/propulsion failure Other Out of position, adrift Breakage or fatigue Towline failure/rupture

Code Main Event

WP

Well problem, no blowout

RADD – Major accidents

Table 2.7 Num ber of Total Losses by Type of Unit and Geographical Area: W orldwide, 1970 – 2007 [1] Type of unit

Geographical Area US GoM 0

Europe N.S. 0

Asia 0

Australia 0

Other 1

Total 1

Barge (not drilling)

4

1

1

2

1

9

Concrete structure Drill barge

0 7

1 0

0 1

0 0

0 7

1 15

Drill ship

0

0

3

0

1

4

Drilling tender Flare

0

0

0

0

1

1

Helicopter-Offshore duty Jacket

52 17

28 1

29 9

4 0

32 6

145 33

Jackup

36

4

18

1

22

81

Lay barge Loading buoy

0 0

0 3

1 0

0 0

1 0

2 3

Mobile unit (not drilling)

4

1

0

0

1

6

Other fixed structure Pipeline

0

2

0

0

0

2

Semi-submersible

0

4

0

0

6

10

Ship, not drilling or production Submersible

2

0

0

0

0

2

3 125

0 45

0 62

0 7

0 79

3 318

Artificial Island

FPSO/FSU

Subsea installation Well support structure Total

©OGP

13

RADD – Major accidents

Table 2.8 Num ber of Accidents with Severe Dam age by Type of Unit and Operation Mode: W orldwide, 1970 – 2007 [1] Type of Unit

Operation mode (see below for key to codes) DR ID LO MO OT PR RE SC SE ST

AB

AC

CP

C W

DM

TE

TR

UC

W O

Tota l

Artificial Island Barge (not drilling)

0 0

0 0

0 0

4 0

0 0

0 0

0 0

0 0

0 0

0 0

0 2

1 0

0 0

0 0

0 0

0 0

6 0

0 1

0 0

11 3

Concrete structure

0

0

1

0

0

15

0

0

0

0

0

0

0

Drill barge Drill ship

0 0

0 0

0 0

0 0

0 0

7 2

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0

1

0

4

1

1

23

0 0

0 0

0 0

2 0

0 0

0 0

9 2

Flare FPSO/FSU

0

0

0

0

0

0

0

0

0

55

0

0

0

0

0

0

0

0

0

55

Helicopter-Offshore duty

0

2

3

0

0

17

0

0

0

0

149

1

1

0

0

0

1

10

5

189

Jacket Jackup

0 0

1 0

0 0

6 0

4 0

44 0

3 0

0 0

23 1

3 0

1 0

1 0

0 0

2 0

1 0

1 0

32 0

1 0

4 0

127 1

Lay barge

0

0

0

0

0

0

0

3

0

0

0

0

0

0

0

0

0

0

0

3

Loading buoy Mobile unit (not drilling)

0 0

0 0

0 0

3 0

0 0

0 1

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

2 0

0 0

0 0

5 1

Other fixed structure

0

0

0

0

0

0

0

0

0

0

148

0

0

0

0

0

0

4

0

152

Pipeline Semi-submersible

0 0

1 0

0 0

0 0

0 0

15 0

1 0

0 0

1 0

0 0

2 1

1 0

0 0

0 0

1 0

1 0

3 0

3 0

1 0

30 1

Ship, not drilling or production Submersible

0

0

0

0

0

2

0

0

0

0

0

0

0

0

0

0

0

1

0

3

0

0

0

0

Subsea installation

0

0

0

0

0

1

0

0

0

0

2

0

0

0

0

0

0

1

0

4

0

1

0

0

0

0

83

0

0

0

0

0

0

0

0

84

Well support structure Total

0

4

4

13

4

105

4

3

25

58

388

4

1

2

3

2

50

22

11

703

Drilling tender

14

©OGP

RADD – Major accidents Code Operation Mode

Code Operation Mode

Code Operation Mode

Code Operation Mode

Code Operation Mode

AB

DM

Demobilizing

MO

Mobilizing

SC

Scrapped

TR

Transfer

DR ID LO

Drilling Idle Loading of liquids

OT PR RE

Other Production Repair work/under repair

SE ST TE

Service Stacked Testing

UC WO

Under construction Well workover

AC CP CW

Abandonment of production Accommodation Completion Construction work

Table 2.9 Num ber of Accidents with Severe Dam age by Type of Unit and Main Event: W orldwide, 1970 – 2007 [1] Type of Unit

Main event (see below for key to codes) FA FI FO GR HE LE LI LG MA

AN

BL

CA

CL

CN

CR

EX

OT

PO

ST

TO

WP

Total

Artificial Island Barge (not drilling)

0

0

3

0

0

0

0

0

1

4

3

0

0

0

0

Concrete structure

0

0

0

0

0

0

0

0

2

0

0

0

0

0

0

0

0

0

0

0

0

11

0

0

0

1

0

0

3

Drill barge Drill ship

0 0

0 1

5 1

0 2

0 0

0 0

0 0

0 2

11 0

4 0

1 1

0 0

0 0

0 0

0 0

0 0

0 0

0 0

2 2

0 0

0 0

23 9

Drilling tender

0

0

0

0

0

0

0

0

1

0

0

0

0

0

0

0

0

0

1

0

0

2

Helicopter-Offshore duty

0

0

0

3

10

0

0

2

0

1

0

0

0

0

0

0

39

0

0

0

0

55

Jacket Jackup

0 0

1 3

79 29

18 3

6 3

0 0

5 2

3 1

44 14

9 11

0 8

0 0

0 3

2 11

3 0

0 0

0 0

0 2

19 36

0 1

0 0

189 127

Lay barge

0

0

0

0

0

0

0

0

0

0

Loading buoy Mobile unit (not drilling)

0 0

0 0

1 1

0 0

0 1

0 0

0 1

0 0

0 0

0 1

1

0

0

0

0

0

0

0

0

0

0

1

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

2 1

0 0

0 0

3 5

Other fixed structure

0

0

0

0

0

0

0

1

Pipeline Semi-submersible

0 0

0 0

0 0

7 1

0 4

0 0

2

0 4

4 5

0

0

0

0

0

0

0

0

0

0

0

0

1

0 1

0 6

0 0

0 2

0 0

117 0

0 0

0 1

0 0

21 5

1 1

0 0

152 30

Ship, not drilling or production

0

0

0

0

0

0

0

0

0

0

0

0

0

0

1

0

0

0

0

0

0

1

Submersible Subsea installation

0 0

0 0

0 1

0 0

0 0

0 0

0 0

0 0

2 0

0 1

1 0

0 0

0 0

0 0

0 0

0 0

0 0

0 0

0 2

0 0

0 0

3 4

Well support structure

0

1

69

8

0

0

0

1

1

Total

0

6

189

42

24

0

10

13

86

1

0

0

0

1

1

0

0

0

1

0

0

84

33

21

0

5

14

122

0

40

2

93

3

0

703

Flare FPSO/FSU

©OGP

15

RADD – Major accidents Code Main Event

AN BL CA CL CN

Anchor/mooring failure Blowout Capsizing, overturn, toppling Collision, not offshore units Collision, offshore units Table 2.10 Number of

Code Main Event

Code Main Event

CR Crane accident GR EX Explosion HE FA Falling load / Dropped object LE FI Fire LG FO Loss of buoyancy or sinking LI Accidents with Severe Damage

Type of unit

Code Main Event

MA Machinery/propulsion failure WP Well problem, no blowout OT Other PO Out of position, adrift ST Breakage or fatigue TO Towline failure/rupture Geographical Area: Worldwide, 1970 – 2007 [1]

Geographical Area US GoM

Europe N.S.

Asia + Australia

Other

Total

Barge (not drilling) Concrete structure

1 1

0 2

3 0

7 0

11 3

Drill barge

13

0

4

6

23

Drill ship Drilling tender

0 1

1 0

5 1

3 0

9 2

Helicopter-Offshore duty

32

12

6

5

55

Jacket Jackup

151 60

7 5

19 39

12 23

189 127

Lay barge

0

0

0

1

1

Loading buoy Mobile unit (not drilling)

0 2

2 0

0 0

1 3

3 5

Other fixed structure

16

Code Main Event

Grounding Helicopter accident Leakage into hull Release of fluid or gas List, uncontrolled inclination by Type of Unit and

0

0

0

1

1

Pipeline Semi-submersible

133 10

9 14

6 3

4 3

152 30

Ship, not drilling or production

0

0

1

0

1

Submersible Tension leg platform

3 4

0 0

0 0

0 0

3 4

Well support structure

82

1

0

1

84

Total

493

53

87

70

703

©OGP

RADD – Major accidents

2.1.3

Major offshore accidents resulting in significant pollution

2.1.3.1 Spills from offshore E&P installations Table 2.11 gives the numbers of blowouts resulting in pollution worldwide and for selected geographical areas, taken from SINTEF’s blowout database [6]. Categorisation of spill size is from this database. Table 2.12 gives the fractions of all blowouts that result in pollution, overall and by spill size category. Table 2.11 Blowouts Resulting in Pollution, by Geographical Area, 1970 – 2007 [6] Location

UK Norway D/DK/NL North Sea* US GoM Worldwide

Total No. of Blowouts 30 34 2 66 273 498

Blowouts with Pollution Large

Medium

Small

Unknown

Total

0 1 0 1 5 22

0 0 0 0 9 11

0 1 0 1 40 56

0 1 0 1 9 39

0 3 0 3 63 128

* Includes UK West of Shetland

Table 2.12 Fractions of Blowouts with Pollution, by Geographical Area, 1970 – 2007 [6] Location

UK

Fraction of Blowouts w. Pollution 0

Fraction of Blowouts with Defined Spill Size Large Medium Small -

-

-

Norway

0.088

0.50

0.00

0.50

D/DK/NL

0

-

-

-

NS/WoS

0.045

0.50

0.00

0.50

US GoM

0.23

0.09

0.17

0.74

Worldwide

0.26

0.25

0.12

0.63

Table 2.13 gives details of large spills (defined here as > 1000 BBL) in the US Gulf of Mexico during 1970 – 2007, excluding those resulting from Hurricane Rita on 24/09/2005, which are given separately in Table 2.14 and Figure 2.2 shows the corresponding proportions of incidents and spill volumes by material spilt.

©OGP

17

RADD – Major accidents

Table 2.13 Large Spills (> 1000 BBL) from Platform s in the US Gulf of Mexico, 1970 – 2007 [2] Date 01/12/1970 10/02/1970 17/04/1974 07/02/1988 24/01/1990 09/01/1973 29/09/1998 26/01/1973 11/12/1981 2 24/09/2005 12/05/1973 06/05/1990 16/11/1994 18/12/1976 11/09/1974 23/07/1999 01/03/2002 21/01/2000 31/08/1992 23/11/1979 19/01/2000 21/05/2003 14/11/1980 26/01/1998 21/10/2007 11/04/2004 Totals Number 16 1 3 5 25

Spill Size (BBL) 53,000 30,000 19,833 15,576 14,423 9,935 8,212 7,000 5,100 2 5,066 5,000 4,569 4,533 4,000 3,500 3,200 3,000 2,240 2,000 1,500 1,440 1,421 1,456 1,211 1,061 1,034 Spill Size (BBL) 174,621 1,500 20,167 7,956 204,244

Material 1

Operation

Oil 1 Oil Oil Oil Condensate Oil Oil Oil Oil Condensate + Diesel Oil Oil Condensate Oil Oil Oil 2 SBM Oil Oil Diesel 3 SBM 3 SBM Oil Condensate 3 SBM 3 SBM

Completion/Workover Production Pipeline Pipeline/Marine Vessel Pipeline Production Pipeline Production Pipeline/Marine Vessel Production + Drilling

Material

Average Spill Size (BBL) 10,914 1,500 6,722 1,591 8,170

Oil Diesel Condensate SBM All

Pipeline Pipeline Pipeline Pipeline Pipeline Pipeline Drilling Pipeline Pipeline Drilling/Marine Vessel Drilling Drilling Production Pipeline/Marine Vessel Drilling Drilling

1

Blowout incident Hurricane Rita: total spill of 5,066 (BBL) comprised 3 spills as listed in Table 2.14 3 SBM = Synthetic Based Mud 2

Table 2.14 Detail of Spills Resulting from Hurricane Rita [2] Date 24/09/2005 24/09/2005 24/09/2005 Total

18

Spill Size (BBL) 2,000 1,572 1,494 5,066

Material

Operation

Condensate Diesel Diesel

Production Drilling Drilling

©OGP

RADD – Major accidents

Figure 2.2 Proportions of Incidents and Spill Volum es by Material Spilt

Table 2.15 and Figure 2.3 present data on all spills offshore UK and Norway by year.

©OGP

19

RADD – Major accidents

Table 2.15 Spills by Year Offshore UK (1991 – 2007) [3] and Norway (1996 – 2007) [4] Year

United Kingdom

Norway

Number of Spills

Spill Size (BBL)

Number of Spills

Spill Size (BBL)

1991 1992

N/A N/A

1,407 1,649

N/A N/A

N/A N/A

1993

N/A

1,642

N/A

N/A

1994 1995

N/A N/A

1,275 616

N/A N/A

N/A N/A

1996

N/A

931

9

227

1997 1998

26 14

6,348 1,004

10 15

680 1,158

1999

21

880

12

1,076

2000 2001

18 17

3,841 689

5 7

214 314

2002

18

704

9

686

2003 2004

10 13

828 550

11 10

5,518 483

2005

10

551

6

2,372

2006 4 195 7 768 2007 10 459 12 28,238* * This includes a large oil spill from the Statfjord field caused by the rupture of a loading hose on the Offshore Loading System. An estimated 27,500 barrels of oil was pumped into the sea amounting to 99% of the total oil spilled in 2007. This is the second-largest spill in Norwegian petroleum history.

20

©OGP

RADD – Major accidents

Figure 2.3 Spills by Year in UK (1991 – 2007) [3]and Norway (1996 – 2007) [4]

2.1.3.2 Tanker spills Table 2.16 presents data on major tanker spills worldwide since 1970, comprising those of the ITOPF [5] “top 20” tanker spills during this period (only the Torrey Canyon incident of 1969 is thereby omitted from the ITOPF “top 20”) and other significant tanker spill incidents.

©OGP

21

RADD – Major accidents

Table 2.16 Major Tanker Spills W orldwide 1970 – 2007 ([5] and others) Date 19/07/1979

Tanker Atlantic Empress

Spill Location Off Tobago, West Indies

Spill Size (te) 287,000*

28/05/1991

ABT Summer

700 nautical miles off Angola

260,000

06/08/1983 16/03/1978

Castillo de Bellver Amoco Cadiz

Off Saldanha Bay, South Africa Brittany, France

252,000 223,000

11/04/1991

Haven

Genoa, Italy

144,000

10/11/1998 19/12/1972

Odyssey Sea Star

700 nautical miles off Nova Scotia, Canada Gulf of Oman

132,000 115,000

07/12/1971

Texaco Denmark

Belgium, North Sea

107,140

23/02/1980 12/05/1976

Irenes Serenade Urquiola

Navarino Bay, Greece La Coruna, Spain

100,000 100,000

23/02/1977

Hawaiian Patriot

300 nautical miles off Honolulu

95,000

15/11/1979 29/01/1975

Independenta Jakob Maersk

Bosphorus, Turkey Leixoes, Portugal

95,000 88,000

05/01/1993

Braer

Shetland Islands, UK

85,000

19/12/1989

Khark 5

80,000

03/12/1992

Aegean Sea

120 nautical miles off Atlantic coast of Morocco La Coruna, Spain

15/02/1996

Sea Empress

Milford Haven, UK

72,000

17/04/1992 06/12/1985

Katina P Nova

Off Maputo, Mozambique Off Kharg Island, Gulf of Iran

72,000 70,000

13/11/2002

Prestige

Off Galicia, Spain

63,000

13/05/1975 24/03/1999

Epic Colocotronis Exxon Valdez

USA, Caribbean Sea Prince William Sound, Alaska, USA

61220 37,000

11/12/1999

Erika

Bay of Biscay, off Brittany Coast

20,000

74,000

* This comprised 2 separate spills of approximately 145,000 te on 19/07/1979 and 141,000 te on 02/08/1979 following repairs.

2.2

Major onshore accidents

2.2.1

Major onshore accidents resulting in significant fatalities

The MHIDAS database [13] was searched for all accidents involving fatalities. The data searched cover the period from 1970 onwards 2 , in which period a total of 13,502 accidents involving dangerous substances resulting in a total of 21,785 fatalities are recorded. Table 2.17 lists all accidents resulting 10 or more fatalities along with the material(s)

involved, the source of the event, and event descriptors.

2

Accidents up to the end of 2005 are covered by the database made available to DNV: see Section 4.2. 22

©OGP

RADD – Major accidents

Table 2.17 Top Onshore Incidents Listed in Decreasing Order of Fatalities Involved: Worldwide, 1970 – 2005 (mainly [13]) Accident Location Date (dd/mm/yyyy)

Material name

Source

Event (Note 1)

3/12/1984

Bhopal, Madhya Pradesh

Methyl Isocyanate

Process: Pressurised

2/11/1994 19/11/1984

Aircraft Fuel LPG

23/12/2003

Dronka San Juan Ixhuatepec, Mexico City Gao Qiao, Chongqing

Storage: Atmospheric Storage: Pressurised Storage Gas Well

Continuous Release; Fireball Continuous Release; Fire BLEVE

19/12/1982

Tacoa

14/9/1997

26/6/1971 6/11/1990

Visakhapatnam, Andhra Pradesh LPG, Kerosene, Petroleum Products, Crude Oil Semarang, Java Kerosene Xingping, Shaanxi Nitrogen Bantry Bay, Cork Crude Oil Dakar Ammonia Staten Island, New York Natural Gas Duque De Caxias, Rio De LPG Janeiro Korfez, Gulf Of Izmit Crude Oil, Naphtha Bombay Toluene, Benzene, Naphtha Czechowice Oil Maharastra, Bombay LPG

21/9/2001

Toulouse

1/6/1974

24/1/1970 6/1/1998 8/1/1979 24/3/1992 10/2/1973 30/3/1972 17/8/1999 9/11/1988

Natural Gas, Hydrogen Sulphide (Sour Gas) Fuel Oil

No. of No. of Country Fatalities Injuries >2000

>170,000

>580 >500

2500

243

4000-9000

>153

500

Venezuela

56

20

India

Transfer: Atmospheric Storage Transfer: Pipework

Blowout; Continuous Release Explosion; Instantaneous Release Explosion; Fire

Storage: Pipework Process: Pipework Transfer: Ship Process Storage: Atmospheric Storage: Pressurised

Fire; Tank Fire Explosion Explosion; Fireball Explosion; Fire Confined Explosion; Fire BLEVE; Fire

50 50 50 41 40 39

Process Storage: Atmospheric

Fire; Continuous Release Fire; Explosion

Storage: Atmospheric Process: Pipework Storage: Atmospheric

Flixborough, Lincolnshire

Ammonium Nitrate, Ammonia, Chlorine Cyclohexane

22/10/1988

Shanghai

LPG

Process

20/10/1995

Colombo

Storage: Atmospheric

19/1/2004

Skikda

Diesel, Kerosene, Crude Oil LNG

23/10/1989

Pasadena, Texas

Isobutane

Process: Pipework

Process: Heat Exchangers Process: Reactor

©OGP

India

1

Egypt Mexico

3

China

403 2 51

Indonesia China Eire Senegal Usa Brazil

37 35

16

Turkey India

Explosion; Fire Continuous Release; Unconfined Explosion Explosion

33 30

Poland India

30

2500

France

Continuous Release; Unconfined Explosion Unconfined Explosion; Fire Explosion; Fire

28

89

UK

25

17

China

15

28 86 >160

UK China China

Explosion; Fire

15

>100

USA

Unconfined Explosion; BLEVE Explosion; Fire Explosion Release Dense Gas Cloud; Unconfined Explosion Explosion; Fire Explosion; Fire Explosion; Fire Explosion; Fire Continuous Release Explosion; Fire

15

Continuous Release; BLEVE Fire; Explosion

Notes

8

9 10

11 12

USA

15 14 14 14

4 79 6 107

Sumatra 13 Czechoslovakia Egypt 14 Netherlands

14 13 13 13 13 13

>30 6 19 >1 11

Greece Hungary South Korea Iran China USA

15 16

13

95

USA

17

13

8

USA

18

RADD – Major accidents

Accident Location Date (dd/mm/yyyy)

Material name

Source

Event (Note 1)

30/1/1989 25/3/1993 26/5/1992 7/9/1992 ??/3/1984 ??/2/1979 22/6/1981

Oil Natural Gas Ammonia Ammonia Kerosene Petrol Gasoline

Process: Pipework Process Process: Pipework Process: Pipework Process Process Storage: Atmospheric

Explosion; Fire Explosion; Fire Release Explosion Explosion Confined Explosion; Fire Release

Secunda, Transvaal Maracaibo, Haryana, Haryana, , Lagos Risa, Rocklin, California

No. of No. of Country Fatalities Injuries 12 11 11 >11 10 10 10

8 >1 9 9

Notes

South Africa Venezuela India India Nigeria Germany USA

Notes 1. Events are presented as given in MHIDAS. 2. Fatalities/injuries estimated from various sources. 3. Military depot tanks struck by lightning and flaming fuel spread through flooded town. 4. Tank fire caused by theft from pipeline after torch ignited leak from pipeline. 5. Explosion on vessel during unloading. 6. Ammonia tank in peanut plant. 7. Bomb attack. 8. Coking works. 9. Guerilla attack. 10. Resin factory. 11. Water pumping station. 12. Warehouse fire spread to LPG tank. 13. Explosion on ship during loading. 14. Butane bottling factory 15. Unclear from description if plastics goods factory or acrylonitrile plant. 16. Underground gas storage facility. 17. Rail tanker BLEVE during unloading. 18. Explosion on ship - not clear from description if vessel was loading/unloading at time of incident.

©OGP

25

RADD – Major accidents

2.2.2

Major onshore accidents resulting in significant property damage

Table 2.18 presents data on major onshore accidents in the hydrocarbon-chemical industry during 1970 to 2001 resulting in significant property damage as measured by the cost, taken from [6] (the most recent compilation of data). The loss amounts include property damage, debris removal and cleanup costs while the costs of business interruption, extra expense, employee injuries and fatalities, and liability claims are excluded. These data do not include the Texas City disaster of 23/03/2005. The cost of this has been reported [9] as USD 305M; however, the basis of this sum may not be comparable to the values presented in Table 2.18, which are strictly property damage losses.

26

©OGP

RADD – Major accidents

Table 2.18 Top Property Dam age Losses in the Hydrocarbon-Chem ical Industry, 1970 – 2001 [7],[8] Date

Name of Unit

Type of Unit

Operating Mode

Main Event

Cost (10 USD Actual)

6

6

Cost (10 USD 2002)

Area

23/10/1989 21/09/2001

High Density Polyethylene Reactor Ammonium Nitrate Storage Warehouse

Petrochem Petrochem

Operating Storage

Explosion Explosion

675 750

869 750

USA Europe

25/06/2000 05/05/1988

Condensate Line Fluid Catalytic Cracking Unit

Refinery Refinery

Transfer Operating

Explosion Explosion

412 255

433 336

Middle East USA

09/11/1992

Fluid Catalytic Cracking Unit

Refinery

Operating

Explosion

260

318

Europe

25/12/1997 14/11/1987

Air Separation Unit Butane Oxidation Reactor

Gas Processing Petrochem

Operating Startup

Explosion Explosion

275 215

294 288

Asia USA

23/07/1984

Monoethanolamine Absorber Column

Refinery

Operating

Explosion

191

275

USA

16/10/1992 01/06/1974

Hydrodesulphurization Unit Cyclohexane Oxidation Reactor

Refinery Petrochem

Startup Operating

Explosion Explosion

161 62

196 182

Asia Europe

03/04/1977

Refrigerated Propane Storage

Gas Processing

Storage

Fire

76

179

Middle East

25/09/1998 26/07/1996

Gas Processing Plant Cryogenic Unit

Gas Processing Gas Processing

Operating Operating

Explosion Explosion

160 136

171 148

Australia Central America

13/12/1994

Ammonium Nitrate Unit

Petrochem

Operating

Explosion

120

141

USA

01/09/1979 09/04/2001

Ethanol Storage Tank/DWT Tanker Visbreaker Unit

Refinery Refinery

Transfer Maintenance

Explosion Fire

68 130

138 134

USA Central America

01/05/1991

Nitroparaffin Unit

Petrochem

Operating

Explosion

105

129

USA

23/04/2001 30/05/1978

Coker Unit Alkylation Tank Farm

Refinery Refinery

Operating Storage

Fire Fire

120 55

124 120

USA USA

27/05/1994

Synthetic Rubber Reactor

Petrochem

Operating

Explosion

100

118

USA

15/04/1978 05/12/1970

Gas Transmission Pipeline Hydrocracking Unit

Gas Processing Refinery

Transfer Operating

Explosion Explosion

54 27

117 114

Middle East USA

©OGP

27

RADD – Major accidents

Date

28

Name of Unit

Type of Unit

Operating Mode

Main Event

Cost (10 USD Actual)

6

6

Cost (10 USD 2002)

Area

11/03/1991

Vinyl Chloride Plant

Petrochem

Operating

Explosion

91

112

10/04/1989

Hydrocracker Unit

Refinery

Shutdown

Fire

87

112

Central America USA

21/10/1980

Polypropylene Reactor

Petrochem

Maintenance

Explosion

60

111

USA

16/05/2001 15/08/1984

Polyacrylates Plant Fluid Bed Coking Unit

Petrochem Refinery

Operating Operating

Fire Fire

109 76

109 109

Europe Canada

22/06/1997

Olefins Unit

Petrochem

Operating

Explosion

100

108

USA

22/03/1987 07/03/1989

Hydrocracking Unit Aldehyde Column

Refinery Petrochem

Startup Operating

Explosion Explosion

79 77

107 99

Europe Europe

12/03/1991

Ethylene Oxide Unit

Petrochem

Operating

Explosion

80

98

USA

08/10/1992 19/05/1985

Hydrogen Processing Unit Ethylene Plant

Refinery Petrochem

Operating Operating

Explosion Fire

73 65

96 93

USA Europe

©OGP

RADD – Major accidents

Table 2.19 presents a summary of the top 100 onshore incidents during 1972 – 2001 (i.e. over the 30 years preceding publication) [8]; Figure 2.4 presents this information graphically. Table 2.19 Sum m ary of Top 100 Major Onshore Incidents, 1972 – 2001 [8] Industry

Total Loss 6 (10 USD 2002)

Percent of Total USD

No. (and %) of Incidents

Refining

4,958

47

49

Petrochemical Gas Processing

4,072 1,170

38.5 11

33 10

363

3.5

8

10,563

100

100

Terminals/Distribution Total

Figure 2.4 Breakdown of Top 100 Major Onshore Incidents by Type of Unit, 1972 – 2001 [8]

©OGP

29

RADD – Major accidents

3.0

Guidance on use of data

3.1

General validity

The information presented in Section 2.0 is taken from data sources believed to be the most comprehensive available. Nevertheless, it cannot be taken to be complete for all worldwide locations, for the reasons set out in Section 4.0. It is intended to give an overview of the types of accident that have occurred and the types of unit involved, and to provide limited indications of relative likelihoods for different types of unit, operation mode, main event, variation over time, and geographical area. However, it should not be used by itself to estimate absolute frequencies as the corresponding exposure data are not given. Rather, as stated in Section 1.1, the information presented is background historical information on major accidents in the onshore and offshore oil and gas production and process industries, to serve as background information for QRA studies.

3.2

Uncertainties

Regarding the completeness of the information with respect to major offshore accidents, see Section 4.1. For offshore tanker spills, various data sources have been cross-checked with the primary source, ITOPF statistics [5]: spill quantities do not always match and, in these cases, the ITOPF data have been taken as definitive.

4.0

Review of data sources

4.1

Major offshore accidents

The Worldwide Offshore Accident Databank (WOAD) project was launched in 1983 and at present [1] includes accident data from 1970 to 2007 inclusive. The database is maintained by DNV, which collects data on major offshore accidents from public sources worldwide. Although the database attempts to cover worldwide accidents, there are areas of the world for which limited information is available, e.g. countries with a fully state-owned offshore industry. For such areas only accidents to units owned by private, foreign operators is normally known. Whereas WOAD provides good data on fatalities and damage levels, it has only limited data on pollution incidents, hence other, national, sources have been used to obtain the pollution incident data presented in Section 2.1.3 for the US Gulf of Mexico [2], offshore United Kingdom [3] and offshore Norway [3] (with supplementary data from [10]). SINTEF’s blowout database [6] indicates whether pollution occurred and, where information was available, categories the pollution as “Small”, “Medium”, “Large”, “Unknown”, and “None”; however, it does not define these categories quantitatively. For the purposes of determining the fraction of blowouts resulting in pollution (Table 2.12), it has been assumed that some pollution resulted where the category is “Unknown”. Tanker accident data has been taken principally from ITOPF [5] with additional data from [11].

30

©OGP

RADD – Major accidents

4.2

Major onshore accidents

The accident data presented in Table 2.17 are taken almost entirely from MHIDAS [13], one of the most authoritative databases of accidents in the onshore energy and process industries. Compilation of MHIDAS commenced in the 1980s, however information on selected accidents before that time were included as available. Two editions of Marsh’s (formerly Marsh & Maclennan) regular publications of major onshore property damage incidents have been used, from 1995 [7] and 2003 [8]. These provide property damage values, both actual and on a common USD basis (1993 USD in [7]; 2002 USD in [8]; the 1993 values have been updated to 2002), as well as brief accident descriptions.

5.0

Recommended data sources for further information

The sources referenced in Section 4.0 may be consulted for additional information, especially: WOAD [1] for offshore accidents in general, and in particular for accidents causing fewer than 10 fatalities (cf. Section 2.1.1, Table 2.1). MMS [2] for offshore pollution accidents and other offshore accidents OLF [4] for discharges and emissions offshore Norway ITOPF [5] for tanker spills SINTEF [6] for comprehensive data on blowouts (requires licence to download and access) MHIDAS [13] for further information on major onshore incidents up to the end of 2005. Marsh [7] for further information on major onshore property damage incidents JLT [9] for insurance costs of losses in upstream, downstream and power generation and also losses from hurricanes Katrina, Rita and Wilma in 2005 MHIDAS is now maintained by AEA Technology, who should be contacted for further information (http://www.aeat.co.uk/cms/locations-office/).TNO’s FACTS database contains information on more than 23,000 (industrial) accidents involving hazardous materials that have happened all over the world during the past 90 years. It is available online (http://www.factsonline.nl/) but requires a licence to obtain detailed information such as numbers of fatalities and injuries.

6.0

References

[1]

DNV. WOAD - Worldwide Offshore Accident Databank, v5.0.1.

[2]

MMS, 2009. MMS Incident Statistics and Summaries, US Department of the Interior, Minerals Management Service. http://www.mms.gov/incidents/IncidentStatisticsSummaries.htm

[3]

DECC, 2009. Pollution Prevention and Oil Spills, Department of Energy and Climate Change. https://www.og.berr.gov.uk/information/bb_updates/chapters/Table_chart3_1.htm

[4]

OLF, 2008. 2007 environmental report, The Norwegian Oil Industry Association (OLFboyl), 2008.

©OGP

31

RADD – Major accidents

http://www.olf.no/getfile.php/Dokumenter/Publikasjoner/Milj%C3%B8rapporter/0808 05%20OLF%20Enviromental%20report%202007.pdf [5]

ITOPF, 2009. Statistics, International Tanker Owners Pollution Federation Limited. http://www.itopf.com/information%2Dservices/data%2Dand%2Dstatistics/statistics/

[6]

SINTEF, 2008. Offshore Blowout Database, version 4.0. http://www.exprosoft.com/blowout/ (requires licence to download and access)

[7]

Marsh & McLennan Protection Consultants, 1995. Large Property Damage Losses in the Hydrocarbon - Chemical Industries, A Thirty-year Review (16th ed.), ed. Mahoney D.

[8]

Marsh Property Risk Consulting, 2003. The 100 Largest Losses 1972-2001. Large Property Damage Losses in the Hydrocarbon-Chemical Industries, 20th ed., ed. Coco, JC. http://www.marshriskconsulting.com/ma/maStore/cgibin/ma_onlinestorecatalog.exe?VM_CGI_EVENT=ProductDetailEv&VM_CGI_OBJE CT=storebuilder_displayed_page&Category_ID=371&Subcategory_ID=228136&Nav Root=306&Product_ID=234871

[9]

JLT Risk Solutions, 2006. Energy Insurance Newsletter, January. http://www.jltusa.net/files/EnergyNL0601.pdf

[10] SFT, 2009. Utslipp av olje og kjemikalier på norsk kontinentalsokkel 1996, Statens forurensningstilsyn. http://www.sft.no/publikasjoner/vann/1470/ta1470.pdf [11] Etkin, DS, 1999. Historical overview of oil spills from all sources (1960-1998), Intl. Oil Spill Conf., Seattle, WA, American Petroleum Institute, 1097-1102, API publication 4686. [12] http://home.versatel.nl/the_sims/rig/index.htm (accessed 18/03/2009). [13] Health and Safety Executive, 2006. MHIDAS Database - Major Hazard Incident Data Service.

32

©OGP

Risk Assessment Data Directory Report No. 434 – 18 March 2010

Construction risk for offshore units International Association of Oil & Gas Producers

RADD – Construction risk for offshore units

Contents 1.0 1.1 1.2

Scope and Application ........................................................... 1 Scope ............................................................................................................... 1 Definitions ....................................................................................................... 1

2.0 2.1 2.2 2.3

Summary of Recommended Data ............................................ 3 Worldwide Construction Failure Risks ......................................................... 3 North Sea Construction Failure Frequencies............................................... 3 Fatal Accident Rate (FAR) data ..................................................................... 3

3.0 3.1 3.2 3.3

Guidance on use of data ........................................................ 4 General validity ............................................................................................... 4 Contributors to Severe/Significant or Total Loss Incidents ....................... 4 Uncertainties ................................................................................................... 4

4.0 4.1

Review of data sources ......................................................... 5 Construction Incident frequency................................................................... 5

4.1.1 4.1.2

Historical Frequencies of Incidents.......................................................................... 5 WOAD Accident Reports ........................................................................................... 6

4.2

FAR data ........................................................................................................ 12

4.2.1 4.2.2 4.2.3 4.2.4

OGP FAR Data .......................................................................................................... 12 Comparison with other industries .......................................................................... 13 Construction FAR breakdown by Region .............................................................. 13 Norwegian Construction Data................................................................................. 13

5.0

Recommended data sources for further information ............ 13

6.0

References .......................................................................... 14

©OGP

1

RADD – Construction risk for offshore units

Abbreviations: DPS E&P FAR FPSO FSU GoM HSE MODU MOPU NPD NS OGP OSHA PSA QRA TLP UK US UKCS WOAD WW

2

Dynamic Positioning System Exploration and Production Fatal Accident Rate Floating Production, Storage and Offloading Floating Storage Unit Gulf of Mexico (UK) Health & Safety Executive Mobile Offshore Drilling Unit Mobile Offshore Production Unit Norwegian Petroleum Directorate North Sea International Association of Oil and Gas Producers Occupational Safety & Health Administration Petroleum Services Authority (Norway) Quantitative Risk Assessment Tension Leg Platform United Kingdom United States United Kingdom Continental Shelf Worldwide Offshore Accident Databank Worldwide

©OGP

RADD – Construction risk for offshore units

1.0

Scope and Application

1.1

Scope

This datasheet presents estimates of fabrication, construction and installation risks in respect of asset damage/loss and personnel safety. The data are mainly applicable to offshore installations although reference is made to onshore construction fatal accident rates. The datasheet has not been designed to assist with the quantification of general project management uncertainties for the purpose of estimating the likelihood of project schedule and cost overruns. This is considered to be a separate subject. Measured in terms of the life-cycle of a project, the fabrication, construction and installation phases have a short duration and can be characterised as: • • • •

labour intensive, involving a large number of one-off tasks, requiring temporary work arrangements and working environments, exposing components/structures to non-design loading condition.

In terms of the last of these, structures can be designed to withstand extreme loadings when fixed in-situ, such as an offshore installation being designed for a one-hundred year return wave (a storm having an annual probability of occurrence of 10-2). However, their tolerance can be considerably lower during the temporary phases. In addition, ancillary systems such as semi-submersible crane vessels can be in a condition which makes them vulnerable to adverse weather for the period of an operation. In regard to the QRA of an onshore facility there may be no need to treat the three phases as distinct. All hazardous operations could take place at the one site and the phases could overlap in the project schedule. The risks arising from the use of Temporary Living quarters and in particular the potentially high risk associated with vehicle activity are not included in the construction risks outlined. The Land Transport Accident Statistics datasheet provides an indication of potential vehicle risk which may need to be evaluated when considering the total risks associated with a construction project.

1.2 •

Definitions Construction (as defined by OGP [4]) Construction comprises all construction and fabrication activities, and also disassembly, removal and disposal (decommissioning) at the end of the facility life. Factory construction of process plant, yard construction of structures, offshore installation, hook-up and commissioning, and removal of redundant process facilities are all examples which are included under construction activities. With this definition, construction may involve the assembly of relatively large sections of an installation. Examples would include: -

lifting of modules onto a module support frame (MSF), mechanical outfitting of a concrete gravity based structure (GBS).

©OGP

1

RADD – Construction risk for offshore units

Fabrication activities need not take place in the same location as the construction activities. Therefore, construction could involve the transport of substantial sections of the installation between sites. The hazards and risks associated with these activities may need to be considered and analysed within the framework of a “total” risk analysis. •

Fabrication (taken as a subset of Construction above) Activities performed in producing significant sub-components, packages, or modules which will be combined during the construction phase.

•

Installation (taken as a subset of Construction above) Activities performed to transfer the structure to, and position it at, the designated site. This definition is tailored to offshore developments, where one or more structures are transported and assembled at the site. An onshore facility may have no equivalent activities. For an offshore jacket platform this phase can include the lifting or load-out of the jacket and deck, onto transport barges. Some structures, such as concrete gravity based structures, can be towed without the assistance of a transport barge.

This data sheet can be used in risk assessments oriented to either quantifying risks to personnel or to quantifying risks to asset integrity. The following damage categorisation as extracted from the Worldwide Offshore Accident Databank (WOAD, [1]) is used, as applied to all accident types: •

Total Loss: Total loss of the unit including constructive total loss from an insurance point of view, however the unit may be repaired and put into operation again.

•

Severe Dam age: Severe damage to one of more modules of the unit: large /medium damage to load bearing structures: major damage to essential equipment.

•

Significant Dam age : Significant/serious damage to module and local area of the unit: minor damage to the load bearing structures: significant damage to single essential equipment: damage to more essential essential equipment.

•

Minor Dam age: Minor damage to single essential equipment: damage to more non essential equipment: damage to non load bearing structures.

•

Insignificant Dam age: Insignificant or no damage: damage to part of essential equipment, damage to towline, thrusters, generators and drives.

2

©OGP

RADD – Construction risk for offshore units

2.0

Summary of Recommended Data

2.1

Worldwide Construction Failure Risks

Table 2.1 outlines the Construction damage risks worldwide, where ‘Construction’ is defined as set out in Section 1.2. Table 2.1 Construction Dam age Risks: W orldwide Risk of all types of damage Risk of Severe/Significant damage Risk of Total Loss

2.2

-3

6.5 × 10 per unit constructed -3 3.1 × 10 per unit constructed -4 3.6 × 10 per unit constructed

North Sea Construction Failure Frequencies

Table 2.2 outlines the Construction damage risks in the North Sea, where ‘Construction’ is defined as set out in Section 1.2. Table 2.2 Construction Dam age Risks: North Sea Risk of all types of damage Risk of Severe/Significant damage Risk of Total Loss

-2

6.9 × 10 per unit constructed -2 3.6 × 10 per unit constructed -3 2.0 × 10 per unit constructed

The North Sea damage risks are around 10 times higher than the Worldwide data (Section 3.1 explains this).

2.3

Fatal Accident Rate (FAR) data

The best available FAR data for fabrication, construction and installation activities are those extracted from OGP’s Safety Performance Indicator reports for 2006 and 2007 ([4],[6]). Based on specific construction activity safety data collected in these years, the following FARs have been calculated: • •

2006: 2.63 2007: 2.33

The data have not been split to yield any onshore/offshore specific FAR or Company/contractor FAR as applied to many other breakdowns within [4]. The limited 2 year data collection/ analysis period does not allow for 3 or 5 year rolling bases which offer a stronger (less uncertain) measure of the FAR. Note the reader should be aware of the variation in OGP member company reporting from year to year as this can give rise to some uncertainty on the overall values.

©OGP

3

RADD – Construction risk for offshore units

3.0

Guidance on use of data

3.1

General validity

The risk values given in Sections 2.1 and 2.2 are applicable to the offshore oil and gas industry worldwide and specifically in the North Sea. However, it is recommended that failure risk data to be used on particular studies are localised to the country where the unit will be deployed as there are variations and trends on the risks calculated, as can be seen comparing the worldwide and NS data (Table 2.1 and Table 2.2). The worldwide data are dominated by the fixed installations in US GoM. These are historically smaller and simpler than North Sea installations and this is likely to be reflected in the risks. Therefore the Worldwide data is considered appropriate to represent the construction risk for simple installations in shallow water. For large integrated installations in deeper water (including those in deeper water in the GoM) the North Sea data are representative of the risks as there is much more material and overall construction activity involved. The risks reflect incidents that have arisen mainly in the ‘under construction’ phase within WOAD, and do not address the reverse construction / decommissioning risks. Note there is a small category of events listed under “scrapping” category within WOAD, most of which relate to idle units having problems, rather than true decommissioning/ deconstruction activity. Conservatively, as there has been no serious deconstruction events noted to date despite such activities occurring, construction phase risks could be applied to deconstruction activities which are becoming more common.

3.2

Contributors to Severe/Significant or Total Loss Incidents

The failure risk data presented in section 2.1 and 2.2 relate to the frequency of overall system failures rather than component failures. Failure data at system level are most useful for a “first pass” QRA, with the function of gauging the overall risk level and estimating the relative contribution of specific activities. By review of the actual incident reports detailed in Table 4.3 to Table 4.6 inclusive, the following hazard types are prevalent: • • • • • •

Dropped objects Mooring failures Dynamic positioning failures Floating unit collisions with installations Ballasting failures Weather window forecasting failures.

A detailed causal analysis of failures when under construction has not been attempted although the raw incident reports will allow users to interpret causes if desired.

3.3

Uncertainties

In some cases the exposure data available makes no distinction between unit categories e.g. for Monohull units there is no distinction between FPSO and FSU. The same situation occurs for WOAD exposure data for fixed units. [2] provides a summary of exposure data used to calculate worldwide structural failure accident frequencies.

4

©OGP

RADD – Construction risk for offshore units

Hence, by making no distinction in the exposure data the calculated frequency may be overestimated or underestimated for FSPO, FSU and Fixed units within WOAD.

4.0

Review of data sources

4.1

Construction Incident frequency

The principal source of the data presented in Section 2.1 is the data from WOAD for the period 1980-2005 [1] and the HSE [7],[8] for 1980-2005. Databases available worldwide were thoroughly reviewed and interrogated appropriately in producing these sources. It is therefore believed that they are reasonably complete in recording accidents and incidents worldwide and on the NS for offshore units. These statistics are based on the numbers of incidents evident within WOAD software v5.1 and the exposure data (number of unit years) [2],[7],[8]. Accident data used cover the time period from 1980 to 2005 as this is the basis of the exposure data.

4.1.1

Historical Frequencies of Incidents

This section gives a historical picture of all incidents, including their severity during the fabrication, construction and installation phases of offshore projects. The review is limited to offshore incidents due to the accessibility of relevant accident/incident records. Incidents from WOAD, satisfying following criteria were used for the analysis: • •

installation type - concrete, jacket, FPSO/FSU, and TLP operation mode - under construction

Examinations of the records found the majority did not occur in the phases as defined by this data sheet. In WOAD, “construction” can cover temporary work on the platform at any point in its lifecycle. Therefore it was necessary to review each entry to find relevant incidents. It was also found not to be possible to differentiate with confidence between the fabrication or construction phases of a project. Overall estimates of incident/accident frequencies for all phases are given in Table 4.1 along with the assumptions underlying the estimates. The relevant entries from WOAD are listed in Table 4.2 to Table 4.5 in Section 4.1.2. Table 4.2 details a breakdown on the severity of each of the events on a worldwide and North Sea Basis, used to determine the frequency of severe/significant and total failure frequencies outlined in Table 2.1 and Table 2.2.

©OGP

5

RADD – Construction risk for offshore units

Table 4.1 Sum m ary of W OAD search [4] Fixed units

Number of reported incidents (in WOAD)

Concrete Jacket FPSO/ FSU TLP TOTAL

WW 13 36 2 3 54

NS 13 17 2 2 34

Estimated population (units constructed) (1,2) WW NS n/a 41 8201 425 77 21 13 3 8291 490

Estimated risk of incident/unit constructed WW NS n/a 0.32 0.004 0.04 0.026 0.095 0.23 0.67 0.0065 0.069

Note 1 Assumption of total fixed installation World wide: For the period 1970 – 1995, total number of fixed installations 6515 (100% Jacket) For the period 1996 – 2005, total number of fixed installations 1686 (100% Jacket) There are few concrete installations outside the North Sea (Hibernia, Sakhalin (Lun-A, PA-B, Molipak), at least 3 off Australia), none of which feature in the WOAD search, and as they are less than 1% of the overall population they are excluded as negligible. Note 2 Assumption of total fixed installation in North Sea: For the period 1970 – 1995, total number of fixed installations 360 (10% concrete and 90% Jacket) For the period 1996 – 2005, total number of fixed installations 106 (5% concrete and 95% Jacket)

Table 4.2 Incident Severity Fixed installations Concrete WW Concrete NS Jacket WW Jacket NS FPSO/ FSU WW FPSO/FSU NS TLP WW TLP NS

4.1.2

Incident Severity No. of Event s 13 13 36 17 2 2 3 2

Insignifica nt/ no damage 6 6 9 3 2 2 0 0

Minor

Severe

Significa nt

Total Loss

1 1 6 2 0 0 1 1

1 1 10 5 0 0 1 0

4 4 9 7 0 0 1 1

1 1 2 0 0 0 0 0

WOAD Accident Reports

Table 4.3 to Table 4.6 detail the construction incident descriptions for the 4 fixed installation categories within WOAD [1] for the period up to February 2009.

6

©OGP

RADD – Construction risk for offshore units

Table 4.3 Concrete Facility Under Construction Incidents [1] Accident Date

Unit Name

Description

15-May-96

BRENT,211/29,C

12-Aug-95

TROLL,31/6

15-Apr-95

TROLL,31/6,A

09-Aug-92

SLEIPNER,15/9,A2

14-May-92

SLEIPNER,15/9,A2

23-Aug-91

SLEIPNER,15/9,A1

08-Nov-85

GULLFAKS,34/10,A

04-Nov-85

GULLFAKS,34/10,B

27-Aug-84

FRIGG,25/1,TCP2

25-Feb-78

STATFJORD,33/9A,A

06-Oct-76

NINIAN NORTH,3/3,CENTRAL

The new derrick of the platform drilling rig for the Brent C platform was being transported from Bergen in Norway to the UK on Heerema's derrick barge "DB 102" when the derrick struck a bridge causing damage to the upper section of the derrick. The platform rig was returned to Consafe's Burntisland yard for repairs. An investigation into the accident was initiated. The incident was not expected to delay the re-development of the Brent field. A similar accident occurred in August (see accident in Table 4.4 dated 04-Aug-96 to unit in CAPTAIN field). Smoke developed in a firewater pump located in the seawater shaft. No persons were in the shaft at that moment. No further information available. During installation of scaffolding below the deck, a worker fell overboard and 20 m down into the sea and was quickly recovered. The worker was in shock and taken to hospital. A fire occurred in a 440 V emergency switchboard. The fire will not hamper the completion of the platform. The replacements and repair work should be completed mid September. The Aker Verdal yard experienced a construction accident during assembly of the platform jacket. The accident occurred during roll-up and lifting of the upper part of the "row 2" jacket frame (weight 700 tons). One of the two lift slings parted and the frame leaned slowly over and stopped at a 45 deg. Angle without hitting "row 1". No injuries or damage. Water intrusion into one of the drillshafts caused the sinking of the 600,000 tons concrete base of Sleipner 'a' platform. 22 workers onboard were evacuated when the water flooding started. 15 mins later the base sank in water 200 m deep. The base was crushed against the sea bottom and destroyed. Investigations have revealed that the concrete base in some places were underdesigned and hence not able to support the exposed loads. Three separate mistakes led to the sinking: 1: design forces in cracked areas were underestimated; 2: reinforcing steel in those areas was incorrectly designed; 3: some joints were not separately designed. The accident may delay startup of the Sleipner field and it would take approx. 12-15 months to build a new gravity base structure. Insurance claims worth 2.3 billion NOK arising from the loss of the platform were settled in October 1993. This sum covers a new base structure, outfitting lost with the original, the cost of temporarily storing the topsides and additional hook-up work. The amount will be covered by insurance companies Vesta (Norway) and Lloyd's of London. Steel shock absorbers between the 41.000 ton deck and the legs failed and the deck started tilting. The deck was evacuated. The deck was raised 0.02 m during a 10 hour successful jackup operation Nov.11 and the shock absorbers were replaced by steel plates so that weight was evenly distributed on the four legs. Work was then resumed. The barge 'concem' was offloading cement into the platform Gullfaks C during slipforming when barge capsized and sank (ref accident id. No 8601100). The barge's 10m high construction tower struck platform and containers on barge's deck clipped side of platform base and caused damage to riser supports. Additional damage resulted from power failure which affected slipforming equipment on platform. A gas leak occurred due to a failure of the bolts of the upper isolating valve of the standpipe for LSH on glycol contactor CV2C. Standpipe and isolating valves were removed and nozzles blinded. Cause seems to be that bolts were overstressed due to misaligned supporting and inaccurate tightening of bolts. During installation of platform four workers were doing welding and grinding at the 49.5 m level of the utility shaft. A liquid surface was 2 m below the workers. Protective coating was added to the water from time to time. Diesel was trapped on top of the surface. Probably due to breakage of acetylene hose a sudden fire ignited the diesel and heavy smoke and fire developed. Air hose to grinding tool was probably melted and escaping air fed the fire. Escape stair tube behaved as a chimney with high flame intensity. 2 men tried to escape by elevator, but this stopped probably due to optical endstop switches activated by heavy smoke. One man was found in the control room, an other at the 49.5 m deck. The only man wearing a breathing apparatus was found at 55.5 m deck with only the last 5 min emergency air left. The smoke divers were forced back at the 61.5 m level due to the strong heat. Water from hoses and deluge system cooled down heat and the fire was under control after about 2 hours. The concrete batching plants barges "no. 3" and "no. 4" and generator barge "h.d. barge no. 3" ranged against fendering of the partly constructed platform. The platform suffered damage to temporary installed anti-scouring fenderings and water ingress. No further info available. ©OGP

7

RADD – Construction risk for offshore units 22-Mar-76

FRIGG,10/1,CPD1

15-Mar-99

TROLL,31/2,C

The fire blaze broke out at the base of the towers of the structures about 40 ft from the water level. The fire was extinguished after one hour. About 10 square metres of concrete was damaged into a thickness of one inch. The incident occurred during pressure testing of the of the Troll C platform structure before connection of deck and hull. Main parts of the hull (including pipe shafts in columns) is filled with water and in order to ensure watertight penetrations for electric-, instrument-, power- and hydraulic cables and pipes "Brattberger connections" are used. The day after the test immersion started, leaks occurred between pipe shaft and pump room in column g 20 and between pipe shaft and stairwell in column g 10. The ballasting operation was stopped immediately and the pump room and the stairwell was de-ballasted, flushed with fresh water and dried out with hot air. Both leaks were caused by leaking "Brattberger connections". The Brattberger connection in the pump room (mct rgsr) was designed for a hydrostatic pressure of 4 bar and started leaking at a water depth of 31.4 m. The supplier (Nortelco) found the cause to be wrong packing of the connection. The Brattberger connection in the stairwell (mct rgpm 100) was design for a hydrostatic pressure of 1.8 bar and started leaking at a waterdepth between 13.2 and 18.2 m. The cause of the leak was that the maximum hydrostatic pressure the connection was designed for had been reached. - it was concluded that an unsuitable connection was installed since this connection will not be capable of handling an unforeseen immersing. Corrective actions taken: all Brattberger connections installed below el. 15.0 m were checked by supplier. All Brattberger connections between pipe shaft and pump room (rgsr) were opened and re-packed. 8 Brattberger connections of type RGPO 100 towards pipe shaft in columns g10 and g20 were replaced with Brattberger connections of type RGPM 100 which are designed for a hydrostatic pressure of 15 bar. All other Brattberger connections of type RGPO was reinforced by use of flat bar welded to both sides of the bulkhead. All work was controlled, checked out and approved by Nortelco AS. When the test immersion was restarted, small leaks from 3 Brattberger connections were discovered. The pipe shafts was de-ballasted and the connections re-packed under control and approval of Nortelco. More information available in archive.

Table 4.4 Steel Jacket Under Construction Incidents [1]

8

Accident Date

Unit Name

Description

15-Mar-00

VERMILION,267

03-Dec-98

PETRONIUS

17-Jul-98

MAIN PASS,65/B

17-Nov-77

HEATHER,2/5,A

While derrick barge 'Southern Hercules' was attempting to load the 390-ton vermilion 267 platform deck onto a materials barge in the bayou black channel at the ocean marine facility in Gibson la., the load dropped. The derrick barge's jib broke away from the boom during the lifting operation. The derrick barge suffered minor damage to hull and boom. It was not revealed any damage to deck and no delays to first production was expected. The cause of failure was to be investigated. The accident is also recorded on the derrick barge, see accident id. No. 0004060. The platform was under construction when a 72 million usd worth 3800-ton south deck module dropped to the seabottom at 2230 hrs as it was being installed onto the deepwater compliant tower platform. The module was being lifted by derrick barge "db 50" when a lifting line parted. The module struck a transport barge being alongside as well as the "db50" before falling to the seafloor in 1754 ft waters. The deck, the second of two modules that were to be pieced together into one unit, held the crew quarters, waterflood facilities and production equipment. It was decided that the module would not be retrieved since it did not pose any threat to the environment or to navigation. In may 1999, the go-ahead for building a new module was given. The Nabors offshore drilling platform rig "t-269" was being installed on the 100-ft platform when the rig partially collapsed over the platform (with approx. 70 people onboard) and several sections of the rig fell overboard. However, the largest part of the rig remained intact. The platform was in the final stage of construction when the accident occurred. The rig and heavy drilling set-up were being constructed on top of the platform. When the work was finished there would have been a towering derrick typical of those that drill older fields. Crews were unloading components to the "sub-structure" (supporting the derrick) from a barge to large rails on the platform. Pumping equipment, tanks, electrical components and generator were in place when the accident occurred. The rig split in two sections of which one fell overboard and onto a neighbouring barge. Three workers were killed and 12 persons were injured. Fishing vessels in the area pulled floating workers from the waters and the injured persons were taken to hospital by helicopters and by boats. Two of the dead workers were crushed by the collapse of steel rigging and walkways as the drilling portion of the rig fell. In wind NNE 45 knots and 40 feet waves, a 24" pipe, 50ft long, 8 tons, sealed in both ends and floating, broke loose.

©OGP

RADD – Construction risk for offshore units 28-Dec-92

BRUCE,9/8A,PUQ

04-Aug-96

CAPTAIN,13/22A,WPP A

10-Sep-94

FRÏY,25/5

21-Jan-94

GUNESHLI FIELD PLATFORM

27-Oct-93

GRAND ISLE,102

15-Nov-92

BRUCE,9/8A,D

15-Oct-92

GOODWYN A

25-Aug-92

BRUCE,9/8A,PUQ

13-Jan-92

BRUCE,9/8A,D

15-Aug-90

OSEBERG 2,30/6,C

06-Mar-88

OSEBERG,30/9,B

17-May-87

LOGGS GGS,ACCOMODATION

14-Jul-86

CHEVRON JACKET UNKNOWN

Two persons were working on the scaffolding underneath the platform, some 70 ft above the sea, when the scaffolding suddenly collapsed. The incident occurred when they pulled equipment on to the scaffolding. One person fell straight into the icy sea, while the other was trapped by his legs and struggled to free them before he let himself into the sea. Fortunately, none of them suffered injuries apart from shock. Despite not wearing life jackets, both managed to swim to the platform legs within two mins and climb up the ladders before "zodiac" rescue boats were launched and reached the spot. During towout of the platform (transport on barge) from the Clydebank yard of UIE Scotland, it collided with the Erskine road bridge (aadt=18000) in the river Clyde, causing damage to the platform's drilling rig and closing of all traffic on the bridge such that engineers assessed the extent of damage. It will probably remain closed to end-august and for heavy vehicles to the end of '96. Reports indicate that the accident may have been caused by a miscalculation of clearances, which failed to take account of the height of the barge being used. Platform repairs were carried out offshore. There may be raised claims by road transport firms to compensate for extra costs due to the closing of the bridge. This was the second such accident within short time, see accident in Table 4.3 dated 15-May-96 to BRENT C. During cutting of riser pipe, a sheen of oil in the pipe ignited causing a fire. A fire blanket was used to put out the fire. The oil was left in the pipe after flushing during construction. The platform capsized and sank during bad weather. The recently installed drilling platform was designed to withstand winds up to 42 m/s. No injuries and no oil was spilled. No decision has been made yet on whether the platform will be salvaged. The platform took over 7 years to build and will cost tens of millions of dollars to replace. No further information available. During installation the platform jacket toppled. Certain problems with the jacket's mud mats and inclement weather were encountered during the installation. The jacket is being surveyed for damage. It is expected that the jacket will be salvaged and reinstalled after being repaired at the fabrication yard of "gulf island fabrication" in Houma. During offshore commissioning it was discovered that someone seriously had tampered with electrical cables and pipework in platform's drilling modules. The defects were corrected and the platform's hookup schedule was not affected. The platform is under construction at the Eiffel yard in Marseilles. The Bruce field is scheduled to commence commercial production in spring 1993. During installation of the platform, the pile foundations (20 off, 130 m long), which should secure the platform to the sea floor, were damaged. After sinking through a soft layer of sand, the piles were supposed to pierce into a thin layer of rock before sinking further into bedrock. However, the piles did not pierce neatly through and were bent and buckled approximately 86 m below the sea bed. A programme aimed at repairing the piles was started immediately so that the topsides installation, hook-up and commissioning could proceed. Initial production is set to October 1994, one year later than expected. A fire occurred on the south-east leg of the platform at 0856 hrs. The fire is believed to have caused by a gas burner pre-heater. Helicopters were scrambled and the platform was downmanned from 34 to 16. M tug/supply vessel "Maersk Rover" (standby vessel for the "beryl a" platform), was put on readiness to assist in fire-fighting if required. Rescue operations terminated at 0930 hrs. The fire was reported put out at 0920 hrs. An explosion occurred to the drilling platform under construction at the Eiffel yard at St Louis du Rhone near Fos (Marseille). The explosion occurred in one of the mud tanks. It is speculated that inflammable gas built up in the tank during the weekend and was ignited when normal construction activities restarted Monday morning. The walls of the module and the scaffolding were hit by the blast. Bp states that the accident will not affect the schedule for the project. During piling of the platform, brace no. 7015 was dented. The damage does not affect platform integrity in the period until installation of modules in spring 1991. Corrective actions have been taken. West German submarine U27 collided with the Oseberg B platform. Personnel were evacuated to the hotel platform "Polyconfidence" which is linked to the platform with a gangway. A later survey found that a crossmember with diameter of 1.2 m had been dented to a depth of about 20 cm. The repair costs will probably reach several million dollars. The submarine was navigating approx. 20 m below the surface. The platform was marked on the map, but no signals from the sonar were received. The submarine sustained damage to bow, bridge and navigation equipment. No injuries. One of the newest offshore platforms may have to be cut from the seabed by explosive charges. During piling work severe vibrations caused damage to the jacket. The pile-driving equipment broke down. A substitute pile-driver proved to be too powerful for the piles needed. The platform installed by Brown&Root tipped over while the structure was being set. The incident was believed to be caused by a hole left in the seafloor where the drilling rig had been. The jacket was uprighted and there was no damage.

©OGP

9

RADD – Construction risk for offshore units

10

26-Jun-86

HARRIET,B

07-Jun-86

ZELDA/E

04-Dec-85

PNT ARGUELLO 316,HERMOSA

09-Jun-82 01-Apr-82

NORTH RANKIN,A MAGNUS,211/12,PRODUCTION

25-Feb-82 15-Jul-81

TYRA,5504/6.2,TE-E VALHALL,2/8A,PCP

16-Aug-80

PLATFORM SA

17-Apr-80 11-Jan-80

PLATFORM SA PLATFORM SA

01-Jun-77

HEATHER,2/5,A

18-Nov-76 29-Aug-75 12-Mar-75

NINIAN SOUTH,3/8A AUK,30/16,A UNKNOWN,TRINIDAD JACKET

25-Oct-74

FRIGG,10/1,DP1

06-Jun-74 05-Feb-73

SAMAAN EKOFISK,2/4,A

09-Oct-70 04-May-04

AGOSTINO South Pars platform, SPP1

The deck structure of Harriet B tilted approx. 20 deg. On barge Intermac 256. Towed to shallow water for safety. The barge's deck received some holes. Salvage required a giant derrick barge and salve cost estimated to 1mill usd. Value of monopod cargo of 350 tonnes is 4mill usd. Diving/work barge "Satyra Tirta" had accidental contact with the platform. No damage to the platform is reported, but the vessel got its port side shell plating torn open in way of fuel tank and store room associated distortion to internal crop etc. Later inspection showed flooding of winchroom and wetting of electrical cables. Jacket contacted lock in panama canal during voyage from Morgan City to Port Hueneme loaded on barge "450-10". One gantry crane needs to be renewed, two turbo generator casings reconditioned and partly renewed, 2 sets of electric conduits and one air winch clutch renewed. Repairs deferred. Damage to valve removal track during launching. Installation of the 40000 tonne structure halted because several steel piles fell off the structure altering the balance of the structure. The piles were needed to secure it to the seabed. The piles were discovered 100 yards clear of the platform target location. The oil platform was finally sited on the Magnus field Apr 4. Damage to jacket due to storm during tow out. During installation of the jacket in July 1981, a pile hammer was accidently dropped on the east side of the jacket. An investigation survey by use of ROV showed no damage to jacket structure. During an annual underwater insp. In June 85,a puncture in the subject diagonal was revealed during close visual inspection. The repair offshore is scheduled to start mid September 85. Accident occurred when deck was lifted from barge to place it onto the jacket. There were two unsuccessful attempts, and in each attempt the ropes gave way resulting in damage to the barge in the first and to the deck in the second. Repairs will be handled locally. Jacket fell into sea while being fitted onto leg of rig. See also accident 11-Jan-1980. The jacket of the "platform SA" sank while it was launched at Bombay high oilfield. Mishap probably due to a leakage in the compressor system at the time of the mechanical launching. Jacket was salvaged with the help of cranes and divers and was then installed at the site. Suffered damage during piling operation when a steel pile was accidentally dropped, striking one of the "bottle" legs and fracturing pile sleeves. Production delayed probably six months (to February 1978). External corrosion was discovered on an import riser pipe. One of three flow- lines has to be replaced. Visibility below 50 yards. Collision with supply vessel. Production delayed for 3 weeks. Jacket on barge '299'. Delivery to Amoco Trinidad Oil Co.. During launching, the jacket slipped off the barge and subsequently floated in an angular position. Platform was to be launched in sheltered water due to prolonging storm. It was under way to be installed when interrupted by storm. Location: the elf/total group at the 'Frigg' gas field. The buoyancy tanks failed as the platform was tilted from a horizontal to a vertical position about 3 km from the installation site. A new 20 mill usd platform is under construction. Field production delayed about one year. Platform was refloated July 7 1975. Will be used for other purposes. Barge 'MM 151' transporting platform overturned and sank. No attempts to recover jacket. Half the deck section dropped into the water. The wire broke while lifting the deck section from the building site to the pontoon for transport to Ekofisk. Repaired March 22, expected cost: several million NOK. Ready for use when found inclined. Submerged part of support columns reinforced by further internal piles. A man was killed while working on the installation of the jacket for one of the gas platforms for the South Pars field off Iran. The accident happened when the piles were being loaded from a barge to the Stanislav Yudin crane ship. Both Statoil and seaway heavy lifting have appointed internal commissions of inquiry to find the cause of the accident. Statoil is operator for the development of the offshore part of phases six, seven and eight. The deceased was contracted for construction and installation of the jackets for the gas platforms. No more information available.

©OGP

RADD – Construction risk for offshore units

Table 4.5 FPSO/FSU Under Construction Incidents [1] Accident Date

Unit Name

Description

27-Dec-98

JOTUN,25/7,FPSO

30-Jan-99

JOTUN,25/7,FPSO

Jotun B was undergoing hook up/commissioning activities when the incident occurred. No production or drilling activities was performed. A hydraulic oil leak in the east fire pump was detected and thought to be a maintenance issue initially but pulling of the pump was found to be required. 300 - 400 l of oil was lost within the pump caisson. All hot work in connection with the hookup was suspended. The repair period was estimated to 2-3 days. No more information available The incident occurred in platform hook-up and commissioning phase. Two smoke detectors in room 108, 1st floor, living quarters detected gas. All personnel were mustered. Site inspection showed that smoke was still present in the room and the initial investigation showed that the feeder within a switchboard had short circuited resulting in damage to the bars and surrounding insulation supports. No injuries to personnel. No more information available.

Table 4.6 TLP Under Construction Incidents [1] Accident Date

Unit Name

Description

04-May-95

HEIDRUN,6507/7,TLP

23-Jun-89

GREEN CANYON,184

01-Nov-82

HUTTON,211/28,TLP

During towout of tension leg no. 2 to the Heidrun field, the clamps for the pontoons broke and the leg sank in 240 m waters at position N 64.37.5 and E 08.03.7. The leg has been located and is lying flat on the seabed. The operator plans to salvage the leg. No further information available. Four of the structure's tendons sank while enroute to installation site. Cause is being investigated, but rests of the tropical storm allison may have accelerated the sinking. Installation was carried out without the four tendons. Production would not begin until the four missing ones were installed. Estimated startup of production was second week in November. Cracks in steelwork for the Hutton field prod. Platf. Built at Nigg bay on the Cromarty Firth. The cracks are so widespread that large sections may have to be scrapped. However, Conoco might be able to repair cracked sections.

©OGP

11

RADD – Construction risk for offshore units

4.2

FAR data

4.2.1

OGP FAR Data

As at the date of preparation of this datasheet, [6] is the source for the recommended FAR data, replacing all other FAR data provided in the original E&P Forum datasheet. However, users of these data are advised to consult the most up-to-date annual OGP Safety performance indicators reports as they become available. Though limited in recording period, this is considered to offer a modern, stronger insight into construction FAR than many other sources. Other data sources have been reviewed to identify alternative or more extensive FAR analysis. The UK HSE publishes annual statistic reports (Offshore Injury, Ill Health, and Incident Statistics) and it is noted that the Maintenance/Construction category in these offers the closest match to the Construction category as defined in this datasheet. For 2007/2008, the Maintenance/Construction category contributed 72 incidents, or 37.5% of all the incidents and also had the most major injuries (13 incidents, or 29.5%). In 2006/2007 [10] the equivalent values were 2 fatal incidents (2 fatalities) (100% of total), 15 major (39% of total) and 60 severe (38% of total). The HSE data does not present a FAR breakdown for the Maintenance/Construction category. In overall terms a single FAR value per annum, or on a rolling basis is not provided. The HSE data combines fatal and major injury data in presenting 3-year rolling results. The OGP data [4],[6] have been analysed in more detail to determine if further breakdown of the reported Construction FAR is feasible. The OGP report presents a breakdown of the overall annual FAR, with further breakdown for onshore/offshore and contractor/ company personnel. Though not accurate, some estimate of onshore and offshore Construction FAR could be determined from the reported data. •

From 2006 data ([4]) the overall FAR was 3.92, with 4.64 applicable onshore and 1.58 offshore.

•

From 2007 data ([6]) the overall FAR was 3, with 3.0 applicable onshore and 2.9 offshore.

Offshore FAR contributions increased in 2007, with the capsize of the Bourbon Dolphin which claimed 8 lives. The 2-year average onshore overall FAR allocation is 3.82 ((4.64+3.0)/2) and the offshore overall FAR is 2.24 ((1.54+2.9)/2). Continued collection of OGP data will enable better 3and 5-year rolling average estimates to be made in the future. The overall average Construction FAR for 2006 was 2.63 ([4], p63) and that for 2007 was 2.33 ([6], p62) If the overall average FAR ratios are applied to the Construction FAR, the following approximate average Onshore and Offshore Construction FAR are determined. • • • •

Average construction FAR (2 year average) = (2.63+2.33)/2) Average overall FAR (2 year average) (= (3.92+3.0)/2) Onshore average construction FAR = 3.82/3.46 × 2.48 Offshore average construction FAR = 2.24/3.46 × 2.48

= 2.48 = 3.46 = 2.74 = 1.60

The onshore and offshore average construction FAR values are considered approximate; analysis of the actual detail of the OGP electronic database will yield more accurate values.

12

©OGP

RADD – Construction risk for offshore units

The finding that the onshore construction FAR is higher than the offshore construction FAR overturns the previous E&P Forum datasheet which postulated that the offshore FAR was higher.

4.2.2

Comparison with other industries

Comparing overall FARs with other industries as detailed in the original E&P Forum datasheet is no longer seen as offering significant value and has not been included. The OGP now has a wealth of data where it is possible to analyse data by geography, operation/activity type and incident severity along with trending. This is of much greater value than comparison with other industries.

4.2.3

Construction FAR breakdown by Region

It is conceivable that the OGP database enables this, although no attempts have been made to postulate this using mathematical manipulation of the reported data.

4.2.4

Norwegian Construction Data

The average frequency of fatalities for the period 2001 up to and including the first half of 2008 on the UK Continental Shelf is 2.9 per 100 million manhours against 1.2 on the Norwegian Continental Shelf [11] (Page 30). However the report does not lend itself to any interpretation of the contributions stemming from construction activity and reference to the old data presented in the E&P Forum Construction datasheet is now considered to be significantly out of date (very high values) and should be avoided.

5.0

Recommended data sources for further information

Country-specific accidents and incidents data bases may be interrogated depending on the area that the installation will be deployed. As a starting point WOAD is a reliable source of information that can be interrogated in a variety of ways. There are more sources of data including, but not limited to, the HSE in the United Kingdom, the Occupational Safety & Health Administration (OSHA) in the United States of America, and the Petroleum Services Authority (Norway) and the increasingly valuable annual OGP reports which do illustrate a breakdown along regional lines on some of their construction statistics, e.g. Lost Time Injury Frequency but not on their FAR values.

©OGP

13

RADD – Construction risk for offshore units

6.0

References

[1]

DNV, 2009. Worldwide Offshore Accident Databank (WOAD), v5.2. Search: February 2009. [2] DNV, 2004. Exposure Data for Offshore Installations 1980-2002, Technical Note 22, DNV internal documentation. [3] UK Health & Safety Executive, 1996. The Offshore Installations and Wells (Design & Construction, etc) Regulations, 1996. [4] OGP, 2007. Safety performance indicators - 2006 data, OGP report no. 391. [5] Trbojevic V.M., Bellamy L.J., Brabazon P.G., Gudmestad T., Rettedal W.K., 1994. Methodology for the analysis of risks during the construction and installation phases of an offshore platform, J Loss Prev. Process Ind., 1994 Vol 7(No 4). [6] OGP, 2008. Safety performance indicators - 2007 data, OGP report no. 409. noting erratum for FAR corrected in OGP Report 419 [7] DNV, 2007a. Accident statistics for fixed offshore units on the UK Continental Shelf 1980-2005, HSE Research Report RR566, Sudbury, Suffolk: HSE Books. (http://www.hse.gov.uk/research/rrhtm/rr566.htm) [8] DNV, 2007b. Accident statistics for floating offshore units on the UK Continental Shelf 1980-2005, HSE Research Report RR567, Sudbury, Suffolk: HSE Books. (http://www.hse.gov.uk/research/rrhtm/rr567.htm) [9] HSE, 2008. Offshore Injury, Ill Health, and Incident Statistics 2007/2008, HID Statistics Report HSR 2008 - 1, Sudbury, Suffolk: HSE Books. (http://www.hse.gov.uk/offshore/statistics/hsr0708.pdf) [10] HSE, 2007. Offshore Injury, Ill Health, and Incident Statistics, 2006/2007, HID Statistics Report HSR 2007 - 1, Sudbury, Suffolk: HSE Books. (http://www.hse.gov.uk/offshore/statistics/hsr0607.pdf) [11] Petroleum Safety Authority Norway, 2009. Trends in Risk Level in the Petroleum Industry – Summary Report Norwegian Continental Shelf 2008. http://www.ptil.no/getfile.php/PDF/RNNP%20sam%20eng%2008.%20til%20nettet.pd f

14

©OGP

Risk Assessment Data Directory Report No. 434 – 19 March 2010

Evacuation, escape & rescue International Association of Oil & Gas Producers

RADD – Evacuation, escape & rescue

Contents 1.0 1.1 1.2

Scope and Definitions ........................................................... 1 Scope ............................................................................................................... 1 Definitions ....................................................................................................... 1

2.0 2.1

Summary of Recommended Methods and Data ....................... 2 Recommended Methods ................................................................................ 2

2.1.1 2.1.2 2.1.3 2.1.4 2.1.5 2.1.6 2.1.7 2.1.8 2.1.9 2.1.10

Application.................................................................................................................. 2 Generic Stages of EER .............................................................................................. 3 Evacuation Decision and its influence on EER Analysis ....................................... 6 Helicopter Evacuation................................................................................................ 7 TEMPSC Evacuation .................................................................................................. 7 Times and Failures Modes of Lifeboat Evacuation................................................. 7 Activity Undertaken to Improve TEMPSC Evacuation ............................................ 8 Bridge-Link Evacuation ............................................................................................. 9 Escape to Sea ............................................................................................................. 9 Rescue and Recovery ................................................................................................ 9

2.2

Recommended Data ..................................................................................... 10

2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7

Availability of Escape Routes to Muster Areas ..................................................... 10 Lifeboat Embarkation............................................................................................... 11 Lifeboat Evacuation ................................................................................................. 11 Frequency of Installation Evacuation..................................................................... 12 Probability of Evacuation Success......................................................................... 12 Escape by Sea Entry ................................................................................................ 13 Operability of Evacuation and Escape Methods under Various Accident Circumstances.......................................................................................................... 13 Survival Times in Water........................................................................................... 15

2.2.8

3.0 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9

Guidance on Use of Data ..................................................... 15 Availability of Escape Routes to Muster Areas.......................................... 15 Lifeboat Embarkation ................................................................................... 15 Lifeboat Evacuation...................................................................................... 16 Frequency of Installation Evacuation ......................................................... 16 Probability of Evacuation Success ............................................................. 16 Escape by Sea Entry..................................................................................... 16 Operability of Evacuation and Escape Method under Various Accident Circumstances .............................................................................................. 16 Survival Times in Water ............................................................................... 16 Development of Offshore EER Arrangements ........................................... 17

3.9.1

Post PFEER Activity in the UK in Relation to Evacuation, Escape and Rescue 17

4.0

Review of Data Sources ....................................................... 19

5.0

Recommended Data Sources for Further Information ........... 19

6.0

References .......................................................................... 20

©OGP

RADD – Evacuation, escape & rescue

Abbreviations: ARRC DC DoE EPIRB EER ERP ERRV ERRVA FRC GEMEVAC H 2S HSE NPD OIM OREDA OSC PFEER PLB POB QRA SAR SBV TEMPSC UKCS

Autonomous Rescue and Recovery Craft Daughter Craft (UK) Department of Energy (no longer exists as such) Emergency Position Indicating Radio Beacon Evacuation, Escape and Rescue Emergency Response Plan Emergency Response and Rescue Vessel Emergency Response and Rescue Vessel Association Fast Rescue Craft Trade Name for Gondola System for Hibernia Hydrogen Sulphide (UK) Health and Safety Executive Norway Petroleum Directorate Offshore Installation Manager Offshore Reliability Data On-Scene Commander Prevention of Fire and Explosion, and Emergency Response Personal Locator Beacon People on Board Quantitative Risk Assessment Search And Rescue Standby Vessel Totally Enclosed Motor Propelled Survival Craft United Kingdom Continental Shelf

©OGP

RADD – Evacuation, escape & rescue

1.0

Scope and Definitions

1.1

Scope

This data sheet provides Quantitative Risk Assessment (QRA) data and guidance for Evacuation, Escape and Rescue (EER) from offshore installations as this has the potential to be more significant in personnel risk terms compared to onshore installations. Total evacuations of installations are rare events and each has very different circumstances. Thus, data relating to real EER events are sparse and QRA tends to rely on detailed analysis of escalation scenarios and EER activities within each scenario. This datasheet contains a number of example data rule sets and general guidance for EER analysis. Assuming personnel have survived the initial events, personnel EER from onshore facilities tends to be less complex and of inherently lower risk. Qualitative analysis, geared towards provision of suitable escape routes and appropriate rescue and medical contingency planning, will normally be adequate. On some onshore facilities the provisions of temporary shelters are required for sheltering from certain toxic gas releases e.g. H2S. In addition some emergency procedures are required for remote onshore facilities such as being overdue in desert, cold climate and jungle environments. The data presented is for North Sea and the user should seek local legislation for guidance. It is noted that maintenance activities on Totally Enclosed Motor Propelled Survival Craft (TEMPSC) in particular have been a source of risk. QRAs do not typically distinguish this risk as part of EER analysis but take account of maintenance risk within the general occupational risk category. Specific guidance on TEMPSC maintenance risk is provided by the UK HSE in its SADIE (Safety Alert Database Information Exchange).

1.2

Definitions

The following definitions are based on those within the UK Prevention of Fire and Explosion, and Emergency Response (PFEER) Regulations 1995 [1] . Evacuation Evacuation means the leaving of an installation and its vicinity, in an emergency, in a systematic manner and without directly entering the sea. Successful evacuation will result in persons being transferred to a place of safety, by which is meant a safe onshore location, or a safe offshore location or marine vessel with suitable facilities. Evacuation means may include helicopters, lifeboats and bridge-links. Escape Escape means the process of leaving the installation in an emergency when the evacuation system has failed; it may involve entering the sea directly and is the ‘last resort’ method of getting personnel off the installation.

©OGP

1

RADD – Evacuation, escape & rescue

Means of escape cover items which assist with descent to the sea, such as life-rafts, chute systems, ladders and individually controlled descent devices; and items in which personnel can float on reaching the sea such as throw-over liferafts. Rescue In the PFEER regulations, this is normally addressed as ‘Recovery and Rescue’. Recovery and rescue is the process of recovering of persons following their evacuation or escape from the installation, and rescuing of persons near the installation and taking such persons to a place of safety. Place of safety means an onshore or safe offshore location or vessel where medical treatment and other facilities for the care of survivors are available. The recovery and rescue arrangements are: •

Facilities and services external to the installation, such as vessels, public sector and commercially provided search and rescue facilities; and

•

Facilities on the installation such as installation-based fast rescue craft.

2.0

Summary of Recommended Methods and Data

2.1

Recommended Methods

2.1.1 Application All EER activities expose personnel to an element of risk. However, three broad classes of EER can be distinguished: •

Routine Practice. These might be organized numerous times per year at an installation to rehearse the procedures and use of the EER equipment. The timing and conditions of such activities can to a large extent be controlled so that personnel are not put at unnecessary risk. The risks stemming from routine practice are not typically documented as part of a QRA. The risks are however appreciated and the offshore and marine industries have undertaken activity to control these risks, for the offshore industry the work done by the UK Step Change in Safety group in relation to its guidance on the Loading of Lifeboats during drills [11] provides effective guidance on risk control.

•

Precautionary. For example, these might occur in the event of a drilling kick, an unignited gas leak, a drifting ship nearby, a minor structural failure or threatening platform movements in rough seas. Such an activity is not usually done under great pressure, and there have historically been few fatalities in such events.

•

Emergency. For example, these might occur in the event of an ignited blowout, leak from process equipment, a collision or a structural collapse. Such activities are usually performed with urgency. These are historically more likely to result in fatalities.

In developing predictions about the frequency of EER activities, for a given installation, influences will include, for instance, local environmental factors, the nature and extent of processing facilities, and the intrinsic hazards of the process. A multitude of variables can influence the outcome success of offshore EER activities. In particular, the weather is an important factor. Should an emergency evacuation be necessary during severe storm conditions, the risks of the EER activities are greater.

2

©OGP

RADD – Evacuation, escape & rescue

As each installation has its own unique characteristics, it is necessary to model the EER operation to give some basis for EER effectiveness. This can be done by using computer models, manual calculation methods, or a combination of these.

2.1.2 Generic Stages of EER Table 2.1 presents the stages of EER as a possible set of descriptions for use in EER analysis. Figure 2.1 provides a basic flowchart for the key stages of offshore emergency response as defined by the HSE in its guide for offshore EER HAZOP [8]. The situation may require evacuation, escape or a mix of both. The stages of an EER are complex and need to be considered with care during a risk assessment. The stages shown in Table 2.1 should be tailored for the particular installation and its potential major accident scenarios. Table 2.1 provides failure modes for evacuation but does not suggest the effects of failure. It should be recognised that the various types of failure carry different levels of risk for participants. An example is given in Section 2.2.5. Figure 2.1 Basic EER Stages

©OGP

3

RADD – Evacuation, escape & rescue

Table 2.1 Generic Stages of EER Stage + Generic Description

Typical Specific Descriptions

Possible Problems

Alarm Appreciation of an incident.

Detection system warns of an unsafe condition. Control room operator decides that there is an emergency and starts emergency procedure. Using the public address system, personnel are told that there is an emergency.

• • • • •

Detection fails. Delay (any cause). Operator error. Public Address System fails. Public Address System not heard.

Access Movement from immediate area of the hazardous condition.

Personnel become aware that they should leave their work area. They move out of the immediate area.

•

Personnel do not hear alarms and do not notice the hazard condition. Hazard condition incapacitates personnel before they can leave the area. Escape routes blocked due to hazard or other causes. Personnel ignore procedures and do not escape. Escape routes not understood by personnel. Environment within muster area not tolerable due to accident effects i.e. smoke, heat. Problems in maintaining order within muster/ refuge area

•

• • • Muster Personnel assemble in a place of refuge.

Personnel assemble in designated muster /refuge area.

a

Egress Personnel move from a muster/ refuge area to a point of embarkation

Personnel move to the helideck or to TEMPSC boarding areas to await controlled embarkation

•

Evacuation

Personnel leave the installation using the primary and preferred means, helicopter, or using the primary mainstay means, TEMPSC. Some Operators consider crane system use allowing personnel to be lowered to attendant vessels as an effective evacuation means. Use of Gondola type systems (GEMEVAC Hibernia)

•

•

•

• • •

• • • • • • • • • •

4

©OGP

Egress routes affected by the hazard Helicopters unavailable Lack of control Personal survival equipment (e.g. smoke hoods) unavailable Means unavailable (wholly or partly) Uncontrolled situation resulting in early departure, leaving others Means affected by hazard Means adversely affected by weather/ conditions Insufficient capacity. Failure during transfer/launch process. No vehicle at place where personnel have gathered. Failure in the organisation or in the judgment of leaders. Lifeboat or other vehicle damaged by fire/explosion. Means of transfer damaged by fire or explosion. Personnel injured by explosion while awaiting order to evacuate.

RADD – Evacuation, escape & rescue

Stage + Generic Description

Typical Specific Descriptions

Possible Problems

Escape

Personnel leave the installation by controlled descent provisions, ladders, stairs, chutes, personal descenders, davit launched liferafts, or uncontrollably by jumping

•

Personnel in the water or in liferafts await external parties (air and marine) to provide rescue. Those in the water are the first priority, next liferaft then TEMPSC occupants.

• • •

Rescue

• • •

• • • Recovery to a Place of Safety Personnel make further transfer to arrive at shore or a place of safety before return to shore.

Helicopter shuttles evacuees to base/ship/nearby platform. Lifeboat transfers evacuees to helicopter then on to a place of safety. Lifeboat transfers evacuees to ship. Lifeboat reaches shore or another platform. Pick-up from liferaft and transfer to a place of safety. Those immersed rescued from water and transferred to a place of safety. Those immersed arrive at, and are then recovered to, a place of safety.

©OGP

• • • • •

Access to controlled descent prov-isions hampered Hazard effects Debris in the water Descent devices do not work Adverse weather/ visibility Inadequate external support Unavailable, inappropriate or damaged personal survival equipment (lifejacket, survival suit, etc) Personnel injury Those in water affected by cold, heat or other effects of an incident. Possible shark attack in tropical waters. Adverse weather Lack of control on TEMPSC disembarkation Accident during pick-up. Rescue vehicle suffers accident. Ineffective support facilities on recovery vessel

5

RADD – Evacuation, escape & rescue

2.1.3 Evacuation Decision and its influence on EER Analysis The decision on whether or not to evacuate the installation is made by a designated OnScene Commander (OSC), typically the Offshore Installation Manager (OIM). The Emergency Response Teams would advise the OIM of the severity of the incident. In most cases, the OIM would stand-by and wait for the response teams to control the incident, and then return the installation to normal operations. Depending on the severity of the event, the installation layout, the weather conditions, and the response teams' capabilities, the OIM may choose to evacuate the installation. The choices are: •

Remain on the installation until the incident is over. This may be adopted for small incidents (e.g. false alarms, minor oil leaks etc), but these are not usually modelled in a QRA. It may also be adopted for major incidents of short-duration (e.g. large isolated process releases) where it is considered that staff in a muster/refuge area are safer to remain onboard

•

Evacuate non-essential personnel only. Incidents where a fire-party or other essential crew can be left on the installation are considered to be precautionary evacuations, and are often not modeled a QRA, since accident experience indicates a very low level of fatality risk.

•

Evacuate all personnel. This emergency evacuation is the only case typically analysed in offshore QRA and is outlined in the evacuation model within Figure 2.2 that can be utilised as a basis for EER analysis. Figure 2.2 EER Analysis Decision Model

6

©OGP

RADD – Evacuation, escape & rescue

2.1.4 Helicopter Evacuation Use of helicopter to evacuate is only possible in situations where both helicopter(s) and helideck are available. Some potential major accident scenarios would make it very dangerous to utilise helicopter transportation. Heat, smoke and flames from fires tend to propagate upwards and can impair a helideck facility. Helicopter evacuation is often more available for performing precautionary evacuations. Any evaluation of helicopter options must include an assessment of: •

The time scale of the supposed incident.

•

The possible timing of the incident in relation to the availability of helicopters and crew (i.e. day or night).

•

The defined evacuation plan i.e. to shore, ships or other installations.

•

The possible problems in the access, mustering and loading process.

2.1.5 TEMPSC Evacuation In the event that evacuation by helicopter is not possible, generally, evacuation will be attempted by TEMPSC. The critical features affecting the risks of evacuation by TEMPSC are: •

Availability of TEMPSC suitable for launch, given the event necessitating evacuation.

•

The choice of which TEMPSC to use, if there is spare capacity.

•

Time required to load and launch the TEMPSC compared to the time for the event to escalate.

•

The risk of an unsuccessful launch in the prevailing weather conditions.

•

The risk of an accident during recovery of personnel to a place of safety (ERRV).

2.1.6 Times and Failures Modes of Lifeboat Evacuation Table 2.2 presents a more detailed analysis of evacuation failure modes, which is drawn from [2]. This provides a framework for discussion and analysis. For analysis of existing installations, analysts should be able to use measured times from trials and exercises in place of the typical times shown in the table. The design of a TEMPSC to withstand physical effects due to an incident can also affect the success of an evacuation.

©OGP

7

RADD – Evacuation, escape & rescue

Table 2.2 Typical Tim es and Failure Modes for Evacuation of a North Sea Installation by 40-person TEMPSC Action (with Indicative Duration) Muster Go to stations Head Count Order to abandon (5 to 15 mins)

Possible Problems

Prepare to launch

Muster area exposed to heat or smoke. Craft damaged by effects of incident. Engine defect. Gear stuck. Sea cocks jammed. Craft damaged. Personnel injured. Premature descent. Access blocked. Other delays.

Embark (4 to 10 mins)

Effects of incident. Escape ways blocked or unusable. Alarm ignored or not observed by personnel. Problems of command.

Start to lower Descend under control to near sea level Final descent to sea Release (1 min)

Release/cable/brakes jammed, craft hooked up on gear and various other mechanical defects. Craft hits structure due to wind. Premature release of craft from falls. Wires too short. Release fails. Craft damaged by effects of the incident (heat, fire, blast, fire on sea).

Move away from installation

Steer into structure. Blown back into structure. Tides carries craft into structure. Mechanical failures. No pickup means.

Stay intact while awaiting pickup

Craft not located. Craft sinks or capsizes before recovery. Injured person die before recovery. Excessive delay in pickup leads to death or injury of personnel.

Personnel recovered successfully

Mistakes during recovery. Failure of mechanism.

Recovery unit reaches shore

Helicopter or ship suffers failure.

2.1.7 Activity Undertaken to Improve TEMPSC Evacuation The offshore oil and gas industry has seen efforts to improve the design, hardware and management of EER issues. Such improvements will achieve a reduction in risk for personnel. For example, TEMPSC design and operations improvement studies have covered: •

Assessment of Onload and Offload release mechanisms, to reduce the chance of premature erroneous release.

•

Improved Clearance / Offset of TEMPSC from installations

•

TEMPSC mounted at right angles to the structure or at its corners so as to allow a straight course away from the structure, also creating reduced wind and marine loads which would tend to bring the craft closer to the installation

•

Improved vessel maneuverability, some adopting use of bow thrusters.

•

Better visibility for TEMPSC Coxswain

•

Better maintenance of TEMPSC launch mechanisms.

•

More consideration given to the practicalities of recovering personnel from TEMPSC.

•

Improved impact resistance of TEMPSC

•

Development of Freefall TEMPSC

8

©OGP

RADD – Evacuation, escape & rescue

•

Development of the Preferred Orientation and Direction (PrOD) system to translate craft orientation in descent to an optimal heading and then translate descent potential energy into forward thrust.

Currently additional effort is being applied to the safety of Freefall TEMPSC in relation to issues associated with increased average offshore worker mass and its effect on craft load distribution, canopy strength etc. Increased mass effects are also being addressed for conventional davit fall TEMPSC.

2.1.8 Bridge-Link Evacuation This essentially relates to an evacuation from an adjacent installation e.g. a drilling platform which is connected to the central platform by a bridge within a large production complex. If personnel are able to reach the central platform where evacuation normally takes place, the potential evacuation means where warranted are either by helicopter or TEMPSC as discussed above.

2.1.9 Escape to Sea Events that lead to the need for evacuation of the installation may also impair the means of evacuation or access to them. In such a case, personnel will have to leave the installation using escape means e.g. liferafts. The critical features of escape to the sea are: •

Availability of means of escape to the sea, such as ladders, scrambling nets, ropes and personal escape equipment. These may be impaired by the event requiring the evacuation.

•

The reliability of the available means of escape, which is typically expressed in terms of the fatality rate among people using it.

2.1.10 Rescue and Recovery The purpose of the rescue and recovery arrangements is to ensure prompt recovery to a place of safety of personnel evacuating by TEMPSC, or entering the water during escape or because of a man overboard (MOB) incident, (Note MOB not typically assessed in QRA). This is normally achieved through arrangements with ‘local’ search and rescue (SAR) helicopters and standby vessels/ Emergency Response and Rescue Vessels (ERRV) as specified by the installation’s Emergency Response Plan (ERP). The critical features affecting the risks of rescue and recovery are: •

Location of the SAR helicopter.

•

Response / launch times for the SAR helicopter and SBV/ERRV.

•

Speed of the SAR helicopter and SBV/ERRV.

•

Capacity of the SAR helicopter and SBV/ERRV.

•

The time taken to rescue people from the sea, compared to their survival time in the prevailing conditions. This depends on the availability of suitable rescue craft, their reliability and performance in the rescue task, the environmental conditions affecting survival times and rescue performance, and the clothing and survival equipment used by the people in the water.

©OGP

9

RADD – Evacuation, escape & rescue

The potential for accidents involving rescue vessels and helicopters.

•

2.2

Recommended Data

The following sub-sections discuss the data and rule sets utilised in the EER analysis. There is little or no further update on the EER data used by the industry, hence the data and rule sets presented in the report are mainly adopted from OGP member database 1996, unless otherwise stated. The industry focus has been on making practical improvements in hardware rather than enhancing the nature and basis of EER analysis. Such practical improvements have been highlighted for TEMPSC evacuation in Section 2.1.7 and for other general EER activity in Section 3.9. The rule sets describe the adopted principles in the EER analysis and may be further developed in conjunction with the installation specific EER arrangements. The rule set will ensure consistent approach and provide a guideline on industry best practice for EER analysis. Note that much of the data set out in the following sub-sections has been provided by OGP members, in which case it should be taken as indicating the type of data required at each stage and values typically used, rather than definitive recommended values.

2.2.1 Availability of Escape Routes to Muster Areas Table 2.3 provides sample rule sets that may be developed to assess the availability of escape routes to muster areas exposed to heat radiation and smoke effects. Table 2.3 Sam ple Rule Sets for Criteria of Im passability of Escape Routes due to Heat Radiation and Sm oke If the underside structure of a route formed by cladding and plate, is still intact, the escape route is impassible if heat radiation level at the underside of the escape route exceeds 37.5 2 kW/m . A route, separated from heat effects to the side by a clad wall but having a grated floor, is 2 impassable if the heat radiation level on other side of the clad wall is more than 12.5 kW/m . 2

Less than 5 kW/m will cause pain in 15 to 20 seconds and injury after 30 seconds’ exposure [12]. 2

Greater than 6 kW/m will cause pain within approximately 10 seconds; rapid escape only is possible [12]. An unprotected route is impassable if the smoke concentration is higher than 2.3%.

In addition, many companies adopt smoke obscuration criteria such that routes are deemed to be blocked if the visibility is less than 10 m. It is noted also that many companies provide escape packs with smoke hoods, although little credit is adopted for using smoke hoods for the access (immediate escape) stage as they are located typically in accommodation areas for limited use in aiding helicopter or TEMPSC boarding.

10

©OGP

RADD – Evacuation, escape & rescue

2.2.2 Lifeboat Embarkation Table 2.4 provides sample rule sets that may be developed to assess the inoperability of lifeboat embarkation areas due to heat radiation and explosion effects. Table 2.4 Sam ple Rule Sets for Criteria of Inoperability of Lifeboat Em barkation Areas due to Heat Radiation and Explosion Effects Any jet fire impact (with or without water sprays operating). Any pool fire impact (without water sprays operating). Any explosion impact with an overpressure higher than 0.2 bar [12]. Permanent damage to the supporting structure. 2 A heat radiation level of more than 12.5 kW/m to the underside or outside of the embarkation area.

2.2.3 Lifeboat Evacuation Table 2.5 shows the probabilities of success for TEMPSC evacuation based on computer model predictions. Table 2.5 Probabilities of Success 1 for TEMPSC Evacuation (Com puter Model Predictions) 2

Wind (Beaufort Force ) (m/s) Calm Moderate Gale Storm

Davit-Launched [2],[6]

Free-Fall [OGP Member]

0.8 0.6 0.1 0.05

0.95 0.9 0.75 0.4

(0-3) (0 - 5 m/s) (4-6) (5 - 14 m/s) (7-9) (14 - 24 m/s) (>9) (> 24 m/s)

Notes:

1. “Success”, in this context, is achieved when no fatalities occur during the TEMPSC evacuation event. Thus 100% of the personnel on board the TEMPSC will be safely transported away from the installation and potentially to shore. As a rule of thumb it is commonly assumed in QRA that 50% of the occupants of a failed TEMPSC will become evacuation phase fatalities and the remaining 50% are immersed with the potential to suffer rescue and recovery phase risk.

2. Beaufort refers to the Beaufort Wind Scale, an internationally recognized system of describing observed effects of winds of different velocities. Winds are grouped into speed categories from 1 to 12 and area referred to as Force 1, Force 2, etc.

The Computer Model was the Escape model as documented within [6] developed by Technica, now part of DNV and is available within the NEPTUNE Software toolkit, upgraded as ESCAPE III to cater for mobile unit motion dynamics. It is noted that the probability of successful TEMPSC evacuation is strongly influenced by the facility layout. As a result of the research conducted in developing the ESCAPE model and by the associated D.En Guidance, installation designers and facility operators created greater clearance distances between TEMPSC and structures that could be impacted on descent and in offset sea level clearances to minimize the potential to be swept back towards the facility once released. By remounting new and existing TEMPSC from a parallel/side on mount to a perpendicular/end-on mount this reduced the wind loading on descent which could cause platform collisions and offered

©OGP

11

RADD – Evacuation, escape & rescue

the ability to drive more quickly away (without a need to turn) when seaborne reducing the swept back collision potential. In addition, OREDA-92 [7] includes some recorded failure incident and failure rate data for davit launched TEMPSC.

2.2.4 Frequency of Installation Evacuation Table 2.6 shows the frequency of partial/total evacuation for the Northern North Sea. Table 2.6 Frequency of Partial/Total Evacuation (Northern North Sea) -3

Survival Craft Evacuation Helicopter Evacuation

3.0 × 10 per installation year [2] -3 7.5 × 10 per installation year [2]

Over a 25 year installation life, this implies a 7.5% probability that there will be a TEMPSC evacuation and 19% probability of an evacuation by helicopter.

2.2.5 Probability of Evacuation Success The actual success rates at each stage of the process of EER for a defined group of personnel can be translated into an overall success rate. Stages of EER and associated probabilities of personnel acting as described may be defined as follows: •

identifying alarm = P1

•

making local escape (access stage) = P2

•

reaching muster/refuge place = P3

•

effecting evacuation or escape (from muster/refuge away from installation) = P4

•

reaching place of safety = P5

As an example, consider escape of 5 people working in a process area in which there is a rapidly developing fire. It is assumed that evacuation is by TEMPSC. Weather conditions may be any of those observed at this location. There is a good back-up organization to recover personnel after they have transferred to TEMPSC. (Source: OGP member). •

P1 = 0.95 (Visual and thorough alarm system)

•

P2 = 0.80 (Fire effects may overcome personnel)

•

P3 = 0.98 (Good escape routes unlikely to be blocked)

•

P4 = 0.85 (to include allowance for possibility of becoming trapped at the muster/refuge place. Also includes derivation for TEMPSC launching weighted for different weather conditions)

•

P5 = 0.90 (Emergency organization for the installation retrieves personnel. Success is good except in poor weather)

Overall Success = (P1 × P2 × P3 × P4 × P5) = (0.95 × 0.80 × 0.98 × 0.85 × 0.90) = 0.57 for the 5 people in the area where the incident takes place. Note that the chance can be improved to 0.74 (P1 × P2 × P3) if people can stay on the installation.

12

©OGP

RADD – Evacuation, escape & rescue

2.2.6 Escape by Sea Entry Table 2.7 provides a sample rule set for the probability of immediate fatality due to jumping to the sea from a North Sea deck (a lower deck where staff could be expected to routinely work). Table 2.7 Sam ple Rule Set for Im m ediate Fatality Probability due to Jum ping to Sea from a North Sea Lower Deck Fatality Probability

0.1

Source: Sample extract from a typical Rule Set document of an OGP member. Note: Does not allow for use of tertiary devices, such as rope ladders etc., or for distance to sea.

Table 2.8 provides sample rule set that may be developed to assess the probability of fatality upon entering the sea to escape in the North Sea. Table 2.8 Sam ple Rule Set for Fatality Probability Upon Entering the Sea to Escape (North Sea Data) Stand-by vessel status

Probability of fatality

No stand-by vessel present Averaged over all weather conditions Stand-by vessel(s) present. Calm Weather (Wind 0 to 5 m/s) No or Low Fire Effects at Sea Level High Fire Effects at Sea Level Moderate Weather (Wind 5 to 12 m/s) Severe Weather (Wind >12 m/s)

0.8

0.06 0.15 0.22 0.92

Source: Sample extract from a typical Rule Set document of an OGP member. Notes: •

Probabilities cover full scope of evacuation: entering sea; remaining at sea surface; rescue.

•

Personnel making a sea entry expected to be wearing survival suit and life-jacket.

•

Data do not differentiate sea temperature effects on personnel survival rate. In reality, personnel survival time immersed in sea, depends on local sea temperatures and generic human endurance times.

2.2.7 Operability of Evacuation and Escape Methods under Various Accident Circumstances Table 2.9 shows the operability ratings of evacuation and escape methods under various accident circumstances. Table 2.10 shows the historical success rates for a number of evacuation and escape methods.

©OGP

13

RADD – Evacuation, escape & rescue

Table 2.9 Operability Ratings of Evacuation / Escape Methods Under Various Accident Circum stances: Hazards, Evacuation Tim e, W eather Types of Evacuation/Escape means

Hazard Radiant Gas/H 2 Heat S/ Smoke

Evacuation Time < 15 < 60 < 180 mins mins mins

Weather Calm Mod Severe

Preferred Evacuation

Helicopter

2

2

2/2

8/2

9/9

9

9

5

Bridge Direct Marine

5 5

5 5

9/9 2/2

9/9 9/5

9/9 9/9

9 9

9 8

7 3

TEMPSC Evacuation

Protected Access

9

9

9/7

9/9

N/A

9

6

1

Unprotected Access

3

3

7/7

9/9

N/A

9

6

1

Liferaft, Ropes, Jump etc.

2

2

8/8

N/A

N/A

3

2

0

Escape to Sea means

Source: OGP member. Notes Ratings: Lowest = 0, Highest = 9. These ratings are based on how operable the various methods of evacuation / escape are expected to be under different accident circumstances of hazard, evacuation time and weather. A N/A mark indicates that alternative methods of evacuation / escape would be used in these circumstances. Two marks are given for the evacuation times based on the separate cases of total People on Board (PoB) = 20 and total PoB = 200 respectively (i.e. 8 / 2 refers to 8 for a 20 man installation, 2 for a 200 man installation).

Table 2.10 Evacuation and Escape Success Rates Types of Evacuation/Escape

Historical Success Rates 1

Preferred Evacuation

Helicopter

Low

Bridge Direct Marine

High 2 N/A

TEMPSC Evacuation

Protected Access

N/A

Escape to Sea means

Unprotected Access Liferafts, Ropes, Jumping etc.

Low Low

Source: OGP member. Notes Ranking Categories: High / Medium / Low 1. Helicopters have not generally been available in time for emergency evacuations. 2. No data, as these are more recent developments and are not widely deployed offshore as yet e.g. Hibernia GEMEVAC.

14

©OGP

RADD – Evacuation, escape & rescue

2.2.8 Survival Times in Water Table 2.11 shows the survival time in water adopted in the North Sea. These values do not account for times for injured staff where injured survival times in summer are 85% of those not injured and in winter 60%. Table 2.11 Survival Tim es (m inutes) in W ater [9] Sea State: Category

Calm

Moderate

Rough

Summer

Winter

Summer

Winter

Summer

Winter

Lifejacket and Survival Suit Lifejacket / No Survival Suit

180 75

120 45

165 30

60 30

120 15

100 15

Insulated Immersion Suit with Buoyancy

180

180

180

180

180

180

150

75

60

30

30

15

150

180

60

80

180

60

20

10

15

10

10

5

Lifejacket / leaking survival suit Lifejacket/ leaking survival suit with thermal immersion garment during winter No Lifejacket/No Survival Suit

Survival times can be extended for warmer water environments with the following rough guidance, depending on a variety of factors such as body type, clothing etc: •

70° to 80°F (21° to 27°C): 3 hours to indefinitely

•

60° to 70°F (16° to 21°C): 2 to 40 hours

•

50° to 60°F (10° to 16°C): 1 to 6 hours

In warmer water factors other than hypothermia may become more important.

3.0

Guidance on Use of Data

The following sub-sections provide guidance on use of data presented in Section 2.2.1 to 2.2.7.

3.1

Availability of Escape Routes to Muster Areas

The criteria shown in Table 2.3 are samples of rule sets that can be used to evaluate the number of fatalities to personnel trapped in a fire area over an extended period due to effects from a fire of long duration. The criteria may be considered conservative when escape is possible within a few minutes after the start of a fire. Rule sets should be developed specific to the circumstances. The Vulnerability of Humans datasheet provides data complementary to that given in Section 2.2.

3.2

Lifeboat Embarkation

Similar to the above, the rule set for inoperability of TEMPSC embarkation areas should be developed specific to the installation circumstances.

©OGP

15

RADD – Evacuation, escape & rescue

3.3

Lifeboat Evacuation

The various references in Table 2.5 give a range of predictions for the success rate of TEMPSC evacuation. These data figures are not precise, but give an indication that launching of TEMPSC does not guarantee safe evacuation. The outlines of the various ways in which the TEMPSC evacuation process can fail are as indicated in Table 2.1 and Table 2.2. TEMPSC evacuation success data are generally predictions based on North Sea experience of davit launched TEMPSC. Installations in other areas may use craft which are not davit launched TEMPSC. This could affect the success rate for evacuation.

3.4

Frequency of Installation Evacuation

Table 2.6 shows the predicted frequency of having to evacuate an installation is derived from generic information. Some installations may never have an evacuation, others may have several over their lifetime. Helicopter evacuation might not be achievable until some hours after the initiating event. Fire, smoke and gas presence can prevent the use of helicopter. For such cases, TEMPSC and bridge transfer (for bridge linked platforms) provide further alternative means of evacuation.

3.5

Probability of Evacuation Success

The probabilities presented are based on typical OGP member database. Any probabilities used should be scrutinised and developed specific to the installation evacuation arrangement and facilities.

3.6

Escape by Sea Entry

There are insufficient data on the use of liferafts to give reliable figures for the probability of fatality when these devices are available. The probabilities presented in Table 2.7 and 2.8 are sample extract from typical rule sets document of OGP member database. Similar to the above, probabilities used should be scrutinised and developed specific to the installation escape arrangement and facilities.

3.7

Operability of Evacuation and Escape Method under Various Accident Circumstances

Tables 2.9 and 2.10 are provided to aid estimates of EER systems effectiveness under different accident circumstances. The data is qualitative estimate of the applicability and success rates for different types of EER equipment.

3.8

Survival Times in Water

The survival times are taken from HSE Offshore Technology Report OTO 95 038 [9]. Survival times may be multiplied by 0.6667 to give a factor of safety as suggested in guidance PBN 97/20 of HSE for demonstration of good prospect.

16

©OGP

RADD – Evacuation, escape & rescue

All of these references date from the late 1980s/early 1990s. There has been little subsequent development in this area, as explained by the following brief account. Prior to the PFEER (Offshore Installations (Prevention Of Fire and Explosion, and Emergency Response)) Regulations 1995 in the UK, a significant degree of EER analysis was performed associated with the Piper Alpha Disaster report by Lord Cullen which required EER Analysis as a “forthwith” study in advance of the Safety Case Regulations which were enacted in 1993 (Updated in 2005 [10]). Much of the new numerical analysis work was performed at this time building on the earlier DEn ESCAPE work involving Technica. The PFEER Regulations set out more firm requirements on emergency response issues, principal among which was the requirement to demonstrate a good prospect of rescue and recovery. The Regulations enabled the possibility of Standby Vessel sharing. A lot of industry application was then devoted to demonstrating “good prospect”, particularly in cases of SBV sharing. Post PFEER many SBV sharing studies were performed using analysis methods developed before PFEER. Industry activity then drifted away from numerical risk methods and focused more on the practicalities of effective rescue and recovery. Section 2.3 gives a more detailed account of activity observed post PFEER in the UK.

3.9

Development of Offshore EER Arrangements

Whatever offshore evacuation technique is used, two areas have been developed to improve the success of EER, principally stemming from Lord Cullen’s report on the Piper Alpha Disaster. Firstly there is the development of concept, specification and performance of Temporary Refuges. Secondly, there is increased allowance for human factors, comprising command, control, human behaviour and ergonomics in the design of equipment, procedures etc with significant efforts given to training emergency command teams in simulated exercises. Much work has been done in these areas and there is continuous focus from operators and regulators. A number of innovative EER systems are in various stages of development. Several systems have been adopted by operators as risk reduction measures and best available means for EER. Examples of these innovative systems can generally be grouped into the following categories: •

TEMPSC assist systems

•

Individual Escape Devices

•

Multiple Personnel Escape Devices

Levels of operational testing and experience for each particular system vary. Due to these systems’ relatively limited usage within the industry, there are little or no data currently available.

3.9.1 Post PFEER Activity in the UK in Relation to Evacuation, Escape and Rescue It became obvious that a good prospect of rescue and recovery required the ability to deploy resources quickly enough to recover people before survival times were exhausted. Therefore effort was applied from two sides to this survival challenge: •

To improve survival times in water, and

©OGP

17

RADD – Evacuation, escape & rescue

•

To deploy new and different resources to get to people in the water more quickly.

3.9.1.1 Improving Survival Times It became obvious that survival time was linked to the type of survival suits being worn. Zips and worn seals compromised suits and caused ingress of water, which reduced survival times, so new suits were developed and additional training provided to reduce such problems. The problems of incompatibility between various survival suits and lifejacket combinations became more obvious and efforts were applied to demonstrate effective combinations, with many companies performing mannequin water tests at sea. The survival time was additionally tackled with the widespread adoption of thermal immersion garment liners worn within survival suits in defined weather/sea conditions to enhance the “good prospect”. More recently, led by several companies from the mid 1990s, there has been the adoption of rebreather technology to enhance personnel’s ability to survive helicopter ditching scenarios. This addresses the human response to cold water immersion, which induces breathing and water ingress if submerged. The rebreather allows breathing to take place drawing in previously expelled breath to facilitate submerged escape from the aircraft. 3.9.1.2 Reducing Recovery Times As an aid to faster recovery of personnel from the water, the use of personnel locator beacons (PLB), previously limited to TEMPSC, Helicopter and Liferafts, was adopted by many companies whose associated support response fast rescue craft had provisions to track the PLB signal. When using PLBs, it important to ensure that when activated these devices do not interfere with helicopter EPIRB signals. On the deployment of resources side, advances began with better systems of recovering personnel from the sea. Lessons learned on earlier emergency situations prompted: •

The development of devices such as the Jason’s Cradle, Dacon Scoop

•

The development of Caley davits for FRC quick recovery in rough weather with an inbuilt heave compensation device

•

Lower freeboard, and better illuminated and defined SBV rescue zones.

A SBV code of practice was developed to harmonise the specification of SBVs, outlining different classes of vessel essentially related to the POB on the installations they are attending. This was then developed more recently as the Emergency Response Rescue Vessel (ERRV) code. The specifications of equipment and manning requirements were developed to ensure effective resources could be available to rescue, recover, attend survivors and crew the vessels effectively. With respect to SBV, the industry began to increase the number, capacity, reliability, endurance and speed of fast rescue craft. From the mid 1990s, fast rescue craft began to develop towards the “daughter craft” (DC) principle. These craft were larger, had canopies and could operate somewhat independently of the SBV for defined periods.

18

©OGP

RADD – Evacuation, escape & rescue

This enabled more distant deployments and enabled closer support for example for helicopter operations between local facilities, greater support under shared SBV circumstances e.g. over the side work close in support. DC have greater weather limitations than FRC as their weight makes rough weather recovery a problem, limiting their deployment to moderate seas. Also from the late 1990s, BP and various partners began to advance the Jigsaw concept that would provide good prospects of rescue and recovery by a more focused deployment of higher specification SBV and offshore based Search and Rescue (SAR) helicopter provisions (essentially equipped with forward looking Infrared systems, for the location of those immersed, and winch recovery provisions). The Jigsaw vessels are equipped with Autonomous Rescue and Recovery Craft (ARRC). These are essentially vessels that can be deployed using dual davits, which have a Rigid Inflatable Boat basis but with large cabs over 2 decks allowing comfortable autonomous operations and effective recovery capabilities. 3.9.1.3 Non UK Developments Away from the UKCS and the North Sea, newer work has been applied in the field of Emergency Response towards colder and ice oilfield environments. The Terra Nova development demonstrated the need to keep TEMPSCs in warmed garage facilities to ensure quick, effective use. The Sakhalin developments have demonstrated the need for new thinking in relation to evacuating onto full or partial sea ice cover. More recently the Kashagan development in the northern Caspian Sea, icebound in winter, has required creative solutions for emergency response arrangements, also influenced by significant potential for high concentration H2S situations.

4.0

Review of Data Sources

The principal source of the data presented in Section 2.2 is the data published by OGP. References [4], [4] and [6] include a useful overview of offshore EER, including fatality assessment, as well as evacuation modeling (helicopters, lifeboats, bridge, sea entry). OREDA-92 [7] includes some recorded failure incident and failure rate data for conventional davit launched life boats. The Vulnerability of Humans datasheet provides data complementary to that discussed in Section 2.2. Most of the data presented are generally based on the North Sea experience. Installations in other areas operating in different environmental conditions and operating standards may be subjected to area specific data.

5.0

Recommended Data Sources for Further Information

There are limited data available for use in EER analysis, however, a number of organisations provide guidance on EER best practice through their websites, within the UK this includes the Oil and Gas UK (formerly known as UKOOA), the Health and Safety Executive (HSE) UK, Emergency Response and Rescue Vessel Association (ERRVA) UK, and The Step Change in Safety group. For Norway the Norwegian Petroleum Services Authority (PSA) (formerly the NPD) provides guidelines. For other offshore sectors local authorities can be referred to such Transport Canada, Mineral

©OGP

19

RADD – Evacuation, escape & rescue

Management Services (US), Occupational Safety and Health Administration (US), US Coast Guard, and in general the International Maritime Organisation (IMO).

6.0

References

[1] HSE, 1995. Prevention of Fire and Explosion, and Emergency Response on Offshore Installations. Not yet available electronically in full; link to summary information: (http://www.hsebooks.com/Books/product/product.asp?catalog%5Fname=HSEBoo ks&category%5Fname=&product%5Fid=2788) [2] Sykes, K, 1986. Summary of conclusions drawn from reports produced by, or made available to, the Emergency Evacuation of Offshore Installations Steering Group, MaTSU. [3] Technica, 1988. Escape II - Risk Assessment of Emergency Evacuation from Offshore Installations, OTH 88 8285, London: HMSO, ISBN 0 11 412920 7. [4] Robertson, D, 1987. Escape III - The Evaluation of Survival Craft Availability in Platform Evacuation, Intl. Offshore Safety Conference, London. [5] Department of Energy, 1988. Comparative Safety Evaluation of Arrangements for Accommodating Personnel Offshore, Section 9 + Appendix 7. [6] Technica, 1983. Risk Assessment of Emergency Evacuation from Offshore Installation, Report F 158, prepared for DoE. [7] DNV Technica, 1993. OREDA-92, Offshore Reliability Data Handbook, 2nd ed., ISBN 82 515 0188 1. [8] HSE, 1995. A Methodology for Hazard Identification on EER Assessments, RM Consultants Ltd, OTH 95 466. http://www.hse.gov.uk/research/othhtm/400-499/oth466.htm [9] HSE, 1995. Review of Probable Survival Times for Immersion in the North Sea, OTO 95 038. http://www.hse.gov.uk/research/otopdf/1995/oto95038.pdf [10] The Offshore Installations (Safety Case) Regulations 2005, SI2005/3117, Norwich: The Stationery Office, ISBN 0 11 073610 9. http://www.opsi.gov.uk/si/si2005/20053117.htm [11] (UK) Step Change in Safety, 2003. Loading of Lifeboats during Drills - Guidance. http://stepchangeinsafety.net/ResourceFiles/Lifeboat%20Loading%20Guidance%20 Final%20Copy.pdf [12] International Association of Oil & Gas Producers, 2009. Vulnerability of Humans, DNV Report no. 32335833/14, rev 2.

20

©OGP

Risk Assessment Data Directory Report No. 434 – 20.1 March 2010

Guide to finding and using reliability data for QRA International Association of Oil & Gas Producers

RADD – Guide to finding and using reliability data for QRA

contents 1.0   1.1   1.2   1.3  

Scope and Application.............................................................. 3   Scope.................................................................................................................... 3   Application ........................................................................................................... 3   Definitions ............................................................................................................ 3  

2.0   Summary of Recommended Data ............................................... 4   2.1   Copyright.............................................................................................................. 4   2.2   Sources of Reliability Data ................................................................................. 4   3.0   Guidance on use of data ........................................................... 6   3.1   Introduction.......................................................................................................... 6   3.2   Failure Rate Calculation...................................................................................... 7   3.2.1   Background ................................................................................................................... 7   3.2.2   Failure Rate Calculation #1 – Few Failures, Constant Failure Rate Assumed ........ 8   3.2.3   Failure Rate Calculation #2 – Point Estimate ............................................................. 9   3.2.4   Failure Rate Calculation #3 – Many Failures with Probability Plotting .................. 10   3.2.5   Treatment of Common Cause Failures ..................................................................... 13   3.2.6   Failure Rate Calculation using the OREDA Estimator............................................. 13   3.3   Calculation of “on demand” Failure Probability............................................. 14   3.4   Guidance Specific to the OREDA Handbook .................................................. 14   3.4.1   Selecting Appropriate Data ........................................................................................ 14   4.0   Review of data sources ........................................................... 16   4.1   OREDA Database and Handbook(s) ................................................................ 16   4.1.1   OREDA Data Presentation.......................................................................................... 18   4.2   MIL-HDBK-217F ................................................................................................. 19   4.3   FIDES .................................................................................................................. 19   4.4   EPRD-97 and NPRD-95...................................................................................... 19   4.5   PDS Data Handbook.......................................................................................... 20   4.6   FARADIP III......................................................................................................... 20   4.7   IEEE 493-1997 .................................................................................................... 20   4.8   Sintef Reports, SubseaMaster and WellMaster .............................................. 20   5.0   Recommended data sources for further information ................ 21   6.0   References .............................................................................. 21  

©OGP

RADD – Guide to finding and using reliability data for QRA

Abbreviations: BIT BOP DNV E&P MTTF MTTR ND OGP OREDA QRA SCSSV

Built-in Test Blowout Preventer Det Norske Veritas Exploration and Production Mean Time To Failure Mean Time To Repair Nominal Diameter Oil and Gas Producers Offshore Reliability Data Quantitative Risk Assessment Surface Controlled Subsurface Safety Valve

©OGP

RADD – Guide to finding and using reliability data for QRA

1.0

Scope and Application

1.1

Scope

The reliabilities of fire and gas detection, ESD and blowdown, blowout prevention and fire protection systems are key inputs to Quantitative Risk Assessment (QRA) of exploration and production facilities. This datasheet provides guidance on obtaining, selecting and using reliability data for these systems and for their component parts, for use in QRA.

1.2

Application

This datasheet contains specimen data taken from previous OGP datasheets; this specimen data are presented in Error! Reference source not found. to Error! Reference source not found.. In addition, the recommended data sources that are identified in section 2.0 should be consulted to ensure that all data are the most up to date and relevant for any particular analysis. Guidance on using and processing data is given in Section 3.0. The data presented are applicable to activities in support of operations within exploration for and production of hydrocarbons.

1.3

Definitions

For the purposes of this document, the following terms and definitions apply. •

Failure

The inability of an equipment unit or system to perform a specified function.

•

Critical failure

Failure of an equipment unit that causes an immediate cessation of the ability to perform a required function.

•

Non-critical failure

Failure of an equipment unit that does not cause a cessation of the ability to perform a required function.

•

Dangerous failure

A failure that has the potential to prevent a safety system from achieving its safety function(s) when there is a true demand. A single dangerous failure may not be sufficient to prevent a redundant safety system from performing its safety function (e.g. two coincident dangerous failures may be needed to prevent operation of a 2-out-of-3 voting system).

•

Non-dangerous failure A failure of a safety system that is not dangerous.

•

Safe failure

A failure that has the potential to unnecessarily trigger a safety function.

•

Revealed failure

A failure that is evident or that is detected by the system itself as soon as it occurs. Failures detected by the built-in diagnostic tests (BIT) of a logic solver are also considered as revealed failures.

•

Hidden failure

A failure that is not revealed to operation or maintenance personnel and that needs a specific action (e.g. periodic test) in order to be identified.

•

Com m on cause failure Failure of different items resulting from the same direct cause, occurring within a relatively short time, where these failures are not consequences of another. See also Common mode failure. ©OGP

3

RADD – Guide to finding and using reliability data for QRA •

Com m on m ode failure A subset of Common cause failure whereby two or more components fail in the same manner.

•

Demand

Activation of a system’s function (may functional, operational and test activation).

•

Failure m ode

Effect by which a failure is observed on the failed item.

•

Failure on dem and

Failure that occurs immediately when an item is instructed to perform its intended function (e.g. standby emergency equipment).

•

Reliability

Probability of an item performing a required function under stated conditions for a specified time interval.

•

Observation period

Interval of time between the start date and end date of reliability data collection.

•

Failure rate

Limit, if this exists, of the ratio of the conditional probability that the instant of time, T, of a failure of an item falls within a given time interval, (t + + Δt) and the length of this interval, Δt, when Δt tends to zero, given that the item is in an up state at the beginning of the time interval.

include

Note: 1. In this definition, t may also denote the time to failure or the time to first failure. 2. A practical interpretation of failure rate is the number of failures relative to the corresponding operational time. In some cases, time can be replaced by units of use. In most cases, the reciprocal of MTTF can be used as the predictor for the failure rate, i.e. the average number of failures per unit of time in the long run if the units are replaced by an identical unit at failure. •

M ean Tim e to Failure

(MTTF) Expectation of the time to failure.

•

M ean Tim e Between Failures (MTBF) Expectation of the time between failures.

2.0

Summary of Recommended Data

2.1

Copyright

The data that are presented in the sources discussed in Section 2.2 are protected by copyright and cannot be reproduced without specific written permission from the copyright holders. Where guideline values are given (Error! Reference source not found. to Error! Reference source not found.), these are taken from sources that are either in the public domain or from pre-existing OGP datasheets. It is strongly advised that in all analyses the best available data are taken from the relevant source as listed in section 4.0.

2.2

Sources of Reliability Data

The recommended sources of reliability data are presented in Table 2.1.

4

©OGP

RADD – Guide to finding and using reliability data for QRA

Table 2.1 Data Sources Data Source

Equipment

Available From

OREDA Handbooks [1] Note: new issue scheduled for release in 2009 MIL-HDBK-217F – Reliability Prediction of Electronic Equipment [10]

Process Equipment (Offshore)

Det Norske Veritas N-1322 Høvik Norway

Electronic components

US Military Handbook

EPRD-97 – Electronic Parts Reliability Data (RAC) [12]

Electronic components

NPRD-95 – Non Electronic Parts Reliability Data [11]

Mechanical and electromechanical components

Reliability Analysis Center 201 Mill Street Rome, NY 13440 USA Reliability Analysis Center 201 Mill Street Rome, NY 13440 USA

PDS Data Handbook [13]

Sensors, detectors, valves & control logic

Sydvest Sluppenvegen 12E N-7037 Trondheim Norway

FARADIP III [14]

Electronic, electrical, mechanical, pneumatic equipment

[email protected]

IEEE 493-1997 [15]

Electrical power generation and distribution Surface Controlled Subsurface Safety Valves

ISBN1-55937-066-1

STF75 A89054, Subsea BOP Systems, Reliability and Testing. Phase V

Subsea Blowout Preventers

Exprosoft N-7465 Trondheim www.exprosoft.com

STF75 A92026, Reliability of Surface Blowout Preventers (BOPs)

Surface Blowout Preventers

Exprosoft N-7465 Trondheim www.exprosoft.com

STF38 A99426, Reliability of Subsea BOP Systems for Deepwater Application, Phase II DW

Subsea Blowout Preventers – deepwater subsea

Exprosoft N-7465 Trondheim www.exprosoft.com

SubseaMaster & WellMaster [9] and [8] EIREDA Database European Industry Reliability Data Handbook, Electrical Power Plants

Components in oil wells (BOPs and SCSSVs)

Exprosoft N-7465 Trondheim www.exprosoft.com EUORSTAT, Paris

STF18 A83002, Reliability of Surface Controlled Subsurface Safety Valves

Valves, sensors and control logic (nuclear power station data)

©OGP

Exprosoft N-7465 Trondheim www.exprosoft.com

5

RADD – Guide to finding and using reliability data for QRA

3.0

Guidance on use of data

3.1

Introduction

The science of reliability prediction is based upon the principals of statistical analysis. Reliability is defined as “the probability that equipment will perform a specified function under stated conditions for a given period of time” which defines a probabilistic approach rather than a deterministic one. This probability can be calculated or stated to reside within certain statistical confidence limits. Fundamental to such a calculation is the ability to source basic reliability data. Ideally such data should be: •

Current

•

Auditable

•

Specific (applicable to equipment/component type)

•

Extensive (large sample with many recorded failures)

•

Applicable to environment

•

Be suitable for life trending

Unfortunately, real world data sources rarely meet these ideals and it is therefore necessary to accept compromises. When performing QRA, it is important that the limitations of the data source are understood, and where necessary alternatives sought. For QRA, the reliability parameters to be taken from the database would be the failure rate (or the mean time to failure) and/or the probability of failure on demand; see Section 3.3 for details of probability of failure on demand calculation. Where information is extracted from the OREDA or another industry standard database it is not (in general) necessary to perform any further statistical analysis of the failure patterns. The approach described in Section 2.3.3 applies where basic information relating to times to failure is available for analysis, for example from maintenance records or breakdown reports. In these circumstances, it is necessary to judge the quality of the data and to then apply the appropriate analytical technique. The techniques for data analysis presented herein are divided into two classifications, those that are based simply on the sample statistics and those that are based on inferences from the associated statistical distributions. The characteristics of distributions are much harder to derive (especially from field breakdown reports rather than laboratory test data), but have the potential to provide more information. Note that it is not the intention to provide a comprehensive theoretical background to data analysis in this document, but instead to provide some practical techniques that may be used to prepare reliability data. Three techniques are outlined, namely: •

Prediction of failure rate within defined confidence limits applied where only sparse failure data are available – refer to Section 3.2.2

•

Calculation of point estimate of failure rate applied where adequate data are available – refer to Section 3.2.3

•

Use of probability plotting to derive information relating to the underlying statistical distribution – refer to Section 3.2.4

6

©OGP

RADD – Guide to finding and using reliability data for QRA

3.2

Failure Rate Calculation

3.2.1

Background

The observed failure rate for a component is defined as the ratio of the total number of failures to the total cumulative observation or operational time. For items displaying a constant failure rate, if λ is the failure rate of the N items then: λ = k/T where k is the total number of failures and T is the total observation time across the N items. For the case where components are replaced after failure (as applies to industry field databases) then the total cumulative observation time may be defined as N × field operational lifetime. Strictly, this calculation provides a point estimate of the failure rate and if the exercise were repeated with another set of identical equipment and conditions it may yield results that are not identical to the first. Any number of such measurements may be made providing a number of “point estimates” for the failure rate, with the true value of the failure rate only being provided after all components have failed (for a non replacement test). In practice therefore, it is necessary to make a prediction about the total population of items based on the failure patterns of a sample. This process of statistical inference can be performed using the properties of a X2 (chi squared) distribution. This allows us to bound the population failure rate within confidence limits (typically 90% or 60% may be used). It is also necessary to make some assumptions about the pattern of failures across time, considering the shape of the commonly depicted ‘bathtub curve’ (Figure 3.1). This curve typifies the expected component failure rate across time and is divided into three distinct area, namely •

Early life, characterized by a decreasing failure rate

•

Useful life (constant failure rate)

•

Wear out (increasing failure rate)

©OGP

7

RADD – Guide to finding and using reliability data for QRA

Figure 3.1 The Bathtub Curve

In order to perform analysis of failure patterns outside of the constant failure rate period a level of detailed information is required that is typically not available from the recorded data (e.g. actual age of equipment of failure, homogeneous samples). Therefore an assumption is made that all failures recorded are experienced during the useful life phase, and the pattern of these failures may be described by a random, exponential distribution. This can, at least to a certain extent, be justified on the following grounds: •

Early life failures resulting from commissioning problems may not be recorded as equipment failures

•

Early life failures resulting from manufacturing defects can be largely eliminated by testing prior to installation

•

Wear out failures largely eliminated by preventative maintenance and planned renewals. Note that this assumption may be less valid for wear out of subsea equipment where no planned maintenance will be performed.

The preceding discussion allows us to analyze the data from each source, and in most cases to calculate a mean value, confidence intervals about the mean value and the associated variance. 3.2.2

Failure Rate Calculation #1 – Few Failures, Constant Failure Rate Assumed

Where total number of failures is small (say < 5), or zero, a point estimate of failure rate is inappropriate, therefore a technique of statistical inference and confidence limits should be applied. This can be addressed via a Chi Squared (X2) test using the following methodology: 1. Measure T (total observed time) and k (number of failures) 2. Select a confidence interval 3. α = 1 – confidence interval

8

©OGP

RADD – Guide to finding and using reliability data for QRA

4. n = 2k for failure truncated test or n = 2(k+1) for time truncated test 5. Look up value for X2 corresponding to n and α (use standard mathematical tables) 6. Failure Rate Confidence Limit at X2/2T 7. For double sided limits use procedure twice to look up value for X2 at: n = 2k and (1 – α/2) (lower limit) n = 2k(2k+2) and α/2 (upper limit) Note that X2/2T is a conservative estimate i.e. the true value has probability of α of being higher than the estimate (based on a single sided upper confidence limit). Using the upper bound of the failure rate is a conservative approach and hence it can be used instead of the maximum likelihood estimate when the sample is considered to be small. Example : Equipm ent m aintenance records show that 5 devices each with a recorded running time of 1000 hours have no recorded failures. Calculate the failure rate at 60% confidence (single sided upper limit). 1.

T = 5 × 1000 = 5000 hours

2&3.

α = (1 – 0.6) = 0.4 for 60% confidence limit

4.

n = 2 × (k+1) = 2 (time truncated since no failures have occurred)

5.

From tables, X2 = 1.83 (60% confidence limit).

6.

Upper bound of failure rate (60% confidence) = X2/2T = 1.83/10000 = 1.83 x 10-4 fails/hour

Note: the decision to use statistical interpretation or point estimate is based on the number of recorded failures. For items with a very high failure rate a significant number of failures could equate to a small amount of experience years, but typically a large amount of experience years are also required for a point estimate. 3.2.3

Failure Rate Calculation #2 – Point Estimate

Where adequate data are available, a point estimate of the failure rate can be made simply by taking the ratio of the total number of failures to the total cumulative observed time. If λ is the failure rate of the N items then λ = k/T where k is the total number of failures and T is the total cumulative observed time.

©OGP

9

RADD – Guide to finding and using reliability data for QRA

3.2.4

Failure Rate Calculation #3 – Many Failures with Probability Plotting

Where sufficient good quality data are available, probability plotting techniques may be used to derive information relating to the underlying statistical distribution. Graphical plotting techniques may be implemented manually or by computer and involve analysis of the cumulative distribution of the data. A commonly used distribution for failure data is the Weibull Distribution. This distribution originally postulated in 1951 by Swedish mechanical engineer Waloddi Weibull. It is particularly suited to reliability life data plotting because of its flexibility, having no specific shape but instead being described by shaping parameters. It is a three parameter distribution, but often only two are used – the characteristic life (α) and shape factor (β). There are special cases associated with values of the shape factor: •

β = 1 corresponds to exponential distribution

•

β < 1 represents burn in (decreasing failure rate)

•

β > 1 represents wear out (increasing failure rate)

NB In line with convention, β is used here to represent the shape factor of the Weibull distribution. This is not the same β used to describe the dependent failure fraction of common cause failures (see Section 3.2.5). By using a graphical plotting technique, the data can be quickly analysed without detailed knowledge of statistical mathematics. A simple procedure for this is as follows: •

Determine test sample size and times to failure

•

List times to failure in ascending order

•

Establish median rankings from published tables (or calculate/estimate from formulae)

•

Plot times and corresponding ranks on Weibull plot paper. This is essentially loglog graph paper but with scales for reading β and α

•

Draw best fit straight line and read off α at 63.3% intercept

•

Draw a parallel line through intercept on y axis and read off β

Note that median ranking is the most frequently used method for probability plotting, especially if the data are known not to be normally distributed. Median ranking tables are available from statistics text books, or they may be estimated by the following equation: Ranking = (i - 0.3) / (N + 0.4) where i is the failure order number and N is the total number of failures. The process is best illustrated by means of a simple example:

10

©OGP

RADD – Guide to finding and using reliability data for QRA

Step 1. Rank Data using Median Rank Tables Failure Number 1 2 3 4 5 6 7 8 9 10

Time to Failure 10 38 80 140 215 310 460 670 1050 1900

Median Rank

Failure Number

0.02 0.06 0.09 0.12 0.15 0.19 0.22 0.25 0.29 0.32

11 12 13 14 15 16 17 18 19 20

Time to Failure 2000 5000 8300 1200 16300 21500 27500 36000 48200 74000

Median Rank

Failure Number

0.35 0.38 0.42 0.45 0.48 0.52 0.55 0.58 0.62 0.65

21 22 23 24 25 26 27 28 29 30

Time to Failure 77000 10200 119000 134000 146000 159000 172000 187000 204000 230000

Median Rank 0.68 0.71 0.75 0.78 0.81 0.85 0.88 0.91 0.94 0.98

Step 2. Plot Tim es to Failure and Median Ranked Probabilities on W eibull Paper

Step 3. Plot Line and Read Values of characteristic life (α) and shape factor (β) It is generally acceptable to fit a straight line plot by eye through the data points. The value of shape factor is read by drawing a line perpendicular to the plotted line through the plot origin. The value of β can then be read from the intercept of this line and the β scale. The value for the characteristic life may read from the intercept of the plotted line with the “estimator line”. The position of the estimator is determined by the intercept of the perpendicular line with the α scale.

©OGP

11

RADD – Guide to finding and using reliability data for QRA

In the above plot all three stages of the bathtub curve are displayed, the values are approximately: Characteristic life (α)

87 hours

320 hours

1000hours

Shape factor (β)

0.7

1.0

3.4

3.2.4.1 Probability Plotting – Complex Scenarios If a straight line is not obtained in the Weibull plot, there could be one or more underlying reasons, including: •

Data having been censored

•

More than one failure mechanism (mixed Weibull effects)

•

Errors in sampling

•

There is a threshold parameter (i.e. a three parameter Weibull distribution applies)

•

Distribution not Weibull

3.2.4.2 Dealing with Censored Data At the end of a reliability trial or when processing field data there may be a number of items that have not failed. This is referred to as a censored data sample. Those items that have survived are referred to as “suspended”. To calculate the median ranks in this situation the following procedure should be followed: •

Determine test sample size and times to failure

•

List times to failure in ascending order

•

Place suspended test items at the appropriate points in list

•

For each failed item calculate the mean order number iti

where and n is the sample size •

Establish median rankings from published tables (or calculate/estimate from formulae)

•

Plot times and corresponding ranks on Weibull plot paper.

3.2.4.3 Mixed Distributions If the data do not fit to a straight line, especially where an obvious change of slope is seen it may be that more than one mode of failure is being displayed by the sample. If this is the case, the data pertaining to each failure mode must be segregated and analysed separately. 3.2.4.4 Failure Free Period Should the data still yield a curve rather than a straight line, it is possible that a failure free life period is being exhibited i.e. a three value rather than a two value Weibull distribution is applicable. 12

©OGP

RADD – Guide to finding and using reliability data for QRA

The third Weibull parameter (location parameter), γ, locates the distribution along the abscissa. Changing the value of γ has the effect of "sliding" the distribution and its associated function either to the right (if γ > 0) or to the left (if γ < 0). The parameter γ may assume all values and provides an estimate of the earliest time a failure may be observed. A negative γ may indicate that failures have occurred prior to the beginning of the test or prior to actual use. The life period 0 to +γ is the failure free operating period of such units To cater for this, an attempt can be made to predict the failure free period. This may be based on engineering judgement and knowledge of the items under consideration or may simply the time until the first failure occurs. The data are then replotted from this time and if a straight line results the failure free period is as estimated and the remaining parameters may be estimated from the plot. If another curve is produced the process is repeated. 3.2.5

Treatment of Common Cause Failures

A Common Cause Failure (CCF) is the result of an event that, because of dependencies, causes a coincidence of failure states in two or more separate channels of a redundant system, leading to the defined system failing to perform its intended function. CCFs can degrade the performance of any redundant system and are of particular concern when analysing protective functions. A number of mathematical techniques exist for the treatment of CCF’s, one of the simplest and most practical is the Beta factor approach. In essence this assumes that λ, the total failure rate for each redundant unit in the system, is composed of independent and dependent failure contributions as follows:

λ = λc + λi where λi is the failure rate for independent failures

λc the failure rate for dependent failures The parameter beta (β) can then be defined as:

β = λ c/ λ NB β is also commonly used to represent the shape factor of the Weibull distribution, this is not the same as β used to describe the dependent failure fraction of common cause failures. Thus beta is the relative contribution of dependent failures to total failures for the item. The lack of available data relating to dependent failures of sufficient quality necessitates the use of an estimation technique for beta, guided by a number of parameter shaping factors (the subjective assessment of defensive mechanisms). Such a quantification method, known as the partial beta factor model may be applied for detailed assessment. A full description of the technique, including weighting factors is presented in [20]. For a simpler approach a representative value of β may be assumed between 0.01 (highly diverse components or systems) and 0.1 (similar components or systems). 3.2.6

Failure Rate Calculation using the OREDA Estimator

The OREDA handbook recognises that the data it presents are not taken from a homogeneous sample. To merge these non homogenous data into a single multi sample estimate with an average failure rate (point estimate of total number of failure divided by aggregated time in service) is likely therefore to result in an unrealistically short confidence interval. An approach referred to as the “OREDA-estimator” is applied to derive a mean failure rate with associated upper and lower 90% confidence bounds. A description of the theoretical basis for the OREDA-estimator is given in [2].

©OGP

13

RADD – Guide to finding and using reliability data for QRA

The handbook also gives point estimates of failure rate; the numerical difference between this and the OREDA estimator gives an indication of the degree of diversity in failure rates between parts of the overall population. OREDA recommends that the OREDA estimator be used when data are taken from this source.

3.3

Calculation of “on demand” Failure Probability

The on-demand failure probability may be listed in the failure data source, e.g. OREDA or occasionally FARADIP. Section 3.4.1.1 illustrates how this is extracted from OREDA. It is usually more appropriate, however, to calculate a specific probability of failure on demand for a given protective function. Typically such failures are unrevealed and must be detected by means of manual or automatic proof testing. For a protective system having failure rate λ and proof test interval T, the probability of failure on demand or unavailability due to unrevealed failures is presented in Table 3.1. Table 3.1 Unrevealed Failure Probability Number of Units 1 2 3 4

Number of Units Required to Operate 1

2

3

λT/2 λ2T2/3 λ3T3/4 λ4T4/5

λ 2T 2 λ 3T 3

2λ2T2

3.4

Guidance Specific to the OREDA Handbook

3.4.1

Selecting Appropriate Data

The item selected from database must be appropriate in terms of fit to the system under analysis and in terms of data quality. Specifically, the following should be considered: Technology: does the data correctly represent the equipment being assessed? It may be necessary for the analyst to provide or seek expert judgement. e.g. can data for a diesel engine be used for a spark ignited engine? Environm ent: will the environmental conditions influence the failure rate? OREDA data are gathered offshore North Sea. This introduces specific failure mechanisms (saline environment, humidity, temperature), if transferring the data to another environment additional failure modes and mechanisms may be involved. Operational Mode: Equipment operated frequently in a standby mode (emergency generators, firewater pumps) will exhibit different failure modes and frequency compared to equipment operating continuously. Num ber of Recorded Failures: Equipment with few recorded failures will have a large uncertainty associated with their failure rate. Population/Installations: It is desirable for data to be selected for equipment with a large population across a wide number of installations. This avoids data representing localised effects or dominated by one design or manufacturer.

14

©OGP

RADD – Guide to finding and using reliability data for QRA

Tim e in Service: It is desirable for data to be selected for equipment with a long time in service (calendar time). The operational time may be considerably less for equipment that is normally on standby (e.g. firewater pumps). 3.4.1.1 Number of Demands Where stated, this value can be used to derive an on-demand failure probability (but note also that an on-demand failure probability is occasionally stated in the comment field). For example, one selected data item (taxonomy code 1.3.2) has 7 recorded critical failures for the mode “fails to start on demand”. The number of demands is given as 860, and hence the on-demand critical failure probability can be calculated as 7/860 = 0.008. 3.4.1.2 Repair Time Repair times are stated in terms of active repair hours and repair manhours (min, mean and max). In general the “active repair hours” will be of most interest but this field is sometimes blank. In these instances and estimate can be made at 50% of the repair manhours. Note that the active repair time does not include time for fault realisation, spare parts or crew mobilisation or the impact of any applied maintenance strategy or delays.

©OGP

15

RADD – Guide to finding and using reliability data for QRA

4.0

Review of data sources

4.1

OREDA Database and Handbook(s)

Originally initiated by the Norwegian Petroleum Directorate in 1981 to collect reliability data for safety equipment, OREDA is a project organization sponsored by eight oil companies with worldwide operations. OREDA's main purpose is to collect and exchange reliability data among the participating companies and to act as a forum for co-ordination and management of reliability data collection within the oil and gas industry. OREDA has established a comprehensive databank of reliability and maintenance data for exploration and production equipment from a wide variety of geographic areas, installations, equipment types and operating conditions. Offshore subsea and topside equipment are primarily covered, but onshore equipment may also be included. The data are stored in a database, and specialized software has been developed to collect, retrieve and analyze the information. A more recent addition to the OREDA database is information pertaining to subsea equipment including control systems, flowlines, manifolds, production risers, templates, wellheads and Xmas trees amongst others. NOTE: access to the electronic database is restricted to participants in the OREDA program . A revised edition of this Handbook was released in October 2002 containing OREDA Phase IV (1993-96) and Phase V (1997-00) data. Reliability data collected and processed in the OREDA project has been published in generic form in three Reliability Data Handbooks; 1984 (1st edition), 1992 (2nd edition) and in 1997 (3rd edition). These handbooks contain reliability data on offshore equipment compiled in a form that can easily be used for various safety, reliability and maintenance analyses. The project phases are reported in various handbooks as follows: •

Phase I (1983 to 1985) published in OREDA 84 handbook

•

Phase II (1987 to 1990) published in OREDA 92 handbook. This handbook also contains the data collected during phase I

•

Phase III (1990 to 1992) published in OREDA 97 handbook

•

Phase IV (1993 to 1996) and Phase V (1997 to 2000) published in OREDA 2002 handbook

Note that the OREDA handbooks do not catalogue the data recorded in the electronic database; instead they present the results of filters defined by the OREDA committee that are believed to be representative of users’ needs. OREDA-2002, -97 and -92 data equipment groups and the equipment items covered are listed in Table 4.1.

16

©OGP

RADD – Guide to finding and using reliability data for QRA

Table 4.1 OREDA-2002, -97 and -92 Data Categories In OREDA- Data Group (OREDA92)

Machinery

Compressors Gas turbines Pumps Combustion engines

   

  

Process Systems

Vessels Valves Pumps Heat exchangers Compressors Gas turbines Pig launchers and receivers

Electric Equipment

Generators Motors

 



Electrical Systems

Power generation Power conditioning, Protection and circuit breakers

Mechanical Equipment

Heat exchangers Vessels Heaters and boilers

  

 

Control and Safety Equipment

Control logic units Fire and gas detectors Process sensors Valves

  

Safety Systems

Gas and fire detection systems Process alarm sensors Fire fighting systems ESD systems Pressure relieving systems General alarm and communication systems Evacuation systems

Subsea Equipment

Common components Control systems Manifolds Flowlines Isolation systems Risers Running tools Wellhead and Xmas trees

Utility Systems

Slop and drainage systems Ventilation and heating systems Hydraulic supply systems Pneumatic supply systems Control instrumentation

Crane Systems Drilling equipment

Diesel hydraulic Diesel friction Drawworks Hoisting equipment Diverter systems Drilling risers BOP systems Mud systems Rotary tables Pipe handling systems

       

©OGP

Equipment Items

97

Equipment Items

200 2

Data Group (OREDA-2002 and -97)

   





17

RADD – Guide to finding and using reliability data for QRA

4.1.1

OREDA Data Presentation

The OREDA handbook [1] presents the following data recorded for each equipment taxonomy class recorded. Boundaries Each equipment item class has an inventory description provided at the start of the respective chapter. This should be examined carefully to identify equipment items for the system under consideration that lie outside the defined OREDA boundary. These must then be considered as separate items. An example of this would be a compressor or electrical generator where the prime mover is listed as a separate item. Taxonom y code The taxonomy code gives an identification of the equipment item selected from the database. It is good practice to record this code and to include it within calculations as a reference for any data extracted. Population Total number of items under surveillance. Aggregated tim e in service (calendar tim e) This is the total recorded observation time for the population. Aggregated tim e in service (operational tim e) Total recorded observation time for the population when it is required to fulfil its functional role. Note that this may be an estimated value. Num ber of dem ands Total number of recorded demand cycles for the population. Note that this may be an estimated value. Failure Mode This column presents the recorded modes of failure for the equipment item, divided into severity classes critical, degraded, incipient and unknown. In general, only the critical severity class failures need be considered i.e. those that cause an immediate and complete loss of an items function. Where an equipment item performs more than one function (e.g. process and protective) it may be necessary to review each failure mode and identify the requirement to progress it into the risk calculation, either as an aggregated failure rate value for the equipment item or as individual failure events. i.e. critical failures may include dangerous, non-dangerous and safe failures. These failures may be critical to production but not to the equipment’s protective function. Num ber of Failures This is the total number of failures aggregated across all modes. In general, the higher the number of failures, the greater the confidence in the calculated failure rate. Failure Rate All failure rates in the OREDA handbook are presented in terms of failures per million hours. The following data are presented for each mode, calculated both in terms of calendar and operational time: •

M ean: estimated average failure rate, calculated using the “OREDA” estimator – see Section 3.2.6 for details

•

Lower, Upper: 90% confidence bounds for the failure rate

•

SD: Standard deviation

18

©OGP

RADD – Guide to finding and using reliability data for QRA •

n/T: Point estimate of the failure rate i.e. total number of failures divided by the total time in service

For most calculations it is recommended that the mean value (i.e. based on the OREDA estimator) is used. Note that the difference in value between the point estimate and mean failure rate relates to the degree of diversity in the population.

4.2

MIL-HDBK-217F

The MIL-HDBK-217 handbook contains failure rate models for the various part types used in electronic systems, such as integrated circuits, transistors, diodes, resistors, capacitors, relays, switches, and connectors. The handbook details two methods for reliability prediction, namely parts count and parts stress calculation. Parts count prediction is recommended during the design phase of a project. It is simpler than parts stress and requires less detailed information. To calculate a system failure rate the following method is used: For each component part of a system, a baseline failure rate value is selected from tables based on the type of the part and the operating environment. This value is then modified by multiplying by a quality factor, again selected from a table (e.g. military or commercial specification). For microelectronics, a learning factor may also be applied. The overall system failure rate is then derived by summation of the parts failure rates; hence the title “parts count”. In general, parts count analysis will provide an adequate estimate of a system’s failure rate for use in QRA. Parts stress analysis involves derivation of more multiplying factors that in turn require detailed analysis of the system.

4.3

FIDES

This is reliability standard created by FIDES Group - a consortium of leading French international defence companies: AIRBUS, Eurocopter, Giat, MBDA and THALES. The FIDES methodology is based on the physics of failures and is supported by the analysis of test data, field returns and existing modelling. The FIDES Guide is a global methodology for reliability engineering in electronics. It has two parts, namely a reliability prediction guide and a reliability process control and audit guide. Its key features are: •

Provides models for electrical, electronic, electromechanical components and some subassemblies.

•

Considers all technological and physical factors that play an identified role in a product's reliability.

•

Considers the mission profile.

•

Considers the electrical, mechanical and thermal overstresses.

•

Failures linked to the development, production, field operation and maintenance processes.

4.4

EPRD-97 and NPRD-95

The databases EPRD-97 (Electronic Parts Reliability) NPRD-95 (Non Electronic Parts Reliability) were developed by the United States Department of Defense Reliability Information Analysis Center (RIAC). The EPRD-97 database contains failure rate data on electronic components, namely capacitors, diodes, integrated circuits, optoelectronic devices, resistors, thyristors, transformers and transistors. The NPRD-

©OGP

19

RADD – Guide to finding and using reliability data for QRA

95 database contains failure rate data on a wide variety of electrical, electromechanical and mechanical components. Both databases contain data obtained by long-term monitoring of the components in the field. The collection of the data was from the early 1970s through 1994 (for NPRD-95) and through 1996 (for EPRD-97). The purposes of the both databases are to provide failure rate data on commercial quality components, provide failure rates on state-of-the-art components to complement MIL-HDBK-217F by providing data on component types not addressed therein.

4.5

PDS Data Handbook

The PDS Data Handbook provides reliability data estimates for components of control and safety systems. Data for field devices (sensors, valves) and control logic (electronics) are presented, including data for subsea equipment. The data are based on various sources, including OREDA and expert judgement. Some values for β factors for analysis of common cause failures are also presented.

4.6

FARADIP III

FARADIP (Failure RAte Data In Perspective) is an electronic database that presents data concatenated from over 40 published data sources. It provides failure rate data ranges for a nested hierarchy of items covering electrical, electronic, mechanical, pneumatic, instrumentation and protective devices. Failure mode percentages are also provided.

4.7

IEEE 493-1997

The objective of this book is to present the fundamentals of reliability analysis applied to the planning and design of industrial and commercial electric power distribution systems. The intended audience for this material is primarily plant electrical engineers. It includes a summary of equipment reliability data under the following headings: •

Mechanical and electrical equipment reliability and availability data collection conducted between 1990 and 1993

•

Equipment reliability surveys (1976–1989)

•

Equipment reliability surveys conducted prior to 1976

4.8

Sintef Reports, SubseaMaster and WellMaster

ExproSoft is a spin-off of the Norwegian Research Institute SINTEF, and has acquired all commercial rights to reliability databases previously operated by this institute. These products have since been refined and extended, creating integrated reliability database and analysis tools for the upstream sector. A study (JIP) on reliability of well completion equipment (“Wellmaster Phase III”) was completed by SINTEF in November 1999. This has resulted in a database of well completion equipment, with a total of 8000 well-years of completion experience represented. A subsea equipment reliability database project was completed by ExproSoft in late 2000 (Phase I). This project, led to the development of the SubseaMaster database and software version 1.0. Phase II of SubseaMaster was launched as a joint industry project in May 2001. and was completed in April 2003. ExproSoft sell copies of the Sintef reports referred to in this datasheet. 20

©OGP

RADD – Guide to finding and using reliability data for QRA

5.0

Recommended data sources for further information

The text book Functional Safety – a Straightforward Guide to IEC61508 [16] presents background theory and a number of worked examples including fault trees and analysis of common cause failures. Layer of Protection Analysis – Simplified Process Risk Assessment [17] also presents worked examples together with some specimen reliability data. Background reliability theory can be found in Practical Reliability Engineering [18] and Reliability, Maintainability and Risk [2]. The latter also contains some reliability data from FARADIP [14] Reliability Technology [19] contains (older) reliability data from the nuclear industry.

6.0

References

1. OREDA Participants, OREDA 2002 Handbook ISBN 82-14-02705-5. 2. Dr David J Smith, Reliability, Maintainability and Risk Sixth edition, ISBN 0-7506-51687, 2001. 3. SINTEF, Reliability of Surface Controlled Subsurface Safety Valves, 21/2/1983, STF18 A83002. 4. Holand, P.: Subsea BOP Systems, Reliability and Testing. Phase V. STF75 A89054 ISBN 82-595-8585-5, 1989). 5. Holand, P.: Reliability of Surface Blowout Preventers (BOPs) STF75 A92026 (ISBN 82595-7173-0), 1992. 6. SINTEF; Reliability of Surface Controlled Subsurface Safety Valves, Phase IV - Main Report 1991 STF75 A91038. 7. Holand, P.: Reliability of Subsea BOP Systems for Deepwater Application, Phase II DW.(Unrestricted version). STF38 A99426 (ISBN 82-14-01661-4), 1999. 8. Exprosoft, Klæbuveien 125, Lerkendal Stadion, Trondheim, Wellmaster Database, ongoing. 9. Exprosoft, Klæbuveien 125, Lerkendal Stadion, Trondheim, Subseamaster Database, ongoing. 10. US DoD, Reliability Prediction of Electronic Equipment, MIL-HDBK-217F, Notice 2 1995. 11. Non-Electronic Part Reliability Data 1995 (NPRD-95), Reliability Analysis Center, PO Box 4700, Rome, NY. 12. Electronic Part Reliability Data 1997 (NPRD-97), Reliability Analysis Center, PO Box 4700, Rome, NY. 13. Reliability Data for Safety Instrumented Systems - PDS Data Handbook, 2006 Edition, Sydvest, Trondheim, Norway. 14. FARADIP (FAilure RAte Data In Perspective), Maintenance 2000 Limited, Broadhaugh Building, Suite 110, Camphill Road, Dundee DD5 2ND 1987 onwards. 15. Institute of Electrical and Electronics Engineers IEEE 493-1997, Recommended Practice for the Design of Reliable Industrial and Commercial Power Systems (“Gold Book”). 16. Smith & Simpson, Functional Safety, ISBN 0-7506-5270-5, 2001. 17. Center for Chemical Process Safety, Layer of Protection Analysis, ISBN 0-8169-08117, 2001. 18. O’Conner, P, Practical Reliability Engineering, ISBN 0-471-95767-4, 1996. 19. Green & Bourne, Reliability Technology, ISBN 0 471 32480-9, 1981. 20. Brand, VP, UPM3.1: A pragmatic approach to dependent failures assessment for standard systems, ISBN 085 356, 1996.

©OGP

21

Risk Assessment Data Directory Report No. 434 – A1 March 2010

Appendix 1 International Association of Oil & Gas Producers

RADD – Appendix 1

Appendix I Data Presented in 1996 Datasheet: ESD and Blowdown Systems This Appendix presents data previously given in the OGP (then E&P Forum) QRA datasheet ESD and Blowdown Systems. The current data is copyright, as stated in Section 2.1; the data previously presented is given in Table I.1 and Table I.2 for reference but should be regarded as illustrative and checked against one of the current sources listed in Table 2.1. Table I.1 Illustrative Data for a Riser ESD Valves System Item

Description

Pilot Valve Pilot Valve Pilot Valve PO Check Valve PO Check Valve PO Check Valve PO Check Valve PO Check Valve Check Valve ESD SOV ESD SOV ESD SOV ESD SOV ESDV ESDV Valve Actuator Actuator Actuator Ball Valve Ball Valve Valve Limit Switch Switch Switch Pilot Line Regulator Accumulator Accumulator Accumulator Annunciator Air Supply Air Supply Pump Filter Filter Filter

All Failures Fail energised Fail de-energised Fail energised fixed Fail de-energised fixed Fail de-energised dynamic Blocked or pilot signal lost Internal leakage Hydraulic; All failures All failures Fail energised Fail de-energised Reset pin failure Fail to close position Fail to re-open Needle, Hydraulic Hydraulic, fail to close Hydraulic, fail to open Hydraulic, all failures + incipient Fail to close All failures Hydraulic manually activated Failure, closed circuit Level; all failures inc. incipient Press; all failures inc. incipient Failure Spring induced failure Hydraulic Leaking Hydraulic no operation/piston fail Minor leakage Microprocessor based; fail to alarm Instrument air supply failure 3 × 50% Compressor system Hydraulic Air Fluid Blocked, (Pre filter low concentration level) Pressure: Faulty indication Instrument Connection Leakage

Gauge Pipework

©OGP

Failure rate (per year) 0.018 0.012 0.006 0.012 0.012 0.006 0.00804 0.0107 0.0268 0.0115 0.0077 0.0038 1.15E-4 0.0219 0.00817 0.0119 not given 0.0278 0.00692 0.1458 0.00578 0.05589 0.0211 0.0021 0.0841 0.1139 0.0001 0.0230 0.0912 0.0120 0.0026 0.0860 0.6220 0.0296 0.0147 0.0105 0.0263 0.03416 0.1752 8.76E-5

1

RADD – Appendix 1

Appendix II Data Presented in 1996 Datasheet: Active Fire Protection Systems This Appendix presents data previously given in the OGP (then E&P Forum) QRA datasheet Active Fire Protection Systems. The current data is copyright, as stated in Section 2.1Error! Reference source not found.; the data previously presented is given in Table II.1 to Table II.9 for reference but should be regarded as illustrative and checked against one of the current sources listed in Table 2.1. Table II.1 Typical failure rates for fire protection system s Equipment Type

Failures (per 10 hrs)

Firewater system

6

Failures (per demand)

9.7

0.01

Water supply - diesel engine driven pumpset Water supply - electric motor driven pumpset

0.025

Deluge system

0.015

Sprinkler system Foam mixing system

0.005 0.01

Foam supply system

0.02

0.004

Halon system CO2 system

87.0 8.0

0.02 0.02

Table II.2 Failure rates for pum ps (source 1, oil and gas industry) Pump type

Failures per demand

Failures 6 per 10 hrs operating

Failures 6 per 10 hrs calendar

Electric motor (offshore) (process industry)

0.0033

4719

56

Diesel engine (offshore)

0.023

25808

185

(process industry)

0.019

0.043

Table II.3 Failure rates for pum ps Pump type

Failure mode

Positive displacement

All

Centrifugal

2

Failures 6 per 10 calendar hrs 22

Failures per demand

While running

1.9

0.019

Fail to start All

1.9 99

0.033

©OGP

0.094

RADD – Appendix 1

Table II.4 Failure rates for firewater distribution valves Type

Failures per demand

Air/hydraulic

0.0003

Failures 6 per 10 operating hrs 10

Motorised

0.001

10

Solenoid Pressure regulating

0.001

10 50

Pressure relief

2.3

Table II.5 Failure rates for firewater distribution m ains Equipment type

6

Leaks per 10 hrs Medium

Serious 0.04/m

Fire main

Large

Joint (>2 in ND)

0.014

0.0015

Joint (2 in ND)

0.0015 0.009

0.001

Valve (2 in ND)

0.0015/100 m

0.0002/100 m

Table II.6 Failure rates for sprinklers Equipment type System

Failure per demand 0.005

Failures per 10 hrs

Control valve

0.001

10

Automatic head

0.001

6

Table II.7 Failure rates for deluge sets Equipment type System

Failure per demand 0.015

Failures per 10 hrs

Butterfly valve

0.001

10

Swing type valve Pneumatic valve

0.001

10

0.0099

21

©OGP

6

3

RADD – Appendix 1

Table II.8 Failure rates for foam supply system s Equipment type

6

Failure per demand

Failure per 10 hrs

Centrifugal electric pump

0.007

200

Pelton wheel motor Supply system

0.007 0.02

200

Foam compound supply

Foam compound proportioning

negligible

In-line proportioner Nozzle eductor

0.005 0.005

negligible negligible

Metered proportioner

0.005

negligible

Pressure proportioning tank Around-the-pump proportioner

0.005 0.005

negligible negligible

0.005 0.005

negligible negligible

Foam generation Low expansion foam maker High back-pressure foam maker

Table II.9 Failure rates for gaseous system s Equipment type Halon System

Failure per 10 hrs

0.0004* 0.02*

87

Discharge nozzle CO2 System

0.27 8

* 2 values quoted from different sources

4

6

Failure per demand

©OGP

RADD – Appendix 1

Appendix III Data Presented in 1996 Datasheet: Fire and Gas Detection This Appendix presents data previously given in the OGP (then E&P Forum) QRA datasheet Fire and Gas Detection. The current data is copyright, as stated in Section 2.1; the data previously presented is given in Table III.1 for reference but should be regarded as illustrative and checked against one of the current sources listed in Table 2.1. Table III.1 Typical failure rates for fire and gas detection system s Component

Gas detector, conventional catalytic Gas detector, conventional IR Gas detector, beam

λ crit 6 per 10 hrs

Coverage c

5.5

Failure rate per 10 hrs

6

λdet

λSO

λFTO

TIF (Test Independent Failures)

50%

3.0

1.0

1.5

3 × 10 - 0.1

4.0

70%

2.9

0.1

1.0

3 × 10 to 0.1

7

70%

5

1

1

3 × 10 to 0.1

-4

-4

-4

-3

Smoke detector Heat detector

4.0 2.5

40% 40%

1.5 1.0

2.0 1.0

0.5 0.5

10 to 0.05 0.05 to 0.5

Flame detector

7.0

40%

2.5

3.0

1.5

3 × 10 to 0.5

ESD push button FGD node (single PLC system)

1.0 80.0

20% 90%

0.2 72.0

0.6 6.0

0.2 2.0

10 -5 -4 5 × 10 to 5 × 10

Field bus coupler Field bus CPU/ Communications unit

0.2 0.2

90% 90%

0.18 0.18

0.02 0.02

0.001 0.001

10 -5 10

-4

-5

-5

λcrit

=

Total critical failure rate of the component. Rate of failures that will cause either trip or unavailability of safety function (unless detected and prevented from causing such failure).

λdet

=

Rate of critical failure which will be detected by automatic self-test or by control room monitoring. The effect of these failures on the Spurious Trip Rate (STR) depends on the operational philosophy of the system.

c

=

det / crit = Coverage of the automatic self-test + control room operator.

λSO

=

Rate of Spurious Operation (SO) failures, undetectable by automatic self-test. The rate of Spurious Operation (SO) failures of a component contributes to the STR of the system (independent of operation philosophy).

λFTO

=

Rate of failures causing Fail-To-Operate (FTO) failures, undetectable by automatic self-test. The FTO failures contribute to the Critical Safety Unavailability (CSU) of the component/system.

TIF

=

Test Independent Failures. The probability that a component which has just been functionally tested will fail on demand (applies for FTO failures only). The TIF probability is the probability that a component which has just been tested will fail on demand. This will include failures caused by for example improper location or inadequate design (software error or inadequate detection principle). An imperfect functional testing procedure will also contribute. Finally, the

©OGP

5

RADD – Appendix 1

possibility that the maintenance crew perform an erroneous functional test or fail to return the component to a working state (which is usually not detected before the next test) also contributes to the TIF probability.

6

©OGP

RADD – Appendix 1

Appendix IV Data Presented in 1996 Datasheet: Blowout Prevention Equipment This Appendix presents data previously given in the OGP (then E&P Forum) QRA datasheet Blowout Prevention Equipment. The current data is copyright, as stated in Section 2.1; the data previously presented is given in Table IV.1 to Table IV.5 for reference but should be regarded as illustrative and checked against one of the current sources listed in Table 2.1. Table IV.1 Subsea BOP item specific average downtim e BOP item

No of failures

Flexible joints

0

Total down-time (hrs) -

Average downtime (hrs)

-

-

Annular preventers

8

534.5

0.203

0.177

Ram preventers Hydraulic connectors

4 6

146.5 111.5

0.056 0.042

0.048 0.037

per BOP-day

per rig-day

Failsafe valves

2

67.0

0.025

0.022

Choke and kill lines Hydraulic control system

19 28

627.0 521.5

0.238 0.198

0.207 0.173

Acoustic control system

7

134.0

0.051

0.044

Total

74

2142.0

0.813

0.708

Notes:

1. BOP-days are all days from the time the BOP is first landed on the wellhead, until it is pulled the last time.

2. Rig-days is the time from when the rig arrives on location and drops the anchors, until the last anchor is pulled prior to leaving the location.

©OGP

7

RADD – Appendix 1

Table IV.2 Subsea BOP item specific failure rate with 90% confidence lim its BOP item

Flexible joints Annular preventers

Ram type preventers

Hydraulic connectors

Failsafe valves

Choke and kill lines

Hydraulic control system

6

Failure mode

Failure rate per 10 hours Lower limit

Estimate

Upper limit

0.0

0.0

36.4

Failed to open fully

23.6

54.1

94.8

Hydraulic leakage

0.5

9.0

27.0

Unknown Total

0.5 35.9

9.0 72.1

27.0 118.5

Internal leakage (seal failures)

1.4

7.9

18.7

Internal leakage (seal and blade failure) External leakage (door seal)

0.2 0.0

4.0 0.0

11.8 9.1

Failed to fully open

0.2

4.0

11.8

Total External leakage

5.4 10.8

15.8 31.6

30.6 61.3

Failed to unlock

0.4

7.9

23.7

Hydraulic failure in locking device (minor)

0.4

7.9

23.7

Total

20.7

47.4

83.1

Internal leakage External leakage

0.1 0.0

2.6 0.0

7.9 6.1

Unknown leakage

0.1

2.6

7.9

Total Leakage to environment

0.9 85.6

5.3 134.4

12.5 192.1

Plugged line (ice)

0.4

7.9

23.7

Unknown Total riser related failures

0.4 54.7

7.9 94.8

23.7 143.9

Total flexible jumper hose failures

20.7

47.4

83.1

Total BOP flexible hose failures Total choke kill line system

0.4 98.3

7.9 150.2

23.7 211.0

Spurious activation of BOP function

0.8

15.8

47.4

Loss of all functions one pod Loss of several functions one pod

41.3 5.6

94.8 31.6

166.2 75.0

Loss of one function both pods

5.6

31.6

75.0

Loss of one function one pod Loss of one topside panel

85.8 0.8

158.1 15.8

248.2 47.4

Loss of one function topside panel

0.8

15.8

47.4

Topside minor failures Other

5.6 0.8

31.6 15.8

75.0 47.4

Unknown

5.6

31.6

75.0

314.6

442.6

588.6

Total

8

©OGP

RADD – Appendix 1

BOP item

Acoustic control system

6

Failure mode

Failure rate per 10 hours Lower limit 5.6

Estimate 31.6

Upper limit 75.0

Spurious operation one BOP function

0.8

15.8

47.4

One subsea transponder failed to function

0.8

15.8

47.4

Portable unit failed

0.8

15.8

47.4

Function failure LMRP function Transducer arm failed

0.8 0.8

15.8 15.8

47.4 47.4

Total

51.9

110.6

187.2

955.4

1169.7

1402.5

Failed to operate BOP

Total subsea BOP system

Table IV.3 Detection of subsea BOP failures BOP Item

Activity when failure detected Total

BOP on rig

Running BOP

Installation test

Regular tests/ drilling

Flexible joints Annular preventers

0 8

0

0

1

7

Ram preventers

4

1

0

3

0

Hydraulic connectors Failsafe valves

6 2

3 1

0 0

1 1

2 0

Choke and kill lines

19

1

5

1

12

Hydraulic. Control system Acoustic control system

28 7

4 0

3 1

9 5

12 1

Total

74

10

9

21

34

©OGP

9

RADD – Appendix 1

Table IV.4 Overview of surface BOP item specific num ber of failures and down tim es BOP item

Total

Total down time (hrs)

Averag e down time per day (hrs)

5 9

6 15

6 50.5

0.013 0.027

7 1

14 0

21 1

56.5 0.5

0.024 0.001

1891

1

7

8

62.5

0.033

Total Low pressure

2364 401

2 0

7 0

9 0

63 -

0.027 0.000

High pressure

3782

2

1

3

10

0.003

Total Low pressure

4183 473

2 7

1 1

3 8

10 13

0.002 0.027

High pressure

1891

7

12

19

66.5

0.035

Total Low pressure

2364 473

14 2

13 0

27 2

79.5 16.5

0.034 0.035

High pressure Total

1891

5

0

5

32.5

0.017

2364

7

0

7

49

0.021

Riser conns. and wellhead connections

Low pressure

473

1

0

1

1

0.002

High pressure Total

1891

6

1

7

10.5

0.006

2364

7

1

8

11.5

0.005

Failsafe valves

Total

5994

5

3

8

20

0.003

BOP stack clamps

Low pressure High pressure

473 1891

2 0

0 0

2 0

5 -

0.011 0.000

Total

2364

2

0

2

5

0.002

Low pressure High pressure

473 1891

1 1

0 0

1 1

3.5 0

0.007 0.000

Total

2364

2

0

2

3.5

0.001

Low pressure High pressure

473 1891

17 31

6 33

23 64

49 249

0.104 0.132

Total

2364

48

39

87

298

0.126

Annular preventers

Shear/blind rams

Pipe rams

Control system

BOP to high pressure riser connection

Choke/kill lines

Total BOP system

10

Pressure class

Days in servic e

Number of failures Installation

Operation

Low pressure High pressure

473 1891

1 6

Total Low pressure

2364 473

High pressure

©OGP

RADD – Appendix 1

Table IV.5 Surface BOP item specific failure m odes and frequencies with 90% confidence lim its (all failures included) Failure mode

Failure rate per 10 6 hours Estimate

Failed to fully open

Lower limit 149.18

246.76

Upper limit 364.29

Leakage in closed position

46.06

105.75

185.30

Hydraulic leakage adapter ring (degraded) External leakage

0.90

17.63

52.80

0.90

17.63

52.80

Leakage in closed position

46.06

105.75

185.30

Premature partly closure shear ram Unknown

0.90 0.90

17.63 17.63

52.80 52.80

Leakage in closed position

3.54

19.92

47.25

Failed to fully open Failed to operate BOP

0.51 34.72

9.96 88.13

29.84 161.34

Failed to operate one BOP function

70.16

141.00

231.74

Failed to operate BOP from remote panels Spurious activation of BOP functions

0.90

17.63

52.80

0.90

17.63

52.80

Failed to operate rams from remote panels

0.90

17.63

52.80

Failed to operate rams from remote panels

0.90

17.63

52.80

Hydraulic leakage

34.72

88.13

161.34

Unknown Incipient

14.41 6.26

52.88 35.25

110.97 83.61

BOP to high pressure riser connections

External leakage

57.91

123.38

208.73

Riser & wellhead connections

External leakage

70.16

141.00

231.74

Failsafe valves

External leakage

0.36

6.95

20.82

External hydraulic leakage Failed to operate valve

0.36 0.36

6.95 6.95

20.82 20.82

Leakage in closed position

5.68

20.85

43.76

Failed to fully open Unknown

0.36 0.36

6.95 6.95

20.82 20.82

BOP stack clamps

External leakage

6.26

35.25

83.61

Choke/kill lines Total BOP system

External leakage

6.26

35.25

83.61

1273.39

1533.42

1813.47

BOP Item

Annular preventers

Shear/blind rams

Pipe rams Hydraulic control systems

©OGP

11

RADD – Appendix 1

Table IV.6 Overall failure categories for SCSSVs (production and injection wells) Valve type

Years in service

No. of failures per category Total

SCSSV

Other

Failure rate per 106 hours

Wireline Retrievable Flapper

1189.7

124

39

54

Unknow n 31

Total

SCSSV

11.9

3.7

Wireline Retrievable Ball All Wireline Retrievables

508.9 1698.6

84 208

36 75

42 96

6 37

18.7 13.9

8.1 5.1

Tubing Retrievable Flapper

1088.2

54

26

22

6

5.7

2.7

Tubing Retrievable Ball All Tubing Retrievables

52.7 1140.9

5 59

4 30

1 23

0 6

10.9 5.9

8.6 3.0

Total, all valves

2839.5

267

105

119

43

10.8

4.2

Note: When SCSSV is stated, the valve itself failed mechanically. “Other” may typically be control line failure or scale in the well.

12

©OGP