Contentsxili774 LessonsfromMajorAccidents794.1Ekofisk BBlowout...794.1.1Event Sequence.794.1.2BarrierPerformance.804.1.3LessonsLearnedforDesign4.1.4Lessons LearnedforOperation.80.804.2IxtocBlowout.804.2.1EventSequence.824.2.2BarrierPerformance824.2.3LessonsLearned.834.3Enchova Blowout...834.3.1EventSequence.834.3.2BarrierPerformance.834.3.3LessonsLearnedforDesign844.3.4LessonsLearnedforOperation...844.4WestVanguard GasBlowout..844.4.1EventSequence..854.4.2BarrierPerformance.864.4.3LessonsLearned forDesign.864.4.4LessonsLearnedforOperation.864.5OceanOddeseyBurningBlowout..864.5.1Event Sequence....884.5.2BarrierPerformance4.5.3Lessons LearnedforDesign..88.884.5.4Lessons LearnedforOperation.894.6Brent AExplosion ...894.6.1Event Sequence..894.6.2BarrierPerformance904.6.3LessonsLearned forDesign.904.6.4LessonsLearnedforOperation914.7PiperAExplosionandFire914.7.1EventSequence...914.7.2BarrierPerformance934.7.3LessonsLearnedforDesign934.7.4Lessons LearnedforOperation944.8EkofiskARiserRupture.944.8.1EventSequence....944.8.2BarrierPerformance954.8.3 Lessons Learned for Design.954.8.4Lessons LearnedforOperation964.9JotunPipelineRupture..964.9.1Event Sequence.974.9.2BarrierPerformance.974.9.3Lessons Learned forDesign..974.9.4LessonsLearnedforOperation984.10Deep SeaDrillerCapsize984.10.1EventSequence
Contents xiii 4 Lessons from Major Accidents. 77 4.1 Ekofisk B Blowout. 79 4.1.1 Event Sequence . 79 4.1.2 Barrier Performance . 79 4.1.3 Lessons Learned for Design. 80 4.1.4 Lessons Learned for Operation . 80 4.2 Ixtoc Blowout . 80 4.2.1 Event Sequence . 80 4.2.2 Barrier Performance . 82 4.2.3 Lessons Learned. 82 4.3 Enchova Blowout. 83 4.3.1 Event Sequence . 83 4.3.2 Barrier Performance . 83 4.3.3 Lessons Learned for Design. 83 4.3.4 Lessons Learned for Operation . 84 4.4 West Vanguard Gas Blowout. 84 4.4.1 Event Sequence . 84 4.4.2 Barrier Performance . 85 4.4.3 Lessons Learned for Design. 86 4.4.4 Lessons Learned for Operation . 86 4.5 Ocean Oddesey Burning Blowout. 86 4.5.1 Event Sequence . 86 4.5.2 Barrier Performance . 88 4.5.3 Lessons Learned for Design. 88 4.5.4 Lessons Learned for Operation . 88 4.6 Brent A Explosion . 89 4.6.1 Event Sequence . 89 4.6.2 Barrier Performance . 89 4.6.3 Lessons Learned for Design. 90 4.6.4 Lessons Learned for Operation . 90 4.7 Piper A Explosion and Fire. 91 4.7.1 Event Sequence . 91 4.7.2 Barrier Performance . 91 4.7.3 Lessons Learned for Design. 93 4.7.4 Lessons Learned for Operation . 93 4.8 Ekofisk A Riser Rupture. 94 4.8.1 Event Sequence . 94 4.8.2 Barrier Performance . 94 4.8.3 Lessons Learned for Design. 95 4.8.4 Lessons Learned for Operation . 95 4.9 Jotun Pipeline Rupture. 96 4.9.1 Event Sequence . 96 4.9.2 Barrier Performance . 97 4.9.3 Lessons Learned for Design. 97 4.9.4 Lessons Learned for Operation . 97 4.10 Deep Sea Driller Capsize. 98 4.10.1 Event Sequence. 98
xivContents984.10.2BarrierPerformance.994.10.3LessonsLearnedforDesign.994.10.4LessonsLearnedforOperation.1004.11AlexanderL.Kielland Capsize.1004.11.1Event Sequence..1004.11.2BarrierPerformance1014.11.3 Lessons Learned forDesign.1014.11.4LessonsLearnedforOperation4.12OceanRangerCapsize1011024.12.1EventSequence1024.12.2BarrierFailures.1034.12.3 Lessons Learned for Design..1034.12.4LessonsLearnedforOperation.1034.13GlomarJavaSeaCapsize.1034.13.1EventSequence1044.13.2Barrier Failures.1054.13.3Lessons Learned forDesign..1054.13.4LessonsLearnedforOperation.1054.14SeacrestCapsize.1054.14.1EventSequence1054.15West Gamma Capsize...1054.15.1Event Sequence..1064.15.2BarrierPerformance1074.15.3LessonsLearnedforDesign1074.15.4Lessons LearnedforOperation.1074.16NorneShuttleTankerCollision1074.16.1 Event Sequence..1084.16.2BarrierPerformance1094.16.3Lessons LearnedforDesign1094.16.4Lessons Learned forOperation4.17P-36Capsize.1091094.17.1EventSequence.1104.17.2BarrierPerformance1114.17.3LessonsLearnedforDesign4.17.4LessonsLearnedforOperation1111124.18P-34Listing.1124.18.1EventSequence1124.19OceanVanguardAnchorLineFailure1124.19.1EventSequence.1134.19.2BarrierPerformance.1144.19.3 Lessons Learned for Design..1144.19.4Lessons Learned forOperation1154.20Exxon Valdez Oil Spill.1154.20.1Event Sequence...4.20.2Barrier Failures..1164.21SummaryofBarrierPerformance116
xiv Contents 4.10.2 Barrier Performance. 98 4.10.3 Lessons Learned for Design. 99 4.10.4 Lessons Learned for Operation . 99 4.11 Alexander L. Kielland Capsize . 100 4.11.1 Event Sequence. 100 4.11.2 Barrier Performance. 100 4.11.3 Lessons Learned for Design. 101 4.11.4 Lessons Learned for Operation . 101 4.12 Ocean Ranger Capsize . 101 4.12.1 Event Sequence. 102 4.12.2 Barrier Failures . 102 4.12.3 Lessons Learned for Design. 103 4.12.4 Lessons Learned for Operation . 103 4.13 Glomar Java Sea Capsize. 103 4.13.1 Event Sequence. 103 4.13.2 Barrier Failures . 104 4.13.3 Lessons Learned for Design. 105 4.13.4 Lessons Learned for Operation . 105 4.14 Seacrest Capsize . 105 4.14.1 Event Sequence. 105 4.15 West Gamma Capsize. 105 4.15.1 Event Sequence. 105 4.15.2 Barrier Performance. 106 4.15.3 Lessons Learned for Design. 107 4.15.4 Lessons Learned for Operation . 107 4.16 Norne Shuttle Tanker Collision . 107 4.16.1 Event Sequence. 107 4.16.2 Barrier Performance. 108 4.16.3 Lessons Learned for Design. 109 4.16.4 Lessons Learned for Operation . 109 4.17 P-36 Capsize . 109 4.17.1 Event Sequence. 109 4.17.2 Barrier Performance. 110 4.17.3 Lessons Learned for Design. 111 4.17.4 Lessons Learned for Operation . 111 4.18 P-34 Listing . 112 4.18.1 Event Sequence. 112 4.19 Ocean Vanguard Anchor Line Failure . 112 4.19.1 Event Sequence. 112 4.19.2 Barrier Performance. 113 4.19.3 Lessons Learned for Design. 114 4.19.4 Lessons Learned for Operation . 114 4.20 Exxon Valdez Oil Spill . 115 4.20.1 Event Sequence. 115 4.20.2 Barrier Failures . 116 4.21 Summary of Barrier Performance. 116
ContentsXV1195MethodologyforQuantifiedRiskAssessment1195.1Analytical Steps and Elements.1195.1.1Analytical Elements1215.1.2Identification of InitiatingEvents.1215.1.3CauseAnalysis.1235.1.4 Modelling ofAccident Sequences.1255.1.5ConsequenceAnalysis.1255.1.6RiskCalculation,AnalysisandAssessment5.2Analysis Steps.....1281295.2.1RequirementsforAnalyticalApproach1295.3HazardModellingandCauseAnalysis.1305.3.1Blowout Hazard Study1305.3.2Process Hazard Study1315.3.3Riser/PipelineHazardStudy1325.3.4FireLoadandSmokeAssessment.1325.3.5ExplosionLoadAssessment.5.3.6Collision Hazard Study133.1335.3.7DroppedObjectHazardStudy1345.3.8StructuralFailureStudy1345.4AnalysisofCritical Risks1345.4.1Barrier Study1355.4.2AssessmentofSafetyCriticalSystems1365.4.3DetailedProbabilityStudy1365.4.4HOFIntegration1365.4.5DetailedConsequenceStudy1375.4.6Revised Event Tree Study.5.5AnalysisofDifferentRiskDimensions1371375.5.1ImpairmentAnalysis1375.5.2FatalityRiskAnalysis5.5.3AnalysisofEnvironmental SpillRisk1375.5.4Analysis ofAssetRisk1381385.6SensitivityAnalysis5.7Limitations of RiskAnalysis1381395.8UseofSoftware1405.9DataSources1405.9.1TypesofDataSources5.9.2BlowoutFrequency1415.9.3ProcessSystemLeakFrequency1421425.9.4Riser/PipelineLeakFrequency1425.9.5Vessel Collision1435.9.6Falling Objects.1435.9.7MarineAccidents.1445.9.8UtilityArea Accidents.1445.9.9HelicopterAccidents.1445.9.10OccupationalandDivingAccidents1445.9.11IgnitionProbability1455.9.12SafetySystemReliability
Contents xv 5 Methodology for Quantified Risk Assessment . 119 5.1 Analytical Steps and Elements. 119 5.1.1 Analytical Elements . 119 5.1.2 Identification of Initiating Events. 121 5.1.3 Cause Analysis . 121 5.1.4 Modelling of Accident Sequences. 123 5.1.5 Consequence Analysis. 125 5.1.6 Risk Calculation, Analysis and Assessment. 125 5.2 Analysis Steps. 128 5.2.1 Requirements for Analytical Approach. 129 5.3 Hazard Modelling and Cause Analysis. 129 5.3.1 Blowout Hazard Study . 130 5.3.2 Process Hazard Study. 130 5.3.3 Riser/Pipeline Hazard Study . 131 5.3.4 Fire Load and Smoke Assessment. 132 5.3.5 Explosion Load Assessment. 132 5.3.6 Collision Hazard Study . 133 5.3.7 Dropped Object Hazard Study . 133 5.3.8 Structural Failure Study . 134 5.4 Analysis of Critical Risks . 134 5.4.1 Barrier Study . 134 5.4.2 Assessment of Safety Critical Systems . 135 5.4.3 Detailed Probability Study . 136 5.4.4 HOF Integration . 136 5.4.5 Detailed Consequence Study. 136 5.4.6 Revised Event Tree Study. 137 5.5 Analysis of Different Risk Dimensions . 137 5.5.1 Impairment Analysis . 137 5.5.2 Fatality Risk Analysis . 137 5.5.3 Analysis of Environmental Spill Risk . 137 5.5.4 Analysis of Asset Risk . 138 5.6 Sensitivity Analysis . 138 5.7 Limitations of Risk Analysis . 138 5.8 Use of Software . 139 5.9 Data Sources . 140 5.9.1 Types of Data Sources. 140 5.9.2 Blowout Frequency . 141 5.9.3 Process System Leak Frequency . 142 5.9.4 Riser/Pipeline Leak Frequency . 142 5.9.5 Vessel Collision . 142 5.9.6 Falling Objects . 143 5.9.7 Marine Accidents . 143 5.9.8 Utility Area Accidents. 144 5.9.9 Helicopter Accidents. 144 5.9.10 Occupational and Diving Accidents. 144 5.9.11 Ignition Probability . 144 5.9.12 Safety System Reliability . 145
Contentsxvi1455.9.13Data SourcesforReliabilityAnalysis.1455.9.14DataforFatalityModelling1465.10Useof InstallationSpecificData.1465.10.1GenericVersus Installation SpecificData..1465.10.2InstallationSpecificData fromRNNS.1475.10.3CombinationofSpecificandGenericData.1485.10.4Example,CombinationofData1505.10.5Data SourcesforInstallationSpecificData1515.11Useof RiskAnalysis Studies inLifeCyclePhases1515.11.1Analyses DuringConceptDevelopment.5.11.2Analyses inOperations..153.1535.12Execution ofQuantifiedRiskAnalysis...1535.12.1QualityAspects...1555.12.2DocumentationofAssumptionsandPremises1565.12.3TypicalStudyDefinitions...1565.13ChallengesExperiencedwithQRAStudies.5.13.1Hazard Identification...156..1575.13.2Analysis of Risk.1595.13.3PresentationofAnalysisResults..1595.13.4IdentificationofRiskReductionMeasures1595.13.5UseofStudyResultsinRiskManagement..1616Analysis Techniques1616.1Hazard Identification.1636.1.1HAZOP.1646.1.2PHA6.1.3SAFOP165.1656.1.4Bow-tie..1666.2 Cause, Probability and FrequencyAnalysis6.2.1Fault TreeAnalysis.167.1696.2.2EventTreeAnalysis.6.2.3Failure Mode andEffectAnalysis1691706.2.4Statistical SimulationAnalysis1706.2.5AnalyticalMethods1706.2.6OperationalRiskAnalysis6.3Event Tree Analysis.1741746.3.1BasicsofEventTree6.3.2Major Hazard Scenarios..180.1806.3.3 Initiating EventFrequency.1836.3.4Nodes in EventTrees1856.3.5EndEventFrequency1866.3.6GasLeakinProcessArea1896.3.7BlowoutEventTree1916.3.8GasLeakfromRiser/Pipeline1946.4AnalysisofDependenciesBetweenBarriers.1956.5EventSequenceAnalysis1956.5.1TimeDependency
xvi Contents 5.9.13 Data Sources for Reliability Analysis . 145 5.9.14 Data for Fatality Modelling. 145 5.10 Use of Installation Specific Data . 146 5.10.1 Generic Versus Installation Specific Data . 146 5.10.2 Installation Specific Data from RNNS. 146 5.10.3 Combination of Specific and Generic Data. 147 5.10.4 Example, Combination of Data. 148 5.10.5 Data Sources for Installation Specific Data . 150 5.11 Use of Risk Analysis Studies in Life Cycle Phases . 151 5.11.1 Analyses During Concept Development. 151 5.11.2 Analyses in Operations . 153 5.12 Execution of Quantified Risk Analysis. 153 5.12.1 Quality Aspects. 153 5.12.2 Documentation of Assumptions and Premises. 155 5.12.3 Typical Study Definitions . 156 5.13 Challenges Experienced with QRA Studies. 156 5.13.1 Hazard Identification. 156 5.13.2 Analysis of Risk. 157 5.13.3 Presentation of Analysis Results. 159 5.13.4 Identification of Risk Reduction Measures. 159 5.13.5 Use of Study Results in Risk Management. 159 6 Analysis Techniques . 161 6.1 Hazard Identification . 161 6.1.1 HAZOP. 163 6.1.2 PHA . 164 6.1.3 SAFOP. 165 6.1.4 Bow-tie . 165 6.2 Cause, Probability and Frequency Analysis. 166 6.2.1 Fault Tree Analysis. 167 6.2.2 Event Tree Analysis. 169 6.2.3 Failure Mode and Effect Analysis . 169 6.2.4 Statistical Simulation Analysis . 170 6.2.5 Analytical Methods. 170 6.2.6 Operational Risk Analysis . 170 6.3 Event Tree Analysis. 174 6.3.1 Basics of Event Tree . 174 6.3.2 Major Hazard Scenarios. 180 6.3.3 Initiating Event Frequency . 180 6.3.4 Nodes in Event Trees . 183 6.3.5 End Event Frequency . 185 6.3.6 Gas Leak in Process Area. 186 6.3.7 Blowout Event Tree . 189 6.3.8 Gas Leak from Riser/Pipeline . 191 6.4 Analysis of Dependencies Between Barriers . 194 6.5 Event Sequence Analysis. 195 6.5.1 Time Dependency. 195
Contentsxvii1966.5.2NodeSequenceinEventTreeModelling1966.5.3Directional Modelling1976.5.4 MTO1986.6HC Leak Modelling2006.6.1LeakStatistics.2046.6.2CalculationofLeakRatesfromExperienceData.2056.6.3Modelling of Leaks2066.7IgnitionProbabilityModelling2066.7.1ExperienceData2086.7.2 Cox Model..6.7.3Platform Specific Modelling...208.2096.7.4 Industry State-of-the-art TimeDependent Modelling.2136.7.5 Revised JIP Model..2146.8EscalationModelling2146.8.1Functionality.2156.8.2Availability and Reliability2166.8.3Survivability.2166.8.4NodeProbability2176.9EscalationAnalysis.2176.9.1ModellingofFireEscalation.2186.9.2Modellingof Explosion Escalation..2196.9.3Damage Limitation...2216.9.4ResponseofEquipmenttoFireandExplosion2236.9.5TolerabilityCriteriaforPersonnel2246.9.6ImpairmentCriteriaforSafetyFunctions2266.9.7RequiredIntactnessTimesforSafetyFunctions2286.10AnalysisofEnvironmentalImpactRisk2286.10.1Overview...2296.10.2Measurementof EnvironmentalDamage2306.10.3EventTrees2306.10.4EnvironmentalDamageDistribution2332FatalityRiskAssessment.2337.1OverviewofApproaches2337.1.1 Why Fatality Risk?2347.1.2Statistical Analysis.2347.1.3PhenomenaBasedAnalysis.2377.1.4Averaging of FAR Values..2377.1.5VariationsBetweenInstallations.2397.2OccupationalFatalityRisk.2407.3ImmediateFatalityRisk2407.3.1Overview.2417.3.2SubjectiveModelling.2437.3.3ModellingBasedonPhysicalEffects2467.3.4 Is there a Need for Benchmarking?.2507.4Analysis of Escape Risk2507.4.1Overview
Contents xvii 6.5.2 Node Sequence in Event Tree Modelling . 196 6.5.3 Directional Modelling. 196 6.5.4 MTO . 197 6.6 HC Leak Modelling . 198 6.6.1 Leak Statistics. 200 6.6.2 Calculation of Leak Rates from Experience Data. 204 6.6.3 Modelling of Leaks. 205 6.7 Ignition Probability Modelling . 206 6.7.1 Experience Data. 206 6.7.2 Cox Model . 208 6.7.3 Platform Specific Modelling. 208 6.7.4 Industry State-of-the-art Time Dependent Modelling. 209 6.7.5 Revised JIP Model. 213 6.8 Escalation Modelling . 214 6.8.1 Functionality. 214 6.8.2 Availability and Reliability. 215 6.8.3 Survivability . 216 6.8.4 Node Probability. 216 6.9 Escalation Analysis. 217 6.9.1 Modelling of Fire Escalation . 217 6.9.2 Modelling of Explosion Escalation. 218 6.9.3 Damage Limitation . 219 6.9.4 Response of Equipment to Fire and Explosion. 221 6.9.5 Tolerability Criteria for Personnel. 223 6.9.6 Impairment Criteria for Safety Functions. 224 6.9.7 Required Intactness Times for Safety Functions . 226 6.10 Analysis of Environmental Impact Risk . 228 6.10.1 Overview. 228 6.10.2 Measurement of Environmental Damage. 229 6.10.3 Event Trees . 230 6.10.4 Environmental Damage Distribution . 230 7 Fatality Risk Assessment. 233 7.1 Overview of Approaches . 233 7.1.1 Why Fatality Risk? . 233 7.1.2 Statistical Analysis. 234 7.1.3 Phenomena Based Analysis. 234 7.1.4 Averaging of FAR Values . 237 7.1.5 Variations Between Installations . 237 7.2 Occupational Fatality Risk. 239 7.3 Immediate Fatality Risk. 240 7.3.1 Overview . 240 7.3.2 Subjective Modelling. 241 7.3.3 Modelling Based on Physical Effects . 243 7.3.4 Is there a Need for Benchmarking? . 246 7.4 Analysis of Escape Risk . 250 7.4.1 Overview . 250